[tps-anvil]

What this is

The version bump for cli 0.7.0 — the release following 0.6.0 (2026-09-17).

since v0.6.0   10 commits — 1 feat, 9 fix
breaking       0  (no `!:` subjects, no BREAKING CHANGE bodies)

Minor rather than patch because the range carries a feature: the three agent runtimes adopt the shared promote() lifecycle (feat(mail) in the range).

The lockstep set moves together, including the exact pins

packages/cli pins the platform packages at exact versions in optionalDependencies. A partial bump therefore ships a 0.7.0 CLI that installs 0.6.0 binaries.

package	before	here
@tpsdev-ai/cli	0.6.0	0.7.0
@tpsdev-ai/agent	0.6.0	0.7.0
@tpsdev-ai/cli-darwin-arm64	0.6.0	0.7.0
@tpsdev-ai/cli-darwin-x64	0.6.0	0.7.0
@tpsdev-ai/cli-linux-arm64	0.6.0	0.7.0
@tpsdev-ai/cli-linux-x64	0.6.0	0.7.0

plus the four optionalDependencies pins inside packages/cli/package.json. packages/pi-tps-mail stays at its own version. bun.lock is regenerated (bun install, not --frozen) and committed so the versions it records move with the manifests.

A grepped sweep of every remaining 0.6.0 in the tree finds no version declaration left behind: only CHANGELOG history, release-workflow comments that discuss the 0.6.0 run, fixture arguments in scripts/test-promote-latest.sh, and unrelated dependencies (emoji-regex@10.6.0, @mozilla/readability@0.6.0).

plugins/openclaw-tps-mail/package-lock.json is an npm lockfile that mirrors the linked workspace packages, so it is regenerated here too (npm install --package-lock-only --ignore-scripts) and its mirror of @tpsdev-ai/cli, @tpsdev-ai/agent and the four pins moves to 0.7.0 as well — six lines, with the lockfile's own dependency graph untouched.

CHANGELOG.md

The fragments split in two at the tag.

Present at v0.6.0 (1) — changes that shipped IN 0.6.0 but were never rolled into its notes. Appended to the existing 0.6.0 section under the line "Omitted from the 0.6.0 notes at release time:":

• fixed-release-error-diagnosis.md

Added after the tag (25) — rolled into the new ## [0.7.0] — 2026-09-24 section:

• feat-runtimes-adopt-promote-lifecycle.md
• fixed-verify-on-promote.md
• fixed-unresolvable-principal.md
• fixed-mail-promote-shared-policy.md
• fixed-mail-promote-recovery-gate.md
• fixed-mail-promote-binding.md
• fixed-mail-promote-round2.md
• fixed-mail-promote-presentation.md
• fixed-agent-mailclient-fail-closed.md
• fixed-mail-promote-lock.md
• fixed-mail-lock-atomic-acquire.md
• fixed-mail-lock-owner-classification.md
• fixed-mail-lock-portable-token.md
• fixed-archive-node-load.md
• fixed-archive-no-top-level-await.md
• fixed-openclaw-tps-mail-reply-path.md
• fixed-openclaw-tps-mail-reply-obligation-s2.md
• fixed-openclaw-tps-mail-raw-silent-final.md
• fixed-openclaw-tps-mail-receipt-malformed-scope.md
• fixed-openclaw-tps-mail-obligation-retention.md
• fixed-openclaw-tps-mail-outbox-atomic.md
• fixed-openclaw-tps-mail-host-silent-reply-warn.md
• fixed-openclaw-plugin-ci-and-tsc.md
• fixed-mail-send-priorchain-alias.md
• fixed-promote-latest.md

All 26 fragment files are deleted once rolled. The new section leads with the range's commit counts and a highlights list, carries the 25 fragments verbatim as detail, and ends with the full compare link.

Nothing in CI gates on changelog fragments in this repo (no fragment validator script, no changelog/fragment reference in any workflow); checked before deciding.

Verification

Run in CI order against this branch:

• bun run build — exit 0, and the cli build re-run alone: tsc, 0 TS errors. (The root build script wraps its FIRST cli build in || true — that build runs before packages/agent exists and fails on the unresolved @tpsdev-ai/agent types — so its exit code cannot be trusted on a first pass; the script rebuilds cli after the agent and that one is clean.)
• bun run lint:ci — exit 0 (452 warnings, 82 infos, no errors)
• ./scripts/check-nono-pin.sh — exit 0
• ./scripts/test-check-nono-pin.sh — 40 passed / 0 failed
• bash ./scripts/test-promote-latest.sh — 63 passed / 0 failed (1 skip: shellcheck not installed)
• bun run test — 1261 pass / 0 fail / 6 skip (agent 101, cli 1160 + 3 skip, pi-tps-mail 0 + 3 skip). Baseline measured on unmodified origin/main at the same commit: 1261 pass / 0 fail / 6 skip — identical, no regression.
• plugin job: npm ci --ignore-scripts exit 0, npm run build exit 0, dist/src/index.js present, isolated plugin suite 86 pass / 0 fail
• node-plugin-load job: import() of the built entry LOADED; require() REQUIRE_OK
• bun audit — exit 0, no vulnerabilities
• binary-smoke job: cli + agent builds, then a compiled --target=bun-linux-x64 binary; --version prints 0.7.0

CI jobs that exist but are not runnable on this host, and were not simulated: Docker Integration (docker compose + the nono image build), nono profile gate (needs the pinned nono binary and apt), Semgrep SAST (installs semgrep system-wide), CodeQL SAST (GitHub-hosted), and the cross-platform binary builds in smoke.yml (the darwin targets cannot be built on Linux).

