The owner explicitly requested the next release including @barocss/render and the documentation website. #471 owns publishable render metadata, four-package release guards and staged public documentation. Execute implements and integrates only after fresh exact Review ACCEPT; Planner owns protected release promotion under the existing delegation.

Planned coordinated version: 0.12.0 for kit/browser/server/render. Render remains an experimental five-component React renderer, ESM-only with an external React peer; the host supplies state/actions/components, BaroCSS startup and any model transport. It makes no model-performance or broad UI-catalog claim. No additional model run is authorized or needed for this release.

Public registry artifacts verified. All four stable0.12.0 versions and latest tags became visible at13:43:46Z. Subsequent canonical tarball GETs matched public SHA-512 integrity and the original first-attempt npm SHA-1 receipts. Browser/server depend on kit0.12.0; all four tags and non-draft/non-prerelease Releases match exact main. Artifact gate passed; fresh consumer behavior and Docs promotion remain pending. Main is now 4f63396f7e57738dcfb81d06f6fcdb934d1bf35a; strict build/test protection, enforce_admins=true and zero required approving reviews remain active. Remote develop is the safe version merge b3f7e8f7b4a493c4f8e3dd1881f386962e6a281d. Local integration contains the accepted source work but its accumulated private research ancestry must never be pushed.

Safe checkpoint merged: #472 merged through the protected ordinary path to remote develop 84744c0b7a7cc0c178e0ab172182bc7a94925b92. Exact public head 560453ea96f5a80d7982dd14d581d2c60db706ce had independent #473 ACCEPT, corrected CI36700722351 and Docs build success before merge. Merged develop push CI36701037497 also passed. #473 is closed; its evidence records the stale local install failure and successful isolated/default and post-integration rerun. The safe snapshot history excludes private research ancestry; originals/private evidence and kiosk recordings stay local. Every later public branch must start from safe remote history. #474 is closed after four-package version/source promotion. #475 is closed after independent acceptance of the first-render setup artifact and concrete owner plan; no registry action is authorized by that preparation.

Version merged; final source candidate ACCEPT: protected version PR #476 merged after exact 71044f8a2cb60b3c4b9ac9c9cc57fce1cbae15a0 CI36703867016 success. Safe remote develop is now b3f7e8f7b4a493c4f8e3dd1881f386962e6a281d, tree 209ccb94183340ffa03d690bdbd04cc09cedc6a8. The focused merged-candidate Review accepts that exact source for ordinary develop-to-main preparation: source tree and all four tarballs match the original acceptance, ancestry contains protected main, and develop push CI36704130921 passed. The candidate subsequently reached main through protected PR #477; the single authorized OIDC run has since accepted all four publication commands; actual public registry verification remains outstanding. Local integration's transient manifest mismatch was restored and rerun honestly; no changed source was substituted for the accepted public candidate.

Main and staged Pages complete: protected PR #477 merged as main@4f63396f7e57738dcfb81d06f6fcdb934d1bf35a, with previous main and reviewed develop as its two parents, and the identical accepted tree. Exact main push build/test 36711676863 passed with npm publication skipped. Exact main Pages 36711676619 passed deployment. Live smoke at 2026-09-30T12:05:52Z passed homepage, Quick Start, API index, build-free UI, Vanilla HTML, render guide and render API. Existing published examples remain pinned to 0.11.2; render docs remain visibly unpublished. No website defect was found; two initial wording/runtime assertions were corrected against accepted source.

First-render owner setup complete: #475 preparation ACCEPT binds the reviewed @barocss/[email protected] artifact. The owner separately approved authentication, one public RC registration and render Trusted Publisher. CLI authentication and existing three-package read-write rights were verified. One RC publication succeeded with bootstrap; independent public registry integrity matches the exact reviewed artifact. npm also assigned first-package latest to the RC despite the explicit bootstrap flag. Planner disclosed and accepts that temporary state until normal stable publication replaces latest; no tag edit, cleanup, unpublish or retry was performed. The owner added GitHub barocss/barocss / npm-release.yml with direct publish; Planner restricted the initially blank environment to approved npm, and owner completed2FA. npm displays successful edit and the persisted npm environment. Registration observation, setup record, exact renderer consumer gate. The whole-release readiness and fresh exact preflight subsequently authorized one stable OIDC dispatch. No setup republish is needed.

