release: Cockroach Browser 0.5.0-rc.1

.github/workflows/ci.yml

@@ -33,6 +33,7 @@ jobs:
       - run: npm ci --ignore-scripts
       - run: npm run typecheck
       - run: npm run build
+      - run: npm run verify:lightweight-proof
       - run: npm test
       - run: npm run check:package
       - run: npm run check:site

.github/workflows/release.yml

@@ -44,6 +44,15 @@ jobs:
         run: |
           node -e "const p=require('./package.json'); const tag=process.env.GITHUB_REF_NAME; if(tag !== 'v'+p.version) throw new Error('tag '+tag+' does not match package '+p.version)"
           git tag --points-at HEAD | grep -Fx "${GITHUB_REF_NAME}"
+          if [ "$(git cat-file -t "refs/tags/${GITHUB_REF_NAME}")" != "tag" ]; then
+            echo "::error::Release tags must be annotated tags"
+            exit 1
+          fi
+          default_branch="${{ github.event.repository.default_branch }}"
+          if ! git merge-base --is-ancestor "$GITHUB_SHA" "origin/$default_branch"; then
+            echo "::error::Release commit $GITHUB_SHA is not reachable from protected $default_branch"
+            exit 1
+          fi
       - run: npm ci --ignore-scripts
       - run: npx playwright install --with-deps chromium firefox webkit
       - run: xvfb-run -a npm run check
@@ -191,4 +200,18 @@ jobs:
               throw new Error(`GitHub release state mismatch: ${JSON.stringify(release)}`);
             }
           ' "$release_json" "${{ steps.channel.outputs.prerelease }}"
-          gh release upload "$GITHUB_REF_NAME" "$RELEASE_ASSET_DIR"/* --clobber
+          existing_assets="$(gh release view "$GITHUB_REF_NAME" --json assets --jq '.assets[].name')"
+          for asset in "$RELEASE_ASSET_DIR"/*; do
+            asset_name="$(basename "$asset")"
+            if grep -Fxq "$asset_name" <<<"$existing_assets"; then
+              download_dir="$(mktemp -d)"
+              gh release download "$GITHUB_REF_NAME" --pattern "$asset_name" --dir "$download_dir"
+              if ! cmp --silent "$asset" "$download_dir/$asset_name"; then
+                echo "::error::Existing release asset $asset_name has a different immutable identity"
+                exit 1
+              fi
+              echo "Verified existing immutable release asset $asset_name."
+            else
+              gh release upload "$GITHUB_REF_NAME" "$asset"
+            fi
+          done

CHANGELOG.md

@@ -6,6 +6,32 @@ The format follows Keep a Changelog and the project uses Semantic Versioning.
 
 ## [Unreleased]
 
+## [0.5.0-rc.1] - 2026-09-03
+
+### Added
+
+- explicit runtime-owned Obscura and Lightpanda CDP providers with loopback-only
+  startup, optional executable digest pinning, capability preflight, and owned
+  process-tree cleanup
+- bounded structured extraction for sanitized text, HTML, Markdown, links,
+  metadata, JSON-LD, and tables
+- continuous browser process-tree sampling and a fail-closed lightweight
+  conformance benchmark that reports browser and coordinator memory separately
+
+### Changed
+
+- browser capabilities now describe a routed union across full Playwright and
+  Puppeteer engines, protocol and device adapters, and experimental lightweight
+  engines instead of implying one engine implements every browser feature
+- public action and session schemas now track the runtime action and provider
+  contracts, including lightweight-provider opt-in and configuration limits
+
+### Verification
+
+- lightweight benchmark results include exact binary identity, machine data,
+  warm-up and measured runs, required DOM/JavaScript/form checks, continuous
+  peak RSS and CPU observations, and a non-zero exit when any target fails
+
 ## [0.4.1] - 2026-08-15
 
 ### Fixed
@@ -206,7 +232,8 @@ The format follows Keep a Changelog and the project uses Semantic Versioning.
 - deterministic capability catalog, JSON schemas, examples, Docker profile, and release checks
 - Node.js 22, 24, and 26 verification matrix
 
-[Unreleased]: https://github.com/AjnasNB/cockroach-browser/compare/v0.4.1...HEAD
+[Unreleased]: https://github.com/AjnasNB/cockroach-browser/compare/v0.5.0-rc.1...HEAD
+[0.5.0-rc.1]: https://github.com/AjnasNB/cockroach-browser/compare/v0.4.1...v0.5.0-rc.1
 [0.4.1]: https://github.com/AjnasNB/cockroach-browser/compare/v0.4.0...v0.4.1
 [0.4.0]: https://github.com/AjnasNB/cockroach-browser/compare/v0.4.0-rc.1...v0.4.0
 [0.4.0-rc.1]: https://github.com/AjnasNB/cockroach-browser/compare/v0.3.0...v0.4.0-rc.1

CITATION.cff

@@ -6,8 +6,8 @@ authors:
   - family-names: "N B"
     given-names: "Ajnas"
     alias: "AjnasNB"
-version: 0.4.1
-date-released: 2026-08-15
+version: 0.5.0-rc.1
+date-released: 2026-09-03
 license: AGPL-3.0-or-later
 repository-code: "https://github.com/AjnasNB/cockroach-browser"
 url: "https://cockroachbrowser.com"

Dockerfile

@@ -7,6 +7,7 @@ RUN npm ci --ignore-scripts
 
 COPY tsconfig.json tsconfig.build.json server.json ./
 COPY src ./src
+COPY schemas ./schemas
 RUN npm run build
 
 FROM node:24-bookworm-slim AS runtime