chore(release): prepare agent-eval 0.137.0

[drewstone]

Summary

• release the trace analyst measurement and review-integrity APIs merged in feat(analyst): measure and validate trace analysis #489 and fix(analyst): enforce exact reviews, cost, and scoring #490
• keep npm and Python package versions locked at 0.137.0
• name the release in the changelog

Proof

• pnpm test: 321 files passed, 2 skipped; 4,383 tests passed, 3 skipped
• pnpm typecheck
• pnpm build
• pnpm verify:package
• pnpm audit --prod --audit-level high: zero known vulnerabilities
• clean merge simulation against origin/main

[tangletools]

✅ Auto-approved drewstone PR — a1c60d0d

This PR was opened by the trusted drewstone account.
The full PR reviewer audit still runs separately and will publish findings if it detects issues.

_{tangletools · auto-approval · reason: drewstone_author · 2026-07-30T01:57:23Z}

[tangletools]

🟢 Value Audit — sound

Verdict	sound
Concerns	0 (none)
Heuristic	0.0s
Duplication	0.0s
Interrogation	70.2s (2 bridge agents)
Total	70.2s

💰 Value — sound

Routine release-prep bumping 0.136.0→0.137.0 across all five version-bearing files in lockstep, publishing the trace-analyst and review-integrity work from #489/#490; textbook in-grain change.

• What it does: Bumps the locked version from 0.136.0 to 0.137.0 in all five places that carry it: package.json (npm), clients/python/pyproject.toml (PyPI), clients/python/src/agent_eval_rpc/init.py (PackageNotFoundError fallback at line 56), clients/python/uv.lock (editable-install lock at line 37), and CHANGELOG.md (renames the [Unreleased] header at line 7 to [0.137.0] - 2026-07-29). No code or behavior de
• Goals it achieves: Publishes the trace-analyst measurement and review-integrity APIs that landed in merged PRs #489 (f0862dd, feat: measure and validate trace analysis) and #490 (7b6715a, analyst blocker fixes) by stamping a version consumers can pin. Keeps npm and PyPI versions locked, as the CHANGELOG preamble (line 3) mandates.
• Assessment: Coherent and complete. All five version references are bumped atomically with no stragglers (grep for 0.136.0 returns only the CHANGELOG history entry at line 38, which is correct). The [Unreleased]→versioned-header rename matches the exact pattern of prior releases (e.g. commit 1243ca2 renamed 'Unreleased' to '[0.135.2]'). No release-automation tooling exists in the repo (no release-it, changeset
• Better / existing approach: none — this is the right approach. Searched for release-automation tooling (glob for release/version/bump scripts; grep for release-it|changesets|standard-version|semantic-release in package.json) and found none. The only release-related source files (src/release-confidence.ts, src/release-report.ts) implement release-gating verdicts, not version bumping. Every prior release in git log was a manua
• Model: opencode/zai-coding-plan/glm-5.2
• Bridge attempts: 2
• Bridge warning: opencode/kimi-for-coding/k2p7: bridge stream ended without value-audit content

🎯 Usefulness — sound

A coherent, complete version bump to 0.137.0 across npm + PyPI + uv.lock + CHANGELOG, releasing the merged trace-analyst and review-integrity work from #489/#490.

• Integration: The bumped fields are the canonical version sources that npm publish (package.json:3) and PyPI/Hatch (pyproject.toml:7) read directly; agent_eval_rpc.__version__ (init.py:56) is what Python consumers introspect at runtime. Reachable by definition — these are the publish inputs, not surface that needs a caller.
• Fit with existing patterns: Matches the documented release convention exactly: CHANGELOG.md:3 states npm + PyPI versions are intentionally locked together, and all four version surfaces move in lockstep with one named, dated CHANGELOG header. No competing version source exists (grep found no TS VERSION constant; the only legacy 0.136.0 is the prior-release changelog entry at CHANGELOG.md:38).
• Real-world viability: A metadata-only version bump; nothing runtime to stress. CHANGELOG content matches the features actually merged in #489/#490 (verified against git log), so the release description is not aspirational fiction.
• Model: opencode/zai-coding-plan/glm-5.2
• Bridge attempts: 1

No concerns — sound change, no better or existing approach found. ✅

---

What this audit checks

It judges the change on its merits — not whether it was tasked out in an issue. Unticketed, fast-moving work is fine; the question is whether the change is good and whether a better or existing approach should be used instead.

Pass	What it asks
Heuristic	Vague title? Whitespace-only or cruft-bearing diff? (content signals only)
Duplication	Do added function/class names already exist elsewhere in the repo?
Value Audit	What does it do? What goal does it achieve? Is it good? Better architecture or already-exists?
Usefulness Audit	Does it integrate and fit? Will it hold up in real use and actually get used?

Findings are concerns, not blocks — the human reviewer decides what to do with them.

_{value-audit · 20260730T015901Z}