chore(master): release 0.5.0

[github-actions]

🤖 I have created a release beep boop

0.5.0 (2026-08-05)

Features

• evidence: represent GSTR JSON artifacts in filed-return live evidence (#110) (54479aa)

Fixes

• download: bind portal blob capture and cancellation to the Pack action (#112) (22ae918)
• gst: bind filed-return acquisition to the requested target (#96) (bf10bf3)
• gst: restore returns dashboard and GSTR-2B download (#125) (32a92e7)
• injection: make MAIN-world functions self-contained across the executeScript boundary (#116) (20e7422)
• recovery: keep unproven artifact outcomes in review (#106) (c3c98ea)
• recovery: persist direct download completion proof (#135) (52c66d8)
• recovery: reconcile a cancelled target from exact download evidence (#113) (b7447bb)
• recovery: reconcile a completed acquisition checkpoint after worker death (#117) (61b63fd)
• recovery: retain acquisition checkpoints (#126) (93171b4)

Documentation

• agent: align reviewed manifest boundaries (#82) (818ebf7)
• agents: record that the PR body is gated and where its contract lives (#114) (ff95027)
• privacy: disclose full-year ZIP correlation fields and retained JSON bytes (#105) (4fbdd78)
• readiness: add full-year recovery QA matrix (#132) (9cd0737)
• readiness: clarify full-year recovery matrix (#134) (114b80a)
• store: refresh v0.4.0 listing assets (#83) (c7d306e)

Tests

• release: cover release-please API contract (#133) (155fd54)

Maintenance

• deps-dev: bump @types/chrome from 0.2.2 to 0.2.5 (#129) (371f87a)
• deps-dev: bump prettier from 3.9.4 to 3.9.6 (#89) (28204b3)
• deps-dev: bump release-please from 17.10.1 to 17.11.1 (#128) (d2fd677)
• deps-dev: bump typescript-eslint from 8.63.0 to 8.65.0 (#88) (a92babd)
• deps: bump actions/checkout from 7.0.0 to 7.0.1 (#86) (4d4bb4e)
• deps: bump actions/setup-node from 6.4.0 to 7.0.0 (#87) (3b8492e)
• deps: remediate high severity audit findings (#94) (ae38ce8)

---

Pack Workflow Preflight

• Generated by Release Please. pnpm workflow:preflight runs in Review findings gate.

Privacy And Data-Flow Impact

• Release metadata only; no extension runtime, browser permission, host permission, network, credential, GST file, taxpayer-data, analytics, or telemetry behavior changes are introduced by this generated PR.

Sensitive Surface Review

• Release metadata only; no current-tab targeting, portal target binding, download completion, service-worker durability, local path, raw URL/referrer, or portal HTML behavior is changed by this generated PR.

Verification

• Pack CI and Review findings gate are required for the latest PR head.
• Release ZIP and provenance will be produced by the Pack Release workflow after the release PR merges.

PR Review Follow-Up

• Autogenerated review comments and inline review threads should be inspected before merging.
• Follow-up release hardening remains separate from this generated Release Please PR.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: fa83846c14

ℹ️ About Codex in GitHub

Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".

[chatgpt-codex-connector]

Align public source-version claims

With this bump, the canonical source version becomes 0.4.1, but the public status/readiness copy still says the repository source has advanced only to v0.4.0 (README.md:47, docs/PUBLICATION_READINESS.md:29). Because those pages distinguish source releases from Store-published evidence, shipping the release with stale source-version claims makes the public release status false until the claims are updated or narrowed.

AGENTS.md reference: AGENTS.md:L49-L53

Useful? React with 👍 / 👎.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 8d69f7f489

ℹ️ About Codex in GitHub

Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".

[chatgpt-codex-connector]

Align public source-version claims with 0.5.0

When this release PR lands, the canonical package/runtime version becomes 0.5.0, but the public status copy still says the repository source has advanced only to v0.4.0 (README.md:47, docs/PUBLICATION_READINESS.md:29). Fresh evidence since the earlier review comment is that this diff now bumps the canonical version to 0.5.0, so those source/readiness claims remain false until they are updated or narrowed.

AGENTS.md reference: AGENTS.md:L49-L53

Useful? React with 👍 / 👎.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 235ff959e9

ℹ️ About Codex in GitHub

Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".

[chatgpt-codex-connector]

Qualify the GSTR-2B release note

For readers of the public v0.5.0 release notes, this unqualified "GSTR-2B download" fix strengthens the current source/store claim: the manifest/package/README still describe GSTR-2B as private, source-build experimental support rather than a generally supported download. Keep the same qualifier here, or avoid naming it as an unqualified release capability, so the generated release notes do not overstate the shipped public surface.

AGENTS.md reference: AGENTS.md:L137-L137

Useful? React with 👍 / 👎.