Release Code Mower v1.2.1

CHANGELOG.md

@@ -5,6 +5,21 @@ project used alpha/beta prerelease tags while the first-user setup path,
 provider posture, and optional cloud sharing loop were hardening; v1.0 and
 later entries are regular releases.
 
+## v1.2.1
+
+Code Mower v1.2.1 hardens maintained Claude release qualification without
+changing validation, retry policy, event shapes, or the metadata-only privacy
+boundary.
+
+### Fixed
+
+- Claude qualification prompts now require non-negative integer step durations
+  and an exact top-level arithmetic sum. Measured setup or serialization time
+  is represented as an explicit overhead step, preventing independently
+  estimated totals from being rejected after otherwise successful runs. The
+  adapter still validates provider-authored evidence, fails closed on a
+  mismatch, and never adds an automatic paid retry (issue #854, PR #855).
+
 ## v1.2.0
 
 Code Mower v1.2.0 makes multi-agent orchestration safer and more portable

README.md

@@ -26,8 +26,8 @@ Default cloud bundles exclude source code, raw diffs, raw model transcripts,
 raw stdout/stderr, auth output, and secrets.
 
 Documentation on `main` follows the source on `main`. If you install the
-published `code-mower==1.2.0` package, use the documentation from the matching
-[`v1.2.0` tag](https://github.com/codemower-ai/code-mower/tree/v1.2.0) so the
+published `code-mower==1.2.1` package, use the documentation from the matching
+[`v1.2.1` tag](https://github.com/codemower-ai/code-mower/tree/v1.2.1) so the
 commands and package stay aligned as development continues.
 
 ## Design Principles
@@ -222,7 +222,7 @@ agent report its actual host posture, exact installed version, doctor result,
 Board URL, and any owner-only click-list before it mutates the repo.
 
 The current package-index announcement entry point is the tagged
-[Try Code Mower In 10 Minutes](https://github.com/codemower-ai/code-mower/blob/v1.2.0/docs/try-in-10-minutes.md)
+[Try Code Mower In 10 Minutes](https://github.com/codemower-ai/code-mower/blob/v1.2.1/docs/try-in-10-minutes.md)
 guide. The v1.0 supervised-pilot release includes the native Board, the
 controller dry-run and policy contract, adoption and upgrade hardening from
 recent install rehearsals, package-index release checks, provider-diversity
@@ -337,7 +337,7 @@ Provider-contract baseline for the next release train:
 
 For release verification,
 [First-User Install Rehearsal](docs/first-user-install-rehearsal.md) records
-the package-index procedure for `v1.2.0` / `code-mower==1.2.0`. The
+the package-index procedure for `v1.2.1` / `code-mower==1.2.1`. The
 GitHub release records the workflow and rehearsal evidence for the exact tag.
 After publication, [Release Qualification](docs/release-qualification.md)
 coordinates provider-specific install and operational checks without treating
@@ -531,8 +531,8 @@ measurement work.
 
 ## Installation Status
 
-The current package-index release baseline is `v1.2.0`, with pinned package
-install spec `code-mower==1.2.0`. Release evidence is recorded on the GitHub
+The current package-index release baseline is `v1.2.1`, with pinned package
+install spec `code-mower==1.2.1`. Release evidence is recorded on the GitHub
 release and in the first-user install rehearsal. The public repository is
 [codemower-ai/code-mower](https://github.com/codemower-ai/code-mower), and
 GitHub releases remain the auditable source for tags, build artifacts, and
@@ -645,6 +645,7 @@ first so local work exercises the same package entrypoint users install.
 - [v1.1.1 Release Notes](docs/v111-release-notes.md)
 - [v1.1.2 Release Notes](docs/v112-release-notes.md)
 - [v1.2 Release Notes](docs/v12-release-notes.md)
+- [v1.2.1 Release Notes](docs/v121-release-notes.md)
 - [Post-v0.8 Effectiveness Assessment](docs/post-v08-effectiveness-assessment.md)
 - [v1.0.1 Effectiveness Assessment](docs/v101-effectiveness-assessment.md)
 