Stable publication commands succeeded; final registry verifier failed: run36718373744, attempt1, exact main4f63396f, accepted all four npm publication commands at13:03:23–38Z. Each npm response stated that processing may take a few minutes. Build/test, OIDC publication and four tag/Release creation steps succeeded. The final31-attempt public registry verifier failed at13:09:42Z because stable package records were not visible. Independent Review reconciliation confirms four tags and non-draft Releases target the exact main; public metadata, dependencies, SRI tarballs and fresh consumers are not yet accepted. At13:32:38Z, about29 minutes after successful command receipts, all four canonical public package metadata still lacked0.12.0. An additional bounded read-only visibility check completed without public confirmation. Do not rerun publication, change tags or claim installation is verified. Keep website pins/staged render notices until read-only public reconciliation and consumer checks pass. The source ACCEPT remains valid. Follow-up #478 is blocked on public visibility and owns metadata/archive reconciliation, fresh consumers, normal ancestry sync, reviewed Docs-only promotion and live smoke.

Public visibility reconciled without a second publication step: the owner explicitly requested one ordinary failed-job rerun, then withdrew the need after npm became visible. Attempt2 publish job109913995190 was cancelled at13:41:30Z with no recorded steps; no second OIDC publication step was reached. Observation. The original publication checker now passes in read-only post mode. #478 is unblocked for fresh registry consumers, independent Review, normal ancestry sync, three-file Docs-only promotion and Pages/live checks. The staged site still uses published0.11.2 pins until this remaining verification completes. Do not republish0.12.0.

Reviewed protected source promotion and staged Pages deployment may proceed after full exact source/Review/CI gates. First-package authentication holds actual npm publication only; source preparation must not be needlessly held. Docs must not claim the planned version is already published. Initial first-publication authentication returned401; owner browser login has since completed, and an isolated-cache authenticated check passed. npm trust prerequisites require an existing package. The exact artifact, Review and separately approved setup are now complete. Do not publish the other packages first, weaken partial-publication guards, switch to a token, republish existing versions or bypass owner authentication. Docs install references stay on published versions until registry publication is verified; render docs remain visibly staged until promotion.

All three packages (@barocss/kit, @barocss/browser, @barocss/server) are npm latest 0.11.2. Release PR #451 merged to main@0f3560a3c3a6ddfb87a83ff9ed3470749c84e1f0. The single manual OIDC publish run succeeded. Independent postflight confirmed exact npm versions, dependencies, three tags at the release SHA and three published Releases. Fresh consumer checks passed installation, ESM, CommonJS, theme/CDN imports and CSS generation. Do not republish this version.

Fixes: empty runtime style segment collection (#440), Shadow DOM property registration under strict CSP (#442), transparent gradient via fallback (#445), and dark variant ordering with arbitrary-value parsing (#448). The release also includes accepted example/research updates. Synthetic json-render and authored visual fixtures do not establish live model output quality. Four deferred rendering gaps from #438 remain; corrected fallback coverage was Chromium-only.

The Docs staging correction #452 separated the published Docs version from source package versions. Release Pages deployment and live HTTP checks passed with install links intentionally on published 0.11.1 before npm publication. The subsequent Docs-only promotion #455 merged as main@0648a2b25918faba62438c93ca7124fed935d650. Its automatic Pages deployment succeeded. Live checks confirmed 0.11.2 install/CDN references on the homepage, Quick Start, Vanilla HTML, build-free UI and API index. Both exact jsDelivr ESM and UMD URLs returned 200. Final ancestry sync #456 merged as develop@9ef236cafe618add8848aa94a0d58798958b3c91. No npm republish occurred.

The owner delegated release work to Planner on September 26 and explicitly requested autonomous release completion on September 27. Planner may merge reviewed checkpoint/version/main/sync PRs and run the explicit OIDC publication when required checks pass. See Human Directives. Main stays protected; there is no automatic main-to-npm publication or branch-protection bypass. The manual-owner-merge wording in the September 23 history below is historical.

@barocss/* 0.11.1 are on npm as latest (publish run, PR #418). Fixes the boot-time FOUC race where transition utilities animated from unstyled values on about 1 in 20 to 1 in 3 first paints (#405/#407; app transitions are untouched), and hardens the scope guard against class matches inside attribute values (#396).

