From 56d7b88a599e023edb2280a31edbf7ad8ca1f63e Mon Sep 17 00:00:00 2001 From: Mark Beacom Date: Mon, 10 Aug 2026 08:57:56 -0400 Subject: [PATCH] =?UTF-8?q?chore(release):=20v0.5.0=20=E2=80=94=20ratify?= =?UTF-8?q?=20ADR-0022=20and=20ADR-0023,=20retire=20ADR-0021?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Cuts the release that takes inbound `@adr` markers from a single local command to CI, and narrows what counts as a marker in the same version so no adopter ever sees the loose grammar in a pull-request comment. Ratifies ADR-0022 (markers reach `check` and the Action, without exit-code authority) and ADR-0023 (a marker is read only where the format hides it), and retires ADR-0021 as `superseded` by 0022. ADR-0021's argument is unedited; only `status` and `supersededBy` moved. ADR-0022 takes the `arb` review tier. Every other component-scope record in the corpus is `async`, but 0022 is the only record carrying a cross-team blast radius at component scope, and it is the first to have `@adrkit/core` read untrusted input in an automated context. The reason is recorded in the record rather than inferred from the pair of axes that disagree. Bumps the four lockstep packages to 0.5.0 with their two hardcoded version constants and the four `bun.lock` workspace `version` lines, which nothing refreshes automatically. Minor rather than patch: three additive runtime exports, and `scanSourceMarkers` now varies with its `path` argument. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Signed-off-by: Mark Beacom --- CHANGELOG.md | 25 ++++++++++++++++--- bun.lock | 8 +++--- ...annotations-without-changing-the-schema.md | 3 ++- ...without-giving-them-exit-code-authority.md | 20 +++++++++++++-- ...rmat-hides-it-fences-and-markdown-prose.md | 5 ++-- package.json | 2 +- packages/cli/package.json | 2 +- packages/cli/src/index.ts | 2 +- packages/core/package.json | 2 +- packages/evaluator/package.json | 2 +- packages/mcp/package.json | 2 +- packages/mcp/server.json | 4 +-- packages/mcp/src/server.ts | 2 +- 13 files changed, 58 insertions(+), 21 deletions(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index e37607be..4671b116 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -9,6 +9,8 @@ Until `1.0.0`, minor releases may include breaking changes ## [Unreleased] +## [0.5.0] - 2026-08-10 + ### Added - `adr check` and the governing-decisions Action now resolve inbound `@adr` @@ -20,8 +22,15 @@ Until `1.0.0`, minor releases may include breaking changes This answers the separate decision ADR-0021 left open rather than revising it. [ADR-0022](docs/adr/0022-scan-inbound-markers-in-check-and-ci-without-giving-them-exit-code-authority.md) - supersedes ADR-0021, which stands unedited as the record of the explain-only - scope shipped in v0.4.0. + supersedes ADR-0021, whose argument stands unedited as the record of the + explain-only scope shipped in v0.4.0; only its `status` and `supersededBy` + moved when ADR-0022 was ratified. + +- **Three new `@adrkit/core` runtime exports**, pinned by the package surface + test: `readSourceMarkersBatch`, the impure batch boundary callers use to + pre-scan before the pure `checkChanges`; and `MARKER_SCAN_FILE_CAP` / + `MARKER_SCAN_CONCURRENCY`, the bounds it enforces. Additive — nothing was + removed or renamed. - **`{/*` is accepted as a comment introducer.** MDX rejects ``, so the markdown introducer rule under *Fixed* below would otherwise leave that dialect @@ -46,6 +55,15 @@ Until `1.0.0`, minor releases may include breaking changes both sides of a rename for `affects` matching. Previous rename paths can no longer consume the 3,000-file scan budget and cause a current file's marker-only governance to be skipped. +- The Action no longer hands deleted files to the marker scanner. A `removed` path + is guaranteed absent in the checkout, so it consumed a scan slot only to report + `absent` — the one signal that would otherwise tell an operator the checkout does + not match the pull request head. +- Marker path selection and every `markerScan` path list now sort by code unit + rather than `localeCompare`, whose order depends on the runtime's ICU locale. + The sort decides which paths survive the 3,000-file cap and which ten appear in + the `marker-scan-capped` warning, so two environments could disagree on both + while `CheckOutcome` promises identical inputs produce identical output. - **A fenced documentation example no longer declares the decision it illustrates.