release: 0.3.0

[TusanHomichi]

Primary Issue

Refs #146

The issue stays open until the tag is pushed, the release is published and verified, and the preview is upgraded.

Problem And Outcome

Release 0.3.0 is a minor release under ADR 0022. It adds a capability, and operators must act on the new browser floor. After merge and tagging, the release workflow builds, attests, and publishes 0.3.0.

Changes

• Cargo.toml / Cargo.lock and web/package.json / package-lock.json are set to 0.3.0. tests/release_version.rs checks that they agree, and only the root version lines of the lockfile change.
• CHANGELOG.md: Unreleased becomes [0.3.0] - 2026-10-15. Its summary bolds the browser floor and that upgrading from 0.2.0 runs no migration. That is verified: git diff v0.2.0 -- crates/consolebook-server/migrations is empty.
• README status, the roadmap's release baseline and operability list (adding ADR 0029), and the install guide's --version example are set to 0.3.0.

What 0.3.0 contains

• The complete installation export (export: one complete installation export an agency can leave with #98, feat(export): one complete installation export an agency can leave with #130; ADR 0028)
• SvelteKit 3, Vite 8, and current web tooling, with the browser floor Chrome/Edge 111+, Firefox 114+, Safari 16.4+ (web(deps): resolve SvelteKit cookie audit advisory #54, deps(web): SvelteKit 3, Vite 8, and current web tooling #140)
• Rust 1.99, sqlx 0.9 and the other crate majors, with bundled SQLite 3.51.3 (deps(rust): move to the latest stable toolchain and current crates (sqlx 0.9 and five other majors) #136, deps(rust): Rust 1.99 and current crates (sqlx 0.9 and five majors) #139)
• doctor's migration verdict now matches serve (doctor: compare stored migration checksums, not just versions #138, fix(doctor): report every migration history serve would refuse #144; ADR 0029)
• Current GitHub Actions and Dependabot version updates (ci: update the pinned actions and keep dependencies current with Dependabot version updates #137, ci: update the pinned actions and keep dependencies current with Dependabot #141)
• Runtime test credentials with a guard against literals (test: one shared invented credential so CodeQL stops re-flagging every test file #126, test: one runtime test credential, and a guard against password literals #145)

Verification

• Candidate revision: db9c80db674cdc2c6485ec6258c6a8ff8644cf46 (tree 9b1c0ce6).
• Local full proof (verifier role): scripts/proof.py passed all 7 gates in 531 s.
  • 309 Rust tests passed, 0 failed, 3 ignored.
  • Browser suite: 62 expected, 0 unexpected, 0 flaky, 0 skipped, on system Google Chrome 155.
  • consolebook-server --version prints consolebook 0.3.0 (db9c80db674c).
  • Receipt sha256 b7f0fe9e…, archived on the maintainer machine.
• Listed the exact verification commands run below
• Added or updated tests when behavior changed (no behavior change)
• Added or updated an ADR when a durable decision changed (none)
• All fixtures and examples are invented; no real agency data

- scripts/check-guidance-names.sh
- web/: npm ci, npm run check, npm run build
- cargo fmt --check
- cargo clippy --workspace --all-targets -- -D warnings
- cargo test --workspace
- cargo build -p consolebook-server
- web/: npm run e2e (system Google Chrome 155)

Review And Merge Notes

• Review performed: the worker role made the edits from a brief modeled on the 0.2.0 release commit (e4fc1d3), and the integrator reviewed the diff.
• Authority: the maintainer chose "Cut 0.3.0" on 2026-10-15. That covers this PR, the tag, the post-release verification, and the preview upgrade, under the standing PR permission.
• After merge:
  • Tag v0.3.0 on the merge commit, after confirming that commit's tree equals the proven candidate's.
  • Then verify the published release as on install: pin the one-line installer to a release and decide on archive signing #95: the one-line install, checksums, and gh attestation verify on every asset, including the first attest-build-provenance v4.2.2 run, which is what ci: update the pinned actions and keep dependencies current with Dependabot version updates #137 is waiting on.
  • Then upgrade the preview.

🤖 Generated with Claude Code

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-10-15T23:01:08.527560Z	db9c80d	PR opened

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.