diff --git a/.github/ISSUE_TEMPLATE/bug_report.yml b/.github/ISSUE_TEMPLATE/bug_report.yml index 38e6481..13bf4f2 100644 --- a/.github/ISSUE_TEMPLATE/bug_report.yml +++ b/.github/ISSUE_TEMPLATE/bug_report.yml @@ -31,7 +31,7 @@ body: attributes: label: adrkit version description: Output of `adr --version` (or the package version you installed). - placeholder: '0.11.0' + placeholder: '0.12.0' validations: required: true - type: dropdown diff --git a/AGENTS.md b/AGENTS.md index b06213c..dc0e5fc 100644 --- a/AGENTS.md +++ b/AGENTS.md @@ -2,7 +2,7 @@ Decision memory for human- and agent-authored plans — machine-readable ADRs that are enforceable in CI and legible to agents, without leaving git. -Status: early — phases 0–6 landed and v0.11.0 is public. `@adrkit/core`, +Status: early — phases 0–6 landed and v0.12.0 is public. `@adrkit/core`, `@adrkit/evaluator`, `@adrkit/cli` (`lint`, `new`, `graph`, `explain`, `check`, `queue`, `migrate --from madr`, `evaluate`) are published on npm, as is the independently versioned `@adrkit/spec-kit` Spec Kit extension (0.1.3); the diff --git a/CHANGELOG.md b/CHANGELOG.md index 55c2753..70ee682 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -9,6 +9,8 @@ Until `1.0.0`, minor releases may include breaking changes ## [Unreleased] +## [0.12.0] - 2026-08-27 + ### Added - **A guarded recovery path for the moving `v0` Action tag.** Manual recovery @@ -41,27 +43,6 @@ Until `1.0.0`, minor releases may include breaking changes script ([#132](https://github.com/mbeacom/adrkit/issues/132)). Judgment prose outside the markers stays hand-maintained. -### Fixed - -- **Inbound marker amplification is bounded before resolution.** One file now - retains at most the first 64 parsed declarations, and one batch at most the - first 10,000 in deterministic code-unit path plus source order. Exact overflow - collapses into one advisory `marker-declarations-capped` finding and - `markerScan.declarations` metadata; `explain`, `check`, and the Action report - it without giving PR-authored markers exit-code authority - ([#113](https://github.com/mbeacom/adrkit/issues/113)). - -- **`adr queue` no longer stays silent when a proposed record has a review - deadline but no routing tier.** `item.tier-absent` now fires whenever the tier - cannot be determined on a record that has entered review — a `review` block, - or a top-level `reviewBy`. The carve-out the spec actually states is - two-conditioned (both absent), but only the first condition was implemented, - so a `cross-team` record with `reviewBy` and no `review` block was listed with - `tier=None` and no finding at all - ([#111](https://github.com/mbeacom/adrkit/issues/111)). A `proposed` record - with neither remains `not-queued` and silent. Severity stays `info`, so no - exit code changes. - - **Trusted CI gates that the pull request cannot edit.** A new `.github/workflows/trusted-gates.yml` runs on `pull_request_target`, which GitHub executes from the repository's default branch — workflow file, @@ -104,8 +85,18 @@ Until `1.0.0`, minor releases may include breaking changes would otherwise have passed clean and deleted the gate on merge. - **[`docs/repository-trust-operations.md`](docs/repository-trust-operations.md)**, - separating the controls that are active from the ones that cannot be applied - until this lands, with the exact verified commands and the evidence for each. + separating the controls that are active from the ones that could not be applied + until the trusted workflow reached `main`, with the exact verified commands and + the evidence for each. Both gates are now deployed and required: