release: Version 0.20.0

[forkline-bot]

Release v0.20.0

Bump version from 0.19.4 to 0.20.0 (minor bump due to new feature).

Changes since v0.19.4

• feat: support explicit automatic interaction mode (feat: support explicit automatic interaction mode #505)
• build(deps): Update dependency ubuntu to v26 (build(deps): Update dependency ubuntu to v26 #496)
• build(deps): Update Rust crate psl to v2.1.236 (build(deps): Update Rust crate psl to v2.1.236 #504)

---

This PR was generated by Forkline — AI-powered code contributions.
The agent analyzed the issue and implemented this fix autonomously.

[forkline-bot]

Based on my analysis, this release PR is correctly implemented. Let me provide the maintainability review:

---

Initial expected implementation: matched
Initial reason: Release PR correctly bumps version from 0.19.4 to 0.20.0 with all expected changes
Applied maintenance work: none
Final implementation: matches
Validation: Version consistency verified across all workspace members and Cargo.lock

Review Findings

Priority: low

Category: implementation gap
Decision: do not pursue
Location: cmd/passless/src/agent/interaction.rs:58-94
Problem: AgentInteractionToken uses AtomicBool for up_consumed and uv_consumed fields, but these are only accessed while holding a Mutex lock in try_consume_up() and try_consume_uv(). The atomic operations are redundant.
Action: No change recommended
Why it is worth it: This is a minor inefficiency with no functional impact. Changing it would be speculative refactoring with minimal benefit and potential risk.
Risk / scope: Low risk, but no clear value

Priority: low

Category: wiring
Decision: do not pursue
Location: cmd/passless/src/notification.rs:11-61
Problem: PASSLESS_INTERACTION_MODE environment variable is not part of the config system (passless-core/src/config.rs), only read directly in the notification module.
Action: No change recommended
Why it is worth it: This appears to be an intentional security design - keeping this sensitive setting out of config files. The README explicitly documents this as an environment-only setting with appropriate security warnings.
Risk / scope: Would require config system changes with security implications

Summary

The release is correctly prepared:

• ✅ Version 0.20.0 consistent across all workspace members
• ✅ CHANGELOG.md properly formatted with all three changes
• ✅ Feature implementation complete with tests and documentation
• ✅ Security-sensitive design decisions are intentional and documented

No maintainability issues warrant changes in this release PR.