Prepare Kitaru 0.26.0 coordinated release

[strickvl]

What changed?

Prepare the coordinated Kitaru 0.26.0 release with UI kitaru-ui-v0.5.0, ten Python plugins, and the TypeScript 0.3.0 package set. UI 0.5.0 is published and its bundle checksum is verified; the core rehearsal wheel includes that exact bundle.

Why?

The release brings the merged import, analyzer, provider-connection, and Mastra replay work into installable versions with matching server defaults. Core 0.26.0 is the deterministic proposal from the latest stable 0.25.0 and all merged PR labels, including the breaking import-response change.

Release context

Selected releases

Distribution or release set	Latest published	Selected	Related source PRs
kitaru	0.25.0	0.26.0	API imports #970, import records #980, analyzers #984, selectable insights #988, connections #1007; complete source range listed below
kitaru-braintrust-importer	0.2.0	0.3.0	#970, #1005, #1019, #1043
kitaru-langfuse-importer	0.2.0	0.3.0	#970, #1005, #1019, #1043, #1072
kitaru-langsmith-importer	0.2.0	0.3.0	#970, #1019, #1043
kitaru-logfire-importer	0.2.0	0.3.0	#970, #993, #1005, #1019, #1043
kitaru-phoenix-importer	0.2.0	0.3.0	#970, #1005, #1019, #1043
kitaru-jsonl-importer	0.1.1	0.1.2	#1019
kitaru-pydantic-ai	0.2.0	0.2.1	#992
kitaru-claude-agent-sdk	Unpublished	0.1.0rc0	#940, #996
kitaru-mastra-importer	Unpublished	0.1.0	#1063
kitaru-post-import-insights	Unpublished	0.1.0	#988, #1022, #1023, #1024, #1041, #1042, #1047
@zenml-io/kitaru, @zenml-io/kitaru-mastra, @zenml-io/kitaru-vercel-ai	0.2.0	0.3.0	node filtering #997, Mastra compatibility #994, recorded context #1064, secondary model recording #1066, plus generated core API changes

Leave kitaru-evaluator 0.1.3, kitaru-langgraph 0.1.2, and kitaru-openai-agents 0.2.0 unchanged: their package paths have no changes since their own stable tags. Vercel AI participates in the documented TypeScript lockstep release despite having no direct implementation change.

Complete core source PR range since 0.25.0

#940, #970, #972, #973, #974, #975, #976, #977, #978, #980, #983, #984, #986, #987, #988, #992, #993, #994, #995, #996, #997, #998, #999, #1000, #1001, #1004, #1005, #1007, #1008, #1009, #1010, #1011, #1013, #1014, #1015, #1016, #1017, #1018, #1019, #1020, #1021, #1022, #1023, #1024, #1032, #1033, #1034, #1036, #1037, #1039, #1041, #1042, #1043, #1044, #1045, #1047, #1048, #1063, #1064, #1066, #1069, #1072

Compatibility and ordering

The insights package requires core >=0.26.0. The five provider importers retain base kitaru>=0.24.0 for file parsing, but their api extras now require >=0.26.0; each adapter extra includes [api] and inherits that floor. Core 0.25.0 lacks the query and retry APIs those modules import. All selected default requirements/display versions match their package manifests; adapters and the Mastra importer remain outside the default catalog.

1. Obtain human approval and merge this PR. Verify the exact release commit, the stable UI 0.5.0 release, and both kitaru-ui.tar.gz and kitaru-ui.tar.gz.sha256. Rehearse the eligible release commit without publication.
2. Publish python/kitaru/v0.26.0, then verify its PyPI availability before dependent plugins. Public image and Helm jobs may still be running.
3. Publish typescript/kitaru/v0.3.0 and verify all three npm packages before publishing the Mastra importer, whose recorded-context replay requires the new adapter.
4. Push each selected Python package tag separately and verify each artifact. Claude starts at 0.1.0rc0; run its released-candidate live smoke before proposing a stable promotion.
5. After core public artifacts and GitHub Release succeed, the release owner fast-forwards main to the reviewed release commit, then reviews/merges the generated development-reset PR on develop.

