Release gate: react_on_rails 17.1.0

[justin808]

Final release target

react_on_rails 17.1.0

Release coordination

• Release branch: release/17.1.0
• Initial cut SHA: cf39d07ea02a6fba644cbfd0854f75e17009fae0
• Phase: rc
• Current candidate: not cut
• Tag/publication status: no v17.1.0* tag or 17.1 artifact has been created
• Merge authority: ask
• Tag/publication authority: none until an explicit maintainer go/no-go

Package versions under test

Planned first candidate; these versions are not published yet:

• react_on_rails gem: 17.1.0.rc.0
• react-on-rails npm: 17.1.0-rc.0
• react_on_rails_pro gem: 17.1.0.rc.0
• react-on-rails-pro npm: 17.1.0-rc.0
• react-on-rails-pro-node-renderer npm: 17.1.0-rc.0
• create-react-on-rails-app npm: 17.1.0-rc.0
• shakapacker gem/npm, if changed: unchanged / pending verification
• cpflow, if changed: unchanged / pending verification

Agent Release Mode

Mode: strict-rc
Allowed modes: development, accelerated-rc, strict-rc, final-release
Auto-merge threshold: not enabled unless Mode is intentionally changed to accelerated-rc
Recent close guard: use Released or Superseded by #NNN in the closing label/comment
Full interpretation rules: AGENTS.md -> Release Mode And Auto-Merge Coordination

Pre-RC.0 blockers

• Resolve #4825: malformed credential URL fallback redaction.
• Resolve #4827: fetched RSC payload allowlist parity.
• Investigate or explicitly disposition #4822: production console-replay diagnostic exposure.
• Close or supersede the completed 17.0.1 release tracker #4806.
• Reconcile and stamp the release-branch changelog for 17.1.0.rc.0.
• Verify the generated six-package version bump and lockfile consistency.
• Produce maker-distinct security QA on the exact candidate head.

Hard gates

Non-demo gate

• react_on_rails generator/install smoke
  • RC/final version: pending
  • Commands:
    • (cd react_on_rails && bundle exec rspec spec/react_on_rails/generators)
    • pnpm run build
    • CREATE_ROR_SMOKE_SCOPE=oss packages/create-react-on-rails-app/scripts/smoke-test-local-gems.sh
  • Result: pending
  • Issue/waiver: none

App gates

• shakacode/hichee

  • PR: pending
  • Public-safe evidence: pending
  • Tester/date: pending
  • Issue/waiver: none

• shakacode/react-on-rails-demo-flagship

  • PR: pending
  • Public-safe evidence: pending
  • Required CI: pending
  • Issue/waiver: none

• shakacode/react-on-rails-demo-marketplace-rsc

  • PR: pending
  • Install/build/smoke evidence: pending
  • Required CI: pending
  • Issue/waiver: none

• shakacode/react-on-rails-demo-hacker-news-rsc

  • PR: pending
  • Install/build/smoke evidence: pending
  • Required CI: pending
  • Issue/waiver: none

• shakacode/react-on-rails-demo-gumroad-rsc

  • PR: pending
  • Install/build/smoke evidence: pending
  • Required CI: pending
  • Issue/waiver: none

• shakacode/react-webpack-rails-tutorial

  • PR: pending
  • Install/build/smoke evidence: pending
  • Required CI: pending
  • Issue/waiver: none

• shakacode/react-on-rails-starter-tanstack

  • PR: pending
  • Install/build/smoke evidence: pending
  • Required CI: pending
  • Issue/waiver: none

RC results

Pre-RC.0

• Version(s): planned 17.1.0.rc.0 / 17.1.0-rc.0
• Release branch initial CI: 9/9 branch-triggered workflows passed at the initial cut SHA
• Released at: not released
• Hard gates completed: none yet
• Suspected RC regressions: none yet; pre-candidate security blockers are listed above
• Waivers: none
• Decision for next step: resolve pre-RC.0 blockers, prepare the candidate, then request an explicit maintainer go/no-go