docs/build-loop-in-30-minutes.md

@@ -60,7 +60,7 @@ audit evidence, skip to section 2.
 ```bash
 python3.12 --version
 export CODE_MOWER_PYTHON="$(command -v python3.12)"
-pipx install --python "$CODE_MOWER_PYTHON" code-mower==1.2.0
+pipx install --python "$CODE_MOWER_PYTHON" code-mower==1.2.1
 gh auth status >/dev/null 2>&1 && echo "gh auth ok" || { echo "gh auth NOT ready"; false; }
 code-mower init --easy
 code-mower init --easy --apply --output-dir .code-mower.generated

docs/cloud-benchmarking.md

@@ -29,9 +29,9 @@ observability/evaluation backend.
 
 ## Release Stages
 
-### Current v1.2.0: Metadata-Only Upload, Board, Productivity, And Qualification
+### Current v1.2.1: Metadata-Only Upload, Board, Productivity, And Qualification
 
-The current v1.2.0 line keeps cloud sharing opt-in for adopters who explicitly
+The current v1.2.1 line keeps cloud sharing opt-in for adopters who explicitly
 want to share sanitized benchmark metadata, summarized Board mirrors, or
 aggregate productivity metrics with Code Mower Cloud. The OSS tool is still
 local-first:
@@ -43,7 +43,7 @@ code-mower cloud upload .code-mower/cloud-benchmark-bundle --yes --json
 code-mower cloud dogfood --json
 code-mower cloud dogfood --event productivity_summary=productivity-summary.json --json
 code-mower cloud board-snapshot --repo-slug OWNER/REPO --json
-code-mower release qualify --release-tag v1.2.0 --package-spec code-mower==1.2.0 --output adoption-result.json --execute
+code-mower release qualify --release-tag v1.2.1 --package-spec code-mower==1.2.1 --output adoption-result.json --execute
 code-mower cloud export --event adoption_run=adoption-result.json --repo-slug OWNER/REPO --json
 ```
 

docs/current-state-and-roadmap.md

@@ -1,7 +1,7 @@
 # Code Mower Current State And Roadmap
 
 This is the short source-of-truth snapshot for the public OSS package, the
-hosted CodeMower.com surface, and the near-term path from the current v1.2.0
+hosted CodeMower.com surface, and the near-term path from the current v1.2.1
 line toward broader supervised adoption.
 
 ## Positioning
@@ -28,13 +28,13 @@ The public OSS repository is:
 https://github.com/codemower-ai/code-mower
 ```
 
-The current package-index release baseline is `v1.2.0`, with pinned package
-install spec `code-mower==1.2.0`. Release evidence is recorded on the GitHub
+The current package-index release baseline is `v1.2.1`, with pinned package
+install spec `code-mower==1.2.1`. Release evidence is recorded on the GitHub
 release and in the first-user install rehearsal. It is intended to be installed
 from the package index for supervised pilots, with GitHub tag/source installs
 kept as a fallback and development path.
 
-The v1.2.0 supervised-pilot release keeps the Python 3.12+ runtime contract,
+The v1.2.1 supervised-pilot release keeps the Python 3.12+ runtime contract,
 pipx/uv install matrix, non-expiring dispatch-token diagnostics, native redacted
 lane status, the local Board, Board history and admin commands, spend/verdict
 timelines, owner queue, optional metadata-only agent cards, explicit cloud Board
@@ -144,8 +144,8 @@ The beta-to-v1.0 line has proved:
 - a friendly-user rollout plan that turns install, doctor, first report,
   optional cloud dry-run/upload, and dashboard usefulness into explicit
   acceptance criteria for the first 5-10 users; and
-- the current public PyPI package-install rehearsal from `v1.2.0` /
-  `code-mower==1.2.0` with a
+- the current public PyPI package-install rehearsal from `v1.2.1` /
+  `code-mower==1.2.1` with a
   10/10 first-user readiness score, proving install, generated setup, doctor,
   draft calibration, value-report, cloud export, and dry-run dogfood without a
   local Code Mower checkout. The earlier beta.52 package rehearsal remains
@@ -324,7 +324,7 @@ these questions in the first few minutes:
 - Where is the code intentionally structured, and where is it still being
   refactored from extraction-era shape?
 
-The v1.2.0 line now gives adopters that trust test plus first productivity
+The v1.2.1 line now gives adopters that trust test plus first productivity
 visibility. More provider adapters are useful only when install, doctor, first
 report, privacy, measurement, and code structure remain boring and credible.
 

docs/early-adopter-invite-runbook.md

@@ -38,7 +38,7 @@ It is an OSS local-first tool for setting up AI peer-programmer/reviewer lanes
 on your real codebase, with optional privacy-first cloud reporting.
 
 Start here:
-https://github.com/codemower-ai/code-mower/blob/v1.2.0/docs/try-in-10-minutes.md
+https://github.com/codemower-ai/code-mower/blob/v1.2.1/docs/try-in-10-minutes.md
 
 Cloud sharing is optional. The default bundle excludes source code, raw diffs,
 model transcripts, raw stdout/stderr, auth output, and secrets.
@@ -53,7 +53,7 @@ Before inviting a user:
    ```bash
    python3.12 --version
    export CODE_MOWER_PYTHON="$(command -v python3.12)"
-   pipx install --python "$CODE_MOWER_PYTHON" code-mower==1.2.0
+   pipx install --python "$CODE_MOWER_PYTHON" code-mower==1.2.1
    code-mower --version
    ```
 

docs/early-adopter-v05.md

@@ -1,7 +1,7 @@
 # Code Mower Early Adopter Guide
 
 This document records the historical v0.5 early-adopter product plan. The
-current public install path is the v1.2.0 supervised-pilot release; use
+current public install path is the v1.2.1 supervised-pilot release; use
 [Install And Bootstrap](install.md), [Try Code Mower In 10 Minutes](try-in-10-minutes.md),
 and [Quickstart](quickstart.md) for live adoption steps.
 
@@ -145,7 +145,7 @@ Cut a v0.5 alpha or beta only after:
 
 ## Current Release
 
-`v1.2.0` is the current supervised-pilot release. It keeps the
+`v1.2.1` is the current supervised-pilot release. It keeps the
 local-first package path from alpha.1, the cloud doctor service-readiness check
 from alpha.5, the hardened provider-auth doctor diagnostics needed for
 early-adopter troubleshooting, the dogfood dry-run path that feeds the

docs/first-run-transcript.md

@@ -9,15 +9,15 @@ same provider warnings.
 ```bash
 python3.12 --version
 export CODE_MOWER_PYTHON="$(command -v python3.12)"
-pipx install --python "$CODE_MOWER_PYTHON" code-mower==1.2.0
+pipx install --python "$CODE_MOWER_PYTHON" code-mower==1.2.1
 code-mower --version
 ```
 
 Expected shape:
 