Core startup stores the queued default package requirements without installing them. Worker tasks that select those versions must wait until their packages are available; there is no automatic fallback to an older package.

Pending publication and follow-ups

• UI 0.5.0 is published. Its checksum matches the rehearsal wheel manifest; root, SPA, and all 199 static asset serving checks passed. Browser rendering was not exercised. No Kitaru package publication tag has been pushed by this preparation.
• The three new GitHub publishing environments now exist. The release owner confirmed adding their PyPI pending publishers; private PyPI settings remain independently unverified.
• Review the independent skills follow-up kitaru-skills#51 after core and required plugins are published. Its proposed 0.17.0 release remains a separate decision.
• Confirm frontend consumption of analyzer minimum-session results and investigation prompts. Related: frontend#521, Generate insights with selectable analyzers #988, Add contextual insight copy labels #1041, Describe insight actions as investigations #1047. Confirm the ZenML docs follow-up declared by Support @mastra/core 1.51 through 1.64 in the Mastra adapter #994 and hosted model availability noted by Document Luna for hosted post-import analysis #1024. No website release dependency was identified in the merged PR context.
• The public quickstart stays on published core 0.25.0; its manifest floor now matches that lockfile. Both its frozen published install and candidate-wheel run passed, so it does not need an unpublished dependency pin or a post-publication refresh to remain runnable.

Reviewer Notes

Start with the compatibility split: a file-only user can retain core 0.24.0, while installing [api] or [adapter] must select core 0.26.0. Verify that the five provider extras and insights wheel express those floors. A permissive API floor installs successfully but fails when the API module imports unavailable core symbols.

Review the five importer changelogs for source-identity changes. Phoenix now prefixes external IDs with project identity, so reimporting older bare-ID traces can create additional sessions. The assembled core changelog incorporates both fragments and the legacy Mastra entry, and removes superseded empty-analysis behavior.

Reproduction

Run uv run --no-sync python scripts/smoke_plugin_artifacts.py --candidate-dir plugins/candidate-wheels to build clean wheel installations and verify default registration twice. Inspect wheel METADATA: no development placeholder or checkout URL should occur in Requires-Dist.

Follow the quickstart candidate-install steps in .github/workflows/ci.yml, then run its scripts/run_ci_e2e.py with PostgreSQL available. Expect a fresh server, ten imported sessions, completed built-in/custom evaluations, and a cohort; the harness cleans up its isolated database. For the published path, run uv sync --frozen and uv run --frozen python scripts/run_ci_e2e.py from the example directory before installing candidate wheels.

Local checks run

• just check, release inventory validation, exact UI declaration validation, and git diff --check passed.
• Release UI/inventory contract tests: 97 passed. Updated existing fixture expectations to the selected default pins.
• Plugin format/lint/typecheck and full plugin/default-catalog suite: 1,804 passed, 1 opt-in probe skipped.
• Isolated plugin artifact smoke passed; all 14 wheel metadata records contained no development or local-path dependencies. All ten API/adapter-extra combinations reject core 0.25.0; all five API modules import with candidate core 0.26.0.
• TypeScript frozen install, lint, typecheck, generation check, and tarball install/export smoke passed. Built tests: 478 passed. Python-to-TypeScript worker integration: 15 passed across the initial run and one PATH-corrected rerun.
• Quickstart frozen published run and candidate-wheel run each passed, with 16 contract tests on each path. Candidate packages: core 0.26.0, PydanticAI 0.2.1, Langfuse importer 0.3.0. File-only parsing against published core 0.24.0 passed for all five provider importers.

The preparation checks above preceded merge. Post-merge rehearsal and artifact evidence, plus exact publication commands, follow below. No paid provider calls or deployment were performed.

Verified post-merge publication handoff

PR #1074 merged at 0d806f832e3afa05ad14bd045629dd8be4f51afe. Its tree matches the approved candidate. All selected tags were unused at verification. Run these commands in zenml-io/kitaru; each tag deliberately names the exact reviewed commit, independently of later branch changes. These commands publish packages and require the release owner's explicit go-ahead.

