release: finalize v0.0.16 hardening and distribution docs

.github/workflows/chrome-store-publish.yml

@@ -76,6 +76,7 @@ jobs:
       - name: Build extension artifact
         run: |
           npm run extension:build
+          node scripts/chrome-store-compliance-check.mjs
           npm run extension:pack
 
       - name: Upload package to Chrome Web Store

.github/workflows/pr-checks.yml

@@ -14,6 +14,63 @@ concurrency:
   cancel-in-progress: true
 
 jobs:
+  audit-zombie-files:
+    name: audit-zombie-files
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Setup Node
+        uses: actions/setup-node@v4
+        with:
+          node-version: 20
+          cache: npm
+
+      - name: Install dependencies
+        run: npm ci
+
+      - name: Audit zombie duplicate files
+        run: node scripts/audit-zombie-files.mjs
+
+  docs-drift-check:
+    name: docs-drift-check
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Setup Node
+        uses: actions/setup-node@v4
+        with:
+          node-version: 20
+          cache: npm
+
+      - name: Install dependencies
+        run: npm ci
+
+      - name: Validate docs drift invariants
+        run: node scripts/docs-drift-check.mjs
+
+  chrome-store-compliance-check:
+    name: chrome-store-compliance-check
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Setup Node
+        uses: actions/setup-node@v4
+        with:
+          node-version: 20
+          cache: npm
+
+      - name: Install dependencies
+        run: npm ci
+
+      - name: Validate extension compliance invariants
+        run: node scripts/chrome-store-compliance-check.mjs
+
   lint:
     name: lint
     runs-on: ubuntu-latest

.github/workflows/release-public.yml

@@ -30,6 +30,11 @@ on:
         required: true
         default: true
         type: boolean
+      run_release_live_gates:
+        description: "Run strict live provider/regression release gates"
+        required: true
+        default: false
+        type: boolean
 
 permissions:
   contents: write
@@ -55,12 +60,14 @@ jobs:
             publish_npm="true"
             publish_release="true"
             draft_release="false"
+            run_live_gates="false"
           else
             release_ref="${{ inputs.release_ref }}"
             release_tag="${{ inputs.release_tag }}"
             publish_npm="${{ inputs.publish_npm }}"
             publish_release="${{ inputs.publish_github_release }}"
             draft_release="${{ inputs.draft_release }}"
+            run_live_gates="${{ inputs.run_release_live_gates }}"
           fi
 
           if [[ ! "${release_tag}" =~ ^v[0-9]+\.[0-9]+\.[0-9]+$ ]]; then
@@ -77,6 +84,7 @@ jobs:
             echo "publish_npm=${publish_npm}"
             echo "publish_release=${publish_release}"
             echo "draft_release=${draft_release}"
+            echo "run_live_gates=${run_live_gates}"
           } >>"${GITHUB_OUTPUT}"
 
       - name: Checkout
@@ -112,12 +120,22 @@ jobs:
       - name: Run release quality gates
         run: |
           npm run version:check
+          node scripts/audit-zombie-files.mjs
+          node scripts/docs-drift-check.mjs
+          node scripts/chrome-store-compliance-check.mjs
           npm run lint
           npm run typecheck
           npm run test
           npm run build
           npm run extension:build
 
+      - name: Run strict live release gates
+        if: steps.meta.outputs.run_live_gates == 'true'
+        run: |
+          mkdir -p artifacts/release/v0.0.16
+          node scripts/provider-live-matrix.mjs --release-gate --use-global-env --out artifacts/release/v0.0.16/provider-live-matrix.json
+          node scripts/live-regression-matrix.mjs --release-gate
+
       - name: Pack extension artifact
         run: npm run extension:pack
 

.gitignore

@@ -51,6 +51,7 @@ frontend/.validation/
 
 # Continuity ledger (local-only)
 CONTINUITY*.md
+sub_continuity.md
 
 # Auto Claude data directory
 .auto-claude/
@@ -63,5 +64,3 @@ progress.txt
 # Local docs scratch
 docs/RELAY_CDP_TOKEN_PLAN.md
 docs/UI_references/
-CONTINUITY.md
-sub_continuity.md

