From fb8393e403f59f676654c9211da603e2eac47e2e Mon Sep 17 00:00:00 2001 From: Mark Beacom Date: Wed, 26 Aug 2026 22:25:46 -0400 Subject: [PATCH] release: prepare v0.12.0 MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Cut the unreleased changelog into `## [0.12.0] - 2026-08-27` and move every lockstep version-bearing surface from 0.11.0 to 0.12.0. `@adrkit/spec-kit` stays at 0.1.3 and the agent plugin at 0.2.0: both are independently versioned under ADR-0007 and neither moves with the repository release. Two changelog corrections rather than a mechanical rename. The trusted-gates trio was authored under `### Added` in #179, but #177 later inserted a `### Fixed` heading above it and silently swallowed all three entries into the wrong section; they are restored to `### Added`, and `### Fixed` now follows `### Changed` as in every prior release section. The `docs/repository-trust-operations.md` entry said those controls "cannot be applied until this lands" — no longer true once #180 recorded the deployed state, so it now states what is actually deployed: `trusted-dco` and `gate-integrity` are among the ten required contexts, the pull-request- controlled `dco` context was removed from that set only after the trusted one reported green on real pull requests, and both gates were observed red then green on real pull requests rather than in a fixture (ADR-0016). `bun.lock`'s diff is exactly the four workspace `version` lines, edited directly rather than by regenerating the lockfile, so no transitive drift rides along in the release commit. Validation: 2790 tests pass; typecheck, lint, `adr lint` (35 records, 0 errors), actionlint, and every `check:*` gate green; schema, MANIFEST, and committed Action bundle no-diff gates clean. The committed `packages/ci/dist` bundles were confirmed byte-identical to a canonical Linux Bun 1.3.14 rebuild and were restored after `release:pack`'s non-frozen build rewrote them under local Bun 1.4.0. `release:pack --tag v0.12.0` produced five artifacts (four lockstep at 0.12.0 plus spec-kit at 0.1.3); installed-tarball smoke passed on Node 22.22.2 and 24.16.0; `release:publish --dry-run` exited 0 and skipped `@adrkit/spec-kit@0.1.3` as registry-identical, confirmed independently against the registry shasum; `npm audit` over the packed consumer tree found 0 vulnerabilities against an empty `KNOWN_CONSUMER_ADVISORY_ACCEPTANCES`; and both OCI targets built and smoked, with the MCP image serving both protocol eras read-only and networkless. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Signed-off-by: Mark Beacom --- .github/ISSUE_TEMPLATE/bug_report.yml | 2 +- AGENTS.md | 2 +- CHANGELOG.md | 61 ++++++++++++++++----------- bun.lock | 8 ++-- docs/RELEASING.md | 4 +- package.json | 2 +- packages/cli/package.json | 2 +- packages/cli/src/index.ts | 2 +- packages/cli/test/color.test.ts | 2 +- packages/core/package.json | 2 +- packages/evaluator/package.json | 2 +- packages/mcp/package.json | 2 +- packages/mcp/server.json | 4 +- packages/mcp/src/server.ts | 2 +- site/src/components/Hero.astro | 2 +- site/src/content/docs/badges.mdx | 4 +- site/src/content/docs/ci.mdx | 10 ++--- site/src/content/docs/index.mdx | 2 +- site/src/content/docs/quickstart.mdx | 2 +- 19 files changed, 65 insertions(+), 52 deletions(-) diff --git a/.github/ISSUE_TEMPLATE/bug_report.yml b/.github/ISSUE_TEMPLATE/bug_report.yml index 38e6481..13bf4f2 100644 --- a/.github/ISSUE_TEMPLATE/bug_report.yml +++ b/.github/ISSUE_TEMPLATE/bug_report.yml @@ -31,7 +31,7 @@ body: attributes: label: adrkit version description: Output of `adr --version` (or the package version you installed). - placeholder: '0.11.0' + placeholder: '0.12.0' validations: required: true - type: dropdown diff --git a/AGENTS.md b/AGENTS.md index b06213c..dc0e5fc 100644 --- a/AGENTS.md +++ b/AGENTS.md @@ -2,7 +2,7 @@ Decision memory for human- and agent-authored plans — machine-readable ADRs that are enforceable in CI and legible to agents, without leaving git. -Status: early — phases 0–6 landed and v0.11.0 is public. `@adrkit/core`, +Status: early — phases 0–6 landed and v0.12.0 is public. `@adrkit/core`, `@adrkit/evaluator`, `@adrkit/cli` (`lint`, `new`, `graph`, `explain`, `check`, `queue`, `migrate --from madr`, `evaluate`) are published on npm, as is the independently versioned `@adrkit/spec-kit` Spec Kit extension (0.1.3); the diff --git a/CHANGELOG.md b/CHANGELOG.md index 55c2753..70ee682 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -9,6 +9,8 @@ Until `1.0.0`, minor releases may include breaking changes ## [Unreleased] +## [0.12.0] - 2026-08-27 + ### Added - **A guarded recovery path for the moving `v0` Action tag.