Advisory AI review checks

• Claude: pending
• CodeRabbit: pending
• Cursor Bugbot: pending
• Codex: pending
• Other: pending
• Actionable issues filed: Audit: does consoleReplayScript leak server error detail on the fetched RSC payload path? #4822, strip_userinfo only redacts through the first @, leaking passwords containing an embedded @ #4825, [Pro] RSC fetched-payload redaction uses a denylist while the inline path uses an allowlist #4827

Shelved or non-gating repos

• shakacode/react-on-rails-demo-ssr-hmr: outdated; modernization remains non-gating
• shakacode/react-on-rails-example-migration: migration example is not a current final gate
• shakacode/react-on-rails-example-open-flights: migration reference; non-gating
• shakacode/react-on-rails-demo-v16-bundle-splitting: older archived example; non-gating
• shakacode/react_on_rails-demo-octochangelog-on-rails-pro: useful Pro/RSC signal; non-gating
• shakacode/react-on-rails-rsc-demo: retired and archived; validate through the monorepo generator gate

Final-version bump PRs

• Hard-gate repositories updated to the final version or assigned focused follow-ups
• Final bump PR evidence recorded here after publication

Final go/no-go

Before final release

• Every hard gate passed or has an explicit waiver
• Every suspected RC regression is fixed or filed
• HiChee evidence is public-safe
• Maintainer approving final release:
• Decision:

After final release

• Fresh final bump PRs opened
• Final bump PRs merged or follow-up issues filed
• Tracker close summary posted with Released or Superseded by #NNN

[justin808]

Batch record: ror-17-1-security-stabilizers-20260803

• Phase: pre-17.1.0.rc.0
• Mode: strict-rc
• Target branch: release/17.1.0
• Exact starting head: cf39d07ea02a6fba644cbfd0854f75e17009fae0
• Scope: strip_userinfo only redacts through the first @, leaking passwords containing an embedded @ #4825, Audit: does consoleReplayScript leak server error detail on the fetched RSC payload path? #4822, and [Pro] RSC fetched-payload redaction uses a denylist while the inline path uses an allowlist #4827 only
• Execution: serial fix lanes, followed by maker-distinct adversarial QA
• Merge authority: ask
• Tag/publication authority: none

The first wave is read-only issue/scope evaluation. No RC tag or package publication is authorized.

[justin808]

Fleet validation snapshot — v17.1.0.rc.0

• Resolved at: 2026-08-26T22:15:41Z
• Release selector: latest RC or beta
• Candidate tag: v17.1.0.rc.0
• Candidate commit: 5db45d7612a727606a636e8215bbc66cceefd389
• Policy commit: 45c7a81fa3ee72f4375a96dc145937f502df5234
• Tracker mode: strict-rc
• Manifest snapshot fingerprint: 7ef3317f8ad0e3e2b016191d048bb37fd2f293eb75665c69efabb808bcb4bb9e

Published product artifacts

• RubyGems react_on_rails: 17.1.0.rc.0
• RubyGems react_on_rails_pro: 17.1.0.rc.0
• npm react-on-rails: 17.1.0-rc.0
• npm react-on-rails-pro: 17.1.0-rc.0
• npm react-on-rails-pro-node-renderer: 17.1.0-rc.0
• npm create-react-on-rails-app: 17.1.0-rc.0
• Independently versioned npm react-on-rails-rsc: 19.2.1

The registry versions normalize to the candidate tag and agree with the matching product manifests. Artifact/tarball coherence and the published standard, Pro, and Pro+RSC generator matrix remain part of release-wide preflight; this snapshot does not by itself open the app-mutation barrier.

Public evidence: candidate tag, candidate-head workflow runs, react_on_rails gem, react_on_rails_pro gem, react-on-rails npm, react-on-rails-pro npm, react-on-rails-pro-node-renderer npm, create-react-on-rails-app npm, react-on-rails-rsc npm.

