docs/releases/0.4.0.md

# codex-sdlc 0.4.0 release evidence

Date: 2026-09-11

This source revision implements schema-family 2 multi-repository workspaces while retaining schema-family 1 single-repository compatibility.

Prepared release artifacts:

| Artifact | SHA-256 |
| --- | --- |
| `build/public-submission/0.4.0/codex-sdlc-0.4.0.tgz` | `1f9180d2d2335da1c6c386b3c17e93960bc6632541131a51ee906b46e1e2e914` |
| `build/public-submission/0.4.0/codex-sdlc-plugin-0.4.0.zip` | `7d4bab30aebb9baf0317b17aa1c9c71988b746b87f81b53bb8f49afa08cb7580` |
| `build/public-submission/0.4.0/codex-sdlc-skills-0.4.0.zip` | `cf16b1ca50c900c260db177485006e6709322c3bed74dfc1dcebb8f4d4ee4bd3` |
| `build/public-submission/0.4.0/codex-sdlc-logo-0.4.0.png` | `678361975afc99f1c5bcb5b95a0883922b025d2aab3d2ce88f911a5972ff1825` |

| Check | Result |
| --- | --- |
| TypeScript typecheck | Passed |
| Vitest suite | Passed: 7 files, 28 tests |
| Runtime build | Passed |
| Exact npm tarball | Passed for `codex-sdlc@0.4.0`; 160 packaged files, 126,263 bytes compressed, including the local configuration schema and workspace runtime |
| Exact tarball install | Passed in an isolated temporary prefix; CLI reported `0.4.0` and exposed `init`, `configure`, lifecycle, delivery, evidence, and finalization commands |
| Production and complete dependency audits | Passed: zero vulnerabilities |
| Local marketplace build | Passed |
| Portable Agent Plugins manifest | Passed against the referenced public 1.0.0 schema |
| Source, staged, and archived plugin packages | Passed the plugin-creator validator |
| Archived skill bundle | Passed the skill-creator validator for all six skills |
| Independent multi-repository delivery fixture | Passed: coordinator, backend, web, and docs Git repositories; repository-routed command evidence; checkout rebinding; remote mismatch rejection; duplicate mapping rejection |
| Repository-aware authority contract | Passed: assignment/task repository binding and scoped changed-file identity |

Native Linux and Windows qualification remains deferred by release decision. `codex-sdlc@0.4.0` is published on npm with provenance, the `v0.4.0` GitHub tag and release are public, and codex-sdlc 0.4.0 is published in the OpenAI Plugins Directory.