release: v0.10.0-beta.4

[openab-app]

Merge this PR to tag v0.10.0-beta.4 and trigger the build pipeline.

[chaodu-obk]

Important

CHANGES REQUESTED ⚠️ - The version bump is internally consistent, but the release is not ready while mandatory policy CI is failing and the chart can reference artifacts this release does not guarantee.

What This PR Does

This PR advances the Helm chart and application version from 0.10.0-beta.3 to 0.10.0-beta.4. Merging the generated release branch is intended to publish the chart, create tag v0.10.0-beta.4, and start the tag-driven image pipeline.

How It Works

The release generator updates charts/openab/Chart.yaml. A merge to main triggers the GitHub Pages chart release, while the merged release/v* branch causes tag-on-merge.yml to push a v* tag that starts build-operator.yml for agent images and the OCI chart.

Findings

#	Severity	Finding	Location
F1	🟡 Important	The generated PR body omits every mandatory Review Contract section, and the exact-head validate check is failing.	PR body; .github/workflows/release-pr.yml:95
F2	🟡 Important	Updating appVersion also changes the optional gateway's implicit image tag to 0.10.0-beta.4, but the gateway workflow publishes only independently versioned gateway-v* tags.	charts/openab/Chart.yaml:6; charts/openab/templates/gateway.yaml:41
F3	🟡 Important	The GitHub Pages chart release can be published from the merge before the tag-driven image build succeeds, leaving an installable chart that may temporarily or permanently reference unavailable agent images.	.github/workflows/release.yml:3-9; .github/workflows/tag-on-merge.yml:26-35
F4	🟢 Praise	version and appVersion are synchronized, use valid prerelease SemVer, and match the release branch/tag derivation.	charts/openab/Chart.yaml:5-6

Finding Details

🟡 F1: Generate a policy-compliant release PR body

The current body contains only the merge instruction. The base-branch policy requires exactly one ## Review Contract section with meaningful ### Goal, ### Non-goals, ### Accepted Residual Risks, ### Acceptance Criteria, and ### Follow-ups content. The exact-head Review Contract job completed with failure, so this PR is blocked independently of the code review.

Requested change: Add substantive required sections to this PR body, then update release-pr.yml so future automated release PRs are compliant by construction. If mechanical release PRs are intentionally exempt, use the repository's explicit exemption policy rather than leaving the required check red.

🟡 F2: Decouple or produce the gateway tag used by the chart

When a user enables the bundled gateway without setting gateway.tag, the template resolves ghcr.io/openabdev/openab-gateway:0.10.0-beta.4. However, build-gateway.yml triggers on gateway-v* and publishes the gateway component version, while this PR creates v0.10.0-beta.4; no repository workflow maps that application tag to a matching gateway image tag. The gateway is optional, but the chart's documented default should not resolve to an artifact the release does not produce.

Requested change: Pin the chart to a known compatible gateway version or publish a matching alias as part of the application release. Add a Helm unit test for the enabled-gateway default image so this cross-component contract is explicit.

🟡 F3: Gate chart availability on release artifact readiness

release.yml runs as soon as the Chart file reaches main, independently of the v* tag image build. Because the chart derives agent tags from appVersion, publishing it before build-operator.yml completes creates an avoidable window where new installs can fail with image pulls; a failed image workflow can make that state persistent.

Requested change: Publish the user-facing chart only after the matching image manifests are successfully created and verified, or add an equivalent artifact-existence gate before chart publication.

🟢 F4: Minimal and consistent release metadata

The two changed fields are synchronized at 0.10.0-beta.4, the merge-derived tag is exactly v0.10.0-beta.4, and git diff --check is clean. The exact-head check and helm-unittest jobs passed.

Group Review Summary

Reviewer	Verdict	Contribution
Reviewer A	Changes requested	Confirmed the mandatory contract failure and release artifact ordering risk.
Reviewer B	Changes requested	Confirmed the generator creates a noncompliant body and the version bump itself is minimal.
Reviewer C	Changes requested	Confirmed CI coverage passes chart tests but does not gate artifact availability.
Reviewer D	Changes requested	Confirmed image traceability concerns while finding no dependency or permission changes.
Reviewer E	Changes requested	Confirmed the gateway image-tag mismatch and release integration risk.

Addressing External Reviewer Feedback

No external review comments, submitted reviews, or review threads existed when this review was finalized.

Baseline Check

• PR opened: 2026-09-08
• Declared base: main at dabc2fce06105f2354bbccf576ba64f814cf6e33
• Reviewed head: fb189f58021d89eb5ae8f2f048014e23fb98eefd
• Merge base: dabc2fce06105f2354bbccf576ba64f814cf6e33
• Diff: one file, 2 additions, 2 deletions
• Main already has: automated release PR generation, tag-driven agent builds, independent gateway releases, and separate GitHub Pages chart publication
• Net-new value: selects 0.10.0-beta.4 as the next chart/application release and therefore changes every default appVersion-derived image reference
• Validation: git diff --check passed; exact-head check and helm-unittest passed; exact-head Review Contract validate failed

What's Good (🟢)

• The change is intentionally small and easy to audit.
• Chart version and appVersion remain synchronized.
• The prerelease progression from beta.3 to beta.4 is monotonic.
• No dependency, workflow-permission, or application-code changes are mixed into the release bump.

5. Three Reasons We Might Not Need This PR

1. The mandatory release decision record is absent - The red Review Contract check means the release scope, acceptance criteria, and residual risks have not been recorded.
2. The chart can select an unproduced component tag - Users of the optional gateway may need an explicit override, weakening the claim that this chart is a coherent beta.4 release.
3. Publication is not atomic with image readiness - If image production is delayed or fails, publishing beta.4 adds a release artifact that users cannot reliably deploy.