The Docs-only PR #423 later merged as main@6c2bf15cc067196db798ebda73128ab025588ea8; its Pages deployment passed. The PM's live audit checked the Quick Start, Vite + Tailwind guide, companion guide, API index, and homepage: the served Quick Start and API index show 0.11.1 without the earlier 0.10.1 pin. That merge changed Docs only and did not publish another npm version. The 0.4.0 Docs and branch states in Earlier history are the September 23 snapshot, not the current site.

@barocss/* 0.11.0 are on npm as latest (publish run, PR #410). Minor because output order changed: rules now follow Tailwind 4.3.3's property order (#401), so for overlapping utilities on one element the winning class matches Tailwind and can differ from 0.10.x; RuleKey widens to (number | string)[]. Also: opacity modifiers on arbitrary/custom-property colours match 4.3.3 (#393); !important is no longer added inside @property/@font-face/@keyframes/@counter-style, and the runtime inserts root rules one by one (#406). Browser fuzz (#406): no real scope escape; a local multi-seed browser ratchet (scripts/fuzz/browser-ratchet.mjs) is now part of the pre-release checklist.

@barocss/* 0.10.3 are on npm as latest (publish run, PR #399). Security (#392): class input with unusual separator characters can no longer produce a rule that applies outside its element; the fuzz CI ratchet now runs several seeds. Also bg-[var(--x)] / ring-[var(--x)] as colours (#386) and cross-partition rule order (#387). Upgrading is recommended.

@barocss/* 0.10.2 are on npm as latest (publish run, PR #390). The Shadow DOM fix (#384): @property-backed utilities (gradients, shadow-*, ring-*, translate-*) now work in root mode; a full-corpus shadow-mode test in Chromium, Firefox and WebKit went from 20/338 + 41/567 differences to 0/0. Upgrade recommended for Shadow DOM users (0.9.0–0.10.1).

@barocss/* 0.10.1 are on npm as latest (publish run, PR #368). Variant parity (#354, #360) and border parity (#344: border-x/y use logical inline / block), plus bg-(…:--x) type hints and stroke-[<length>] (#303).

@barocss/kit, @barocss/browser and @barocss/server 0.10.0 are on npm as latest (publish run, PR #362). Released by the Planner under the owner's release delegation.

Contents: strict CSP (#347: a nonce option and constructable-sheet mode; on a strict-CSP page parity goes from 0.02 with 572 violations to 1.0 with 0 violations; ssrStyleTag takes a nonce; #356 warns on a mismatched later call); negated variants and group-aria-* (#352); fuzz tidy-ups (#335); security-guide additions (#353: url() CSP and pre-filter; #355: Shadow DOM limits).

Process note: the first main merge (#359) failed the release test job on a timing ratio (49–56×). Extraction was re-measured as linear on develop and on 0.8.0; the test now counts bytes scanned deterministically (#361). A test-only changeset had to be dropped, because the publish check rejects pending changesets. No release-gating test measures wall-clock time any more.

@barocss/kit, @barocss/browser and @barocss/server 0.9.0 are on npm as latest (publish run, PR #350). Released by the Planner under the owner's release delegation.

Contents: Shadow DOM widgets (#327: a root option, root-scoped preflight, shared constructable sheets, 20 widgets 664 KB → 38 KB, embed parity 1.0); new theme keys create utilities (#300), with Tailwind's per-root precedence for custom keys (#338); preflight and rounded-full match Tailwind 4.3.3 (#336, with a comparison fixture); content-["x"] quoting (#325); a wider fuzz ratchet (#339); a security guide for untrusted class input (#345).

@barocss/kit, @barocss/browser and @barocss/server 0.8.2 are on npm as latest (publish run, PR #342). Released by the Planner under the owner's release delegation. Found by the #319 fuzz campaign and triaged by the BaroCSS Review session:

• security (#332): no class input can produce an unbalanced selector or prelude that disables the rules following it in concatenated CSS
• availability (#333): generation never throws; one bad class no longer fails a server sheet
• #334: digit-leading classes (every 2xl:) are escaped and apply
• #337: the browser runtime is silent unless debug is on

Also: logical radius (#321), CJS require exports (#322), vite 8.3.1 (#305; CDN build 63.4 → 47.9 KB gz). Upgrading is recommended for all 0.x users.

