Release OpenEnv 0.4.2

[cursor]

Release PR: v0.4.2

Planned release: Thursday, September 10, 2026 at 10:00 Europe/Brussels (08:00 UTC).

Candidate head: 81c0207c9c2dd4d7852f3683175ab57fc951aa86

Release notes

• Environment client ergonomics: synchronous bootstrap constructors and public base_url support (#959).
• OpenCode/HF Sandbox reliability: Hugging Face Sandbox support plus setup, cleanup, timeout, and retry fixes (#998, #1005, #1009, #1023).
• New environments: Pelican SVG and Pi agent environments (#1019, #999).
• TerminalBench correctness and isolation: canonical Docker scoring, real timeouts, verifier isolation, and missing-reward error handling (#965, #972, #1012, #1025).
• Examples and docs: Tinker ECHO, OpenCode + AsyncGRPO tutorial, current TRL paths, and Task API documentation (#971, #1028, #1086, #1094).

Full candidate comparison: v0.4.1...81c0207

Release-maintenance changes in this PR

• Change 0.4.2.dev0 to stable 0.4.2.
• Serialize TestPyPI and production PyPI publication with one non-cancelling GitHub Actions concurrency group.
• Make the push progress test robust to ANSI output when validation runs in a TTY.

Outstanding blockers

• Maintainer review is required for the release-workflow concurrency policy change.
• Dispatch and pass publish-testpypi.yml from this exact branch using a unique 0.4.2 pre/dev suffix.
• Reconcile main immediately before merge; rerun all required checks if the head or base changes.

Excluded from this candidate: #1119, because FastMCP 4.0.3 breaks MCP session persistence on Python 3.11 and 3.12. Draft dependency aggregates #1123 and #1124 remain outside the candidate pending readiness/review.

Release Checklist

Before opening this PR

• pyproject.toml version changed from 0.4.2.dev0 → 0.4.2
• hf-staging/ is NOT in this PR's diff
• No print(), breakpoint(), or TODO added to release-critical paths
• Release notes include user-facing changes and linked PRs

CI gates (must be green before merge)

• test passes on Python 3.11
• test passes on Python 3.12
• lint passes (usort + ruff)
• Package CI builds, checks, and smoke-tests wheel/sdist installs

Local candidate validation:

• 1518 passed, 98 skipped, 36 deselected
• wheel and sdist build, Twine metadata check, isolated installs, import/version checks, and openenv --help: passed
• real Echo server reset/list-tools/step smoke: passed

TestPyPI validation (before merging)

• Manual dispatch of publish-testpypi.yml from this branch
• TestPyPI workflow published a unique pre/dev version
• Exact TestPyPI package installation verified

Post-merge steps (author only)

• Tag v0.4.2 pushed on the exact validated main commit
• publish-pypi.yml completed successfully from the tag
• GitHub Release was created by the successful PyPI publish workflow
• Fresh pip install openenv==0.4.2 from production PyPI verified
• Post-release 0.4.3.dev0 PR created and processed

  

---

Note

Low Risk
Changes are limited to version metadata, publish-workflow serialization, and a test assertion fix; no runtime product logic is modified in this diff.

Overview
Prepares the 0.4.2 stable release by bumping pyproject.toml from 0.4.2.dev0 to 0.4.2, aligning the package version with the planned tag-driven PyPI publish.

Both publish-pypi.yml and publish-testpypi.yml now share a GitHub Actions concurrency group (openenv-package-publish) with cancel-in-progress: false, so TestPyPI and production publish runs queue instead of overlapping.

The --count push CLI test strips ANSI from captured output before checking progress lines like [1/3], so assertions stay reliable when Rich/TTY coloring is enabled.

^{Reviewed by Cursor Bugbot for commit 81c0207. Bugbot is set up for automated code reviews on this repo. Configure here.}

[cursor]

Release-state correction: the authoritative candidate head is 81c0207cd5aa30eea620ae5287391f4809c8236a. The expanded SHA in the PR description is incorrect; all CI, TestPyPI, merge, and tag guards must use the actual head above (or a subsequently reconciled head after an explicit update). The candidate remains a draft until maintainer review and TestPyPI validation complete.

View PR

  

_{Sent by Cursor Automation: Release}

[cursor]

Additional release gates from the full v0.4.1...81c0207cd5aa30eea620ae5287391f4809c8236a audit:

1. #959 changed the public EnvClient.from_env / from_docker_image return contract to _BootstrapResult without an RFC. Runtime await compatibility is preserved, so the release recommendation remains v0.4.2, but the core-API policy requires explicit maintainer acknowledgement before tagging.
2. #999 establishes an architecture/security-boundary precedent: pi_env exposes an episode-level run_rollout MCP tool and accepts an API key through that MCP call. This is already on main and cannot be omitted from the release by notes; approve the environment-specific pattern or fix/revert it through normal review before release.
3. #1108 reverted all RFC 008 implementation slices, while the RFC remains In Review. Recommendation: confirm whether the RFC is deferred versus still active and record that status separately; the candidate notes already state that the reverted validation stack is not shipped.