[justin808]

Fleet gate — generator/install smoke: BLOCKED

• Candidate: v17.1.0.rc.0 at 5db45d7612a727606a636e8215bbc66cceefd389
• Pack: fleet-20260826T221306Z-9e81c2
• Tester/date: Codex fleet validation, 2026-08-26 UTC
• Blocker: Generated apps return 502 for client packs through Rails dev-server proxy #4947

Passed evidence:

• Exact-tag generator suite: 428 examples, 0 failures
• Monorepo package build and local-gem OSS smoke
• Published standard, default Pro, and Pro + RSC generation without local overrides
• Clean installs, production/test-bundle builds, exact candidate locks, SSR routes, and RSC streaming

Blocking evidence:

• Under each freshly generated app's untouched documented bin/dev stack, every initial client pack returned 502 through Rails: standard 4/4, default Pro 4/4, Pro + RSC 5/5.
• The same dev-server asset was directly reachable, but the Rails-proxied request failed.
• The generated RSC Like control never hydrated or updated.

APP_WORK_ALLOWED remains false. The pack-specific preflight marker was not published, no mutable app claim was acquired, and no demo branch or PR was created. Promotion remains blocked until the generator/dev-server proxy defect is fixed, a replacement RC is published, and a fresh fleet pack passes the complete matrix.

[justin808]

Fleet validation snapshot — v17.1.0.rc.1

• Resolved at: 2026-09-01T06:18:56Z
• Release selector: v17.1.0.rc.1
• Candidate tag: v17.1.0.rc.1
• Candidate commit: ed8c2cab546b208421c1d4736e668e2e541abaae
• Policy commit: 6f856ed73a93aae7674b7eb1843ac95e04f26228
• Tracker mode: strict-rc
• Manifest snapshot fingerprint: 39bd688798d907428ab2c74d8b984db18ddd47c155861ab178337e416633dcb2

Published product artifacts

• RubyGems react_on_rails: 17.1.0.rc.1
• RubyGems react_on_rails_pro: 17.1.0.rc.1
• npm react-on-rails: 17.1.0-rc.1
• npm react-on-rails-pro: 17.1.0-rc.1
• npm react-on-rails-pro-node-renderer: 17.1.0-rc.1
• npm create-react-on-rails-app: 17.1.0-rc.1
• Independently versioned npm react-on-rails-rsc: 19.2.1

The registry versions normalize to the candidate tag and agree with the tagged product manifests. Exact-candidate force-full CI and the published standard, Pro, and Pro+RSC generator matrix remain part of release-wide preflight; this snapshot does not by itself open the app-mutation barrier.

Public evidence: candidate release, candidate commit, react_on_rails gem, react_on_rails_pro gem, react-on-rails npm, react-on-rails-pro npm, react-on-rails-pro-node-renderer npm, create-react-on-rails-app npm, react-on-rails-rsc npm.

[justin808]

Fleet gate — generator/install smoke: BLOCKED

• Candidate: v17.1.0.rc.1 at ed8c2cab546b208421c1d4736e668e2e541abaae
• Pack: fleet-20260901T061545Z-69bea0
• Tester/date: Claude fleet validation (machine m1), 2026-09-02 UTC
• Blocker: [Pro] Prerender-cached streamed RSC render replays a stale random dom id in embedded payload keys, failing hydration on every cached load (generated --rsc app, blocks 17.1.0.rc.1 generator gate) #4984 (pre-existing since 17.0.x; not introduced by rc.1)

Passed evidence:

• Exact-tag generator suite: 1332 examples, 0 failures; pnpm run build; CREATE_ROR_SMOKE_SCOPE=oss local-gem smoke passed.
• Published create-react-on-rails-app@17.1.0-rc.1 standard, default Pro, and Pro + RSC generation without local overrides; exact candidate locks (gems 17.1.0.rc.1, npm 17.1.0-rc.1, shakapacker 10.3.2, react-on-rails-rsc 19.2.1 only in the RSC app); builds and generated tests pass.
• rc.0 blocker Generated apps return 502 for client packs through Rails dev-server proxy #4947 is fixed: under each app's documented bin/dev stack every initial client pack returned 200 through Rails (standard 4/4, default Pro 4/4, Pro + RSC 5/5). Standard and Pro hydration interactions pass, Pro SSR is served by the node renderer, and the RSC route streams with an inline payload and hydrates the Like control on first load.