Process note: the checkpoint CI failed at "Check packed package exports", a CI-only step, because #322's nested export conditions broke the check script; fixed in a00dc15. Integration checks now also run node .github/scripts/check-packages.mjs.

@barocss/kit, @barocss/browser and @barocss/server 0.8.1 are on npm as latest (publish run, main 7a123a1, PR #330), with tags and GitHub Releases. Released by the Planner under the owner's release delegation; post-release sync #331 merged.

Security fixes (#323, reviewed by the BaroCSS Review session): generated CSS can't end an enclosing HTML <style> element, whatever the input, and theme configuration can't change the structure of the :root variable block. Docs: server examples use ssrStyleTag (#326). Upgrading is recommended for all 0.x users.

@barocss/kit, @barocss/browser and @barocss/server 0.8.0 are on npm as latest (publish run, main 7794846, PR #317), with tags and GitHub Releases. Released by the Planner under the owner's release delegation; post-release sync #318 merged.

Contents: Tailwind 4.3 support. The parity reference is 4.3.3 (100% on both corpora), with the 4.3 theme data, logical properties, scrollbar and font-features utilities, zoom, tab-size, container-size / not-@container, text-shadow and the shadow fixes. Also: vitest 5 (faster tests) and the adoption doc fixes (#306), after which a weaker model adopted it in a real starter 2/2.

@barocss/kit, @barocss/browser and @barocss/server 0.7.0 are on npm as latest (publish run, main 384ea03, PR #298), with tags and GitHub Releases. Released by the Planner under the owner's release delegation.

Contents: the server companion API generateCssForHtml with the client handoff (SSR), static custom utilities, config.prefix parsing, animate-* keyframes, and docs for dark-mode mapping and an Astro/SSR recipe.

Process note: the first two main merges failed the release workflow's test job on a wall-clock linearity test (52 ms against < 50, then a 33× ratio against < 30). The extractor was verified linear, and the test now counts regex calls deterministically (#295, #297). Keep release-gating tests free of wall-clock budgets.

@barocss/kit, @barocss/browser and @barocss/server 0.6.0 are on npm as latest, published by the npm-release workflow (run) from main 2035fe6 (PR #278), with tags and GitHub Releases. Release tracking: #276.

Contents: a security fix for 0.5.0 (upgrade recommended), SSR server output and per-class caching (first paint 1.000, ~0.1 ms per request warm), browser rule GC on by default, and theme/companion fixes. See each package's CHANGELOG.md.

Release process note: after each publish, merge main back into develop (the provenance check requires the next candidate to contain the previous main).

@barocss/kit, @barocss/browser and @barocss/server 0.5.0 are on npm as latest, published by the npm-release workflow (run) from main b4dac33 (PR #262), with tags and GitHub Releases. Release tracking: #256.

Highlights: Tailwind 4.1.13 parity on AI-generated UI (100% on a tuned and a held-out corpus), security hardening for untrusted class strings, and the production runtime companion for Tailwind-built apps. Behaviour changes and migration notes are in each package's CHANGELOG.md.

Known limitations fixed after 0.5.0 (next patch): self-referencing theme root vars (#260). Named custom spacing (#261) is in progress.

---

Last verified: September 23, 2026.

Track	Status	Evidence
npm 0.4.0	Present for @barocss/kit, @barocss/browser, and @barocss/server; browser and server depend on kit 0.4.0	kit, browser, server, Ship reconciliation
Git tags and Releases	Three non-draft 0.4.0 package Releases and tags point to main@9d0ab73176593cb06f65f48e173bb66020b724ee	kit, browser, server
Manual release workflow	Failed at postflight verification after successful publication; PM reconciled the public release. The verifier fix is merged in develop; the earlier promotion PR #96 closed without merge	Action run 35849259315, PM's withdrawn #96 GO
Docs Pages	Main Pages deployment and live browser smoke passed; live Quick Start still pins 0.0.3. The 0.4.0 update is merged in develop, but no updated Docs content has reached main	live smoke, closed PR #96

The release candidate was merged through PR #92 as main@9d0ab73176593cb06f65f48e173bb66020b724ee. Main build and test passed with automatic npm publication skipped. After Pages deployed, Docs verified the live Quick Start and key pages, including browser execution of the pinned 0.0.3 ESM and UMD baroStart() examples. PM then authorized one manual 0.4.0 dispatch, with a correction that the three matching package tags and GitHub Releases were in scope.

