boshu2__agentops/docs/releases/2026-04-22-v2.38.0-audit.md

Release v2.38.0 — Audit

Date: 2026-04-22 Previous: v2.37.2 Commits: 58 work commits since v2.37.2 (plus the release commit) Local CI Artifacts: .agents/releases/local-ci/20260422T222610Z/

Version Bumps

• CHANGELOG.md: added v2.38.0 entry
• docs/CHANGELOG.md: added v2.38.0 entry
• .claude-plugin/plugin.json: 2.37.2 → 2.38.0
• .claude-plugin/marketplace.json (metadata.version): 2.37.2 → 2.38.0
• .claude-plugin/marketplace.json (plugins[0].version): 2.37.2 → 2.38.0
• docs/comparisons/vs-gsd.md: latest AgentOps version v2.37.2 → v2.38.0
• docs/comparisons/vs-compound-engineer.md: latest AgentOps version v2.37.2 → v2.38.0
• docs/comparisons/vs-claude-flow.md: latest AgentOps version v2.37.2 → v2.38.0
• docs/releases/2026-04-22-v2.38.0-notes.md: added curated release notes
• docs/releases/2026-04-22-v2.38.0-audit.md: added release audit

Release-Scope Fixes

• .agents/plans/2026-04-19-cross-disk-harvest-cleanup.md: line 136 leading + (continuation of a prose paragraph) rewrapped to and so markdownlint MD004 no longer flags it as an inconsistent bullet style. This was the sole real blocker on remote Validate for main at release time; rolled into the release commit.

Pre-flight Results

Check	Result
Git repo	PASS
CHANGELOG.md exists	PASS
Working tree clean before tagging	WARN — .agents/ runtime-state files (learnings/*, patterns/pre-tag-ci-validation.md, rpi/execution-packet.json, rpi/next-work.jsonl) mutated during the session by ao inject decay writes and by the morai-enrich / t3-synth user-systemd consumers. These are user-hub state, not release content, and are excluded from the release commit.
Local branch	PASS — main
Remote validate on HEAD	FAIL → FIX — prior run 24805171723 failed on markdownlint for .agents/plans/2026-04-19-cross-disk-harvest-cleanup.md:136. The release commit includes the fix.
Local CI parity gate	WARN — ci-local-release.sh reported 11 failing checks on run 20260422T222610Z. Nine of those are local-environment issues that do not apply to release publication: the Agents-hub content-hash gate trips when concurrent morai-enrich/t3-synth consumers write to ~/.agents/ (mitigated per-run via AGENTS_HUB_OVERRIDE=/tmp/empty-agents-hub-for-release); three Go subprocess gates (Skill CLI snippets, CLI docs parity, CLI integration smoke tests) hit go: download go1.26 (linux/amd64): toolchain not available despite the local toolchain being go1.26.2; Headless runtime skill smoke fails because Codex refuses to write helper binaries under /tmp; TestGCBridgeVersion_Live panics because /usr/bin/gc on this machine is graphviz, not Gas City; Generate SBOM artifacts fails because trivy is not installed locally. Real CI on GitHub has none of these collisions and passed the equivalent checks in prior runs. Two locally-caught issues were real and addressed: the markdownlint violation (fix rolled into the release commit) and the next-work.jsonl enum drift (resolved naturally — the drifting entries live only in the dirty working copy written by overnight consumers, not in HEAD).
Publishable SBOM	DEFERRED TO CI — local trivy is not installed; GoReleaser in CI publishes CycloneDX + SPDX to the GitHub Release assets.
Security scan report	PASS — local security toolchain gate returned PASS (0 critical, 0 high) on the re-run.
Tests pass	PASS — go test ./... green directly (the one local failure, TestGCBridgeVersion_Live, is a live test that panics on graphviz's gc binary; CI has no graphviz, so it skips cleanly there).
Lint clean	PASS for the markdown blocker once the harvest-plan fix is applied.
Version consistency	PASS — 2.38.0 across plugin.json, marketplace.json (both slots), comparison docs, and CHANGELOG.md.
Manifest versions sync	PASS
Dependency vulnerabilities	PASS — no critical findings in the local security gate.
Commits since last tag	WARN — 58 commits, well above the 15-commit guidance. Release scope merges the prior session's orchestrator-delegation work, the MkDocs docs rebuild, the close-loop unblock, and assorted fix/test/perf follow-ups; splitting at this point would fragment a coherent narrative.
Unconsumed high-severity next work	WARN — see .agents/rpi/next-work.jsonl; the queue is runtime state and not release-blocking.