[shivros]

Summary

• Prepare the Hydra workspace for the proposed 0.3.0 release line.
• Add an explicitly unpublished release-preparation section that preserves the immutable v0.2.2 history.
• Record the exact merged projection/fix inputs and Rust/TypeScript compatibility migration notes.

Scope and release boundary

This PR changes only Cargo.toml, Cargo.lock, and README.md. It does not create or move a tag, publish a GitHub release, publish to crates.io/npm, repin Iris/Rite, deploy anything, or claim MCP-over-HTTP runtime support. COD-510 is listed accurately as an OpenSpec-only contract.

The proposed v0.3.0 tag and git dependency examples are explicitly gated on separate exact release authorization and public tag verification. The preparation merge SHA is intentionally recorded only after this PR lands.

Exact merged inputs

The README records full immutable SHAs for PRs #10–#18, including COD-515 TypeScript projection, COD-521 nested-schema correction, COD-522 TypeScript freshness gate, and COD-510's spec-only contract.

Verification

Run from the isolated hosted worktree at commit 8f4536f5c9aea765744b03f2771c8b146b72b478:

• cargo metadata --locked --no-deps --format-version 1 — all five workspace packages report 0.3.0.
• Registry lockfile comparison — 91 registry package records/checksums unchanged.
• cargo build --all-targets — pass.
• cargo test --all-targets — pass (60 codegen, 14 Notes surface, 6 Security Scan tests).
• cargo clippy --all-targets -- -D warnings — pass.
• cargo fmt --all -- --check, creed diff, git diff --check — pass.
• Notes, Security Scan, and TypeScript examples: hydra-codegen check — pass.
• Two hydra-codegen write passes across all three examples; all 12 generated artifact bytes matched the pre-write snapshots on both passes; final checks passed.
• examples/ts-client: npm ci --ignore-scripts --no-audit --no-fund, npm run check:generated, npm run typecheck, npm run build, and npm run test:nested-schema — pass.

Linear: COD-523

[shivros]

🤖 Automated Review Panel

Reviewer A — Codex confirmation

APPROVE

Final confirmation found no actionable issues. The initial pass correctly identified three documentation defects—an incomplete COD-521 SHA, abbreviated #11/#12 SHAs despite the “exact” wording, and missing migration notes for GenerateConfig::ts_client_name / GeneratedArtifacts::ts_client_ts; all were fixed before this confirmation. The final diff is limited to the three intended files, all five workspace packages are 0.3.0, all 91 registry package records/checksums are unchanged, all nine listed PR SHAs resolve exactly, and no v0.3.x tag exists.

Reviewer B — Gemini 3 Flash

APPROVE

No required fixes. The README accurately keeps COD-510 at the spec-only boundary, separates preparation from authorization/publication/consumer use, records the merged COD-521/COD-522 inputs, and documents the TypeScript compatibility limits. Cargo.lock changes are limited to workspace versions and the release-preparation scope is faithful to the task.

Panel result

Both reviewers approve the final diff. The full local verification evidence is in the PR description; no tag, release, package publication, repin, deployment, or live runtime claim was made.

[shivros]

Auto-Merge Gate — approved for squash merge

Confidence: 0.95

Scope reviewed: preparation-only Hydra 0.3.0 metadata in Cargo.toml, Cargo.lock, and README.md.

Rationale: The diff directly fulfills COD-523's bounded preparation slice: all five workspace versions align to 0.3.0, the lockfile changes only those workspace versions, and the README documents exact merged inputs and compatibility limits while explicitly preserving the boundary against tags, GitHub releases, registry publication, consumer repins, deployment, and MCP-over-HTTP runtime claims. COD-523's countersign requirement is recorded in Linear, and no do-not-auto-merge/manual-review marker was found.

Checks observed: CI Test and Creed context drift completed successfully. The PR's automated dual-model review panel approved the final diff after its documentation corrections.

Scope limit: This merges preparation metadata only. It does not authorize or perform public release activity; COD-524 remains the separate release-authorization/publication boundary.