@Darktex has been requested for these alignment decisions. The candidate remains draft; unresolved items delay Thursday's tag.

View PR

  

_{Sent by Cursor Automation: Release}

[cursor]

Alignment Review Report

Release PR: 0.4.2.dev0 → 0.4.2, plus serializing the two package-publish workflows and normalizing ANSI in one push CLI test. Reviewed the 4-file diff (git diff ced9d73…81c0207) against the two-tier model. Verdict: no Tier-1 fixes, no principle/RFC conflicts — a clean, well-formed release PR.

Automated Checks

• Lint: PASS (for this PR's files). ruff check src/ tests/ all-pass; the only lint-scoped changed file, tests/test_cli/test_push.py, passes ruff format / ruff check / usort standalone. Pre-existing and not in this diff: ruff format --check src/ tests/ flags src/openenv/core/README.md + src/openenv/cli/templates/openenv_env/README.md; usort check flags tests/envs/test_grid_world.py + tests/envs/test_julia_env.py (documented in AGENTS.md); .claude/hooks/lint.sh exits 1 only on ~23 pre-existing envs/** files. None are attributable to this change.
• Debug code: CLEAN. check-debug.sh only surfaces pre-existing src/ prints/TODOs; this PR changes no src/ files.
• Tests: tests/test_cli/test_push.py → 52 passed locally, including the modified test_push_count_deploys_multiple_spaces.

Open RFCs Context

Open/Draft RFCs on main: 000/001/002/003 (In Review), 004 (Rubrics), 005 (Agentic Harnesses, In Review), 008 (Env Auto-Validation, In Review), 010 (Draft). None governs packaging / PyPI / CI / release / versioning → no RFC surface touched.

Tier 1: Fixes Required

None.

Tier 2: Alignment Discussion

Principle Conflicts

None identified. No Gymnasium API signature, reward computation, client↔server import, or MCP/WebSocket surface is touched. Publishing uses a PyPI Trusted Publisher (OIDC id-token: write, persist-credentials: false) with no secrets added or logged — consistent with INVARIANTS "No credential exposure".

RFC Conflicts

None identified.

Notes (non-blocking, verified)

1. Version bump is release-consistent. pyproject.toml 0.4.2 matches the publish-pypi.yml gate (PYPROJECT_VERSION == tag), so tagging v0.4.2 on a main-reachable commit passes validation; openenv.__version__ is derived from installed metadata, so the wheel smoke-test (__version__ == installed) holds. Last tag is v0.4.1; no in-repo CHANGELOG (the GitHub Release step uses --generate-notes). Reminder: the actual publish is a separate maintainer step — merge, then push the v0.4.2 tag on main.
2. Shared concurrency group is correct. Both publishers use group: openenv-package-publish + cancel-in-progress: false, so a manual TestPyPI dispatch and an automatic PyPI tag-release serialize instead of racing, and neither cancels the other mid-publish. package-ci.yml is a build/smoke-test job (no upload), so correctly left out of the group. Intentional coupling worth knowing: a queued/running TestPyPI dispatch will delay a PyPI tag release, and vice versa — which is the point of "serialize".
3. ANSI test change is hardening, not masking a regression. push.py emits Rich markup ([bold cyan][{i}/{count}] …, [bold green]✓ All {count} instances deployed! at push.py:837/:854); the test now strips ANSI before the substring asserts, matching the pre-existing _strip_ansi helper (defined at :20, already used at :1560/:1587). Assertion semantics are unchanged.

Summary

• 0 mechanical issues to fix
• 0 alignment points for human review
• 0 RFC conflicts to discuss

Owner/reviewer: @burtenshaw (authored both publish workflows and push.py, and cut the last 0.4.1 release); cc @sergiopaniego for the push CLI test.

  

_{Sent by Cursor Automation: Pre-review}

[cursor]

Release bump 0.4.2.dev0 → 0.4.2 is consistent with publish-pypi.yml, which requires pyproject.toml version to equal the vX.Y.Z tag and the commit to be reachable from main. openenv.__version__ resolves from installed metadata, so the wheel smoke-test (__version__ == installed) holds. Next step after merge: push the v0.4.2 tag on main.

[cursor]

Serializing publishes with a fixed group + cancel-in-progress: false is the right call — you never want to cancel a publish mid-flight, and this prevents two tag pushes from racing on the same version / GitHub Release / post-release bump PR.

[cursor]

Sharing the same openenv-package-publish group as publish-pypi.yml means a manual TestPyPI dispatch and an automatic PyPI tag-release won't run concurrently — good. Just note the intended coupling: a queued TestPyPI run will delay a PyPI release (and vice versa).

[cursor]

Good hardening — _strip_ansi (defined at :20, already used at :1560/:1587) makes these substring assertions robust to the Rich markup emitted at push.py:837/:854. Ran the file: 52 passed, semantics unchanged.