[Vsevolod Kukol (sevoku)]

Description

Prepare version 1.4.0 for the merged rule, evaluation, and CI updates.

• Align vendor manifests, skill metadata, and both npm lockfile version fields at 1.4.0 without changing dependency entries.
• Update the version script and manifest validator to keep lockfile versions aligned; add regression tests for updates, dependency preservation, and invalid lockfiles.
• Consolidate the changelog into 1.4.0 and the missing 1.3.0 release summary, retaining dated Vally notes, exclusion reasons, CI evidence, and retry safeguards.

Type of Change

• Bug fix
• Documentation
• Build/Scripts

Related Changes

Follows the 1.3.0 version bump in #273 and includes the release history for #275, #276, #277, and #279.

[Copilot]

🟡 Changes recommended

Malformed lockfiles can leave a partial version bump, and the new regression tests are not wired into CI.

2 open issues

• Run version tooling regression tests in CI · New
• Parse lockfile before updating package manifests · New

What changed in this PR

Prepares the Cosmos DB agent kit’s 1.4.0 release and extends version tooling to keep npm lockfile versions aligned with release manifests.

Changes:

• Bumps package, vendor manifests, and skill metadata to 1.4.0 without dependency changes.
• Adds lockfile version updates, validation, and regression tests.
• Consolidates release history into 1.4.0 and 1.3.0 summaries while preserving evaluation evidence and safeguards.

File	Description
skills/​cosmosdb-best-practices/​metadata.json	Bumps skill metadata to 1.4.0.
scripts/​version.test.mjs	Adds versioning and lockfile regression tests.
scripts/​version.js	Updates both lockfile version fields during bumps.
scripts/​validate-manifests.js	Checks lockfile version alignment.
plugin.json	Bumps the root plugin to 1.4.0.
package.json	Bumps the package to 1.4.0.
package-lock.json	Aligns both version fields at 1.4.0.
gemini-extension.json	Bumps the Gemini extension to 1.4.0.
CHANGELOG.md	Consolidates release summaries and dated evaluation notes.
apm.yml	Bumps the APM manifest to 1.4.0.
.kimi-plugin/​plugin.json	Bumps the Kimi plugin to 1.4.0.
.cursor-plugin/​plugin.json	Bumps the Cursor plugin to 1.4.0.
.codex-plugin/​plugin.json	Bumps the Codex plugin to 1.4.0.
.claude-plugin/​plugin.json	Bumps the Claude plugin to 1.4.0.

_{Review effort: Balanced}

[Copilot]

🟢 Approval recommended

The supplied diffs show focused, consistent version-tooling changes with regression coverage and no identified blocking issues.

No open issues 🎉

2 resolved since last review

• Parse lockfile before updating package manifests
• Run version tooling regression tests in CI

_{Review effort: Balanced}

[Vsevolod Kukol (sevoku)]

Shell tests now pass but partition-high-cardinality is still flaky amongst some others, these are not regressions but new findings introduced by the new Vally pipeline. We'll review and address them separately.