🔖 (release): python-sdk 0.0.1rc3

.claude/skills/sdk-only-release/SKILL.md

@@ -64,6 +64,31 @@ On 2026-06-15 02:21 UTC, `@agent-assembly/sdk@0.0.1-beta.2` was published to npm
 
 The fix is operator discipline (this SOP), not a workflow-code restriction — `workflow_dispatch` is kept open for legitimate Case B releases.
 
+## Version-bump prep PR — required file footprint
+
+Before the `workflow_dispatch` publish, land a **prep-only PR** that advances every
+checked-in version literal to the new release. The `pypi_version` dispatch input is
+what actually stamps the wheel, but master must not lag behind it — a stale literal
+drifts the SonarCloud gate, misleads the docs, and breaks the next Case-B release's
+base. **Bump ALL of the following in one prep PR** (reference: rc.2 PR #190 /
+AAASM-3833). Missing any of these is the most common release-prep defect.
+
+| File | What to change |
+|---|---|
+| `pyproject.toml` | `version = "<PEP440>"` (e.g. `0.0.1rc3`) |
+| `agent_assembly/__init__.py` | `__version__ = "<PEP440>"` — kept in lockstep with `pyproject` |
+| `uv.lock` | regenerate (`uv lock`) so the project's own pinned version matches; CI `uv sync` fails otherwise |
+| `sonar-project.properties` | `sonar.projectVersion=<PEP440>` (source-of-truth / local-scan fallback; never leave at `0.0.0` — AAASM-3815) |
+| `docs/compatibility/release-notes.md` | new `## <SemVer>` section mirroring the previous one (core tag it tracks, ticket ref) |
+| `docs/examples/*.md` | bump the `agent-assembly` install pin `>=<old>` → `>=<new>` in every adapter example that carries one (grep `>=0.0.1rc`) |
+| `docs/guides/container-base-image.md` | bump the governed base-image tag examples `v<old>` → `v<new>` (grep `v0.0.1-rc`) |
+
+**Do NOT hand-edit** `docs/compatibility/` versioned snapshots or the docs-site
+version index — the `Publish release tag for docs` job (gated on `repository_dispatch`,
+AAASM-2868) snapshots those at release time. The prep PR is the *current* docs +
+metadata only. Always `grep -rn` the outgoing version across `agent_assembly/**` and
+`docs/**` to catch every literal before opening the PR; do not copy a stale file list.
+
 ## How to use
 
 Invoke `release-python.yml` via `workflow_dispatch` against `master`, three

agent_assembly/__init__.py

@@ -8,7 +8,7 @@
 import sys
 from typing import TYPE_CHECKING, Any
 
-__version__ = "0.0.1rc2"
+__version__ = "0.0.1rc3"
 
 _MODULE_CORE = "agent_assembly.core"
 _MODULE_ADAPTERS = "agent_assembly.adapters"

docs/compatibility/release-notes.md

@@ -5,6 +5,19 @@ Release notes for the Agent Assembly Python SDK. Versions follow [SemVer](https:
 !!! info "0.x development"
     The SDK is in active 0.x development; per-release notes are minimal. Track full changes via [the commits to `master`](https://github.com/ai-agent-assembly/python-sdk/commits/master) and the [GitHub releases](https://github.com/ai-agent-assembly/python-sdk/releases) feed.
 
+## 0.0.1-rc.3
+
+Third **release candidate** on the `0.0.1` line. This release tracks the published
+`agent-assembly` core **`v0.0.1-rc.3`**: the bundled `aasm` runtime binary and the
+compiled `aa-ffi-python` extension are pinned to that core tag (AAASM-4056).
+
+Changes since rc.2 are limited to the core-pin promotion — there is no new SDK
+surface:
+
+- Bump the `aa-core` / `aa-proto` / `aa-sdk-client` pins in `aa-ffi-python` to the
+  core `v0.0.1-rc.3` tag. rc.3 is a security-hardening cut of the core (three
+  verified sweeps) and fixes the `aa-gateway` crates.io publish break (AAASM-4056).
+
 ## 0.0.1-rc.2
 
 Second **release candidate** on the `0.0.1` line. This release tracks the published

docs/examples/agno.md

@@ -19,7 +19,7 @@ Version pins (from `pyproject.toml`):
 | Dependency | Version |
 |---|---|
 | `agno` | `>=2.0.0` |
-| `agent-assembly` | `>=0.0.1rc2` (the release that ships the Agno adapter) |
+| `agent-assembly` | `>=0.0.1rc3` (the release that ships the Agno adapter) |
 | Python | `>=3.12` |
 
 ## How it works

docs/examples/haystack.md

@@ -20,7 +20,7 @@ Version pins (from `pyproject.toml`):
 | Dependency | Version |
 |---|---|
 | `haystack-ai` | `>=2.0.0,<3.0` |
-| `agent-assembly` | `>=0.0.1rc2` (the release that ships the Haystack adapter) |
+| `agent-assembly` | `>=0.0.1rc3` (the release that ships the Haystack adapter) |
 | Python | `>=3.12` |
 