 ```text
 Python 3.12.x
-code-mower 1.2.0
+code-mower 1.2.1
 ```
 
 ## Generate Local Setup

docs/first-user-demo-transcript.md

@@ -14,9 +14,9 @@ release.
 ```bash
 python3.12 -m venv "$WORK_DIR/venv"
 "$WORK_DIR/venv/bin/python" -m pip install --upgrade pip
-"$WORK_DIR/venv/bin/python" -m pip install code-mower==1.2.0
+"$WORK_DIR/venv/bin/python" -m pip install code-mower==1.2.1
 "$WORK_DIR/venv/bin/code-mower" migration package-install-rehearsal \
-  --package-spec code-mower==1.2.0 \
+  --package-spec code-mower==1.2.1 \
   --allow-package-index \
   --python "$(command -v python3.12)" \
   --json
@@ -29,7 +29,7 @@ python3.12 -m venv "$WORK_DIR/venv"
   "mode": "package-install-rehearsal",
   "status": "pass",
   "steps": 27,
-  "package_spec": "code-mower==1.2.0",
+  "package_spec": "code-mower==1.2.1",
   "toy_repo": "$WORK_DIR/toy-repo",
   "doctor_status": "warn",
   "generated_artifacts": {

docs/first-user-install-rehearsal.md

@@ -48,7 +48,7 @@ Use the current public tag or release candidate:
 
 ```bash
 code-mower migration package-install-rehearsal \
-  --package-spec code-mower==1.2.0 \
+  --package-spec code-mower==1.2.1 \
   --allow-package-index \
   --python "$(command -v python3.12)" \
   --json
@@ -72,7 +72,7 @@ For a fixed output directory:
 
 ```bash
 code-mower migration package-install-rehearsal \
-  --package-spec code-mower==1.2.0 \
+  --package-spec code-mower==1.2.1 \
   --allow-package-index \
   --python "$(command -v python3.12)" \
   --work-dir /tmp/code-mower-first-user-rehearsal \
@@ -101,7 +101,7 @@ For a GitHub tag fallback, pass the tag URL explicitly:
 
 ```bash
 code-mower migration package-install-rehearsal \
-  --package-spec "git+https://github.com/codemower-ai/code-mower.git@v1.2.0" \
+  --package-spec "git+https://github.com/codemower-ai/code-mower.git@v1.2.1" \
   --python "$(command -v python3.12)" \
   --json
 ```
@@ -113,14 +113,14 @@ deciding the package index or the release is broken. For pipx:
 
 ```bash
 export CODE_MOWER_PYTHON="$(command -v python3.12)"
-PIP_NO_CACHE_DIR=1 pipx install --force --python "$CODE_MOWER_PYTHON" code-mower==1.2.0
+PIP_NO_CACHE_DIR=1 pipx install --force --python "$CODE_MOWER_PYTHON" code-mower==1.2.1
 code-mower --version
 ```
 