Blocking evidence:

• Pro + RSC app: every same-host request after the first replays a prerender-cached stream whose embedded RSC payload keys carry the first request's random dom id, so the client refetches /rsc_payload and React reports a hydration failure; in development the error overlay blocks the Like control (2/2 repeats). Reproduced with three curl requests; identical signature with create-react-on-rails-app@17.0.1 --rsc, so this is pre-existing and was masked in rc.0 by Generated apps return 502 for client packs through Rails dev-server proxy #4947.

APP_WORK_ALLOWED remains false. The pack-specific preflight marker was not published, the app-lane coordination claims were released without creating any demo branch or PR, and HiChee stays with its separately owned lane. Promotion remains blocked until the release owner either fixes #4984 and publishes a replacement candidate or records a structured public waiver for the generator/install gate.

[justin808]

Fleet validation closeout

Candidate: v17.1.0.rc.1
Verdict: BLOCKED

Target	Tier	Result	Baseline	Review app	Evidence
react-on-rails-generator-install-smoke	hard_gate	blocked	clean	not_configured	Exact tag ed8c2ca: generator rspec 1332/0, pnpm build, OSS local-gems smoke passed. Published create-react-on-rails-app@17.1.0-rc.1 standard/Pro/Pro+RSC apps lock exact candidate versions (gems 17.1.0.rc.1, npm 17.1.0-rc.1, shakapacker 10.3.2, react-on-rails-rsc 19.2.1 only in RSC), build, and serve every pack URL with 200 through Rails under bin/dev (#4947 fixed); standard/Pro hydration passes. BLOCKED by #4984: with the generated default prerender_caching=true and random dom ids, every same-host load of the RSC route after the first replays a cached stream whose embedded payload keys reference the first request dom id, forcing a /rsc_payload refetch and a React hydration failure. Pre-existing (identical with the 17.0.1 generator), masked in rc.0 by #4947. Maker claude-m1-fleet-17-1-rc1-worker-generator-gate; coordinator replay confirmed with curl.
shakacode-hichee	hard_gate	pending	pending	unknown
shakacode-react-on-rails-demo-flagship	hard_gate	pending	pending	unknown
shakacode-react-on-rails-demo-hacker-news-rsc	hard_gate	pending	pending	unknown
shakacode-react-on-rails-demo-marketplace-rsc	hard_gate	pending	pending	unknown
shakacode-react-on-rails-demo-gumroad-rsc	hard_gate	pending	pending	unknown
shakacode-react-webpack-rails-tutorial	hard_gate	pending	pending	unknown
shakacode-react-on-rails-starter-tanstack	hard_gate	pending	pending	unknown
shakacode-react-on-rails-demo-octochangelog-on-rails-pro	soft_track	pending	pending	unknown
shakacode-react-on-rails-demo-ssr-hmr	soft_track	pending	pending	unknown
shakacode-react-on-rails-demo-v16-bundle-splitting	soft_track	pending	pending	unknown
shakacode-react-on-rails-example-open-flights	soft_track	pending	pending	unknown
shakacode-react-on-rails-example-migration	soft_track	pending	pending	unknown

Required release paths

Path	Status	Lane	Evidence
standard-generator	passed	generator-flagship (lane 1, m1)	fleet-standard via create-react-on-rails-app@17.1.0-rc.1 --standard: core-only locks (react_on_rails 17.1.0.rc.1, react-on-rails 17.1.0-rc.1, shakapacker 10.3.2, no Pro/RSC), bin/dev on base port 3100, /hello_world 200 with SSR Hello, Stranger! , 4/4 packs 200 through Rails, Playwright hydration typed Fleet Checker -> heading updated, 0 console/page errors.
pro-ssr	passed	generator-flagship (lane 1, m1)	fleet-pro via create-react-on-rails-app@17.1.0-rc.1 (default): react_on_rails_pro 17.1.0.rc.1, react-on-rails-pro/node-renderer 17.1.0-rc.1, no RSC; bin/dev on base port 3200; node renderer on 3202 served the HelloWorld render request and Rails logged Node Renderer responded; /hello_world 200 with SSR markup, 4/4 packs 200 through Rails, hydration interaction passed, 0 console/page errors.
pro-rsc	blocked	generator-flagship (lane 1, m1)	fleet-rsc via create-react-on-rails-app@17.1.0-rc.1 --rsc: locks include react-on-rails-rsc 19.2.1; /hello_server 200, chunked, inline RSC payload, 5/5 packs 200 through Rails, first-load Like 0->1 passed; every same-host request after the first replays a prerender-cached stream with stale dom-id payload keys -> /rsc_payload refetch -> React hydration failure (curl: 2 distinct uuids on requests 2 and 3; Playwright 2/2 repeats blocked by the dev-server overlay). #4984
rspack	pending
webpack-rsc-production	pending
ssr-rsc-html	pending
client-navigation-interaction	pending

