Release validation covers TypeScript, runtime behavior, skill/template/package integrity, the npm payload, all three native clients, and the public docs.
Harness Checks
pnpm --filter cadre-ai check
pnpm --filter cadre-ai test
pnpm --filter cadre-ai validatecheckruns strict TypeScript without emitting.testbuilds both bundles and runs CLI plus integration tests.validatebuilds and verifies manifests, marketplace catalogs, package identity, the solecadre-aibin, self-contained dependency policy, skills, agent isolation rules, templates, MCP configs, and absence of retired source.
Package Inspection
pnpm --filter cadre-ai pack --dry-runConfirm the payload contains manifests, MCP configs, skills, agents, immutable
templates, license, README, and both runtime bundles. It must not contain source
tests, development dependencies, node_modules, or a second binary alias.
Documentation Checks
pnpm --filter cadre-docs checkThis runs content validation, ESLint, TypeScript, the static Next.js build, and
rendered SEO/internal-link validation.
The docs package version and release notes must match harness/package.json.
Native Installer Validation
Build locally and install for all supported clients:
pnpm --filter cadre-ai build
node harness/dist/cadre-cli.mjs doctor
node harness/dist/cadre-cli.mjs install --target all --scope user
codex plugin list --json
claude plugin list --json
zed --versionVerify:
- Codex and Claude report
cadre@cadreinstalled and enabled at the candidate version (with installation cache-buster metadata where applicable); - Codex launches
./dist/cadre-mcp.mjsfrom the packaged plugin root; - Claude launches
${CLAUDE_PLUGIN_ROOT}/dist/cadre-mcp.mjs; - Codex has the plugin-scoped MCP approval mode;
- Claude has both the
cadreenabled server andmcp__cadre__*allow rule; - Zed Agent has ten global
cadre-*skills, an active Cadre context server, and exactmcp:cadre:<tool>allow entries; - new Codex and Zed sessions plus a reloaded Claude session discover all ten workflows.
There is no current install --check mode. Native listing and a real skill/MCP
smoke test are the verification path. Zed has no plugin-list CLI, so verify its
Skills and MCP Server pages and run /cadre-status in a native Zed Agent thread.
4.0.0 Verification Record
The local 4.0.0 implementation passed 480 harness tests, type checking, package validation, pack dry run and the complete documentation check. A native Codex fixture completed 14 fresh sessions covering brownfield setup, interrupted track drafting, revision during implementation, review and remediation, manual product changes invalidating clean completion, archive interruption/recovery and refresh. Its 26 tests passed, including 200,020 arithmetic oracle comparisons. All nine receipts had exactly one verified commit and historical evidence was preserved.
The native workflow test used Autonomous approval and sequential execution with
synthetic fixture approvals. It did not change global installations and does not
replace the three-client installer/discovery/activation gate above. The detailed
record is docs/development/cadre-4.0.0-native-flow.md in the source repository.
Final 4.0.0 user-scope installation and activation passed for all three clients.
Codex completed a fresh read-only status smoke test; Claude reported a connected
Cadre server; Zed showed all ten skills and an active server. Packaged MCP bytes
matched the tested build, and narrow Cadre approval settings were verified.
See docs/development/cadre-4.0.0-release.md for the release validation record.
Release Sequence
- Update runtime, package, and both plugin manifest versions together; Zed adapters inherit the package version from the shared payload.
- Update docs package version and release notes.
- Install with the locked workspace dependencies.
- Run harness check, tests, validation, and package inspection.
- Run the complete docs check.
- Validate local-build installation against Codex, Claude, and Zed.
- Stop and fix any installer, listing, discovery, MCP, permission, or version mismatch before creating or publishing the release.
Publishing, tagging, pushing, and external release creation require explicit user authorization; local validation does not imply it.