 ## How it works

docs/examples/llamaindex-tool-policy.md

@@ -19,7 +19,7 @@ Version pins (from `pyproject.toml`):
 | Dependency | Version |
 |---|---|
 | `llama-index-core` | `>=0.14.22` |
-| `agent-assembly` | `>=0.0.1rc2` (the release that ships the LlamaIndex adapter) |
+| `agent-assembly` | `>=0.0.1rc3` (the release that ships the LlamaIndex adapter) |
 | Python | `>=3.12` |
 
 ## How it works

docs/examples/microsoft-agent-framework.md

@@ -19,7 +19,7 @@ Version pins (from `pyproject.toml`):
 | Dependency | Version |
 |---|---|
 | `agent-framework` (the `live` extra) | `>=1.9,<2` |
-| `agent-assembly` | `>=0.0.1rc2` (the release that ships the Microsoft Agent Framework adapter) |
+| `agent-assembly` | `>=0.0.1rc3` (the release that ships the Microsoft Agent Framework adapter) |
 | Python | `>=3.12` |
 
 The adapter's `get_supported_versions()` reports `>=1.0.0,<2.0` — governance attaches across the 1.x line.

docs/examples/smolagents.md

@@ -19,7 +19,7 @@ Version pins (from `pyproject.toml`):
 | Dependency | Version |
 |---|---|
 | `smolagents` | `>=1.0.0,<2.0.0` |
-| `agent-assembly` | `>=0.0.1rc2` (the release that ships the Smolagents adapter) |
+| `agent-assembly` | `>=0.0.1rc3` (the release that ships the Smolagents adapter) |
 | Python | `>=3.12` |
 
 ## How it works

docs/guides/container-base-image.md

@@ -33,13 +33,13 @@ There are two families of tags: **immutable** (pinned, reproducible) and **movin
 
 | Tag | Example | Mutable? | Use it for |
 | --- | --- | --- | --- |
-| `python:<runtime>-<core-version>` | `python:3.14-slim-v0.0.1-rc.2` | **No** — immutable | **CI and production.** Reproducible, byte-for-byte stable. |
+| `python:<runtime>-<core-version>` | `python:3.14-slim-v0.0.1-rc.3` | **No** — immutable | **CI and production.** Reproducible, byte-for-byte stable. |
 | `python:<runtime>` | `python:3.14-slim` | Yes — moves per release | Local experiments on a fixed Python runtime. |
 | `python:latest` | `python:latest` | Yes — moves per release | Quick one-off tries only. |
 
 `<core-version>` is the **Agent Assembly core / `aa-runtime` release** baked into the
 image — it is also the version of the `aasm` CLI inside the image. Pinning
-`python:3.14-slim-v0.0.1-rc.2` therefore pins *both* the Python runtime and the exact
+`python:3.14-slim-v0.0.1-rc.3` therefore pins *both* the Python runtime and the exact
 governance core/CLI version, which is what makes the build reproducible.
 
 !!! warning "Pin the immutable tag in CI and production"
@@ -53,7 +53,7 @@ A minimal agent image that inherits governance from the base image:
 
 ```dockerfile
 # Pin the immutable tag — Python 3.14 runtime + a fixed governance core/CLI version.
-FROM ghcr.io/ai-agent-assembly/python:3.14-slim-v0.0.1-rc.2
+FROM ghcr.io/ai-agent-assembly/python:3.14-slim-v0.0.1-rc.3
 
 WORKDIR /app
 
@@ -117,7 +117,7 @@ docker build --build-arg SDK_VERSION=0.0.1b5 -t my-agent .
 ## Best practices
 
 - **Pin the immutable tag in CI and production.** Use
-  `python:<runtime>-<core-version>` (e.g. `python:3.14-slim-v0.0.1-rc.2`); never `:latest`.
+  `python:<runtime>-<core-version>` (e.g. `python:3.14-slim-v0.0.1-rc.3`); never `:latest`.
 - **Pair the image with the `aa-runtime` sidecar.** The image makes your agent
   *governance-ready*, but the in-process SDK layer is **not a security boundary on its
   own** — point `init_assembly()` at an `aa-runtime` instance (sidecar or service) so policy

pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "agent-assembly"
-version = "0.0.1rc2"
+version = "0.0.1rc3"
 description = "Python SDK for AI Agent Assembly - A governance-native runtime for AI agents"
 authors = [{ name = "Agent Assembly Team", email = "team@agent-assembly.dev" }]
 requires-python = ">=3.12,<4.0"

sonar-project.properties

@@ -12,7 +12,7 @@ sonar.projectName=python-sdk
 # `-Dsonar.projectVersion=...` (see .github/workflows/rw_run_all_test_and_record.yaml),
 # so it always tracks the current release; this static value is the local-scan
 # fallback only.
-sonar.projectVersion=0.0.1rc2
+sonar.projectVersion=0.0.1rc3
 
 # Path is relative to the sonar-project.properties file. Replace "\" by "/" on Windows.
 sonar.projectBaseDir=./