release: prepare DevTools 4.0.1

CHANGELOG.md

@@ -2,6 +2,23 @@
 
 ## Unreleased
 
+## 4.0.1 - 2026-11-10
+
+### Changed
+
+- Make plugin and virion PHAR builds reproducible when staged files and the build toolchain are unchanged.
+- Normalize archive ordering, timestamps, permissions, and internal PHAR metadata while retaining SHA-256 signatures.
+- Declare the ZIP extension required by the PHAR build path.
+
+### Fixed
+
+- Prevent generated PHAR timestamps from changing an otherwise identical artifact checksum.
+
+### Compatibility
+
+- Plugin commands, manifest formats, namespace contracts, and runtime APIs are unchanged.
+- PHP 8.4 remains the minimum supported version.
+
 ## 4.0.0 - 2026-11-10
 
 ### Changed

RELEASE_NOTES.md

@@ -1,19 +1,22 @@
-# DevTools 4.0.0
+# DevTools 4.0.1
 
-DevTools 4.0.0 reorganizes dependency selection, runtime loading and artifact building. Direct PHP integrations need the migration described below. Plugin commands, workflow inputs, manifest formats and CLI JSON schema remain unchanged.
+DevTools 4.0.1 makes repeated plugin and virion PHAR builds reproducible when staged files and the build toolchain are unchanged.
 
 ## Changes
 
-- Keep startup dependency errors scoped to the affected folder plugin.
-- Separate candidate selection and graph checks from class-loader registration while preserving folder precedence, compatible cycles and ordered diagnostics.
-- Share artifact replacement and rollback across plugin, virion and dual builds.
-- Share prepared-content verification and project doctor checks, and retain preflight data when a CLI build fails.
+- Use stable archive entry ordering and normalized metadata for plugin and virion PHAR builds.
+- Retain SHA-256 PHAR signatures after archive metadata normalization.
+- Declare the ZIP extension required by the PHAR build path.
+
+## Compatibility
+
+- Plugin commands, manifest formats, namespace contracts, and runtime APIs are unchanged.
+- PHP 8.4 remains the minimum supported version. CI covers PHP 8.4 and 8.5.
+- Build environments must provide the ZIP extension.
 
 ## Upgrading
 
 - Replace `plugins/DevTools.phar` and restart the server.
-- Use `AxolotlBucketLabs/DevTools@v4` or the corresponding reusable workflow reference for the 4.x channel. `v3` remains on the 3.x series. `latest` follows stable releases across major versions.
-- Direct PHP callers must update the dual builder, CLI and folder-loader construction described in the [migration guide](https://github.com/AxolotlBucketLabs/DevTools/blob/v4.0.0/docs/migration.md#direct-php-integrations).
-- PHP 8.4 remains the minimum. Quality checks cover PHP 8.4 and 8.5. Real-server smoke tests use Axolotl-PM 5.51.1 on PHP 8.4.27.
+- No source migration is required for plugin or virion consumers.
 
 The release tag and checksum manifest are signed with the maintainer's GPG key. Verify `SHA256SUMS.txt.asc` before checking the downloaded assets against `SHA256SUMS.txt`.

composer.json

@@ -52,7 +52,7 @@
     },
     "extra": {
         "devtools": {
-            "release-version": "4.0.0"
+            "release-version": "4.0.1"
         }
     },
     "support": {

plugin.yml

@@ -1,5 +1,5 @@
 name: DevTools
-version: 4.0.0
+version: 4.0.1
 main: AxolotlBucketLabs\DevTools\DevTools
 api: 5.0.0
 load: STARTUP

tests/Validation/RepositoryMetadataTest.php

@@ -19,7 +19,7 @@
 
 final class RepositoryMetadataTest extends TestCase
 {
-	private const VERSION = '4.0.0';
+	private const VERSION = '4.0.1';
 	private const COMPATIBILITY_BUILDER_VERSION = '4.0.0';
 	private const PHP_ACTION_COMMIT = 'b8c3f9add4f2ad4a5e2624a1112aba899ee8db0e';