[hamzahskafi]

Summary

This prepares @augmentworks/cli@0.4.0 the same way PR #85 (137a426, AUG-336) prepared 0.3.9. It doesn't tag, create a release or publish. Publishing is AUG-371, through GitHub release v0.4.0.

Linear: AUG-370 (parent AUG-348, step 4)

• Base: main a6805e6a9ed9751d21b4f0a696fb74876d686605, the merge of #90 (AUG-378)
• Head: 4c8a1ed
• Vendored contracts: aw-real-data/1 from main 16d767967c9d000b81f10ddb09800b0273277b68 (schema 485c58f0…, fixtures 408ee99e…). aw-billing/1 from main 650472d is unchanged.

What changed

• Version: package.json, package-lock.json (only the two root version fields) and src/version.ts are 0.4.0.
• Pins: current-package pins are 0.4.0, on every surface 137a426 changed: README, docs, CI examples, examples/, starters, agent resources, the discovery manifest, schemas/v1/cli-release.json and CONTRIBUTING.md. Agent resources and the discovery manifest were regenerated with npm run generate:agent-resources and npm run generate:discovery.
• Historical records: text describing the inspected 0.3.9 artifact still names 0.3.9. That covers docs/discovery-handoff.md, docs/qa/README.md, release-state.md, the runbook and LAST_VERIFIED_*. 0.3.9 is added to every list of immutable prior artifacts. src/release.ts gains the literal REGISTRY_0_3_9_GIT_HEAD, as 137a426 added one for 0.3.8.
• CHANGELOG.md: [Unreleased] becomes [0.4.0] - 2026-10-17.
  • It leads with the Node.js 22.12 breaking change, then hosted real-data testing and the new commands (target add / verify / list / pull, scope create), then Fixed and Changed.
  • Every existing Unreleased entry is folded in, including the Windows file-identity fix and the old-Node warning.
  • The real-data entry now names the 16d7679 pin instead of 4c27409.
• published-registry-evidence.json: thisPackageIdentity is 0.4.0 with status: pending-protected-publish. gitHead, integrity, verifiedAt, githubRelease and githubReleasePublishedAt are null. lastIndependentlyInspected and immutableArtifacts are unchanged and still record inspected 0.3.9.
• docs/distribution-runbook.md: 0.4.0 is the next immutable artifact, published only from release v0.4.0 through .github/workflows/release.yml. 0.3.9 stays the last version for Node.js 20 and is added to the immutable-artifact list.

Tests

All of these ran on the rebased head with AUGMENTWORKS_API_KEY unset, as CI does:

• npm run check passed: 123 test files, 1232 passed and 1 skipped. Discovery reports @augmentworks/cli@0.4.0 (development); last independently inspected published 0.3.9. Every contract check is ok, including aw-real-data/1 from 16d767967c9d000b81f10ddb09800b0273277b68.
• npm run audit:ci found 0 vulnerabilities.
• npm run smoke:pack passed (74 files).
• npm run test:packed-core-release:local exited 0 (local 0.4.0, 14 checks pass). registry-identity and live-authorized-environment stay not_run, so releaseReady is false, as on the 0.3.9 local path.
• npm run test:packed-real-data-privacy passed: minimized-business, minimized-personal, verbatim-credentials, missing data_policy, stale policyHash, missing redaction_profile.

Linear Issue: AUG-348