fix(web): add v0.27.0 changelog entry and clarify release-data ownership (#2075)

* fix(web): add 0.27 release entry

* test(web): cover 0.27 release entry

* fix(web): clarify 0.27 permission-timeout highlight

* docs: ban drive-by edits to web/src/data/releases.ts

Tell agents and contributors that the curated changelog is owned by
the release/web process, and stop verify-dist from instructing unrelated
PRs to patch it when npm publishes ahead of the site.

* test(web): locate curated release by version

* test(web): enforce newest-first release order

AGENTS.md

@@ -74,6 +74,8 @@ bun run web:typecheck
 bun run web:build
 ```
 
+Do not “fix” a web CI npm-freshness failure by editing `web/src/data/releases.ts` in an unrelated PR. That file is release/web-owned; leave version drift for the dedicated release/web path.
+
 Diagnostics and PR hygiene:
 
 ```bash
@@ -99,3 +101,4 @@ When modifying provider behavior:
 - Do not skip tests for behavior changes.
 - Do not silently change provider tags; maintainers control them during review.
 - Do not ignore CodeRabbit or maintainer feedback; address it before requesting more review.
+- Do not edit `web/src/data/releases.ts` in ordinary feature or bugfix PRs. That curated `/changelog` list is owned by the release/web process (release automation and dedicated web release PRs). If web CI fails because npm is ahead of the site version, leave `releases.ts` alone in your unrelated PR and let the release/web path update it.

CONTRIBUTING.md

@@ -103,6 +103,7 @@ PRs may be closed without review if they:
 - add features, refactors, or dependency changes that were not discussed first
 - drift from the approved scope of a linked issue
 - change the project's language, core runtime, or dependency stack without prior maintainer agreement
+- edit `web/src/data/releases.ts` as a drive-by fix for web CI version drift in an unrelated feature or bugfix PR — that curated changelog is owned by the release/web process
 - are drive-by contributions with no context, no tests, and no clear purpose
 - are automated bounty-hunting or mass-submitted PRs that provide little meaningful value to the codebase
 - are advertisements, sales pitches, or promotional submissions for a product or service — open an issue first to discuss with maintainers if you believe your product or service is relevant to this project
@@ -133,6 +134,7 @@ Dependency changes need a clear project benefit — fixing a bug, addressing a s
 - Preserve existing repo patterns unless the change is intentionally refactoring them.
 - Add or update tests when the change affects behavior.
 - Update docs when setup, commands, or user-facing behavior changes.
+- Do not edit `web/src/data/releases.ts` unless you are on an explicit release/web changelog PR. Release automation and dedicated web release updates own that file. Unrelated PRs must not patch it to silence web CI when npm publishes ahead of the site changelog.
 
 AI-assisted and vibe-coded contributions are welcome, but please review your own changes thoroughly before opening a PR. Even frontier models produce subtle bugs, incorrect assumptions, and code that looks right but isn't.
 
@@ -150,6 +152,8 @@ Self-review up front saves everyone time and reduces back-and-forth during maint
 
 If you are an AI agent (Copilot, Cursor, Claude, etc.) working on this codebase, refer to [AGENTS.md](AGENTS.md) for project-specific coding guidelines, conventions, and validation commands. Following these guidelines will help your contributions align with the project's patterns and reduce review friction.
 
+In particular: do not edit `web/src/data/releases.ts` from ordinary feature or bugfix work. Treat web CI failures about npm being ahead of the site version as out of scope unless you are on an explicit release/web changelog PR.
+
 ## Code Style
 
 - Follow the existing code style in the touched files.

web/scripts/verify-dist.test.ts

@@ -59,6 +59,35 @@ function withFixture(mutate: (dist: string) => void): string[] {
   }
 }
 
+describe('release data', () => {
+  test('keeps releases newest first', () => {
+    const versions = releases.map(release => release.version.split('.').map(Number))
+    const sorted = [...versions].sort((a, b) => {
+      for (let i = 0; i < 3; i++) {
+        if (a[i] !== b[i]) return (b[i] ?? 0) - (a[i] ?? 0)
+      }
+      return 0
+    })
+
+    expect(versions).toEqual(sorted)
+  })
+
+  test('lists the 0.27.0 release with its curated highlights', () => {
+    expect(releases.find(release => release.version === '0.27.0')).toEqual({
+      version: '0.27.0',
+      date: '2026-07-30',
+      theme: 'auth-ready local proxies and a refreshed web identity',
+      highlights: [
+        'opt-in loopback proxy hosts preserve subscription OAuth authentication',
+        'new Ling 3.0 Flash and Macaron V1 Tall catalog entries',
+        'centered startup logo and updated Ember Block O web branding',
+        'agents can spawn subagents from multi-repository parent sessions',
+        'more reliable tool-failure guard, SDK permission-timeout reporting, stats, and status UI',
+      ],
+    })
+  })
+})
+
 describe('verifyDist', () => {
   test('passes on a complete fixture', () => {
     expect(withFixture(() => {})).toEqual([])
@@ -142,7 +171,8 @@ describe('npmFreshnessFailure', () => {
   test('fails when npm has a newer release than releases.ts', async () => {
     const failure = await npmFreshnessFailure(fetchReturning({ version: '999.0.0' }))
     expect(failure).toContain('999.0.0')
-    expect(failure).toContain('src/data/releases.ts')
+    expect(failure).toContain('web/src/data/releases.ts')
+    expect(failure).toContain('do not patch it from unrelated PRs')
   })
 
   test('skips on network failure instead of breaking the build', async () => {

web/scripts/verify-dist.ts

@@ -113,7 +113,7 @@ export async function npmFreshnessFailure(fetchImpl: typeof fetch = fetch): Prom
   }
   if (!/^(0|[1-9]\d*)\.(0|[1-9]\d*)\.(0|[1-9]\d*)$/.test(published)) return null
   if (newerThan(published, SITE.version))
-    return `npm latest ${published} is newer than site version ${SITE.version} — add it to src/data/releases.ts`
+    return `npm latest ${published} is newer than site version ${SITE.version} — releases.ts is stale; do not patch it from unrelated PRs (release/web process owns web/src/data/releases.ts)`
   return null
 }
 

web/src/data/releases.ts

@@ -1,6 +1,10 @@
 // Curated release highlights for the /changelog page. Full notes live on
 // GitHub releases; this list is the hand-picked "what actually matters"
 // per minor version. Newest first.
+//
+// Ownership: release/web process only (release automation and dedicated web
+// release PRs). Do not edit this file from ordinary feature or bugfix PRs,
+// including to silence web CI when npm is ahead of the site version.
 
 export interface Release {
   version: string
@@ -17,6 +21,18 @@ export function releaseUrl(version: string): string {
 }
 
 export const releases: Release[] = [
+  {
+    version: '0.27.0',
+    date: '2026-07-30',
+    theme: 'auth-ready local proxies and a refreshed web identity',
+    highlights: [
+      'opt-in loopback proxy hosts preserve subscription OAuth authentication',
+      'new Ling 3.0 Flash and Macaron V1 Tall catalog entries',
+      'centered startup logo and updated Ember Block O web branding',
+      'agents can spawn subagents from multi-repository parent sessions',
+      'more reliable tool-failure guard, SDK permission-timeout reporting, stats, and status UI',
+    ],
+  },
   {
     version: '0.26.0',
     date: '2026-07-27',