** Manual recovery @@ -41,27 +43,6 @@ Until `1.0.0`, minor releases may include breaking changes script ([#132](https://github.com/mbeacom/adrkit/issues/132)). Judgment prose outside the markers stays hand-maintained. -### Fixed - -- **Inbound marker amplification is bounded before resolution.** One file now - retains at most the first 64 parsed declarations, and one batch at most the - first 10,000 in deterministic code-unit path plus source order. Exact overflow - collapses into one advisory `marker-declarations-capped` finding and - `markerScan.declarations` metadata; `explain`, `check`, and the Action report - it without giving PR-authored markers exit-code authority - ([#113](https://github.com/mbeacom/adrkit/issues/113)). - -- **`adr queue` no longer stays silent when a proposed record has a review - deadline but no routing tier.** `item.tier-absent` now fires whenever the tier - cannot be determined on a record that has entered review — a `review` block, - or a top-level `reviewBy`. The carve-out the spec actually states is - two-conditioned (both absent), but only the first condition was implemented, - so a `cross-team` record with `reviewBy` and no `review` block was listed with - `tier=None` and no finding at all - ([#111](https://github.com/mbeacom/adrkit/issues/111)). A `proposed` record - with neither remains `not-queued` and silent. Severity stays `info`, so no - exit code changes. - - **Trusted CI gates that the pull request cannot edit.** A new `.github/workflows/trusted-gates.yml` runs on `pull_request_target`, which GitHub executes from the repository's default branch — workflow file, @@ -104,8 +85,18 @@ Until `1.0.0`, minor releases may include breaking changes would otherwise have passed clean and deleted the gate on merge. - **[`docs/repository-trust-operations.md`](docs/repository-trust-operations.md)**, - separating the controls that are active from the ones that cannot be applied - until this lands, with the exact verified commands and the evidence for each. + separating the controls that are active from the ones that could not be applied + until the trusted workflow reached `main`, with the exact verified commands and + the evidence for each. Both gates are now deployed and required: the live `main` + ruleset lists `trusted-dco` and `gate-integrity` among its ten required + contexts, and the pull-request-controlled `dco` context was removed from that + set only after the trusted one reported green on real pull requests. Both were + observed failing before being relied on + ([ADR-0016](docs/adr/0016-require-every-check-to-be-observed-failing-before-it-counts-as-coverage.md)): + `gate-integrity` went red before an acknowledgment and green after it on three + ordinary pull requests, and `trusted-dco` went red on a commit that deliberately + omitted `Signed-off-by` and green once it was signed. That is deployed evidence + in both directions, not a fixture or a local invocation. ### Changed @@ -125,6 +116,27 @@ Until `1.0.0`, minor releases may include breaking changes states which invocation is the authority and which is advisory, because the limitation stopped being true for the one that gates the merge. +### Fixed + +- **Inbound marker amplification is bounded before resolution.** One file now + retains at most the first 64 parsed declarations, and one batch at most the + first 10,000 in deterministic code-unit path plus source order. Exact overflow + collapses into one advisory `marker-declarations-capped` finding and + `markerScan.declarations` metadata; `explain`, `check`, and the Action report + it without giving PR-authored markers exit-code authority + ([#113](https://github.com/mbeacom/adrkit/issues/113)). + +- **`adr queue` no longer stays silent when a proposed record has a review + deadline but no routing tier.