CHANGELOG.md

@@ -7,28 +7,46 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
-## [0.0.16] - 2026-02-24
+## [0.0.16] - 2026-02-28
 
 ### Added
-- Automation provider runtime and macro execution surfaces for research, shopping, and product-asset workflows.
-- Debug-trace diagnostics snapshots and blocker metadata contracts across runtime outputs.
-- Expanded bundled skill-pack workflows and multi-agent skill target support.
-- Frontend docs site and branded asset pipeline for generated documentation delivery.
+- Release hardening automation scripts for preflight and compliance:
+  - `scripts/audit-zombie-files.mjs`
+  - `scripts/docs-drift-check.mjs`
+  - `scripts/chrome-store-compliance-check.mjs`
+  - `scripts/provider-live-scenarios.mjs`
+  - `scripts/release-gate-test-groups.mjs`
+- PR and release workflow gates for zombie-file audit, docs drift, extension-store compliance, and optional strict live release lanes.
+- Grouped release-gate npm scripts (`test:release-gate`, `test:release-gate:g1..g5`) for deterministic reruns.
 
 ### Changed
-- Hardened multitab runtime scheduling, provider orchestration, and Ops matrix execution behavior.
-- Migrated and stabilized skill-pack handling for multitab workflows and legacy alias compatibility.
-- Refreshed architecture/operations/distribution docs and release-readiness guidance.
-- Updated package + extension versions to `0.0.16` and refreshed dependency ranges/lockfile.
+- Compared to `v0.0.15`, this release consolidates automation platform/runtime work (provider workflows, macro execute, blocker envelopes, debug-trace surfaces), multitab governance hardening, and release governance/documentation upgrades.
+- `live-regression-matrix` now supports strict `--release-gate` mode, extension readiness recovery, stale worker cleanup, declared-divergence handling, and stronger scenario summarization semantics.
+- `provider-live-matrix` now supports strict release-gate mode with provider coverage assertions, nested live-matrix orchestration controls, extension-launch recovery, and deterministic high-friction/auth-gated handling.
+- CLI launch behavior now derives daemon RPC timeout from `--wait-timeout-ms` hints to prevent premature timeout failures during extension waits.
+- Macro execute daemon path now accepts bounded runtime timeout overrides and maps them into provider operation budgets.
+- CLI `--version` output is sourced from `package.json` (removed stale hardcoded version path).
+- Version verification now enforces parity across `package.json`, `extension/manifest.json`, and `extension/package.json`.
 
 ### Fixed
-- Preserved blocker resolution outcomes and improved traversal recovery under live matrix pressure.
-- Narrowed native extension ID fallback typing for safer native-host path handling.
-- Corrected legacy skill alias drift (`SKILL 2`) to keep compatibility behavior deterministic.
+- Relay extension-mode CDP connect now retries known stale-tab `Target.setAutoAttach` failure paths before failing.
+- Extension TypeScript event typing drift (`TabChangeInfo` -> `OnUpdatedInfo`) and CDP command param typing were tightened to avoid compile/runtime mismatch edges.
+- Provider runtime circuit-breaker timing assertions were stabilized in tests to reduce flaky cooldown-window checks.
+
+### Removed
+- Stale planning/design artifacts and prototypes that are no longer release sources of truth.
+- Legacy/unneeded local artifacts and stale helper scripts superseded by explicit release-gate automation.
+
+### Documentation
+- Swept and refreshed release-facing docs and runbooks across architecture, CLI, troubleshooting, onboarding, extension release, distribution, asset inventory, and dependency inventory surfaces.
+- Updated release evidence ledger and strict gate references for v0.0.16 operations.
 
