saintdle · saintdle · Aug 12, 2026 · Aug 12, 2026
@@ -30,9 +30,9 @@ jobs:
       - name: Build wheel and source distribution
         run: python -m build
       - name: Inspect package contents and privacy boundary
-        run: python scripts/ci/inspect_distribution.py dist --expected-version 0.0.3
+        run: python scripts/ci/inspect_distribution.py dist --expected-version 0.0.4
       - name: Smoke-test wheel outside the checkout
-        run: python scripts/ci/smoke_wheel.py dist/*.whl --expected-version 0.0.3
+        run: python scripts/ci/smoke_wheel.py dist/*.whl --expected-version 0.0.4
       - name: Upload CLI artifacts
         uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
         with:

@@ -85,9 +85,9 @@ jobs:
       - name: Build wheel and source distribution
         run: python -m build
       - name: Inspect package contents and privacy boundary
-        run: python scripts/ci/inspect_distribution.py dist --expected-version 0.0.3
+        run: python scripts/ci/inspect_distribution.py dist --expected-version 0.0.4
       - name: Smoke-test wheel outside the checkout
-        run: python scripts/ci/smoke_wheel.py dist/*.whl --expected-version 0.0.3
+        run: python scripts/ci/smoke_wheel.py dist/*.whl --expected-version 0.0.4
       - name: Upload inspected distributions
         uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
         with:

@@ -6,6 +6,8 @@ follow [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
 ## [Unreleased]
 
+## [0.0.4] - 2026-08-12
+
 ### Added
 
 - Added an automatic controller classification for Claude-authored
@@ -104,7 +106,8 @@ follow [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 - Hardened-isolation documentation accurately describes its protected-root
   read denylist rather than a global read allowlist.
 
-[Unreleased]: https://github.com/saintdle/agentflow/compare/v0.0.3...HEAD
+[Unreleased]: https://github.com/saintdle/agentflow/compare/v0.0.4...HEAD
+[0.0.4]: https://github.com/saintdle/agentflow/compare/v0.0.3...v0.0.4
 [0.0.3]: https://github.com/saintdle/agentflow/compare/v0.0.2...v0.0.3
 [0.0.2]: https://github.com/saintdle/agentflow/compare/v0.0.1...v0.0.2
 [0.0.1]: https://github.com/saintdle/agentflow/releases/tag/v0.0.1
@@ -20,7 +20,7 @@ unrelated projects.
 > permissions, diffs, and backups as though untrusted automation may fail.
 
 > [!IMPORTANT]
-> Agentflow `0.0.3` is a public preview. Its commands, configuration schema,
+> Agentflow `0.0.4` is a public preview. Its commands, configuration schema,
 > and compatibility guarantees may change before `1.0`.
 
 ## What it provides
@@ -115,16 +115,16 @@ For manual installation, continue below.
 The cleanest installation uses an isolated Python tool environment:
 
 ```sh
-uv tool install "git+https://github.com/saintdle/agentflow.git@v0.0.3"
+uv tool install "git+https://github.com/saintdle/agentflow.git@v0.0.4"
 # or
-pipx install "git+https://github.com/saintdle/agentflow.git@v0.0.3"
+pipx install "git+https://github.com/saintdle/agentflow.git@v0.0.4"
 ```
 
 Until the repository is public, an authenticated GitHub checkout or Git
 credential helper is required. To install from a downloaded release wheel:
 
 ```sh
-pipx install ./saintdle_agentflow-0.0.3-py3-none-any.whl
+pipx install ./saintdle_agentflow-0.0.4-py3-none-any.whl
 ```
 
 Verify the installation and prerequisites without exposing credentials:
@@ -214,12 +214,12 @@ locations, and team-safe setup patterns.
 | Platform | Core CLI | Hardened isolation |
 | --- | --- | --- |
 | macOS | Supported | Available through `sandbox-exec`; probes fail closed |
-| Linux | Supported | Not available in `0.0.3`; requests fail closed |
-| Windows | Not supported in `0.0.3` | Not available |
+| Linux | Supported | Not available in `0.0.4`; requests fail closed |
+| Windows | Not supported in `0.0.4` | Not available |
 
 Core coordination can run on macOS and Linux. Hardened isolation is a distinct,
 macOS-only security control; ordinary execution on Linux is not equivalent
-confinement. In `0.0.3`, `agentflow isolation launch` provides synchronous
+confinement. In `0.0.4`, `agentflow isolation launch` provides synchronous
 hardened execution. Direct handoff and persistent Herdr/controller launches
 reject hardened profiles rather than treating a successful probe as confinement.
 