** `item.tier-absent` now fires whenever the tier + cannot be determined on a record that has entered review — a `review` block, + or a top-level `reviewBy`. The carve-out the spec actually states is + two-conditioned (both absent), but only the first condition was implemented, + so a `cross-team` record with `reviewBy` and no `review` block was listed with + `tier=None` and no finding at all + ([#111](https://github.com/mbeacom/adrkit/issues/111)). A `proposed` record + with neither remains `not-queued` and silent. Severity stays `info`, so no + exit code changes. + ## [0.11.0] - 2026-08-26 ### Added @@ -1297,7 +1309,8 @@ against live Spec Kit, rather than reasoning about it: - Node-targeted published distribution of all packages, smoke-tested under Node 22 and 24. -[Unreleased]: https://github.com/mbeacom/adrkit/compare/v0.11.0...HEAD +[Unreleased]: https://github.com/mbeacom/adrkit/compare/v0.12.0...HEAD +[0.12.0]: https://github.com/mbeacom/adrkit/compare/v0.11.0...v0.12.0 [0.11.0]: https://github.com/mbeacom/adrkit/compare/v0.10.0...v0.11.0 [0.10.0]: https://github.com/mbeacom/adrkit/compare/v0.9.0...v0.10.0 [0.9.0]: https://github.com/mbeacom/adrkit/compare/v0.8.0...v0.9.0 diff --git a/bun.lock b/bun.lock index 75244a8..f54a72e 100644 --- a/bun.lock +++ b/bun.lock @@ -55,7 +55,7 @@ }, "packages/cli": { "name": "@adrkit/cli", - "version": "0.11.0", + "version": "0.12.0", "bin": { "adr": "./dist/index.js", "adrkit": "./dist/index.js", @@ -70,7 +70,7 @@ }, "packages/core": { "name": "@adrkit/core", - "version": "0.11.0", + "version": "0.12.0", "dependencies": { "picomatch": "^4", "semver": "^7", @@ -85,7 +85,7 @@ }, "packages/evaluator": { "name": "@adrkit/evaluator", - "version": "0.11.0", + "version": "0.12.0", "dependencies": { "@adrkit/core": "workspace:*", "jsonpath-rfc9535": "1.3.0", @@ -96,7 +96,7 @@ }, "packages/mcp": { "name": "@adrkit/mcp", - "version": "0.11.0", + "version": "0.12.0", "bin": { "adrkit-mcp": "./dist/bin.js", }, diff --git a/docs/RELEASING.md b/docs/RELEASING.md index c1eae80..706d942 100644 --- a/docs/RELEASING.md +++ b/docs/RELEASING.md @@ -9,13 +9,13 @@ Action, and one lockstep OCI image: | `@adrkit/evaluator` | npm | | `@adrkit/cli` (`adr`, `adrkit`) | npm | | `@adrkit/mcp` (`adrkit-mcp`) | npm | -| `packages/ci/action.yml` | Git tag (latest immutable release `v0.11.0`, moving `v0`) | +| `packages/ci/action.yml` | Git tag (latest immutable release `v0.12.0`, moving `v0`) | | `ghcr.io/mbeacom/adrkit` | GitHub Container Registry (`vX.Y.Z`, moving `vX`, `latest`; begins with the first release containing ADR-0032) | `@adrkit/ci` stays private because GitHub executes the committed Action bundle directly from the referenced repository ref. -The coordinated lockstep surface is published; the current release is `v0.11.0`. `@adrkit/core`, +The coordinated lockstep surface is published; the current release is `v0.12.0`. `@adrkit/core`, `@adrkit/evaluator`, and `@adrkit/cli` use GitHub Actions Trusted Publishing. `@adrkit/mcp` was created with the isolated one-time bootstrap path below; its Trusted Publisher and token-restriction cleanup must be completed before the diff --git a/package.json b/package.json index 7eefd01..248acd4 100644 --- a/package.json +++ b/package.json @@ -1,6 +1,6 @@ { "name": "adrkit", - "version": "0.11.0", + "version": "0.12.0", "description": "Decision memory for human and agent-authored plans \u2014 machine-readable, CI-enforceable architecture decision records.", "type": "module", "private": true, diff --git a/packages/cli/package.json b/packages/cli/package.json index b8bfe7e..0f70120 100644 --- a/packages/cli/package.json +++ b/packages/cli/package.json @@ -1,6 +1,6 @@ { "name": "@adrkit/cli", - "version": "0.11.0", + "version": "0.12.0", "description": "Git-native architecture decision record tooling from adrkit.", "type": "module", "license": "Apache-2.0", diff --git a/packages/cli/src/index.ts b/packages/cli/src/index.ts index 6a93084..ce30ad6 100644 --- a/packages/cli/src/index.ts +++ b/packages/cli/src/index.ts @@ -63,7 +63,7 @@ import { getPresentation, setPresentation, styleUsageBlock, type ColorMode, type * (mirroring `@adrkit/mcp`'s `SERVER_INFO`) so the bundled `dist/index.js` never has * to locate `package.json` at runtime. `version.test.ts` asserts the two agree. */ -export const CLI_VERSION = '0.11.0'; +export const CLI_VERSION = '0.12.0'; function topLevelUsage(style?: StreamStyle): string { return renderTopLevelUsage(CLI_VERSION, style); diff --git a/packages/cli/test/color.test.ts b/packages/cli/test/color.test.ts index ec3cfa6..d288ab1 100644 --- a/packages/cli/test/color.test.ts +++ b/packages/cli/test/color.test.ts @@ -33,7 +33,7 @@ describe('CLI color presentation', () => { expect(result.exitCode).toBe(0); expect(result.stderr).toBe(''); expect(result.stdout).toContain('\u001b['); - expect(result.stdout).toContain('adrkit 