** `@adr` markers are now skipped inside ` ``` ` and `~~~` fenced @@ -446,7 +464,8 @@ against live Spec Kit, rather than reasoning about it: - Node-targeted published distribution of all packages, smoke-tested under Node 22 and 24. -[Unreleased]: https://github.com/mbeacom/adrkit/compare/v0.4.0...HEAD +[Unreleased]: https://github.com/mbeacom/adrkit/compare/v0.5.0...HEAD +[0.5.0]: https://github.com/mbeacom/adrkit/compare/v0.4.0...v0.5.0 [0.4.0]: https://github.com/mbeacom/adrkit/compare/v0.3.0...v0.4.0 [spec-kit-0.1.2]: https://github.com/mbeacom/adrkit/compare/spec-kit-v0.1.1...spec-kit-v0.1.2 [spec-kit-0.1.1]: https://github.com/mbeacom/adrkit/compare/spec-kit-v0.1.0...spec-kit-v0.1.1 diff --git a/bun.lock b/bun.lock index 650be4dc..cbd84939 100644 --- a/bun.lock +++ b/bun.lock @@ -51,7 +51,7 @@ }, "packages/cli": { "name": "@adrkit/cli", - "version": "0.4.0", + "version": "0.5.0", "bin": { "adr": "./dist/index.js", }, @@ -65,7 +65,7 @@ }, "packages/core": { "name": "@adrkit/core", - "version": "0.4.0", + "version": "0.5.0", "dependencies": { "picomatch": "^4", "semver": "^7", @@ -80,7 +80,7 @@ }, "packages/evaluator": { "name": "@adrkit/evaluator", - "version": "0.4.0", + "version": "0.5.0", "dependencies": { "@adrkit/core": "workspace:*", "jsonpath-rfc9535": "1.3.0", @@ -91,7 +91,7 @@ }, "packages/mcp": { "name": "@adrkit/mcp", - "version": "0.4.0", + "version": "0.5.0", "bin": { "adrkit-mcp": "./dist/bin.js", }, diff --git a/docs/adr/0021-resolve-inbound-source-annotations-without-changing-the-schema.md b/docs/adr/0021-resolve-inbound-source-annotations-without-changing-the-schema.md index c326d923..8cea0725 100644 --- a/docs/adr/0021-resolve-inbound-source-annotations-without-changing-the-schema.md +++ b/docs/adr/0021-resolve-inbound-source-annotations-without-changing-the-schema.md @@ -2,13 +2,14 @@ schemaVersion: 0.1.0 id: "0021" title: Resolve inbound source annotations without changing the schema -status: accepted +status: superseded date: 2026-08-05 deciders: ["@mbeacom"] tags: [core, cli, matching, governance, agents] scope: component reversibility: two-way-door blastRadius: component +supersededBy: "0022" relatesTo: ["0009", "0012", "0014", "0016"] affects: - type: path diff --git a/docs/adr/0022-scan-inbound-markers-in-check-and-ci-without-giving-them-exit-code-authority.md b/docs/adr/0022-scan-inbound-markers-in-check-and-ci-without-giving-them-exit-code-authority.md index 070cc931..bdc37082 100644 --- a/docs/adr/0022-scan-inbound-markers-in-check-and-ci-without-giving-them-exit-code-authority.md +++ b/docs/adr/0022-scan-inbound-markers-in-check-and-ci-without-giving-them-exit-code-authority.md @@ -2,9 +2,9 @@ schemaVersion: 0.1.0 id: "0022" title: Scan inbound markers in check and CI without giving them exit-code authority -status: proposed +status: accepted date: 2026-08-08 -deciders: [] +deciders: ["@mbeacom"] tags: [core, cli, ci, matching, governance, agents] scope: component reversibility: two-way-door @@ -22,6 +22,22 @@ affects: pattern: "packages/ci/src/**" provenance: authoredBy: agent-drafted + ratifiedBy: "@mbeacom" +review: + tier: arb + tierReason: >- + ADR-0021 reached `adr explain`, a command a developer runs against a file + they already own, and took the `async` tier on that basis. This record points + the same reader at content a fork pull request authored, inside CI, and + renders strings derived from it into a comment signed by + github-actions[bot]. That is a change of kind rather than of degree — the + first time `@adrkit/core` opens untrusted input in an automated context — and + it is why this record carries a cross-team blast radius where its predecessor + carried component. The failure modes are all quiet ones: an existence oracle + handed to a fork, a live link inside a trusted comment, a 422 turning + authored content into a failed check. Two of those three were closed by + review rather than by design, which is the argument for the higher tier + rather than against it. reviewBy: 2027-02-08 --- diff --git a/docs/adr/0023-read-a-marker-only-where-the-format-hides-it-fences-and-markdown-prose.md b/docs/adr/0023-read-a-marker-only-where-the-format-hides-it-fences-and-markdown-prose.md index 33dec4db..e64f16b7 100644 --- a/docs/adr/0023-read-a-marker-only-where-the-format-hides-it-fences-and-markdown-prose.md +++ b/docs/adr/0023-read-a-marker-only-where-the-format-hides-it-fences-and-markdown-prose.md @@ -2,9 +2,9 @@ schemaVersion: 0.1.0 id: "0023" title: "Read a marker only where the format hides it: fences and markdown prose" -status: proposed +status: accepted date: 2026-08-10 -deciders: [] +deciders: ["@mbeacom"] tags: [core, matching, governance, agents, docs] scope: component reversibility: two-way-door @@ -15,6 +15,7 @@ affects: pattern: "packages/core/src/markers/**" provenance: authoredBy: agent-drafted + ratifiedBy: "@mbeacom" review: tier: async tierReason: >- diff --git a/package.json b/package.json index 305a2f55..8951af81 100644 --- a/package.json +++ b/package.json @@ -1,6 +1,6 @@ { "name": "adrkit", - "version": "0.4.0", + "version": "0.5.0", "description": "Decision memory for human and agent-authored plans — machine-readable, CI-enforceable architecture decision records.", "type": "module", "private": true, diff --git a/packages/cli/package.json b/packages/cli/package.json index ae3c0d08..7cd789dc 100644 --- a/packages/cli/package.json +++ b/packages/cli/package.json @@ -1,6 +1,6 @@ { "name": "@adrkit/cli", - "version": "0.4.0", + "version": "0.5.0", "description": "Git-native architecture decision record tooling from adrkit.", "type": "module", "license": "Apache-2.0", diff --git a/packages/cli/src/index.ts b/packages/cli/src/index.ts index 046a9ffe..1a42212d 100644 --- a/packages/cli/src/index.ts +++ b/packages/cli/src/index.ts @@ -36,7 +36,7 @@ import { isMainModule } from './main-module.ts'; * (mirroring `@adrkit/mcp`'s `SERVER_INFO`) so the bundled `dist/index.js` never has * to locate `package.json` at runtime. `version.test.ts` asserts the two agree. */ -export const CLI_VERSION = '0.4.0'; +export const CLI_VERSION = '0.5.0'; function writeStdout(text: string): void { process.stdout.write(text); diff --git a/packages/core/package.json b/packages/core/package.json index f3d38cd1..673dcea3 100644 --- a/packages/core/package.json +++ b/packages/core/package.json @@ -1,6 +1,6 @@ { "name": "@adrkit/core", - "version": "0.4.0", + "version": "0.5.0", "description": "Pure ADR parsing, validation, migration, and affects resolution for adrkit.", "type": "module", "license": "Apache-2.0", diff --git a/packages/evaluator/package.json b/packages/evaluator/package.json index 910d7be9..ed0b9056 100644 --- a/packages/evaluator/package.json +++ b/packages/evaluator/package.json @@ -1,6 +1,6 @@ { "name": "@adrkit/evaluator", - "version": "0.4.0", + "version": "0.5.0", "description": "Deterministic, model-free ADR proposal evaluation and routing for adrkit.", "type": "module", "license": "Apache-2.0", diff --git a/packages/mcp/package.json b/packages/mcp/package.json index 4f763b85..ee626972 100644 --- a/packages/mcp/package.json +++ b/packages/mcp/package.json @@ -1,7 +1,7 @@ { "name": "@adrkit/mcp", "mcpName": "dev.adrkit/mcp", - "version": "0.4.0", + "version": "0.5.0", "description": "Local, read-only Model Context Protocol server exposing adrkit decision retrieval over stdio.", "type": "module", "license": "Apache-2.0", diff --git a/packages/mcp/server.json b/packages/mcp/server.json index 02a7a643..cd7d3612 100644 --- a/packages/mcp/server.json +++ b/packages/mcp/server.json @@ -3,7 +3,7 @@ "name": "dev.adrkit/mcp", "title": "adrkit decision memory", "description": "Deterministic, offline, read-only ADR decision memory for coding agents. No model or network calls.", - "version": "0.4.0", + "version": "0.5.0", "websiteUrl": "https://adrkit.dev", "repository": { "url": "https://github.com/mbeacom/adrkit", @@ -15,7 +15,7 @@ "registryType": "npm", "registryBaseUrl": "https://registry.npmjs.org", "identifier": "@adrkit/mcp", - "version": "0.4.0", + "version": "0.5.0", "runtimeHint": "npx", "transport": { "type": "stdio" diff --git a/packages/mcp/src/server.ts b/packages/mcp/src/server.ts index addc9fd6..9422c350 100644 --- a/packages/mcp/src/server.ts +++ b/packages/mcp/src/server.ts @@ -14,7 +14,7 @@ import { registerGetDecisionContext } from './tools/get-decision-context.ts'; import { registerListSuperseded } from './tools/list-superseded.ts'; import type { ToolConfig } from './tools/shared.ts'; -export const SERVER_INFO = { name: '@adrkit/mcp', version: '0.4.0' } as const; +export const SERVER_INFO = { name: '@adrkit/mcp', version: '0.5.0' } as const; /** * The MCP protocol revision this server serves through `serveStdio`'s modern era.