[cursor]

Release PR: v0.9.1 (rolling candidate)

Merge only with --subject "Release OpenEnv 0.9.1 (#<this PR>)" and an exact-head guard. Thursday's release run decides whether to publish.

Candidate state (Monday 2026-10-19 run, base main f2b00027):

• Version lines only: pyproject.toml, envs/grid_world_env/uv.lock, tests/validation_runtime/uv.lock (0.9.1.dev0 -> 0.9.1). uv build and twine check pass.
• Changes on main since v0.9.0 (12 commits): one README line (FineEnvs link, Link FineEnvs from the README, the Learn index and Community Environments #1433), GitHub Actions bumps (Bump astral-sh/setup-uv from 10.2.0 to 10.3.0 #1421 Bump actions/upload-artifact from 7.0.1 to 7.0.2 #1422 Bump huggingface/doc-builder/.github/workflows/build_main_documentation.yml from 9fc8a41d7729c424fdb2192f2f85ff63102ec9a3 to 90ddd199e07144a13408c523680c76987343c95f #1423 Bump actions/download-artifact from 8.0.1 to 8.0.2 #1424 Bump huggingface/doc-builder/.github/workflows/upload_pr_documentation.yml from 9fc8a41d7729c424fdb2192f2f85ff63102ec9a3 to 90ddd199e07144a13408c523680c76987343c95f #1425, plus the pin-comment PRs fix(ci): pin GitHub Actions to commit SHAs (#1422) #1426 fix(ci): pin GitHub Actions to commit SHAs (#1424) #1427 folded into Bump actions/upload-artifact from 7.0.1 to 7.0.2 #1422/Bump actions/download-artifact from 8.0.1 to 8.0.2 #1424), and lockfile-only Dependabot bumps (chore(deps): bump pyjwt from 2.14.0 to 2.15.0 in /tests/validation_runtime #1335 chore(deps): bump fsspec from 2026.3.0 to 2026.6.0 in /envs/textarena_env #1344 chore(deps): bump fsspec from 2026.3.0 to 2026.6.0 in /envs/websearch_env #1336 chore(deps): bump gradio from 6.12.0 to 6.16.0 in /envs/reasoning_gym_env #1317 chore(deps): bump datasets from 4.8.5 to 5.0.1 in /envs/openapp_env #1316). No src/ change, so the wheel differs from 0.9.0 only in the README (PyPI long description).
• Publish workflows now use actions/upload-artifact 7.0.2 and actions/download-artifact 8.0.2. The Wednesday TestPyPI run is the first end-to-end exercise of them.

Outstanding blockers / decisions (not in this release unless merged and green):

• Fork PRs approved by burtenshaw but needing a maintainer "Approve and run" for CI: fix(client): stop provider when async factory is cancelled during connect #1309 (12c6ecc1), fix(cli): escape [harbor] in harbor help so the install hint shows #1315 (f9aad134).
• No wheel-affecting change has landed yet. If none lands by Thursday, the run will skip the release or ask for a decision on a README-only 0.9.1.
• chore(deps): update fastmcp requirement from <4.0.0,>=3.0.0 to >=3.0.0,<5.0.0 #1331 (FastMCP 4) is excluded: FastMCP 4 breaks session persistence and needs a migration.

Release checklist

• pyproject.toml version changed from 0.9.1.dev0 to 0.9.1
• hf-staging/ is not in the diff
• CI gates green on the exact head
• TestPyPI validation (testpypi/0.9.1 push trigger)
• Echo reset/step smoke test
• Tag v0.9.1, publish-pypi.yml, GitHub release, fresh PyPI install verified
• Next dev bump PR (0.9.2.dev0)

Recorded state: candidate head 534002cd, no release lock, no Slack message sent yet.

  

---

Note

Low Risk
Version and lockfile metadata only; no runtime or API changes in the diff.

Overview
Bumps the openenv package version from 0.9.1.dev0 to 0.10.0 for release.

Updates pyproject.toml and syncs the editable openenv entry in envs/grid_world_env/uv.lock and tests/validation_runtime/uv.lock. No application or library code changes in this diff.

^{Reviewed by Cursor Bugbot for commit 027dab0. Bugbot is set up for automated code reviews on this repo. Configure here.}

[cursor]

Release state (Wed 2026-10-21): candidate is 0.10.0 (not 0.9.1), head 027dab0c on exact main c696fe24; diff vs main = 3 version lines. CI 13/13 green, TestPyPI 0.10.0.dev221 byte-identical to the local build (207 members), clean wheel install + Echo reset/step OK. Minor because openenv validate gained network-policy checks and no-network mode. Title/body still say 0.9.1 (not editable by the integration token); merge with --subject "Release OpenEnv 0.10.0 (#1454)".