 ### Tests
-- Expanded multitab, provider, and CLI regression coverage.
-- Added workflow runtime, skill-installer, blocker-transition, traversal, and live-path guard tests.
+- Added regression coverage for:
+  - launch timeout derivation and daemon call timeout forwarding
+  - relay stale-tab attach retry behavior
+  - release audit scripts and grouped release-gate orchestration
+- Preserved full-repo coverage threshold expectations (`>=97%`) while expanding release-governance checks.
 
 ## [0.0.15] - 2026-02-08
 

CONTRIBUTING.md

@@ -55,6 +55,9 @@ npm run dev
 # Run linting
 npm run lint
 
+# Run type checks
+npm run typecheck
+
 # Run tests with coverage
 npm run test
 
@@ -128,6 +131,27 @@ npm run test -- --watch
 
 See [tests/AGENTS.md](tests/AGENTS.md) for detailed testing conventions.
 
+### Release-Gate Validation (for release-affecting changes)
+
+Run these checks when touching release workflows, docs surface inventories, extension store assets, or live matrix scripts:
+
+```bash
+npm run test:release-gate
+node scripts/audit-zombie-files.mjs
+node scripts/docs-drift-check.mjs
+node scripts/chrome-store-compliance-check.mjs
+```
+
+If a grouped release-gate test fails, rerun only the failed group:
+
+```bash
+npm run test:release-gate:g1
+npm run test:release-gate:g2
+npm run test:release-gate:g3
+npm run test:release-gate:g4
+npm run test:release-gate:g5
+```
+
 ## Commit Guidelines
 
 We follow [Conventional Commits](https://www.conventionalcommits.org/):
@@ -173,7 +197,9 @@ fix: resolve race condition in target manager
 
 1. **Pre-commit Checklist**:
    ```bash
+   npm run version:check  # package + extension versions must match
    npm run lint      # Must pass with no errors
+   npm run typecheck # Must pass strict TypeScript checks
    npm run build     # Must compile successfully
    npm run test      # All tests must pass (97% coverage)
    ```
@@ -241,6 +267,7 @@ When making changes, update relevant documentation:
 - **docs/CLI.md**: CLI commands and options
 - **docs/ARCHITECTURE.md**: System design changes
 - **docs/TROUBLESHOOTING.md**: Common issues and solutions
+- **docs/RELEASE_RUNBOOK.md** and **docs/RELEASE_0.0.16_EVIDENCE.md**: Release-gate or release process changes
 - **AGENTS.md**: Development conventions (nearest to changed code)
 
 ### Documentation Standards

README.md

@@ -182,7 +182,7 @@ OpenDevBrowser uses the same automation model across plugin tools and CLI comman
 Shipping checklist for first-time users (local-package install, daemon, extension, first task, multi-tab auth/cookies):
 - [`docs/FIRST_RUN_ONBOARDING.md`](docs/FIRST_RUN_ONBOARDING.md)
 
-Parallel execution is target-scoped (`ExecutionKey = (sessionId,targetId)`): same target is FIFO, different targets can run concurrently up to the governor cap. `session-per-worker` remains the safest baseline for strict isolation. See [`docs/CLI.md`](docs/CLI.md) (Concurrency semantics), [`docs/MULTITAB_PARALLEL_OPERATIONS_SPEC.md`](docs/MULTITAB_PARALLEL_OPERATIONS_SPEC.md), and [`skills/opendevbrowser-best-practices/artifacts/provider-workflows.md`](skills/opendevbrowser-best-practices/artifacts/provider-workflows.md) (Workflow E).
+Parallel execution is target-scoped (`ExecutionKey = (sessionId,targetId)`): same target is FIFO, different targets can run concurrently up to the governor cap. `session-per-worker` remains the safest baseline for strict isolation. See [`docs/CLI.md`](docs/CLI.md) (Concurrency semantics) and [`skills/opendevbrowser-best-practices/artifacts/provider-workflows.md`](skills/opendevbrowser-best-practices/artifacts/provider-workflows.md) (Workflow E).
 
 ### Core Workflow (Plugin Tools)
 
@@ -237,9 +237,11 @@ Use `--output-format json|stream-json` for automation-friendly output.
 
