NhanAZ · Nov 10, 2026 · Nov 10, 2026
diff --git a/.github/workflows/axolotl-compatibility.yml b/.github/workflows/axolotl-compatibility.yml
@@ -103,7 +103,7 @@ jobs:
       - name: Build and analyze DevTools-owned example PHAR with the pinned stable builder
         if: steps.release.outputs.candidate == 'true'
         id: build
-        uses: AxolotlBucketLabs/DevTools@559f744a156a9e8e9c845c72ff4ad08e133bdaa7 # v4.0.0
+        uses: AxolotlBucketLabs/DevTools@281364d985c8366ac06756c6270489d097561628 # v4.0.1
         with:
           project: examples/HelloShared
           virions: examples

diff --git a/docs/ecosystem.json b/docs/ecosystem.json
@@ -34,9 +34,9 @@
     ]
   },
   "devtools": {
-    "stable_version": "v4.0.0",
-    "stable_commit": "559f744a156a9e8e9c845c72ff4ad08e133bdaa7",
-    "reference_policy": "AxolotlBucketLabs repositories use @v4.0.0. External consumers may use @latest or an exact release commit."
+    "stable_version": "v4.0.1",
+    "stable_commit": "281364d985c8366ac06756c6270489d097561628",
+    "reference_policy": "AxolotlBucketLabs repositories use @v4.0.1. External consumers may use @latest or an exact release commit."
   },
   "summary": {
     "total_repositories": 143,

diff --git a/docs/ecosystem.md b/docs/ecosystem.md
@@ -2,7 +2,7 @@
 
 This page gives a short human-readable summary of public projects whose default-branch workflows reference DevTools. The complete inventory and its counts are stored in [`ecosystem.json`](ecosystem.json). The data contract is described by [`ecosystem.schema.json`](ecosystem.schema.json).
 
-The stable release represented by this inventory is DevTools `v4.0.0`. Repositories in AxolotlBucketLabs use the `v4.0.0` release. External consumers may use the maintained `@latest` channel or an exact release commit according to their compatibility policy.
+The stable release represented by this inventory is DevTools `v4.0.1`. Repositories in AxolotlBucketLabs use the `v4.0.1` release. External consumers may use the maintained `@latest` channel or an exact release commit according to their compatibility policy.
 
 ## Inventory
 

diff --git a/docs/github-actions.md b/docs/github-actions.md
@@ -2,7 +2,7 @@
 
 The composite action calls `bin/devtools.php build --json`, using the same builder as the CLI and server command. It accepts `type: plugin` (default) or `type: virion`, verifies the reported PHAR SHA-256 and exposes the actual path from that result. PHPStan and Composer dependency preparation are opt-in for plugin builds. Virion builds use `phpstan: off` because the action's PHPStan helper is plugin-oriented. A successful build verifies packaging. It does not prove an Axolotl-PM runtime boot.
 
-These interfaces are available in the `v4.0.0` release. Most repositories should use the maintained `v4` channel: `AxolotlBucketLabs/DevTools@v4` for the composite action and `AxolotlBucketLabs/DevTools/.github/workflows/build-plugin.yml@v4` or `build-virion.yml@v4` for reusable workflows. The `latest` channel is also available for repositories that intentionally want every stable release, including future major versions. Use `AxolotlBucketLabs/DevTools@latest` or the corresponding reusable workflow reference. Use `@v4.0.0` when a repository should stay on one release, or a full commit SHA for a strict reproducible pin. The called workflow checks out its builder from the resolved reference using the current job's workflow identity. Installing DevTools does not publish a release.
+These interfaces are available in the `v4.0.1` release. Most repositories should use the maintained `v4` channel: `AxolotlBucketLabs/DevTools@v4` for the composite action and `AxolotlBucketLabs/DevTools/.github/workflows/build-plugin.yml@v4` or `build-virion.yml@v4` for reusable workflows. The `latest` channel is also available for repositories that intentionally want every stable release, including future major versions. Use `AxolotlBucketLabs/DevTools@latest` or the corresponding reusable workflow reference. Use `@v4.0.1` when a repository should stay on one release, or a full commit SHA for a strict reproducible pin. The called workflow checks out its builder from the resolved reference using the current job's workflow identity. Installing DevTools does not publish a release.
 
 ## Short build workflow
 
@@ -185,24 +185,24 @@ DevTools moves `latest` only to a validated stable release. It may move from v4
 Use an exact release when a repository needs controlled upgrades.
 
 ```yaml
-uses: AxolotlBucketLabs/DevTools/.github/workflows/build-plugin.yml@v4.0.0
+uses: AxolotlBucketLabs/DevTools/.github/workflows/build-plugin.yml@v4.0.1
 ```
 
 Use a full commit SHA for strict reproducibility or a supply-chain policy. Resolve the commit behind the reviewed release tag and keep the version in a comment.
 
 ```sh
-git ls-remote https://github.com/AxolotlBucketLabs/DevTools.git 'refs/tags/v4.0.0^{}'
+git ls-remote https://github.com/AxolotlBucketLabs/DevTools.git 'refs/tags/v4.0.1^{}'
 ```
 
 ```yaml
-uses: AxolotlBucketLabs/DevTools/.github/workflows/build-plugin.yml@<full-commit-sha> # v4.0.0
+uses: AxolotlBucketLabs/DevTools/.github/workflows/build-plugin.yml@<full-commit-sha> # v4.0.1
 ```
 
 The called job reads its own `workflow_sha` and `workflow_repository`, checks out that revision, and verifies the checked-out HEAD and CLI contract before building. The same rule applies to release verification. The workflow contract no longer accepts the removed `devtools-ref` input. Remove it when migrating a v1 caller. GitHub's workflow identity context is available on GitHub.com. These reusable workflows are not supported on GitHub Enterprise Server without that context.
 
