release: 0.27.0

[TheAmericanMaker]

Release 0.27.0. This bumps every version surface and turns [Unreleased] into the dated ## [0.27.0] section, which the release workflow extracts as the GitHub Release notes.

Why 0.27.0 and not 0.26.1: the CHANGELOG says the project follows SemVer, and the 33+ commits since 0.26.0 include additions: the EXPERIMENTAL codecarto_change tool (tools/list 22 → 23), the engineering-record core exports, the traverse skill, and new templates. All of that warrants a minor bump.

What ships

• Headline fixes:
  • the handoff parser no longer silently drops malformed entries (Handoff parser silently drops malformed closures and entry fields instead of failing completion #453);
  • Pi gives a refused handoff one repair turn (Pi: a refused handoff strands a finished phase — check it before the sub-agent exits and give one repair turn #454);
  • the smoke harness no longer hangs for six hours (Published-package Smoke workflow hangs after tool inventory drift #449);
  • audit-clean production dependencies;
  • scaffold refresh no longer copies engineering records (fix: scaffold refresh never copies engineering records; correct the traverse and codecarto_change docs #457).
• Everything else merged since v0.26.0: MCP SDK v2 serving 2026-07-28 (MCP server on SDK v2, serving 2026-07-28 alongside the 2025 era (#185) #443), the EXPERIMENTAL engineering record surface (E01–E11), the Windows fixes (atomicWriteFile: rename over an existing file fails with EPERM on Windows under concurrent writers #393, Pi write guard refuses a legitimate .codecarto/ write on Windows #394, fix: make stale lock ticket reaping single-winner on Windows #444), and the test-isolation fixes.

Version surfaces

• package.json, package-lock.json (both root fields), server.json (both fields), and .codecarto/workflow/scaffold-version.yaml are all 0.27.0.
• The diff has 5 files and only version changes, apart from CHANGELOG.

Candidate verification (head aa19384)

• Locally: npm ci succeeds and npm audit --omit=dev --audit-level=high finds 0 vulnerabilities. npm run build succeeds, and npm test passes 1401/1401.
• Packed: codecartographer-pi-0.27.0.tgz has 247 files, 570,980 B packed and 2,009,292 B unpacked.
  • integrity sha512-ompJW0KYgpxj7vDz7W42qCIG6ICj58eAalf17S4cC2AgKTOOJB6A7g8mTBFT+oJOKEjT/WrK+fPZSoTv3ngjWA==
  • no .codecarto/engineering/ entries and no hosts/
• Smoke against the tarball: node scripts/smoke-mcp.mjs --tarball … gives 12/12 ok (both the 2025 initialize era and the 2026-07-28 server/discover era).

Surface verification (CONTRIBUTING, against the packed tarball's dist/)

Each MCP surface pointed a scratch server name at the installed tarball's dist/mcp-server/bin.mjs, in a separate copy of a six-file scratch repo.

Surface	Run	First line of each result
Claude Code 2.1.291	claude -p --strict-mcp-config --mcp-config …: codecarto_init (lite), then codecarto_next	(1) Initialized CodeCartographer workspace at …/rc/claude/.codecarto. (2) Read .codecarto/GUIDE.md and continue the CodeCartographer workflow for the phase \architecture`.` (the prompt is ≈2,970 chars, not truncated)
Codex 0.159.2	codex exec --ephemeral -s read-only, with mcp_servers.ccrel.default_tools_approval_mode="approve" and the installed registration disabled	mcp: ccrel/codecarto_init (completed), mcp: ccrel/codecarto_next (completed); (1) Initialized CodeCartographer workspace at …/rc/codex/.codecarto. (2) Read .codecarto/GUIDE.md and continue the CodeCartographer workflow for the phase \architecture`.`
Hermes	hermes mcp add ccrel … (the handshake found 23/23 tools), then hermes chat -Q --oneshot; the server was removed afterwards and the config diff against a backup is identical	(1) Initialized CodeCartographer workspace at …/rc/hermes/.codecarto. (2) Read .codecarto/GUIDE.md and continue the CodeCartographer workflow for the phase \architecture`.`
Pi 1.0.4	script -qec "pi -ne -e <tarball>/dist/extensions/codecarto/index.js --model openai-codex/gpt-5.5 -p '/codecarto-init architecture-only' '/codecarto-next --auto'"	Phase architecture sub-agent finished (36 tool uses, 12 turns)., Auto pipeline complete: 1/1 phases.; current_phase: complete; the artifact's **Overall:** PASS WITH GAPS; the gap was routed to q-cli-distribution-intent

The full round trip ran on Pi: init → next → artifact and handoff written by the model → validate → complete. The real model's handoff passed the new #453 shape gates and its open question reached status.yaml with its description. No repair turn was needed, so the #454 repair path was not exercised live; it is covered by unit tests with a fake session only. No carry_forward was routed, because architecture-only has no downstream phase.

Pi model note: the CONTRIBUTING model (openrouter/google/gemini-3.7-flash) could not be used because the OpenRouter key on this machine is expired (401). openai-codex/gpt-5.3-codex-spark is refused for ChatGPT-account Codex logins, so the run used openai-codex/gpt-5.5.

Broad-Side: not touched since 0.26.0, so the live Broad-Side check does not apply.

Known, not blocking

• Engineering lifecycle follow-ups from the #447 review #448: engineering follow-ups, inside the experimental surface.
• codecarto_change: expose planTraverseStep as a read-only 'next' action #458: next action for the traverse planner.
• yaml: a block scalar on the first key of a sequence item keeps its '>' indicator as text #459: YAML first-key block scalar.
• Flaky on Windows: lock claim test reports a break for a ticket deleted mid-scan (mock rename succeeds on a missing source) #460: Windows lock-test flake.
• Pre-0.27 workspaces must add engineering/ to .codecarto/.gitignore by hand; the CHANGELOG says so.