release: promote v0.5.3 to main

[mohanagy]

Summary

Promote the exact tested development state for Miftah v0.5.3 to main.

• development head: f075e35e073c8506ef90d3fac359a8c867a4318d
• release-preparation PR: release: prepare v0.5.3 #310
• release tracking issue: [Release] Publish v0.5.3 returning-dashboard setup patch #309
• implementation delivered by feat(console): keep setup wizard available for returning users #308 for [Onboarding] Build a shared CLI and Console MCP setup wizard #204

Release scope

This compatible pre-1.0 patch makes Set up another MCP visible in the returning Console, preserves safe named-config creation, and updates package/docs/changelog metadata to 0.5.3.

Gates

• release: prepare v0.5.3 #310 exact-head CI passed on Linux/macOS/Windows with Node 20/22/24 and Linux quality.
• Post-merge development CI passed: https://github.com/mohanagy/miftah/actions/runs/30521891224
• Local release checks passed: npm test, npm run test:core, npm run test:coverage, npm run lint, npm run typecheck, npm run build, npm run smoke:cli, npm run check:pack, and npm run test:package.

Honest limitations

External evaluator validation is still incomplete under #25, #88, #202, and #290. Issue #204 was closed using the documented owner waiver, not evidence that three unaided evaluators completed the workflow.

After this PR is merged and its merge commit is confirmed as current main, creating GitHub Release v0.5.3 will trigger trusted npm publishing. No workstation publish will be used.

Refs #309

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on base/target branches other than the default branch.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Organization UI

Review profile: ASSERTIVE

Plan: Pro Plus

Run ID: 4fc99208-ba6f-4c9a-9d68-f969571b82dd

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

_{Comment @coderabbitai help to get the list of available commands.}

[mohanagy]

Release promotion gate for exact head e41770467eacfa5c62d4292075018fec512d4e84:

• Git tree e2c66593f0944432e20f0ded6149ce39b6b9104b is unchanged from the fully tested v0.5.3 release-prep merge f075e35e073c8506ef90d3fac359a8c867a4318d; chore(release): reconcile main ancestry for v0.5.3 #312 changed history only.
• Both current-head CI runs are fully green after rerunning only transient failed Windows jobs unchanged:
  • https://github.com/mohanagy/miftah/actions/runs/30522891158
  • https://github.com/mohanagy/miftah/actions/runs/30522960198
• All Linux/macOS/Windows Node 20/22/24, Linux quality, and Verify contexts pass. No timeout, test, coverage, or containment behavior was changed.
• CodeRabbit explicitly reports that reviews are disabled for the main base branch. Its success context is a policy skip, not an approval.
• A separate independent read-only review therefore inspected the exact head and found no code, docs, security, public-API, or release-metadata findings. It verified the 23-file diff is exactly feat(console): keep setup wizard available for returning users #308 plus release: prepare v0.5.3 #310, including redaction, exclusive/no-follow private publication, owner/link/mode/sync checks, shell: false argument arrays, no-overwrite/fresh discovery, POSIX anchoring, and the existing Windows ACL path.
• External evaluator evidence remains incomplete under [Product] Validate the local multi-account MCP broker wedge with design partners #25, [Release] Validate Console/OAuth compatibility, recovery, and design-partner evidence #88, [Product] Make trust controls and multi-account onboarding discoverable #202, and [Docs] Redesign README for a first-time Miftah user #290. The [Onboarding] Build a shared CLI and Console MCP setup wizard #204 owner waiver is not represented as evaluator completion.

GitHub now reports the PR clean and mergeable.