0.11.0'); + expect(result.stdout).toContain('adrkit 0.12.0'); }); test('forced color keeps lint stdout and stderr separated', async () => { diff --git a/packages/core/package.json b/packages/core/package.json index 1c53bbf..e951220 100644 --- a/packages/core/package.json +++ b/packages/core/package.json @@ -1,6 +1,6 @@ { "name": "@adrkit/core", - "version": "0.11.0", + "version": "0.12.0", "description": "Pure ADR parsing, validation, migration, and affects resolution for adrkit.", "type": "module", "license": "Apache-2.0", diff --git a/packages/evaluator/package.json b/packages/evaluator/package.json index 0538404..f81d032 100644 --- a/packages/evaluator/package.json +++ b/packages/evaluator/package.json @@ -1,6 +1,6 @@ { "name": "@adrkit/evaluator", - "version": "0.11.0", + "version": "0.12.0", "description": "Deterministic, model-free ADR proposal evaluation and routing for adrkit.", "type": "module", "license": "Apache-2.0", diff --git a/packages/mcp/package.json b/packages/mcp/package.json index 036e0a5..bf9865c 100644 --- a/packages/mcp/package.json +++ b/packages/mcp/package.json @@ -1,7 +1,7 @@ { "name": "@adrkit/mcp", "mcpName": "dev.adrkit/mcp", - "version": "0.11.0", + "version": "0.12.0", "description": "Local, read-only Model Context Protocol server exposing adrkit decision retrieval over stdio.", "type": "module", "license": "Apache-2.0", diff --git a/packages/mcp/server.json b/packages/mcp/server.json index 0793003..d37ae0b 100644 --- a/packages/mcp/server.json +++ b/packages/mcp/server.json @@ -3,7 +3,7 @@ "name": "dev.adrkit/mcp", "title": "adrkit decision memory", "description": "Deterministic, offline, read-only ADR decision memory for coding agents. No model or network calls.", - "version": "0.11.0", + "version": "0.12.0", "websiteUrl": "https://adrkit.dev", "repository": { "url": "https://github.com/mbeacom/adrkit", @@ -15,7 +15,7 @@ "registryType": "npm", "registryBaseUrl": "https://registry.npmjs.org", "identifier": "@adrkit/mcp", - "version": "0.11.0", + "version": "0.12.0", "runtimeHint": "npx", "transport": { "type": "stdio" diff --git a/packages/mcp/src/server.ts b/packages/mcp/src/server.ts index 59c3a54..33b7df0 100644 --- a/packages/mcp/src/server.ts +++ b/packages/mcp/src/server.ts @@ -14,7 +14,7 @@ import { registerGetDecisionContext } from './tools/get-decision-context.ts'; import { registerListSuperseded } from './tools/list-superseded.ts'; import type { ToolConfig } from './tools/shared.ts'; -export const SERVER_INFO = { name: '@adrkit/mcp', version: '0.11.0' } as const; +export const SERVER_INFO = { name: '@adrkit/mcp', version: '0.12.0' } as const; /** * The MCP protocol revision this server serves through `serveStdio`'s modern era. diff --git a/site/src/components/Hero.astro b/site/src/components/Hero.astro index df9751f..2b784b4 100644 --- a/site/src/components/Hero.astro +++ b/site/src/components/Hero.astro @@ -14,7 +14,7 @@ const { title = data.title, tagline, actions = [] } = data.hero || {}; CLI works today - v0.11.0 on npm · decision memory in git + v0.12.0 on npm · decision memory in git

diff --git a/site/src/content/docs/badges.mdx b/site/src/content/docs/badges.mdx index 73b6815..4f87383 100644 --- a/site/src/content/docs/badges.mdx +++ b/site/src/content/docs/badges.mdx @@ -100,8 +100,8 @@ jobs: # current release. - run: | mkdir -p .adrkit - npx @adrkit/cli@0.11.0 queue --format json > .adrkit/queue.json.tmp - npx @adrkit/cli@0.11.0 lint --json > .adrkit/lint.json.tmp + npx @adrkit/cli@0.12.0 queue --format json > .adrkit/queue.json.tmp + npx @adrkit/cli@0.12.0 lint --json > .adrkit/lint.json.tmp # A truncated or malformed write renders as `no result` on the badge, which # reads as a bug in your tooling. Fail here instead of committing it. diff --git a/site/src/content/docs/ci.mdx b/site/src/content/docs/ci.mdx index 130868d..ea58084 100644 --- a/site/src/content/docs/ci.mdx +++ b/site/src/content/docs/ci.mdx @@ -55,8 +55,8 @@ the comment reaches GitHub's size limit. Keep the default checkout rooted at `GITHUB_WORKSPACE`; if a workflow checks out elsewhere, marker health will identify files the Action could not inspect. -`v0` is a moving major tag, and it now resolves to a `v0.11.0` build. Pin the -immutable `v0.11.0` tag or a commit SHA for maximum reproducibility. +`v0` is a moving major tag, and it now resolves to a `v0.12.0` build. Pin the +immutable `v0.12.0` tag or a commit SHA for maximum reproducibility.