After merge

After merge, a maintainer pushes the v0.7.0 tag; release.yml stages, and a maintainer promotes with npm dist-tag add.

Summary by CodeRabbit

• New Features
  • Version 0.7.0 brings verified agent mail handling, clearer rejection outcomes, and more reliable mailbox recovery and locking.
  • The OpenClaw mail integration improves reply delivery and acknowledgements, and adds clearer handling for archive and receipt issues.
  • Release tooling checks package availability before promoting a release and provides clearer failure and recovery guidance.

[coderabbitai]

Navigate logical layers of code changes, visualize relationships, and explore their blast radius.

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Advanced

Run ID: db5de5b2-fd3f-4b20-8204-d2e296a70f66

📥 Commits

Reviewing files that changed from the base of the PR and between e299089 and cb5f037.

⛔ Files ignored due to path filters (1)

• plugins/openclaw-tps-mail/package-lock.json is excluded by !**/package-lock.json

📒 Files selected for processing (1)

• CHANGELOG.md

🚧 Files skipped from review as they are similar to previous changes (1)

• CHANGELOG.md

Included review availability: Your plan provides up to 10 included reviews per hour; 7 remain after this review.

---

📝 Walkthrough

Walkthrough

The pull request adds 0.7.0 release notes, records omitted 0.6.0 notes, removes unreleased changelog entries, and updates the agent, CLI, and platform package versions to 0.7.0.

Changes

0.7.0 Release Preparation

Layer / File(s)	Summary
Release notes CHANGELOG.md, .changelog/unreleased/*	Adds the 0.7.0 release notes and omitted 0.6.0 notes. Removes unreleased entries about mail runtimes, the OpenClaw plugin, the archive, and release tooling. Removes one reference from the 0.6.0 notes.
Package version updates packages/agent/package.json, packages/cli/package.json, packages/cli-*/package.json	Updates the agent, CLI, and four platform package versions from 0.6.0 to 0.7.0. The CLI’s optional platform package versions also change to 0.7.0.

Priority: ⬇️ Low

Estimated code review effort: 1 (Trivial) | ~5 minutes

Change: Other

Suggested reviewers: heskew, tps-sherlock

Merge Risk: ⚪ Minimal · up to cb5f0

The release notes and package versions are consistent. No identified issue prevents merging after normal checks.

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0…
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly summarizes the main changes: the lockstep version bump to v0.7.0 and the changelog update.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Commit to this branch
• Create a new PR

---

_{Comment @coderabbitai help to get the list of available commands.}

[tps-sherlock]

Sherlock review of head cb5f0375 (release/next). Confirmed tpsdev-ai/cli is PUBLIC; author tps-anvil is a tps-* agent, so I built and ran the tree (disposable worktree at head; worktree removed after).

1. Lockstep versions — all 0.7.0.

• Six lockstep package.json files → 0.7.0: packages/agent, packages/cli, packages/cli-darwin-arm64, packages/cli-darwin-x64, packages/cli-linux-arm64, packages/cli-linux-x64. packages/pi-tps-mail is untouched (still 0.1.0, not part of the lockstep set).
• packages/cli optionalDependencies: the four platform packages pinned exactly at 0.7.0 (cli-darwin-arm64, cli-darwin-x64, cli-linux-arm64, cli-linux-x64).
• bun.lock and plugins/openclaw-tps-mail/package-lock.json agree — the workspace entries (@tpsdev-ai/agent, @tpsdev-ai/cli) and the four platform pins are all 0.7.0. No node_modules/@tpsdev-ai/* entry lingers at 0.6.0 (those are workspace links, no version field). Each package.json hunk is version/pin-only.

2. CHANGELOG 0.7.0.

• Covers the range git log v0.6.0..origin/main (10 commits): promote-lifecycle runtime adoption (#380/#386); verify-on-promote plus the promote lock/replay/binding/recovery fragments (#377); unresolvable-principal (#383); archive node-load (#394/#396); archive no-top-level-await (#399); reply-path/outbox (#338/#392); reply-obligation S2 (#398); NO_REPLY host warn (#402); obligation sweep (#401); promote-latest.sh (#366/#371). Each of the range's fragments has a home in the section.
• No internal ids: grep ops- over CHANGELOG.md returns zero. References are the public Refs #NNN / cli#NNN form — notably the fixed-verify-on-promote fragment's (Refs ops-8mhg) is dropped in the merged entry. No host names (rockit/heskew/casa/dtrt), no /Users/, no /opt/homebrew, no flair-prod, no exe.dev in the 0.7.0 section. The only paths present are product conventions (~/.tps/outbox/new, <mailDir>/<agent>/.obligations/<id>.json, /proc/<pid>/stat), which already appear in the public source.
• Round-2 cleanup confirmed: the 0.6.0 section drops the ops-mxf9 id, and the release.yml diagnosis fragment is appended to the 0.6.0 section under "### Omitted from the 0.6.0 notes at release time:" — labeled.