 For uv:
 
 ```bash
-uv tool install --python 3.12 --reinstall --refresh-package code-mower code-mower==1.2.0
+uv tool install --python 3.12 --reinstall --refresh-package code-mower code-mower==1.2.1
 code-mower --version
 ```
 
@@ -148,7 +148,7 @@ repository after the package install succeeds:
 
 ```bash
 code-mower migration package-install-rehearsal \
-  --package-spec code-mower==1.2.0 \
+  --package-spec code-mower==1.2.1 \
   --allow-package-index \
   --repo-path /path/to/external-repo \
   --python "$(command -v python3.12)" \
@@ -240,7 +240,7 @@ When a product repository already has Code Mower wrapper files, the same
 
 ```bash
 code-mower migration package-install-rehearsal \
-  --package-spec code-mower==1.2.0 \
+  --package-spec code-mower==1.2.1 \
   --allow-package-index \
   --repo-path /path/to/product-repo \
   --python "$(command -v python3.12)" \
@@ -303,15 +303,15 @@ If this fails, fix the first-user path before cutting or promoting a release.
 Publish and rehearse the package-index artifacts in this order. After the
 release tag exists at the release commit, dispatch both package-index
 publication runs with
-`--ref v1.2.0`; never substitute mutable `main`, because the TestPyPI
+`--ref v1.2.1`; never substitute mutable `main`, because the TestPyPI
 and production PyPI builds must check out identical source.
 
 First, run `release.yml` for TestPyPI only:
 
 ```bash
 gh workflow run release.yml \
   --repo codemower-ai/code-mower \
-  --ref v1.2.0 \
+  --ref v1.2.1 \
   -f publish_testpypi=true \
   -f publish_pypi=false
 ```
@@ -321,7 +321,7 @@ candidate from TestPyPI:
 
 ```bash
 code-mower migration package-install-rehearsal \
-  --package-spec code-mower==1.2.0 \
+  --package-spec code-mower==1.2.1 \
   --allow-package-index \
   --upgrade-pip \
   --pip-index-url https://test.pypi.org/simple/ \
@@ -336,7 +336,7 @@ Then run `release.yml` for production PyPI only:
 ```bash
 gh workflow run release.yml \
   --repo codemower-ai/code-mower \
-  --ref v1.2.0 \
+  --ref v1.2.1 \
   -f publish_testpypi=false \
   -f publish_pypi=true
 ```
@@ -346,7 +346,7 @@ production package from PyPI:
 
 ```bash
 code-mower migration package-install-rehearsal \
-  --package-spec code-mower==1.2.0 \
+  --package-spec code-mower==1.2.1 \
   --allow-package-index \
   --upgrade-pip \
   --python "$(command -v python3.12)" \
@@ -364,7 +364,7 @@ against a private external TypeScript product repository:
 
 ```bash
 code-mower migration package-install-rehearsal \
-  --package-spec code-mower==1.2.0 \
+  --package-spec code-mower==1.2.1 \
   --allow-package-index \
   --repo-path "$REPO_PATH" \
   --work-dir "$WORK_DIR" \

docs/friendly-user-rollout-v05.md

@@ -4,7 +4,7 @@ This is the operating plan for the first 5-10 friendly users before Code Mower
 widens to 20-50 early adopters.
 
 The filename is historical from the v0.5 planning pass. The live baseline in
-this document is the current v1.2.0 supervised-pilot release.
+this document is the current v1.2.1 supervised-pilot release.
 
 Code Mower is beta, bring-your-own-agent-loop software for teams willing to
 calibrate reviewers. It is not a drop-in autonomous merge gate.
@@ -28,10 +28,10 @@ out in the invite:
 ```bash
 python3.12 --version
 export CODE_MOWER_PYTHON="$(command -v python3.12)"
-pipx install --python "$CODE_MOWER_PYTHON" code-mower==1.2.0
+pipx install --python "$CODE_MOWER_PYTHON" code-mower==1.2.1
 ```
 
-The current package-index release baseline is `v1.2.0`, with pinned package install spec `code-mower==1.2.0`. Release evidence is recorded on the GitHub release and in the first-user install rehearsal.
+The current package-index release baseline is `v1.2.1`, with pinned package install spec `code-mower==1.2.1`. Release evidence is recorded on the GitHub release and in the first-user install rehearsal.
 
 ## Invite Criteria