@@ -242,7 +242,7 @@ reject hardened profiles rather than treating a successful probe as confinement.
 
 ## Project status and releases
 
-`0.0.3` is intended for development/testing and feedback. Pull requests run validation
+`0.0.4` is intended for development/testing and feedback. Pull requests run validation
 and package-build checks. Merges to `main` build the CLI distribution artifacts;
 tagged releases are the versioned distribution boundary. See
 [the changelog](CHANGELOG.md) and [release process](CONTRIBUTING.md#releases).

@@ -28,13 +28,13 @@ integrations without reading their credential stores.
 Install a tagged release with `uv`:
 
 ```sh
-uv tool install "git+https://github.com/saintdle/agentflow.git@v0.0.3"
+uv tool install "git+https://github.com/saintdle/agentflow.git@v0.0.4"
 ```
 
 Or with `pipx`:
 
 ```sh
-pipx install "git+https://github.com/saintdle/agentflow.git@v0.0.3"
+pipx install "git+https://github.com/saintdle/agentflow.git@v0.0.4"
 ```
 
 For a local checkout:
@@ -49,7 +49,7 @@ The repository requires authentication while it remains private. A release
 wheel built by GitHub Actions can be installed without a source checkout:
 
 ```sh
-pipx install ./saintdle_agentflow-0.0.3-py3-none-any.whl
+pipx install ./saintdle_agentflow-0.0.4-py3-none-any.whl
 ```
 
 ## Verify

@@ -1,6 +1,6 @@
 # Transactional migration from a legacy checkout
 
-Agentflow `0.0.3` can replace user-level links owned by a recognized legacy
+Agentflow `0.0.4` can replace user-level links owned by a recognized legacy
 source checkout without importing that checkout's private data. The migration
 is deliberately narrow, journaled, and reversible.
 
@@ -14,7 +14,7 @@ inside the supplied legacy checkout are eligible:
 - Agentflow controller, explorer, reviewer, and PR-gatekeeper profile links;
 - the Agentflow Codex hook link.
 
-The replacement executable must already be a packaged `0.0.3` command in an
+The replacement executable must already be a packaged `0.0.4` command in an
 isolated environment outside the legacy checkout. Skill, profile, and hook
 links are replaced by immutable files from that same installed distribution.
 
@@ -48,10 +48,10 @@ closed.
 Install the reviewed wheel into a separate environment. One portable example:
 
 ```sh
-python3 -m venv ~/.local/share/agentflow/versions/0.0.3
-~/.local/share/agentflow/versions/0.0.3/bin/python -m pip install \
-  ./saintdle_agentflow-0.0.3-py3-none-any.whl
-NEW_AGENTFLOW=~/.local/share/agentflow/versions/0.0.3/bin/agentflow
+python3 -m venv ~/.local/share/agentflow/versions/0.0.4
+~/.local/share/agentflow/versions/0.0.4/bin/python -m pip install \
+  ./saintdle_agentflow-0.0.4-py3-none-any.whl
+NEW_AGENTFLOW=~/.local/share/agentflow/versions/0.0.4/bin/agentflow
 "$NEW_AGENTFLOW" --version
 ```
 
@@ -105,7 +105,7 @@ agentflow migrate legacy --rollback <migration-id>
 Rollback first verifies every installed destination against the digest stored
 at apply time. If any destination has changed, it refuses before mutating any
 entry. A successful rollback restores the original symbolic links. It does not
-delete the isolated `0.0.3` environment or legacy checkout.
+delete the isolated `0.0.4` environment or legacy checkout.
 