Blocker ownership

Blocker	Status	Public summary	Durable owner
rsc-prerender-cache-dom-id-hydration	open	Generated Pro+RSC app (prerender_caching=true, random dom ids): prerender-cached streamed render embeds the first request random dom id in RSC payload keys, so every cached load refetches /rsc_payload and fails React hydration; pre-existing since 17.0.x (reproduced with the 17.0.1 generator), masked in rc.0 by #4947. Blocks the generator/install smoke gate and the release-wide generator matrix for v17.1.0.rc.1.	#4984

Promotion recommendation: blocked

[justin808]

rc.1 disposition: fix in the release line, then rc.2

Maintainer decision on the fleet closeout above: resolve #4984 on release/17.1.0 and cut v17.1.0.rc.2, then run a fresh fleet pack.

• Fix PR (release-first stabilizer): [Pro] Rebind prerender-cached streams to the current dom id (fixes #4984) #4987 — Pro StreamCache now persists the producing dom id and rebinds cached streams to the current mount id; verified on the generated --rsc app (four consecutive requests, one dom id each; three headless-Chromium loads hydrate the Like control with zero errors) plus new unit and dummy-app request specs that fail on the unpatched lib.
• After [Pro] Rebind prerender-cached streams to the current dom id (fixes #4984) #4987 lands: cherry-pick -x forward-port to main, script/release for rc.2 from release/17.1.0, then a new fleet pack (the rc.1 pack fleet-20260901T061545Z-69bea0 stays closed as BLOCKED).
• Demo manifest corrections from the rc.1 inspection are already on main (Docs: correct demo-fleet manifest from rc.1 fleet inspection #4985); the per-repo review-app and audit follow-ups (tutorial getting Uncaught SyntaxError: Unexpected token i in JSON at position 1 #815/Fixes Crash in Development for String Props #784, tanstack The React On Rails Doctrine #220/Use multiple provider in structured rails app #194, marketplace Doc -> API mismatch with RegisterComponent in V2.0.0 #203, hacker-news Improve README and link to the v1.0.0 generator results repo #93, flagship Support 0.14 of React #51, gumroad Update contributing.md and move gem release info to own file #118) still need fixes or explicit waivers before the rc.2 app lanes can reach deployed smoke.

[justin808]

rc.2 preparation status (2026-09-03 UTC)

