[vincentkoc]

What Problem This Solves

Prepares OCM v0.3.9 from the reviewed main source through the signed release workflow.

User Impact

Makes the accumulated OCM fixes available in the next patch release. This preparation changes only the package version.

Why This Change Was Made

Keeps Cargo.toml and Cargo.lock at the same release version so the exact squash-merged main commit can pass CI before signing and publication.

Evidence

• Complete ordered remote Linux baseline passed on the exact preparation diff: formatting, automatic-release and native-Gateway Python suites, all-target Cargo check, full Cargo tests, isolated Cargo install, and installed version 0.3.9.
• Toolchain: Rust 1.98.1, Node.js 24.22.1, npm 11.19.1.
• The first PR CI run stopped during the macOS published OpenClaw install before the full macOS suite. The diagnostic change in fix(ci): expose published install failures #1008 now exposes bounded install failures; its real macOS lifecycle and full CI passed. The earlier install failure did not recur, so its root cause remains unknown.
• Rebased only onto that diagnostic fix. The unchanged Rust/version diff retains its remote baseline; fresh exact-candidate CI covers the diagnostic path and all native checks.
• Diff contains only the two package version values; no dependency changes.
• PR CI, exact merged-main CI, and the native no-publish release rehearsal remain required before signing the release tag.

[clawsweeper]

🦞👀
ClawSweeper picked this up.

Pull request received. I will update this pull request when review starts.

ClawSweeper review complete

ClawSweeper finished reviewing this revision. The review result is being finalized.

View the workflow run.

[clawsweeper]

Codex review: needs maintainer review before merge.

What this changes

This PR updates the OCM package version from 0.3.8 to 0.3.9 in Cargo.toml and Cargo.lock.

Example: Run ocm --version from a build of the prepared source.

• Before: Prints 0.3.8.
• After: Prints 0.3.9.

Review scores

Measure	Result	What it means
Overall readiness	🐚 platinum hermit (4/6)	The minimal version preparation is correct and consistent with release policy; required CI remains an independent landing gate.
Proof confidence	🌊 off-meta tidepool	Not applicable: This maintainer-authored preparation is outside the ordinary contributor proof gate; its body reports an isolated Linux installation identifying itself as 0.3.9, without attached terminal output.
Patch quality	🐚 platinum hermit (4/6)	No actionable review findings were identified.

Product

Kind: Maintenance · Worth it: Yes · Fix scope: Complete
User problem: The next OCM release needs a distinct, consistent package identity across native and npm distributions.
Reason: The maintainer-authored release preparation establishes direction and preserves the existing version-only contract.

Merge readiness

✅ Ready for maintainer review

Keep this maintainer-authored release preparation open: main still identifies OCM as 0.3.8, and the focused version bump is correct, but required CI has not passed.

Priority: P3
Reviewed head: e9a829bc04d05f6253f3c24e108c143516a73743

Before merge

None.

Findings

None.

Agent review details

How this fits together

Cargo metadata supplies the compiled CLI version and verified release package identity; downstream signing and publication remain separately gated.

flowchart LR
  A[Cargo manifest] --> C[Version verification]
  B[Cargo lockfile] --> C
  A --> D[Compiled CLI]
  C --> E[Release preparation]
  E --> F[Signed release pipeline]

Loading

Technical review

Best possible solution:

Land the aligned version-only preparation after required CI passes, then complete the separately authorized signed release workflow.

Do we have a high-confidence way to reproduce the issue?

This is release preparation rather than a bug report; source inspection confirms main still declares 0.3.8 and the CLI derives its version from Cargo metadata.

Is this the best way to solve the issue?

Updating only the two package identities is the smallest complete change and follows the documented distribution contract.

AGENTS.md: found and applied where relevant.

Codex review notes: model internal, reasoning medium; reviewed against f41dc3d316c6.

Provenance checked

• Root Cargo package identity keeps the original intent (32e2de9: The preceding release preparation aligned Cargo metadata at 0.3.8 so native builds and generated npm packages identified the same prepared release.)

Testing

Proof path: none.

Security

None.

Evidence

What I checked:

• Exact introduced change: The pinned diff changes only the root package version in both files; dependency versions, sources, checksums, and executable code are unchanged. (Cargo.toml:3, e9a829bc04d0)
• Current main and published release: The default branch remains at the pinned base with package version 0.3.8, and the latest published release is v0.3.8. (Cargo.toml:3, f41dc3d316c6)
• Existing release contract: Release documentation explicitly derives all distribution versions from verified Cargo metadata and preserves the two-file version-bump contract. (docs/RELEASING.md:199, f41dc3d316c6)
• CLI consumer: The shipped version command prints CARGO_PKG_VERSION, so updating the manifest changes its reported package identity without another implementation path. (src/cli/mod.rs:676, f41dc3d316c6)
• Precedent and original intent: The previous release preparation, chore(release): bump version to 0.3.8 #805, used the same aligned version-only change while retaining exact-main CI, signed-tag, signing, and publication checks. (Cargo.lock:993, 32e2de9e9bd6)
• Required CI remains unresolved: The reviewed head has 12 successful checks, a failed macOS Test job, and an in-progress Ubuntu Test job. The macOS failure occurred in native Gateway lifecycle verification; its subsequent Rust suite and install smoke were skipped. The underlying log download was blocked by the review environment, so the failure cannot be attributed to this diff. (.github/workflows/ci.yml, e9a829bc04d0)

Preflight source

Source unknown. Source comparison at the observed PR snapshot only. Completion is self-reported; body, policy, tests, execution, and report bytes are not verified.

Labels

Label changes:

• add P3: This is routine package identity preparation with no executable or dependency change.
• add rating: 🐚 platinum hermit: Overall readiness is 🐚 platinum hermit; proof is 🌊 off-meta tidepool and patch quality is 🐚 platinum hermit.
• add status: 👀 ready for maintainer look: ClawSweeper has no concrete contributor-facing blocker left for this PR.

Label justifications:

• P3: This is routine package identity preparation with no executable or dependency change.
• rating: 🐚 platinum hermit: Overall readiness is 🐚 platinum hermit; proof is 🌊 off-meta tidepool and patch quality is 🐚 platinum hermit.
• status: 👀 ready for maintainer look: ClawSweeper has no concrete contributor-facing blocker left for this PR.

Rating scale

6/6 🦀 challenger crab · 5/6 🦞 diamond lobster · 4/6 🐚 platinum hermit · 3/6 🦐 gold shrimp · 2/6 🦪 silver shellfish · 1/6 🧂 unranked krab. Overall follows the weaker of proof and patch quality; ✨ marks media proof (a screenshot, video, or linked artifact) that directly shows the changed behavior.

Workflow

ClawSweeper edits this one comment on every review. Comment @clawsweeper re-review for a fresh review only. Repair and merge execution lanes are retired.

Reviewed November 5, 2026, 8:44 PM ET / November 6, 2026, 01:44 UTC.