 Migration manifests and backups are intentionally retained for audit and
 recovery. Remove them only after reviewing their exact paths and deciding the

@@ -84,7 +84,7 @@ security. Use exact provider identifiers and review policy changes.
 
 ## Hardened isolation
 
-Hardened subprocess isolation in `0.0.3` is available only on macOS through
+Hardened subprocess isolation in `0.0.4` is available only on macOS through
 `/usr/bin/sandbox-exec`. Process execution, writes, and network access are
 deny-by-default. Reads use a different boundary: the profile permits blanket
 system reads so interpreters and toolchains can start, denies protected home
@@ -108,11 +108,11 @@ Direct `agentflow handoff launch` requires an exact role, model, and effort and
 validates them against model policy. It is not the synchronous isolation path:
 a handoff declaring `isolation_profile: hardened` is rejected rather than
 launched unconfined. Authenticated Herdr/controller launch also rejects hardened
-handoffs in `0.0.3`, because a probe cannot confine the later persistent
+handoffs in `0.0.4`, because a probe cannot confine the later persistent
 provider session. Use `agentflow isolation launch` for synchronous hardened
 commands; persistent-session confinement is not currently provided.
 
-Linux can run the core CLI but has no equivalent hardened isolation in `0.0.3`.
+Linux can run the core CLI but has no equivalent hardened isolation in `0.0.4`.
 Running a command in a shell, virtual environment, worktree, or terminal
 multiplexer is not an isolation boundary.
 

@@ -81,7 +81,7 @@ Treat third-party skills as executable supply-chain inputs:
 - use Agentflow's asset lock and verification commands;
 - use the separate synchronous `agentflow isolation launch` path for untrusted
   execution where supported; persistent provider sessions are not confined in
-  `0.0.3`.
+  `0.0.4`.
 
 Synchronization does not grant a skill controller credentials, provider
 credentials, or permission to bypass handoff preflight.

@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "saintdle-agentflow"
-version = "0.0.3"
+version = "0.0.4"
 description = "Provider-neutral workflow helpers for Codex, Claude Code, and GitHub Copilot CLI"
 requires-python = ">=3.10"
 dependencies = ["tomli>=2.0; python_version < '3.11'"]

@@ -1,3 +1,3 @@
 """Provider-neutral coding-agent workflow helpers."""
 
-__version__ = "0.0.3"
+__version__ = "0.0.4"
@@ -42,7 +42,7 @@ def fixture(self, root: Path) -> tuple[Path, Path, Path, Path]:
 
         new_command = root / "isolated/bin/agentflow"
         new_command.parent.mkdir(parents=True)
-        new_command.write_text("#!/bin/sh\nprintf 'agentflow 0.0.3\\n'\n", encoding="utf-8")
+        new_command.write_text("#!/bin/sh\nprintf 'agentflow 0.0.4\\n'\n", encoding="utf-8")
         new_command.chmod(0o755)
         return home, legacy, state, new_command
 
@@ -171,7 +171,7 @@ def test_apply_rejects_an_executable_from_a_different_distribution(self) -> None
             root = Path(temporary)
             home, legacy, state, new_command = self.fixture(root)
             new_command.write_text("#!/bin/sh\nprintf 'not-agentflow 9.9.9\\n'\n", encoding="utf-8")
-            with self.assertRaisesRegex(migration.MigrationError, "running Agentflow 0.0.3"):
+            with self.assertRaisesRegex(migration.MigrationError, "running Agentflow 0.0.4"):
                 migration.apply(
                     legacy,
                     home=home,

@@ -20,7 +20,7 @@
 
 class PackagingConfigTests(unittest.TestCase):
     def test_version_and_resources_are_distribution_owned(self) -> None:
-        self.assertEqual(__version__, "0.0.3")
+        self.assertEqual(__version__, "0.0.4")
         self.assertTrue(resources.item("templates", "project", "agentflow.json").is_file())
         self.assertTrue(resources.item("policies", "models-v1.json").is_file())
         self.assertEqual(len(resources.names("skills")), 7)