Core first

The core non-publishing rehearsal 34494267685 passed at this commit. Both artifact checksums passed, and the wheel includes 201 UI assets with the verified UI 0.5.0 checksum. All publication jobs were skipped. A local serving smoke using the actual rehearsal wheel passed for the root and SPA routes and all 199 static assets; browser rendering was not exercised.

git checkout develop
git tag python/kitaru/v0.26.0 0d806f832e3afa05ad14bd045629dd8be4f51afe
git push origin python/kitaru/v0.26.0

TypeScript after rehearsal

The TypeScript non-publishing rehearsal 34494271785 passed at the exact merge SHA, with publishing skipped. All three tarball checksums, packed manifests, clean Node 22 install, five public exports, client construction, and strict TypeScript consumer compilation passed. Wait for core 0.26.0 PyPI availability before running this block. One tag publishes all three npm packages.

git checkout develop
git tag typescript/kitaru/v0.3.0 0d806f832e3afa05ad14bd045629dd8be4f51afe
git push origin typescript/kitaru/v0.3.0

Python plugins after core and TypeScript

Wait for the core publish-python job and verify exact core 0.26.0 on PyPI. Verify all three npm 0.3.0 packages before the Mastra importer. Run the remaining plugin rehearsals, including the insights registry-install check that needs published core 0.26.0. Push each tag separately and check that its workflow starts.

git checkout develop
git tag python/kitaru-braintrust-importer/v0.3.0 0d806f832e3afa05ad14bd045629dd8be4f51afe
git push origin python/kitaru-braintrust-importer/v0.3.0
git tag python/kitaru-langfuse-importer/v0.3.0 0d806f832e3afa05ad14bd045629dd8be4f51afe
git push origin python/kitaru-langfuse-importer/v0.3.0
git tag python/kitaru-langsmith-importer/v0.3.0 0d806f832e3afa05ad14bd045629dd8be4f51afe
git push origin python/kitaru-langsmith-importer/v0.3.0
git tag python/kitaru-logfire-importer/v0.3.0 0d806f832e3afa05ad14bd045629dd8be4f51afe
git push origin python/kitaru-logfire-importer/v0.3.0
git tag python/kitaru-phoenix-importer/v0.3.0 0d806f832e3afa05ad14bd045629dd8be4f51afe
git push origin python/kitaru-phoenix-importer/v0.3.0
git tag python/kitaru-jsonl-importer/v0.1.2 0d806f832e3afa05ad14bd045629dd8be4f51afe
git push origin python/kitaru-jsonl-importer/v0.1.2
git tag python/kitaru-pydantic-ai/v0.2.1 0d806f832e3afa05ad14bd045629dd8be4f51afe
git push origin python/kitaru-pydantic-ai/v0.2.1
git tag python/kitaru-claude-agent-sdk/v0.1.0rc0 0d806f832e3afa05ad14bd045629dd8be4f51afe
git push origin python/kitaru-claude-agent-sdk/v0.1.0rc0
git tag python/kitaru-mastra-importer/v0.1.0 0d806f832e3afa05ad14bd045629dd8be4f51afe
git push origin python/kitaru-mastra-importer/v0.1.0
git tag python/kitaru-post-import-insights/v0.1.0 0d806f832e3afa05ad14bd045629dd8be4f51afe
git push origin python/kitaru-post-import-insights/v0.1.0

Completion and independent follow-ups

After all required public core artifacts and its GitHub Release succeed, verify that main can fast-forward to python/kitaru/v0.26.0 and give the release owner the main-promotion commands. Complete that promotion before merging the generated development-reset PR. The public quickstart remains runnable on its verified published 0.25.0 lockfile.

kitaru-skills#51 remains open. Its proposed 0.17.0 version and reviewed release commit must be settled separately under its skills-release instructions; no skills tag is ready yet. Frontend #521, the ZenML docs follow-up from #994, and hosted model availability from #1024 remain independent follow-ups.

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-09-10T14:23:33.831814Z	62b4abf	Draft marked ready

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.