the live `main` + ruleset lists `trusted-dco` and `gate-integrity` among its ten required + contexts, and the pull-request-controlled `dco` context was removed from that + set only after the trusted one reported green on real pull requests. Both were + observed failing before being relied on + ([ADR-0016](docs/adr/0016-require-every-check-to-be-observed-failing-before-it-counts-as-coverage.md)): + `gate-integrity` went red before an acknowledgment and green after it on three + ordinary pull requests, and `trusted-dco` went red on a commit that deliberately + omitted `Signed-off-by` and green once it was signed. That is deployed evidence + in both directions, not a fixture or a local invocation. ### Changed @@ -125,6 +116,27 @@ Until `1.0.0`, minor releases may include breaking changes states which invocation is the authority and which is advisory, because the limitation stopped being true for the one that gates the merge. +### Fixed + +- **Inbound marker amplification is bounded before resolution.** One file now + retains at most the first 64 parsed declarations, and one batch at most the + first 10,000 in deterministic code-unit path plus source order. Exact overflow + collapses into one advisory `marker-declarations-capped` finding and + `markerScan.declarations` metadata; `explain`, `check`, and the Action report + it without giving PR-authored markers exit-code authority + ([#113](https://github.com/mbeacom/adrkit/issues/113)). + +- **`adr queue` no longer stays silent when a proposed record has a review + deadline but no routing tier.** `item.tier-absent` now fires whenever the tier + cannot be determined on a record that has entered review — a `review` block, + or a top-level `reviewBy`. The carve-out the spec actually states is + two-conditioned (both absent), but only the first condition was implemented, + so a `cross-team` record with `reviewBy` and no `review` block was listed with + `tier=None` and no finding at all + ([#111](https://github.com/mbeacom/adrkit/issues/111)). A `proposed` record + with neither remains `not-queued` and silent. Severity stays `info`, so no + exit code changes. + ## [0.11.0] - 2026-08-26 ### Added @@ -1297,7 +1309,8 @@ against live Spec Kit, rather than reasoning about it: - Node-targeted published distribution of all packages, smoke-tested under Node 22 and 24. -[Unreleased]: https://github.com/mbeacom/adrkit/compare/v0.11.0...HEAD +[Unreleased]: https://github.com/mbeacom/adrkit/compare/v0.12.0...HEAD +[0.12.0]: https://github.com/mbeacom/adrkit/compare/v0.11.0...v0.12.0 [0.11.0]: https://github.com/mbeacom/adrkit/compare/v0.10.0...v0.11.0 [0.10.0]: https://github.com/mbeacom/adrkit/compare/v0.9.0...v0.10.0 [0.9.0]: https://github.com/mbeacom/adrkit/compare/v0.8.0...v0.9.0 diff --git a/bun.lock b/bun.lock index 75244a8..f54a72e 100644 --- a/bun.lock +++ b/bun.lock @@ -55,7 +55,7 @@ }, "packages/cli": { "name": "@adrkit/cli", - "version": "0.11.0", + "version": "0.12.0", "bin": { "adr": "./dist/index.js", "adrkit": "./dist/index.js", @@ -70,7 +70,7 @@ }, "packages/core": { "name": "@adrkit/core", - "version": "0.11.0", + "version": "0.12.0", "dependencies": { "picomatch": "^4", "semver": "^7", @@ -85,7 +85,7 @@ }, "packages/evaluator": { "name": "@adrkit/evaluator", - "version": "0.11.0", + "version": "0.12.0", "dependencies": { "@adrkit/core": "workspace:*", "jsonpath-rfc9535": "1.3.0", @@ -96,7 +96,7 @@ }, "packages/mcp": { "name": "@adrkit/mcp", - "version": "0.11.0", + "version": "0.12.0", "bin": { "adrkit-mcp": "./dist/bin.js", }, diff --git a/docs/RELEASING.md b/docs/RELEASING.md index c1eae80..706d942 100644 --- a/docs/RELEASING.md +++ b/docs/RELEASING.md @@ -9,13 +9,13 @@ Action, and one lockstep OCI image: | `@adrkit/evaluator` | npm | | `@adrkit/cli` (`adr`, `adrkit`) | npm | | `@adrkit/mcp` (`adrkit-mcp`) | npm | -| `packages/ci/action.yml` | Git tag (latest immutable release `v0.11.0`, moving `v0`) | +| `packages/ci/action.yml` | Git tag (latest immutable release `v0.12.0`, moving `v0`) | | `ghcr.io/mbeacom/adrkit` | GitHub Container Registry (`vX.Y.Z`, moving `vX`, `latest`; begins with the first release containing ADR-0032) | `@adrkit/ci` stays private because GitHub executes the committed Action bundle directly from the referenced repository ref. -The coordinated lockstep surface is published; the current release is `v0.11.0`. `@adrkit/core`, +The coordinated lockstep surface is published; the current release is `v0.12.0`. `@adrkit/core`, `@adrkit/evaluator`, and `@adrkit/cli` use GitHub Actions Trusted Publishing. `@adrkit/mcp` was created with the isolated one-time bootstrap path below; its Trusted Publisher and token-restriction cleanup must be completed before the diff --git a/package.json b/package.json index 7eefd01..248acd4 100644 --- a/package.json +++ b/package.json @@ -1,6 +1,6 @@ { "name": "adrkit", - "version": "0.11.0", + "version": "0.12.0", "description": "Decision memory for human and agent-authored plans \u2014 machine-readable, CI-enforceable architecture decision records.", "type": "module", "private": true, diff --git a/packages/cli/package.json b/packages/cli/package.json index b8bfe7e..0f70120 100644 --- a/packages/cli/package.json +++ b/packages/cli/package.json @@ -1,6 +1,6 @@ { "name": "@adrkit/cli", - "version": "0.11.0", + "version": "0.12.0", "description": "Git-native architecture decision record tooling from adrkit.", "type": "module", "license": "Apache-2.0", diff --git a/packages/cli/src/index.ts b/packages/cli/src/index.ts index 6a93084..ce30ad6 100644 --- a/packages/cli/src/index.ts +++ b/packages/cli/src/index.ts @@ -63,7 +63,7 @@ import { getPresentation, setPresentation, styleUsageBlock, type ColorMode, type * (mirroring `@adrkit/mcp`'s `SERVER_INFO`) so the bundled `dist/index.js` never has * to locate `package.json` at runtime. `version.test.ts` asserts the two agree. */ -export const CLI_VERSION = '0.11.0'; +export const CLI_VERSION = '0.12.0'; function topLevelUsage(style?: StreamStyle): string { return renderTopLevelUsage(CLI_VERSION, style); diff --git a/packages/cli/test/color.test.ts b/packages/cli/test/color.test.ts index ec3cfa6..d288ab1 100644 --- a/packages/cli/test/color.test.ts +++ b/packages/cli/test/color.test.ts @@ -33,7 +33,7 @@ describe('CLI color presentation', () => { expect(result.exitCode).toBe(0); expect(result.stderr).toBe(''); expect(result.stdout).toContain('\u001b['); - expect(result.stdout).toContain('adrkit 0.11.0'); + expect(result.stdout).toContain('adrkit 0.12.0'); }); test('forced color keeps lint stdout and stderr separated', async () => { diff --git a/packages/core/package.json b/packages/core/package.json index 1c53bbf..e951220 100644 --- a/packages/core/package.json +++ b/packages/core/package.json @@ -1,6 +1,6 @@ { "name": "@adrkit/core", - "version": "0.11.0", + "version": "0.12.0", "description": "Pure ADR parsing, validation, migration, and affects resolution for adrkit.", "type": "module", "license": "Apache-2.0", diff --git a/packages/evaluator/package.json b/packages/evaluator/package.json index 0538404..f81d032 100644 --- a/packages/evaluator/package.json +++ b/packages/evaluator/package.json @@ -1,6 +1,6 @@ { "name": "@adrkit/evaluator", - "version": "0.11.0", + "version": "0.12.0", "description": "Deterministic, model-free