 ### v0.0.16 (Latest)
 
-- **Dependency refresh for distribution readiness** with updates to runtime and development packages.
-- **Release hardening for root configs** with stricter TypeScript emit safety and deterministic test timeouts.
-- **Documentation alignment** for the new package version and local pre-release install flow.
+- **Release-gate hardening** with dedicated audit/compliance scripts (`audit-zombie-files`, `docs-drift-check`, `chrome-store-compliance-check`) and grouped release-gate tests.
+- **Live matrix robustness upgrades** across `live-regression-matrix` and `provider-live-matrix` (strict `--release-gate`, extension/CDP recovery paths, deterministic strict-mode semantics).
+- **CLI/runtime reliability fixes** including launch RPC timeout derivation from wait hints, bounded macro execute timeouts, and stale extension `/cdp` attach retry handling.
+- **Version/distribution integrity checks** now enforce parity across `package.json`, `extension/manifest.json`, and `extension/package.json`.
+- **Dependency and docs refresh** for v0.0.16 release readiness, onboarding parity, and public/private distribution operations.
 
 ### v0.0.15
 
@@ -790,9 +792,17 @@ Uniform versioning is required (source of truth: `package.json`):
 3. Run: `npm run version:check`
 4. Run: `npm run build`
 5. Run: `npm run extension:build`
-6. Run: `npm run extension:pack` (outputs `./opendevbrowser-extension.zip`)
-7. Tag `vX.Y.Z` and let `.github/workflows/release-public.yml` publish npm + GitHub release artifacts.
-8. Dispatch website content sync to private repo through `.github/workflows/dispatch-private-sync.yml`.
+6. Run release audits:
+   - `node scripts/audit-zombie-files.mjs`
+   - `node scripts/docs-drift-check.mjs`
+   - `node scripts/chrome-store-compliance-check.mjs`
+7. Run strict live release gates:
+   - `node scripts/provider-live-matrix.mjs --release-gate --out artifacts/release/v0.0.16/provider-live-matrix.json`
+   - `node scripts/live-regression-matrix.mjs --release-gate`
+8. Run first-time global install dry run checklist from `docs/FIRST_RUN_ONBOARDING.md`.
+9. Run: `npm run extension:pack` (outputs `./opendevbrowser-extension.zip`)
+10. Tag `vX.Y.Z` and let `.github/workflows/release-public.yml` publish npm + GitHub release artifacts.
+11. Dispatch website content sync to private repo through `.github/workflows/dispatch-private-sync.yml`.
 
 Runbooks:
 - `docs/DISTRIBUTION_PLAN.md`

docs/AGENTS.md

@@ -30,6 +30,16 @@ When extension behavior changes:
 - `docs/EXTENSION.md`
 - `docs/TROUBLESHOOTING.md`
 - `docs/privacy.md` (if permissions/data-handling claims change)
+- `docs/EXTENSION_RELEASE_RUNBOOK.md`
+
+When release-gate automation changes:
+- `docs/RELEASE_RUNBOOK.md`
+- `docs/DISTRIBUTION_PLAN.md`
+- `docs/RELEASE_0.0.16_EVIDENCE.md`
+- automation scripts:
+  - `scripts/audit-zombie-files.mjs`
+  - `scripts/docs-drift-check.mjs`
+  - `scripts/chrome-store-compliance-check.mjs`
 
 When mirrored website inputs change (`docs/`, `skills/`, `assets/`, `CHANGELOG.md`, `src/tools/index.ts`):
 - dispatch private sync via `.github/workflows/dispatch-private-sync.yml`

docs/ANNOTATE.md

@@ -1,7 +1,7 @@
 # Annotate
 
 Status: active  
-Last updated: 2026-02-24
+Last updated: 2026-02-28
 
 OpenDevBrowser can capture interactive annotations either directly via CDP/Playwright or through the extension relay, and
 return a markdown summary plus structured data and screenshots. This is exposed via the `opendevbrowser_annotate` tool.
@@ -113,6 +113,7 @@ Use `details` for inspection; avoid shipping raw output without review.
 
