release: prepare v0.5.3

[mohanagy]

Summary

Prepare the compatible @lubab/miftah@0.5.3 patch release for the returning-user Console setup work merged in #308.

• bump package and lockfile versions to 0.5.3
• add honest v0.5.3 changelog notes for Set up another MCP and its security boundaries
• update pinned installation/version references in README and focused guides
• update the release contract test first, observe its expected failure, then satisfy it
• retain the experimental pre-1.0 boundary and state that closing [Onboarding] Build a shared CLI and Console MCP setup wizard #204 was an owner waiver, not external evaluator evidence

Tracks #309. External validation remains open under #25, #88, #202, and #290.

Validation

• npm test — 1,807 passed, 33 platform-skipped
• npm run test:core — 425 passed, 26 platform-skipped
• npm run test:coverage — 1,807 passed, 33 platform-skipped; 95.65% statements/lines, 91.92% branches, 98.66% functions
• npm run lint
• npm run typecheck
• npm run build
• npm run smoke:cli
• npm run check:pack — 48 files
• npm run test:package — 26 passed
• git diff --check

No workstation publish is performed. After this PR merges to development, the exact development head will be promoted to main through a separate release PR; only a GitHub Release on exact current main may trigger trusted npm publication.

Summary by CodeRabbit

• Changed
  • Returning users can access guided Console setup via a visible Set up another MCP action, even if configurations already exist, with clarified publication behavior, diagnostics, redaction, and fail-closed safety boundaries.
• Documentation
  • Updated installation and compatibility guidance to reference 0.5.3 across the README and docs.
• Tests
  • Updated release-version validation to expect 0.5.3 artifacts and headings.
• Chores
  • Bumped the package/changelog entry to version 0.5.3.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: ASSERTIVE

Plan: Pro Plus

Run ID: 2252c442-6b06-4ba3-aaf7-cb876a8a941f

📥 Commits

Reviewing files that changed from the base of the PR and between b1d33ee and 8e8c5b6.

📒 Files selected for processing (1)

• tests/release-version.test.ts

---

📝 Walkthrough

Walkthrough

Version 0.5.3 is prepared across package metadata, installation documentation, compatibility documentation, changelog content, and release-version tests.

Changes

0.5.3 release preparation

Layer / File(s)	Summary
Release metadata and documentation package.json, README.md, docs/presets-and-clients.md, docs/whats-new-in-0.5.md, CHANGELOG.md	The package version and documented installation references now use 0.5.3, with a dated changelog entry describing returning-user setup changes and release status.
Release artifact validation tests/release-version.test.ts	Release tests now assert the 0.5.3 heading, date, Changed section, and returning-user setup changelog wording.

Estimated code review effort: 2 (Simple) | ~10 minutes

Possibly related issues

• [Release] Publish v0.5.3 returning-dashboard setup patch #309 — Directly covers the v0.5.3 returning-user Console setup patch and its release documentation and test updates.

Possibly related PRs

• mohanagy/miftah#306 — Updates the same release-version contract for the preceding v0.5.2 release.
• mohanagy/miftah#298 — Performs a similar versioned release-artifact update across metadata, documentation, changelog, and release tests.
• mohanagy/miftah#162 — Modifies release tests validating specific experimental-package changelog content.

Poem

A bunny bumps the version bright,
From five-two up to five-three tonight.
Changelog carrots neatly align,
Setup notes sparkle in the sign.
Tests hop after, precise and spry—
Release is ready to nibble by! 🐇

---

Caution

Pre-merge checks failed

Please resolve all errors before merging. Addressing warnings is optional.

• Ignore

❌ Failed checks (1 error)

Check name	Status	Explanation	Resolution
Docstring Coverage	❌ Error	Docstring coverage is 0.00% which is insufficient. The required threshold is 80.00%.	Write docstrings for the functions missing them to satisfy the coverage threshold.

✅ Passed checks (4 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title is concise and accurately summarizes the main change: preparing the v0.5.3 release.
Description check	✅ Passed	The description is detailed and includes summary and validation, but it lacks a dedicated Security impact section from the template.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches 💡 1

📝 Generate docstrings 💡

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch release/0.5.3

---

_{Comment @coderabbitai help to get the list of available commands.}

[coderabbitai]

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@tests/release-version.test.ts`:
- Line 26: Update the release fixture heading in the releaseNotes() contract
test to use the canonical zero-padded date format, changing the month from 7 to
07 while preserving the existing day, version, and changelog structure.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: ASSERTIVE

Plan: Pro Plus

Run ID: 42f48adc-0065-4609-bb6b-6dee85cfb91d

📥 Commits

Reviewing files that changed from the base of the PR and between ea09171 and b1d33ee.

⛔ Files ignored due to path filters (1)

• package-lock.json is excluded by !**/package-lock.json

📒 Files selected for processing (6)

• CHANGELOG.md
• README.md
• docs/presets-and-clients.md
• docs/whats-new-in-0.5.md
• package.json
• tests/release-version.test.ts

Dismissed because CodeRabbit explicitly withdrew the sole finding after verifying the intentionally malformed negative fixture; current head 8e8c5b6 has a completed passing CodeRabbit check and all review threads are resolved.

[mohanagy]

Release gate evidence for exact head 8e8c5b6ff62b4e8248dbe627c61d0ab714ebda5f:

• Current-head CI is green: Linux quality; Linux/macOS/Windows Node 20, 22, and 24; final Verify. Run: https://github.com/mohanagy/miftah/actions/runs/30520976398
• The initial Windows Node 22/24 attempts timed out in unchanged tests; the failed jobs were rerun unchanged and passed. No timeout, coverage, containment, or test behavior was changed.
• CodeRabbit completed on the current head with a passing check. Its sole earlier finding was verified as invalid, explicitly withdrawn by CodeRabbit, and the resolved stale review was dismissed.
• All review threads are resolved.
• Local release state passed: focused release/preset contracts; npm test; npm run test:core; npm run test:coverage; npm run lint; npm run typecheck; npm run build; npm run smoke:cli; npm run check:pack; npm run test:package; and git diff --check.
• External evaluator validation is still incomplete under [Product] Validate the local multi-account MCP broker wedge with design partners #25, [Release] Validate Console/OAuth compatibility, recovery, and design-partner evidence #88, [Product] Make trust controls and multi-account onboarding discoverable #202, and [Docs] Redesign README for a first-time Miftah user #290. Closing [Onboarding] Build a shared CLI and Console MCP setup wizard #204 used the documented owner waiver and is not represented as evaluator evidence.