The manual run passed build, test, npm publish, and tag/Release steps but failed its final state check. The log first reported a tag before npm visibility and later reported partial npm publication. Ship's subsequent read-only reconciliation found all three npm versions, matching package dependencies, integrity-bearing tarballs whose file payloads match the validated candidate, and all three tags and Releases. Guard traced the postflight failure to checks completing before the kit registry record became visible. Release Manager passed fresh consumer install, TypeScript, ESM, CommonJS, and CDN checks. PM declared 0.4.0 published and externally reconciled, while keeping the workflow failure visible. Verifier fix PR #93 was reviewed and merged into develop@9d0494f; merge-commit CI passed. It waits for all three exact npm records before checking tags and Releases and still fails on a persistent partial state. It has not been promoted to main or used for another publish. Do not repeat the publish dispatch or change tags.

The live Quick Start still pins 0.0.3 installation and CDN examples and describes 0.4.0 as a candidate. Its examples were correct for the public version at the time of the Pages deployment. Docs PR #94 updates the installation and CDN examples to 0.4.0 and removes stale candidate wording. It merged into develop@63baa2d, and merged-SHA CI passed. The older promotion PR #96 passed protected main checks with npm publish skipped and built Docs without deployment, but PM withdrew its exact-SHA merge GO. It closed unmerged on September 23. Those checks cover only its older Docs/verifier delta; they do not approve the expanded release candidate. Main remains 9d0ab73, and no new Pages deployment or live 0.4.0 Docs smoke has occurred. Do not republish the already public 0.4.0 packages.

The live Presets guide also imports defaultTheme from @barocss/kit/theme. The published kit 0.4.0 export map exposes ./theme/default, not ./theme, so that exact guide import fails with ERR_PACKAGE_PATH_NOT_EXPORTED. Docs PR #100 corrects this one page, passed its exact-head CI and Docs build with deployment skipped, and merged into develop on September 23. Browser API Docs PR #78 also merged into develop that day. Neither change has reached main or the live site.

The live Frameworks guide also uses a bare @barocss/browser import in a plain HTML module script, which a browser cannot resolve without a bundler or import map. The one-page Docs PR #104 replaces that build-free example with a pinned published 0.4.0 CDN ESM URL. Its exact-head CI and Docs build passed, and the URL and exported baroStart were checked; a mounted browser session was not run. PM included it provisionally in the next develop candidate after the ordered package fixes and fresh final-base checks. PR #104 remains open, and the live guide is unchanged.

1. Integrate verified feature, package, workflow, and Docs fixes through reviewed PRs into develop with their applicable checks. Release cleanup PR #102 merged as develop@b0f8e7e: the duplicate promotion workflow was removed, the previous-main ancestry check remains in the manual release checker, and Changesets excludes the private site. Kit CommonJS fix PR #97 then merged as develop@c3efb40; merged-SHA CI and fresh packed consumer checks passed. These are source integrations, not new published artifacts. PM withdrew the earlier #96 GO so the remaining fixes can be considered together; inclusion of browser preload PR #101 remains undecided pending its browser evidence.
2. Align the three public packages through one reviewed Changesets version PR on develop. Only after exact candidate checks and PM decision, prepare one release-ready develop → main PR. The user merges that final PR manually; PR #92 is the completed 0.4.0 example. The closed #96 is not that final candidate. Do not use automatic promotion or automatic npm publication.
3. When that main merge includes Docs changes, the reviewed Pages workflow deploys automatically. Verify the live site afterward. npm publication is a separate manual OIDC Action requiring its own exact-main-SHA/version PM GO and registry checks; the main merge alone is not a publication instruction.
4. Bring the released main commit back into develop ancestry through a reviewed sync PR before stacking the next release work. For 0.4.0, PR #95 merged main@9d0ab73 into develop@2871968 without changing the develop tree; its merged-SHA CI passed. This ancestry sync neither republished npm nor deployed Pages.