 ## Migrate from v1
 
-Update the reusable workflow reference to `@v4` and remove legacy inputs that the current workflow does not declare. Use `@latest` only if the repository intentionally accepts major upgrades. Use `@v4.0.0` or a full SHA when the repository requires a controlled or strict pin.
+Update the reusable workflow reference to `@v4` and remove legacy inputs that the current workflow does not declare. Use `@latest` only if the repository intentionally accepts major upgrades. Use `@v4.0.1` or a full SHA when the repository requires a controlled or strict pin.
 
 ```diff
  with:

diff --git a/examples/README.md b/examples/README.md
@@ -13,7 +13,7 @@ HelloShared and SharedGreeting are dedicated examples maintained by DevTools. Th
 
 This example also contains `.github/workflows/build.yml`. Extract the complete examples ZIP into an empty GitHub repository and push it. The public action builds `HelloShared.phar` on every push and pull request, then uploads it to that run's **Artifacts** section.
 
-The bundled workflow uses the `AxolotlBucketLabs/DevTools@v4` action channel. For reusable workflows, use the corresponding `@v4` reference from the main GitHub Actions guide. Replace `@v4` with `@latest` only when the repository intentionally accepts stable major upgrades. Use `@v4.0.0` for a release-pinned workflow or a full commit SHA for strict reproducibility. The called workflow selects its builder from the same reference. The action step performs the build. The following `actions/upload-artifact` step makes the resulting PHAR downloadable. The PHAR is not committed back into the repository. New plugin repositories can use the reusable workflow described in the main guide instead.
+The bundled workflow uses the `AxolotlBucketLabs/DevTools@v4` action channel. For reusable workflows, use the corresponding `@v4` reference from the main GitHub Actions guide. Replace `@v4` with `@latest` only when the repository intentionally accepts stable major upgrades. Use `@v4.0.1` for a release-pinned workflow or a full commit SHA for strict reproducibility. The called workflow selects its builder from the same reference. The action step performs the build. The following `actions/upload-artifact` step makes the resulting PHAR downloadable. The PHAR is not committed back into the repository. New plugin repositories can use the reusable workflow described in the main guide instead.
 
 The example intentionally omits `phpstan`, so analysis is off. The [GitHub Actions guide](https://github.com/AxolotlBucketLabs/DevTools/blob/v2/docs/github-actions.md) shows how to opt in with an explicitly pinned server source.
 

diff --git a/examples/agent/AGENTS.md b/examples/agent/AGENTS.md
@@ -2,11 +2,11 @@
 
 ## DevTools PHAR workflow
 
-- For CLI, dependency and release interfaces, read `docs/cli.md`, `docs/dependencies.md`, and `docs/github-actions.md` from the exact DevTools revision used. The references below describe the `v4.0.0` release and its maintained channels.
+- For CLI, dependency and release interfaces, read `docs/cli.md`, `docs/dependencies.md`, and `docs/github-actions.md` from the exact DevTools revision used. The references below describe the `v4.0.1` release and its maintained channels.
 - Use CLI `--json`, check the exit status and `success`, consume the returned artifact path and verify its SHA-256. Report runtime testing and static analysis separately from package validation.
 
 - Read `plugin.yml`, `devtools.yml`, Composer metadata, existing workflows, and referenced source before changing the build.
-- Use `AxolotlBucketLabs/DevTools/.github/workflows/build-plugin.yml@v4` by default according to the versioned [GitHub Actions guide](https://github.com/AxolotlBucketLabs/DevTools/blob/v4/docs/github-actions.md). Use `@latest` only when the repository intentionally accepts stable major upgrades. Use `@v4.0.0` for a release-pinned build or the full commit SHA for strict reproducibility. The workflow checks out the builder from its own resolved reference. Use the step-level action when extra setup is required.
+- Use `AxolotlBucketLabs/DevTools/.github/workflows/build-plugin.yml@v4` by default according to the versioned [GitHub Actions guide](https://github.com/AxolotlBucketLabs/DevTools/blob/v4/docs/github-actions.md). Use `@latest` only when the repository intentionally accepts stable major upgrades. Use `@v4.0.1` for a release-pinned build or the full commit SHA for strict reproducibility. The workflow checks out the builder from its own resolved reference. Use the step-level action when extra setup is required.
 - Run the PHAR workflow on `push`, `pull_request`, and `workflow_dispatch` with `contents: read` permission.
 - The reusable workflow owns the documented Node.js 24 compatible Axolotl-PM PHP setup. Use the step-level setup only when that workflow is selected.
 - Keep PHPStan off unless this repository explicitly enables it. When enabled, keep the requested level and pin Axolotl-PM source with `axolotl-ref`. Use `phpstan-server` only for additional source paths already checked out by the caller.

diff --git a/tests/Validation/RepositoryMetadataTest.php b/tests/Validation/RepositoryMetadataTest.php
@@ -20,7 +20,7 @@
 final class RepositoryMetadataTest extends TestCase
 {
 	private const VERSION = '4.0.1';
-	private const COMPATIBILITY_BUILDER_VERSION = '4.0.0';
+	private const COMPATIBILITY_BUILDER_VERSION = '4.0.1';
 	private const PHP_ACTION_COMMIT = 'b8c3f9add4f2ad4a5e2624a1112aba899ee8db0e';
 
 	public function test_release_version_is_synchronized() : void