ADR proposal evaluation and routing for adrkit.", "type": "module", "license": "Apache-2.0", diff --git a/packages/mcp/package.json b/packages/mcp/package.json index 036e0a5..bf9865c 100644 --- a/packages/mcp/package.json +++ b/packages/mcp/package.json @@ -1,7 +1,7 @@ { "name": "@adrkit/mcp", "mcpName": "dev.adrkit/mcp", - "version": "0.11.0", + "version": "0.12.0", "description": "Local, read-only Model Context Protocol server exposing adrkit decision retrieval over stdio.", "type": "module", "license": "Apache-2.0", diff --git a/packages/mcp/server.json b/packages/mcp/server.json index 0793003..d37ae0b 100644 --- a/packages/mcp/server.json +++ b/packages/mcp/server.json @@ -3,7 +3,7 @@ "name": "dev.adrkit/mcp", "title": "adrkit decision memory", "description": "Deterministic, offline, read-only ADR decision memory for coding agents. No model or network calls.", - "version": "0.11.0", + "version": "0.12.0", "websiteUrl": "https://adrkit.dev", "repository": { "url": "https://github.com/mbeacom/adrkit", @@ -15,7 +15,7 @@ "registryType": "npm", "registryBaseUrl": "https://registry.npmjs.org", "identifier": "@adrkit/mcp", - "version": "0.11.0", + "version": "0.12.0", "runtimeHint": "npx", "transport": { "type": "stdio" diff --git a/packages/mcp/src/server.ts b/packages/mcp/src/server.ts index 59c3a54..33b7df0 100644 --- a/packages/mcp/src/server.ts +++ b/packages/mcp/src/server.ts @@ -14,7 +14,7 @@ import { registerGetDecisionContext } from './tools/get-decision-context.ts'; import { registerListSuperseded } from './tools/list-superseded.ts'; import type { ToolConfig } from './tools/shared.ts'; -export const SERVER_INFO = { name: '@adrkit/mcp', version: '0.11.0' } as const; +export const SERVER_INFO = { name: '@adrkit/mcp', version: '0.12.0' } as const; /** * The MCP protocol revision this server serves through `serveStdio`'s modern era. diff --git a/site/src/components/Hero.astro b/site/src/components/Hero.astro index df9751f..2b784b4 100644 --- a/site/src/components/Hero.astro +++ b/site/src/components/Hero.astro @@ -14,7 +14,7 @@ const { title = data.title, tagline, actions = [] } = data.hero || {}; CLI works today - v0.11.0 on npm · decision memory in git + v0.12.0 on npm · decision memory in git

diff --git a/site/src/content/docs/badges.mdx b/site/src/content/docs/badges.mdx index 73b6815..4f87383 100644 --- a/site/src/content/docs/badges.mdx +++ b/site/src/content/docs/badges.mdx @@ -100,8 +100,8 @@ jobs: # current release. - run: | mkdir -p .adrkit - npx @adrkit/cli@0.11.0 queue --format json > .adrkit/queue.json.tmp - npx @adrkit/cli@0.11.0 lint --json > .adrkit/lint.json.tmp + npx @adrkit/cli@0.12.0 queue --format json > .adrkit/queue.json.tmp + npx @adrkit/cli@0.12.0 lint --json > .adrkit/lint.json.tmp # A truncated or malformed write renders as `no result` on the badge, which # reads as a bug in your tooling. Fail here instead of committing it. diff --git a/site/src/content/docs/ci.mdx b/site/src/content/docs/ci.mdx index 130868d..ea58084 100644 --- a/site/src/content/docs/ci.mdx +++ b/site/src/content/docs/ci.mdx @@ -55,8 +55,8 @@ the comment reaches GitHub's size limit. Keep the default checkout rooted at `GITHUB_WORKSPACE`; if a workflow checks out elsewhere, marker health will identify files the Action could not inspect. -`v0` is a moving major tag, and it now resolves to a `v0.11.0` build. Pin the -immutable `v0.11.0` tag or a commit SHA for maximum reproducibility. +`v0` is a moving major tag, and it now resolves to a `v0.12.0` build. Pin the +immutable `v0.12.0` tag or a commit SHA for maximum reproducibility.