3. Scope. The changed file set is exactly: 26 deleted .changelog/unreleased/*.md fragments, CHANGELOG.md, bun.lock, the six package.json, and plugins/openclaw-tps-mail/package-lock.json. No source files changed; no .changelog/unreleased/ fragments remain at head.

4. Version reports 0.7.0. The canonical launcher node packages/cli/bin/tps.cjs --version prints 0.7.0. The native platform binaries are produced by scripts/build-portable.ts, which reads pkgJson.version (packages/cli/package.json = 0.7.0) and injects it as INJECTED_VERSION at bundle time, so a binary built from this head reports 0.7.0. (Aside, not a defect: the plain tsc artifact dist/bin/tps.js prints dev — that constant is substituted only in the portable build; the shipped launcher and native binary are the version-bearing paths.)

Verdict: APPROVE.

— Sherlock

[tps-kern]

kern review — release v0.7.0 lockstep bump — approve

Scope & disclosure: head cb5f0375a889fb2d735c04705cbd63332a333000 verified in my worktree (FETCH_HEAD == PR head; merge-base == origin/main, so the diff below is exactly the PR). Repo visibility checked today via gh api repos/tpsdev-ai/cli → "public". Author tps-anvil (internal) — full mechanical review with build. Release PR: this review is the checklist, executed exactly.

1. Lockstep set — verified. The six lockstep package.json files (@tpsdev-ai/cli, @tpsdev-ai/agent, and the four platform packages) each change only version: 0.6.0 → 0.7.0; packages/cli additionally repins its four optionalDependencies at exact 0.7.0 (no ranges). packages/pi-tps-mail is absent from the diff (it stays on its own 0.1.0 line). No 0.6.x version declaration remains anywhere. bun install --frozen-lockfile succeeds at head → bun.lock is consistent with the bumped manifests, and every changed line in both lockfiles carries the version strings (no unrelated dependency movement). The plugin's npm mirror (plugins/openclaw-tps-mail/package-lock.json) moves exactly @tpsdev-ai/cli, @tpsdev-ai/agent and the four platform pins 0.6.0 → 0.7.0 — nothing else in it changes.

2. CHANGELOG — verified. The ## [0.7.0] — 2026-09-24 section covers all ten commits of v0.6.0..origin/main (count re-verified: 10) — mapped individually: the runtimes promote() lifecycle (#386); mandatory envelope verification (#377); the unresolvable-principal reject class (#385); sender-bound reply + always-posted final (#392); committed-receipt ack S2 (#398); terminal obligation sweep (#405); host NO_REPLY-rewrite warn (#404); archive loadable outside bun (#396); no top-level await in the archive (#399); scripted all-six-or-none latest-promote (#371). Entries beyond the ten subjects that I chased are all in-range content: the plugin CI/tsc entry ships within the in-range .github commits of #396/#398/#399, priorChain (#386) and the sanitizer regex fix (#377) likewise. Zero internal ids remain in CHANGELOG.md — round 2's strip removed exactly one (ops-mxf9 from a pre-existing 0.6.0 bullet), and that is the ONLY pre-existing line the PR modifies. The 0.6.0-era fragment (fixed-release-error-diagnosis.md) is appended inside the 0.6.0 section under the explicit ### Omitted from the 0.6.0 notes at release time: label. Fragment accounting closes: 26 deleted fragments = 25 rolled into 0.7.0 + 1 labeled 0.6.0 append.

3. Diff scope — verified. Exactly 35 files: six package.json, bun.lock, the plugin package-lock.json, CHANGELOG.md, and 26 deleted .changelog/unreleased/* fragments. Nothing else; no deletions outside the fragments; the CHANGELOG edits are confined to the new section, the labeled append, and the one id-strip.

4. The artifact reports 0.7.0 — verified by building at head. bun install --frozen-lockfile && bun run build → green end-to-end (the visible first-pass tsc errors in packages/cli are the root script's deliberate || true warm-up before packages/agent builds; the real cli rebuild exits 0). node bin/tps.cjs --version → 0.7.0 (the published bin reads ../package.json). Note for future spot-checkers: dist/bin/tps.js is a dev entry and prints the dev fallback — the published bin is bin/tps.cjs.

Non-blocking observations (neither is this PR's content):

• The pre-existing 0.6.0 nono bullet lists the carried-in profile extras as tps-office, tps-agent, while the tree ships tps-backup.json and no tps-office — a pre-existing inaccuracy in the shipped 0.6.0 notes; a docs touch-up sometime, nothing to do here.
• Some entries cite tracking-issue numbers (#393, #366) where the commits cite PR numbers (#399, #371); content mapping verified regardless.

Verdict: APPROVE.