[Nic-dorman]

Package bump for the antd 0.17.0 round, following the pattern of #386. sha256 on upload results and manifest entries (V2-1724, #390–#405) is on main but in no published package yet, so every registry-published daemon client moves up a minor version.

Package	Registry	Version	Tag to push after merge
antd-py	PyPI antd	0.3.0 → 0.4.0	antd-py-v0.4.0
antd-js	npm @withautonomi/antd	0.3.0 → 0.4.0 (package.json + both package-lock root entries)	antd-js-v0.4.0
antd-csharp	NuGet Autonomi.Antd	0.3.0 → 0.4.0	nuget-v0.4.0
antd-dart	pub.dev antd_client	0.3.0 → 0.4.0 (pubspec, CHANGELOG "Unreleased" → 0.4.0, README ^0.4.0)	dart-v0.4.0
antd-ruby	RubyGems antd	0.3.0 → 0.4.0	ruby-v0.4.0
antd-php	Packagist autonomi/antd (mirror)	tag-only	php-v0.4.0
antd-rust	crates.io antd-client (held: no crates.io token yet)	stays 0.4.0 (unpublished; the sha256 fields fold into it)	held
antd-mcp	PyPI antd-mcp (held, never published)	stays 0.1.0; antd[rest]>=0.3.0,<0.5 (see below)	held

Notes

• Additive only: sha256 is a new optional field on the upload results and manifest entries in every SDK (null/None/nil when the daemon doesn't report it, so it works against antd < 0.17.0). Every package is still pre-1.0, and the minor bump matches the antd 0.17.0 minor.
• antd-mcp: only the cap moves (<0.4 → <0.5); the floor stays at 0.3.0. Python CI installs the checkout's antd-py (0.4.0), which the old cap rejects, and the security audit resolves against PyPI, which has no 0.4.0 yet. Checked locally: uv pip compile antd-mcp/pyproject.toml resolves antd==0.3.0, mcp==2.3.0. _fields.sha256_of already reads the field defensively, so 0.3.0 still works. The README now says the sha256 fields need SDK 0.4.0 as well as antd 0.17.0. After antd-py-v0.4.0 publishes, a follow-up raises the floor to 0.4.0.
• antd-go was already released by the v0.17.0 tag (antd-go/v0.17.0).
• Not registry-published, so not bumped here: Java, Kotlin, Swift, Elixir, Lua, Zig, C++.

After merge

Push one tag per push (GitHub drops workflow events when more than 3 tags arrive in one push), in this order: antd-py-v0.4.0, antd-js-v0.4.0, nuget-v0.4.0, dart-v0.4.0, ruby-v0.4.0, php-v0.4.0. Then approve each environment and check that each registry lists the new version.

Verified

• Each bumped manifest parses with the new version (pyproject, package.json, both package-lock root entries).
• The only remaining 0.3.0 mentions in these packages are feature floors ("SDK 0.3.0 or later" for pointers/manifests), CHANGELOG history and the MCP compat tests that simulate a 0.3.0 SDK.

🤖 Generated with Claude Code

[MaidSafe-Hermes]

APPROVE — reviewed head dde3db4 against base e1c1e1d.

No blocking defects found. The five SDK package versions are consistently 0.4.0; the npm lockfile, Dart README, and Dart changelog match. The MCP range >=0.3.0,<0.5 intentionally retains 0.3 compatibility until 0.4.0 is published. I verified _fields.sha256_of uses getattr(..., None), the upload and manifest paths use it, and test_sha256.py covers legacy objects without the field and daemon responses without sha256.

CI at this head is green, including Python, MCP, JS, Dart, C#, Rust checks and security audits. The targeted review concern raised by sol-1 is resolved by source and test inspection.

Coverage: 2/2 seats reviewed (sol-1 gpt-6.1-sol xhigh; glm-1 z-ai/glm-5.3). Both seats agree (two model families) on the version alignment; sol-1 returned UNCERTAIN only because the compatibility helper was outside the supplied patch, which I verified at this exact head. No merge or release authority implied.