Prepare Kitaru 0.27.0 release

[strickvl]

What changed?

This prepares one coordinated stable release: Kitaru core 0.27.0, the TypeScript package set 0.4.0, and all 14 Python plugin distributions. Core selects the verified stable kitaru-ui-v0.5.1 bundle.

Release unit	Version
kitaru	0.27.0
@zenml-io/kitaru, @zenml-io/kitaru-mastra, @zenml-io/kitaru-vercel-ai	0.4.0
kitaru-braintrust-importer	0.4.0
kitaru-claude-agent-sdk	0.1.0
kitaru-evaluator	0.2.0
kitaru-jsonl-importer	0.2.0
kitaru-langfuse-importer	0.4.0
kitaru-langgraph	0.2.0
kitaru-langsmith-importer	0.4.0
kitaru-logfire-importer	0.4.0
kitaru-mastra-importer	0.2.0
kitaru-openai-agents	0.3.0
kitaru-phoenix-importer	0.4.0
kitaru-post-import-insights	0.1.1
kitaru-pydantic-ai	0.3.0
kitaru-typesafe-evaluator	0.1.0

The release versions are unused on their registries and their exact Git tags are unused. The release commit resolves every development-only core pin, keeps post-import insights at its compatible kitaru>=0.26.0 floor, and keeps TypeSafe at its compatible kitaru>=0.22.0 floor.

Why?

The changes since 0.26.0 include two breaking session-node migrations: external IDs replace positional node identity, and reasoning_selectors replace stored reasoning text. The deterministic release rule therefore selects core 0.27.0; the pre-1.0 TypeScript and plugin packages receive minor releases where their public inputs or observable outputs changed.

Publishing these versions together prevents plugin wheels from advertising compatibility with core versions that do not contain the node contract or bounded import helpers they now use.

Release context

The frontend prerequisite is complete: kitaru-ui-v0.5.1 is stable at 41f19ac7734e56a7a7ad02c292a722cead931503, its release and commit checks passed, and both bundle assets have a verified checksum.

The GitHub environment pypi-kitaru-typesafe-evaluator exists and the release owner configured the matching PyPI pending Trusted Publisher. PyPI does not expose pending-publisher configuration publicly, so confirm those fields once more before pushing the first TypeSafe tag.

Source PRs by release unit:

• Core: Support PydanticAI 2.44-2.46 #1139, Add TypeSafe judge evaluations for recorded sessions #1138, Add Podman local runtime support #1136, Record completed Mastra streams without changing native delivery #1129, Bump ty from 0.0.80 to 0.0.81 in the dev-tooling group #1131, Support Node 26 and Mastra 1.67 #1128, Bump hypothesis from 6.167.1 to 6.168.0 in the minor-and-patch group #1124, Evaluate generated Mastra conversations #1068, Update Helm chart branding #1116, Add bounded adaptive Mastra conversations #1065, Add TypeScript and Mastra scorer evaluators #1067, Update httpx2 in the quickstart lockfile to 2.12.0 #1115, Add Python agent registration helpers #1090, Bump the minor-and-patch group across 1 directory with 2 updates #1110, Cancel jobs left pending past a timeout #1106, Pin the expected error on MCP fuzz xfail tests #1103, Require cyclopts>=4.25.1 so CLI typo errors name the right option #1104, Strengthen LangGraph capture accounting #1086, Bump the minor-and-patch group across 1 directory with 5 updates #1100, Bump mcp from 2.1.1 to 2.2.0 in the adapters-and-llm-sdks group across 1 directory #1098, Support @mastra/core 1.65 and 1.66 in the Mastra adapter #1092, Support PydanticAI 2.41-2.43 #1091, Bump the dev-tooling group with 2 updates #1097, Stream and batch API imports #1049, Expose analytics enabled in server info response #1094, Identify session nodes by external id #1073, Replace session node reasoning with reasoning selectors #1078, Allow providers on evaluators #1080, Add a skipped task status for analysis tasks that do not run #1079, Add import source to the import completed event #1077, Start Kitaru 0.26.0 development #1075.
• kitaru-braintrust-importer: Stream and batch API imports #1049, Replace session node reasoning with reasoning selectors #1078.
• kitaru-claude-agent-sdk: Identify session nodes by external id #1073, Replace session node reasoning with reasoning selectors #1078.
• kitaru-evaluator: Strengthen deterministic evaluator properties #1084, Identify session nodes by external id #1073.
• kitaru-jsonl-importer: Identify session nodes by external id #1073.
• kitaru-langfuse-importer: Stream and batch API imports #1049, Identify session nodes by external id #1073, Replace session node reasoning with reasoning selectors #1078.
• kitaru-langgraph: Strengthen LangGraph capture accounting #1086, Identify session nodes by external id #1073.
• kitaru-langsmith-importer: Stream and batch API imports #1049, Replace session node reasoning with reasoning selectors #1078.
• kitaru-logfire-importer: Stream and batch API imports #1049.
• kitaru-mastra-importer: Strengthen importer fuzzing and normalization #1083, Identify session nodes by external id #1073, Replace session node reasoning with reasoning selectors #1078.
• kitaru-openai-agents: Identify session nodes by external id #1073.
• kitaru-phoenix-importer: Stream and batch API imports #1049.
• kitaru-post-import-insights: Identify session nodes by external id #1073.
• kitaru-pydantic-ai: Support PydanticAI 2.44-2.46 #1139, Support PydanticAI 2.41-2.43 #1091, Identify session nodes by external id #1073, Replace session node reasoning with reasoning selectors #1078.
• kitaru-typesafe-evaluator: Add TypeSafe judge evaluations for recorded sessions #1138.
• TypeScript release set: Record completed Mastra streams without changing native delivery #1129, Support Node 26 and Mastra 1.67 #1128, Repair evaluator CI failures #1126, Add TypeScript and Mastra scorer evaluators #1067, Upgrade @biomejs/biome to 2.5.13 #1117, Bump the vercel-ai group across 1 directory with 2 updates #1108, Cancel jobs left pending past a timeout #1106, Support @mastra/core 1.65 and 1.66 in the Mastra adapter #1092, Expose analytics enabled in server info response #1094, Identify session nodes by external id #1073, Replace session node reasoning with reasoning selectors #1078, Allow providers on evaluators #1080, Add a skipped task status for analysis tasks that do not run #1079.

The independent Kitaru skills release remains a follow-up after core and plugins publish. Merge kitaru-skills#52, decide whether kitaru-skills#53 belongs, then use that repository's skills-release procedure to select and publish its version. The guided-tour screenshots noted in #1116 also remain follow-up work.

The quickstart now installs the already-published core 0.26.0 under uv sync --frozen. After 0.27.0 and the selected plugins are public, follow up by refreshing its core/plugin requirements and lockfile again, rerunning frozen E2E, and ensuring the update reaches main.

Post-merge publication order

Do not run these commands until this PR has merged and develop points at the reviewed merge commit.

1. Publish core from zenml-io/kitaru:

git checkout develop
git tag python/kitaru/v0.27.0 HEAD
git push origin python/kitaru/v0.27.0