• [Pro] Prerender-cached streamed RSC render replays a stale random dom id in embedded payload keys, failing hydration on every cached load (generated --rsc app, blocks 17.1.0.rc.1 generator gate) #4984 fix merged into release/17.1.0 as 30247eb7dbcc9cedb0188097da87812ec45c666c ([Pro] Rebind prerender-cached streams to the current dom id (fixes #4984) #4987; independent adversarial review MERGE_GATE PASS on the final head, hosted CI green).
• CHANGELOG stamped for 17.1.0.rc.2 (Stamp CHANGELOG for 17.1.0.rc.2 #4994, tip 0e9846a791da8b1eb08be677ee43681161ff60a5); every release-branch suite on that tip is green and the ShakaPerf pre-run for 17.1.0.rc.2 succeeded.
• script/release --dry-run on the tip selects 17.1.0.rc.2 (gem) / 17.1.0-rc.2 (npm) with the expected file set.
• Forward-port to main: [Pro] Forward-port #4987: rebind prerender-cached streams to the current dom id #4996 (cherry-pick -x), merged via the main queue.
• Cut blocked on publishing credentials: the live script/release run stopped at the npm-auth preflight because the machine running it (m1) has no npm or RubyGems credentials; it was terminated before any version bump, push, or tag. The release-line:17.1.0 lease has been released with a handoff note. Resume with a plain script/release from a release/17.1.0 checkout on a machine with publishing auth (or after npm login + gem credentials on m1). A fresh fleet pack follows the tag.
• Pre-existing forward-port debt noted by script/release-forward-port --dry-run: eight release-first commits (Fix malformed renderer URL credential redaction #4845, [Pro] Redact RSC error diagnostics at browser boundaries #4856, Release: fence and unblock 17.1.0.rc.0 publication #4928, Release: make the safe operator path one command #4931, Fix release dry-run gate discovery #4935, Fix release wrapper terminal job control #4940, Qualify 17.1 with Shakapacker 10.3.2 and Rspack 2.2.1 #4952, Preserve ExecJS release lock platforms during version bumps #4954) and four origin/main merge commits on release/17.1.0 are not yet on main and need the one-PR-per-commit forward-port pass before the release branch is deleted.

[justin808]

Prepared the coordinated RSC RC.1 adoption as draft PR #5026, targeting release/17.1.0, head ef24e08c935479b3a44f947532e868942119aac7.

It updates the generator/Pro pins and lockfile to RSC 19.3.0-rc.1 + React/DOM ~19.2.8, aligns Node startup/Doctor/npm peer admission while preserving the older supported stable pair, and documents stricter client-export failures. No product version bump, merge, tag, or publication was performed.

Local evidence in the PR includes Node compatibility55 tests, Doctor746 examples, Pro RSC20/streaming158 tests, corrected generator assertions, build/type/lint/format/link checks, Webpack+Rspack generated production builds and repeated browser hydration, plus the shared-sibling-chunk manifest regression smoke. The full710-example generator run initially failed3 old message assertions; complete dependency unit96 and affected install-message3 reruns pass. This is not published-next-RC or fleet qualification.

Codex implementation and messaging reviews are clean. Extra local Claude review and simplify were attempted but could not authenticate: OAuth session expired and could not be refreshed. The PR is deliberately draft; hosted/current-head independent adversarial review and CI remain open gates.

Next owner: Justin for the tracker-required merge go/no-go; this task can then resume source-first closeout. After the release fix lands, forward-port its landed SHA to fresh main in a dedicated cherry-pick -x PR. Then separately prepare/publish the next React on Rails RC under explicit publication authority and update flagship/fleet consumers against published artifacts. Do not upgrade the flagship's RSC dependency alone: published Pro RC.2 does not admit this prerelease. Stable RSC adoption still needs a separate pin/lockfile change and a newly qualified RC before final.

[justin808]

PR #5043 merged into release/17.1.0 at 08089e9883171e19331599c122addfb781fa19f4 through the required merge queue. The merged tree is identical to reviewed head 6fc16a46d70a039dba7c9d73b85124bcda626b0f. The squash title includes #5043 and preserves exactly one direct #5022 source footer.

The full hosted link scan passed: 3,571 URLs, zero errors. Independent post-merge inspection found no code regression or late actionable review. Queue and push checks on the merge SHA are complete: 24 passed, 38 normal docs-selected skips, zero failures or pending checks.

Post-merge QA-record replay found three formatting errors in the PR description. These were corrected without changing code or the recorded test results: the no-application-UI paint disposition, the process-gap enum, and the explicit not-applicable priority-finding marker. Live exact-head replay now reports SATISFIED. The supplementary documentation paint evidence remains in prose. Process-gap disposition: checklist+replay; replay this existing evidence validator before the next merge. No new process mechanism or issue is needed.

The separate #5033 JSON backport is in progress from this verified release tip. #5042 remains open; #5026 will refresh after that prerequisite merges. No release tag or package publication has occurred.