  

_{Sent by Cursor Automation: Release}

[cursor]

Cursor Bugbot has reviewed your changes using default effort and found 1 potential issue.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

Want higher recall? High effort reviews run extra passes and find more bugs. A team admin can switch effort levels in the Cursor dashboard.

^{Reviewed by Cursor Bugbot for commit 027dab0. Configure here.}

[cursor]

Incorrect release version number

High Severity

The package version is set to 0.10.0 instead of 0.9.1. Tagging v0.9.1 as planned would fail the publish workflow, and tagging v0.10.0 would skip 0.9.1 on PyPI and drive the post-release bump to 0.10.1.dev0.

Additional Locations (2)

• envs/grid_world_env/uv.lock#L1227-L1228
• tests/validation_runtime/uv.lock#L915-L916

 

^{Reviewed by Cursor Bugbot for commit 027dab0. Configure here.}

[cursor]

Alignment Review Report

Note: this PR diff is version-bump-only (pyproject.toml, envs/grid_world_env/uv.lock, tests/validation_runtime/uv.lock, 0.9.1.dev0 -> 0.10.0); the feature code it releases already merged to main separately. Reviewing for release-process alignment.

Automated Checks

• Lint: PASS for this diff — the 3 changed lines are version strings only. ruff format --check over envs/ does flag 47 pre-existing unformatted files (e.g. envs/wildfire_env/README.md, envs/terminus_env/server/terminus_env_environment.py), but none are touched by this diff and CI's lint job (scoped to src/+tests/) passed green — pre-existing debt, not introduced here.
• Debug code: CLEAN — no debugger/print/TODO additions in this diff. check-debug.sh hits are all pre-existing CLI console.print/print output (legitimate CLI UX, e.g. src/openenv/cli/commands/harbor.py) and pre-existing TODO markers, none in the changed files.
• Both uv.lock files that track openenv via local editable/directory source were updated consistently with pyproject.toml; the ~35 other env lockfiles pin openenv from PyPI at 0.3.1 and correctly weren't touched (expected — they bump independently when they adopt a new published release). CI (13/13 checks) is green on the merged head.

Open RFCs Context

• RFC 008 — Environment Auto-Validation (Status: In Review, @zkwentz): directly relevant. The merge commit (Release OpenEnv 0.10.0: new feature (network policy validation) makes this a minor release) attributes the MINOR bump to openenv validate's new network-policy checks and no-network mode — exactly the runtime.network_policy check and declared network-policy enforcement (public/no-network/allowlist) specified in RFC 008's "Providers" and "Level 2 execution amendment" sections. That feature (commit b52b1062, "feat: validate network policies") landed on main before this release branch was cut.
• Other RFCs (000, 001, 002, 003, 005, 006, 012) are In Review; 010, 011 are Draft. None of their areas (abstractions, MCP, rubrics, harness interception, capture providers, token-world-model, catalog discovery) intersect this diff.

Tier 1: Fixes Required

None. The diff is mechanically clean (3 version-string lines, internally consistent, CI green).

• (non-blocking, not actionable by this automation) PR title/body still read "Release OpenEnv 0.9.1" while the shipped version is 0.10.0 — already noted in a prior automation comment as not editable via the integration token. Flagging only so the discrepancy doesn't get missed in release history/changelog generation.

Tier 2: Alignment Discussion

Principle Conflicts

None identified. No API, client/server boundary, or reward-computation changes in this diff — pure version metadata.

RFC Conflicts

ALIGNMENT FLAG: Public MINOR release ships an RFC-008-governed feature while RFC 008 is still "In Review"

• Principle/RFC at stake: RFC 008 (Environment Auto-Validation) — specifically the "Providers" network-policy section and the "Level 2 execution amendment" that define runtime.network_policy / no-network semantics; also INVARIANTS.md's Breaking Change Policy (MINOR = "new features, backward compatible").
• The concern: This release's own commit message credits the minor bump to the network-policy validation feature, i.e. the project is treating an RFC-008 capability as release-ready and public, while RFC 008 itself is still marked "In Review" rather than "Accepted"/"Implemented". That's not a bug in this PR, but it's the kind of RFC-status/shipped-reality drift the review process exists to surface: either RFC 008 should be moved to Accepted/Implemented now that a piece of it is in a numbered public release, or the release notes should be scoped/caveated to reflect that the design is still under discussion (e.g. the allowlist/no-network provider semantics in the amendment are still being refined). Worth a quick sync so RFC status stays truthful for future contributors reading it as "settled" vs. "released".
• Suggested reviewer: @zkwentz (RFC 008 author) and @Darktex (author of the semver/Breaking Change Policy section in INVARIANTS.md)

Summary

• 0 mechanical issues to fix (diff is clean; 1 pre-existing, unrelated PR-metadata nit noted for visibility only)
• 0 principle-conflict points for human review
• 1 RFC-status/release-scope conflict to discuss (RFC 008 vs. this release's own framing)

  

_{Sent by Cursor Automation: Pre-review}