2. Wait for the core publish-python job to succeed and verify https://pypi.org/pypi/kitaru/0.27.0/json.

3. Publish every selected Python plugin from the same reviewed develop commit, pushing one tag per command:

git checkout develop
git tag python/kitaru-braintrust-importer/v0.4.0 HEAD
git push origin python/kitaru-braintrust-importer/v0.4.0
git tag python/kitaru-claude-agent-sdk/v0.1.0 HEAD
git push origin python/kitaru-claude-agent-sdk/v0.1.0
git tag python/kitaru-evaluator/v0.2.0 HEAD
git push origin python/kitaru-evaluator/v0.2.0
git tag python/kitaru-jsonl-importer/v0.2.0 HEAD
git push origin python/kitaru-jsonl-importer/v0.2.0
git tag python/kitaru-langfuse-importer/v0.4.0 HEAD
git push origin python/kitaru-langfuse-importer/v0.4.0
git tag python/kitaru-langgraph/v0.2.0 HEAD
git push origin python/kitaru-langgraph/v0.2.0
git tag python/kitaru-langsmith-importer/v0.4.0 HEAD
git push origin python/kitaru-langsmith-importer/v0.4.0
git tag python/kitaru-logfire-importer/v0.4.0 HEAD
git push origin python/kitaru-logfire-importer/v0.4.0
git tag python/kitaru-mastra-importer/v0.2.0 HEAD
git push origin python/kitaru-mastra-importer/v0.2.0
git tag python/kitaru-openai-agents/v0.3.0 HEAD
git push origin python/kitaru-openai-agents/v0.3.0
git tag python/kitaru-phoenix-importer/v0.4.0 HEAD
git push origin python/kitaru-phoenix-importer/v0.4.0
git tag python/kitaru-post-import-insights/v0.1.1 HEAD
git push origin python/kitaru-post-import-insights/v0.1.1
git tag python/kitaru-pydantic-ai/v0.3.0 HEAD
git push origin python/kitaru-pydantic-ai/v0.3.0
git tag python/kitaru-typesafe-evaluator/v0.1.0 HEAD
git push origin python/kitaru-typesafe-evaluator/v0.1.0

4. After the required core/plugin artifacts are available and the TypeScript rehearsal has passed, publish the TypeScript release set from the reviewed develop commit:

git checkout develop
git tag typescript/kitaru/v0.4.0 HEAD
git push origin typescript/kitaru/v0.4.0

5. After required public core jobs and the GitHub Release succeed, fast-forward main to the immutable core tag:

git checkout main
git merge --ff-only python/kitaru/v0.27.0
git push origin main

Do not merge the generated development-reset PR until main contains python/kitaru/v0.27.0. Report any managed-image, installer-smoke, or reset-PR failure separately from artifacts that already published successfully.

Reviewer Notes

Review this as one release graph rather than isolated version bumps. Start with the 0.27.0 changelog and release declaration to confirm the breaking-change rationale and UI selection. Then check each plugin's changelog against its dependency floor, and verify that the eight default-catalog requirements exactly match their package versions. Finish with the TypeScript lockstep manifests and both Python lockfiles; they should contain version changes only, without unrelated dependency churn.

The highest-risk mistake would be publishing a plugin before core 0.27.0 is visible on PyPI, or publishing TypeSafe without the pending publisher matching the GitHub environment. The release workflows remain the only publication path; this PR creates no tags and publishes nothing.

Reproduction

Run uv run python scripts/release_ui.py --version 0.27.0 and confirm it resolves stable kitaru-ui-v0.5.1. Run uv run --no-project --with packaging==26.2 python scripts/release_units.py validate and confirm all 15 release units validate. Run just plugin-artifact-smoke to build the core and all plugin wheels, install them cleanly, import their configured entrypoints, and verify default registration.

For the public quickstart installation path, run uv sync --frozen and KITARU_EXAMPLE_SERVER_PORT=18000 uv run --frozen python scripts/run_ci_e2e.py from examples/python/pydantic_ai_ticket_resolver; the run should create a session against an isolated local server and finish with 1 passed.

Local checks run

• just check
• uv run pytest -q tests/server/test_default_plugins.py tests/scripts/test_release_units.py tests/scripts/test_release_ui.py (107 passed)
• uv run --project plugins ruff format --config plugins/pyproject.toml --check plugins
• uv run --project plugins ruff check --config plugins/pyproject.toml plugins
• uv run --project plugins ty check --project plugins
• uv run --project plugins pytest -q -c plugins/pyproject.toml plugins/tests tests/server/test_default_plugins.py (1,997 passed, 2 skipped)
• just plugin-artifact-smoke
• pnpm run pack:check under Node 22.22.3
• Frozen quickstart sync and E2E (1 passed)
• Release UI resolution, 15-unit inventory validation, lockfile checks, registry/tag collision checks, and git diff --check

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	pypi/​kitaru@​0.25.0 ⏵ 0.26.0	+1

View full report

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-09-21T15:34:25.185432Z	f5169f1	Draft marked ready

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.