Pin the SDK to the v0.19.0 release

[jeremy]

go.mod pinned github.com/basecamp/basecamp-sdk/go at
v0.18.1-0.20260916210227-4523eac74cfa, a main pseudo-version taken while the
event-feed operations were still unreleased. basecamp-sdk v0.19.0 is now
tagged and published, so the pin becomes the release tag.
#732, which set the
pseudo-version, said exactly this: "moving to the tag is a one-line bump once it
exists."

It is a one-line bump in go.mod, plus everything that has to move with it.

What moved

• go.mod / go.sum — v0.18.1-0.20260916210227-4523eac74cfa → v0.19.0.
• internal/version/sdk-provenance.json — rewritten by make bump-sdk REF=v0.19.0: version v0.19.0, revision 6abe227204a4, updated_at
2026-09-16T21:15:28Z. make provenance-check passes.
• internal/mcpserver/model/PROVENANCE.json — re-synced with
  scripts/sync-mcp-model.sh against a clean go/v0.19.0 checkout. The ref now
  reads go/v0.19.0 (was the go/v0.18.0-63-g4523eac7 describe) and the commit
  6abe227204a465ced72969f10e32d3a06e77bcc1.
• nix/package.nix — vendorHash recomputed.
• API-COVERAGE.md — the "SDK version" note claimed the pin has to be a
  main pseudo-version because the event-feed operations are unreleased. They
  are released; the note now names v0.19.0.

The MCP model snapshot is unchanged apart from its provenance

behavior-model.json and openapi.json came back byte-identical. The tag
commit 6abe2272 is a direct child of the pinned 4523eac7 and its only
content is "Bump version to 0.19.0" — per-language version strings and lockfiles,
nothing in the Smithy-derived exports. So the re-pin moves a label, not a
surface.

No knock-on

Everything in v0.19.0's nine MIGRATING sections — the gauges changes, the
Retry-After convergence, typed person ids, the event-feed error shapes — was
already in the pinned revision and already absorbed on main. The one silent
Go break in the release notes is basecamp.RecordingSummaryCode(err) returning
("usage", true) for ErrBucketMismatch where it returned ("", false); this
CLI never calls RecordingSummaryCode, it matches
errors.Is(err, basecamp.ErrBucketMismatch) directly in
internal/connector/admission/verdict.go, which did not change. Build and tests
confirm it: no source change was needed anywhere.

vendorHash

sha256-mT0oVMMRcmpbszb0zVYd1k8cZfMHKHZRbhsy/+8GHxo= →
sha256-uiNB0+zjvdDTI7RbC1hwiuUGNJzh7P1DFnr7rInjco0=

Computed and verified locally with make update-nix-hash, which runs the pinned
nixos/nix image over the working tree, extracts the hash from the fixed-output
mismatch, writes it, and then rebuilds to prove the corrected hash builds.
Both builds are in the log; the second exited 0.

This is done by hand because the workflow that would normally refresh it cannot:
cli-release-bot has no installation on this repository, so
actions/create-github-app-token 404s before the job reaches the build. A
go.mod/go.sum change always invalidates vendorHash, and nothing else
refreshes it — so leaving it would have landed the Nix build red.

Gates

make provenance-check, the MCP/catalog unit tests, e2e/event_feed.bats (8/8),
the three Nix script bats files (23/23), and bin/ci — make check end to end:
fmt-check, vet, lint, lint-actions, test, test-e2e, test-sync-skills,
check-naming, check-surface, check-skill-drift, check-bare-groups,
check-lint-lockstep, check-smoke-coverage, provenance-check, tidy-check.
Every one green except test, which has a pre-existing TTY-detection failure set
in this sandbox: 11 tests across internal/appctx, internal/cli,
internal/commands, internal/stdinarg and internal/tui/resolve
(TestIsInteractive*, TestIsTerminal, TestInteractiveStdio,
TestInteractivePrompt, TestPredicatesDisagreeOnTheStreamTheyAskAbout,
TestDeleteConfirmableFollowsTheAudienceNotTheDevice,
TestBareBasecampNeverReportsASetupError, TestExplicitSetupStillRefuses). That
set reproduces identically — same 11 tests, same 5 packages — on unmodified
origin/main (688d9ce) in a separate worktree. Nothing else fails.

---

Summary by cubic

Pins github.com/basecamp/basecamp-sdk/go to the v0.19.0 release tag, replacing the main pseudo-version taken before the event-feed operations shipped. The tag commit is a direct child of the old pin and only contains version bumps, so the MCP model files are byte-identical apart from their recorded provenance.

Migration

• nix/package.nix has a new vendorHash, recomputed and verified with make update-nix-hash.

^{Written for commit 01799bb. Summary will update on new commits.}

[jeremy]

@codex review

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-09-16T22:07:00.278062Z	01799bb	Manual request

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[Copilot]

🟢 Approved

The release tag matches the recorded commit, and all required lockfile, provenance, documentation, and Nix updates are present.

Pull request overview

Pins the Basecamp SDK to the published v0.19.0 release and synchronizes dependent metadata.

Changes:

• Updates Go module checksums and SDK provenance.
• Refreshes MCP provenance and API coverage documentation.
• Recomputes the Nix vendor hash.

[!TIP]
If you aren't ready for review, convert to a draft PR.
Click "Convert to draft" or run gh pr ready --undo.
Click "Ready for review" or run gh pr ready to reengage.

File summaries

File	Description
go.mod	Pins SDK v0.19.0.
go.sum	Updates SDK checksums.
internal/version/sdk-provenance.json	Records the release commit and timestamp.
internal/mcpserver/model/PROVENANCE.json	Aligns MCP provenance with the release tag.
nix/package.nix	Updates the dependency vendor hash.
API-COVERAGE.md	Documents the released SDK version.

Review details

• Files reviewed: 5/6 changed files
• Comments generated: 0
• Review effort level: Balanced

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[chatgpt-codex-connector]

Codex Review: Didn't find any major issues. 🎉

Reviewed commit: 01799bb34a

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[jeremy]

Review threads: 0 resolved (0 fixed, 0 declined). Copilot approved on 01799bb with 0 comments and no suppressed findings; Codex completed on the same commit with no major issues. All checks green, including "Nix flake builds" — which is the CI-side confirmation of the locally recomputed vendorHash.

[jeremy]

Obsolete — closing.

#729 landed the SDK re-pin itself, and #735 landed the API-COVERAGE.md correction. Against current main (9e4d77a) this branch's go.mod line and internal/version/sdk-provenance.json are byte-identical to what is already there (v0.19.0, revision 6abe227204a4).

The only content unique to this branch is nix/package.nix's vendorHash, and it is stale: sha256-uiNB0+zjvdDTI7RbC1hwiuUGNJzh7P1DFnr7rInjco0= here against sha256-fbSMybSFUlSHIE8/aqLH/QCu+Q3cvJV/qpBAKz7VAZI= on main. That one line is the conflict, and it is the one thing that must not land.