 - **Relay behavior**: the extension websocket is singular, but the relay can serve multiple `/ops` clients. Disconnecting the extension or restarting the relay drops active annotation sessions. If annotations stall, reconnect in the popup (or restart the daemon) before retrying.
 - **Restricted URL**: `chrome://` and Chrome Web Store pages cannot be annotated. Use a normal `http(s)` URL.
+- **Release matrix behavior**: strict release-gate runs treat restricted-URL failures as expected boundary checks, not product regressions.
 - **Relay unavailable**: start the daemon and confirm the popup shows **Connected**.
 - **Injection failed**: reload the tab and retry; ensure the extension has `<all_urls>` host permissions.
 - **Capture failed**: switch to `visible` or `none` for very long pages or heavy canvas content.

docs/ARCHITECTURE.md

@@ -2,7 +2,7 @@
 
 This document describes the architecture of OpenDevBrowser across plugin, CLI, and extension distributions, with a security-first focus.
 Status: active  
-Last updated: 2026-02-25
+Last updated: 2026-02-28
 
 ---
 
@@ -225,7 +225,7 @@ sequenceDiagram
 
 ### Multi-tab concurrency contract
 
-- Canonical spec: `docs/MULTITAB_PARALLEL_OPERATIONS_SPEC.md`.
+- Canonical contract: `docs/CLI.md` (concurrency semantics) and `src/config.ts` (`parallelism` settings).
 - Execution key: `ExecutionKey = (sessionId, targetId)`.
 - Command taxonomy:
   - `TargetScoped`: `goto`, `wait`, `snapshot`, interaction commands, DOM commands, `page.screenshot`, export/devtools target-bound commands.
@@ -325,9 +325,13 @@ When hub mode is enabled, the hub daemon is the **sole relay owner** and enforce
 - **CLI build** via `npm run build`.
 - **Private website checks** via `npm run lint --prefix frontend && npm run typecheck --prefix frontend && npm run build --prefix frontend` in `opendevbrowser-website-deploy`.
 - **CLI inventory/help parity check** via `npx opendevbrowser --help` and `npx opendevbrowser help`.
+- **Docs drift gate** via `node scripts/docs-drift-check.mjs`.
+- **Zombie duplicate audit** via `node scripts/audit-zombie-files.mjs`.
+- **Chrome extension compliance gate** via `node scripts/chrome-store-compliance-check.mjs`.
 - **Parity gate** via `tests/parity-matrix.test.ts` (CLI/tool/runtime surface checks + mode coverage).
 - **Provider performance gate** via `tests/providers-performance-gate.test.ts` (deterministic fixture SLO checks).
-- **Release checklist** in `docs/RELEASE_PARITY_CHECKLIST.md`.
+- **Strict live release gates** via `node scripts/provider-live-matrix.mjs --release-gate` and `node scripts/live-regression-matrix.mjs --release-gate`.
+- **Release checklist** in `docs/RELEASE_RUNBOOK.md` with evidence tracking in `docs/RELEASE_0.0.16_EVIDENCE.md`.
 - **Benchmark fixture manifest** in `docs/benchmarks/provider-fixtures.md`.
 - **First-run onboarding checklist** in `docs/FIRST_RUN_ONBOARDING.md`.
 

docs/ASSET_INVENTORY.md

@@ -1,7 +1,7 @@
 # OpenDevBrowser Asset Inventory
 
 Status: active  
-Last updated: 2026-02-25
+Last updated: 2026-02-28
 
 This inventory reflects the current `assets/` tree used by README, extension packaging, and private website branding flows.
 
@@ -67,4 +67,6 @@ shasum assets/extension-icons/icon16.png assets/extension-icons/icon32.png \
   assets/extension-icons/icon48.png assets/extension-icons/icon128.png \
   extension/icons/icon16.png extension/icons/icon32.png \
   extension/icons/icon48.png extension/icons/icon128.png
+
+node scripts/chrome-store-compliance-check.mjs
 ```