From 7649fc57d81dc6c3254dcfddf54a3c115a3901ae Mon Sep 17 00:00:00 2001 From: Tinker Agora <314183062+tinkeragora@users.noreply.github.com> Date: Wed, 19 Aug 2026 10:49:26 +0800 Subject: [PATCH] docs: sync current release versions in governance --- CHANGELOG.md | 2 ++ docs/RELEASE_POLICY.md | 2 +- 2 files changed, 3 insertions(+), 1 deletion(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index 09d62d1..f23367e 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -74,6 +74,8 @@ when releases begin. time-zone module, dual CLI archives, release evidence, and discovery topics. - Synchronized governance evidence with Tool Call Trace `v0.2.0` and its second published release. +- Synchronized MCP Doctor `v0.1.13`, including its Node.js runtime diagnostic, + release assets, SBOM, provenance, and attestation evidence. - Made settings-audit gates control effective applicability, split Actions parent and selected fields into independent checks, and tightened ambiguous API and policy-schema decisions. diff --git a/docs/RELEASE_POLICY.md b/docs/RELEASE_POLICY.md index 5066c80..163ab82 100644 --- a/docs/RELEASE_POLICY.md +++ b/docs/RELEASE_POLICY.md @@ -5,7 +5,7 @@ | Setting | Current | Target | Apply when | | --- | --- | --- | --- | | Release automation | `cert_viewer`, `color_atlas`, `cron_maker`, `csv_sculptor`, `curl_builder`, `developer_primitives`, `diff_viz`, `dmg_background`, `encoding_toolbox`, `favicon_kit`, `image_to_icns`, `json_yaml_swiss`, `jwt_inspector`, `mcp_doctor`, `md_porter`, `pe_version_info`, `qr_forge`, and `tool_call_trace` have project-specific, tag-triggered publication workflows; `data_toolbox` currently builds candidates without an unattended publication job, and the organization reusable workflow remains read-only | Build and verify reproducibly, then publish from a protected tag with least privilege and project-owned verification | A project has stable hosted checks, immutable release inputs, a documented artifact contract, and explicit owner authorization | -| Versioning | Published releases are `developer_primitives` and `tool_call_trace` at `v0.2.0`; `cert_viewer`, `json_yaml_swiss`, and `jwt_inspector` at `v0.1.1`; `csv_sculptor` and `pe_version_info` at `v0.1.0-alpha.2`; `color_atlas`, `curl_builder`, `data_toolbox`, and `md_porter` at `v0.1.0-alpha.1`; and `cron_maker`, `diff_viz`, `dmg_background`, `encoding_toolbox`, `favicon_kit`, `image_to_icns`, `mcp_doctor`, and `qr_forge` at `v0.1.0` | Use Semantic Versioning for public versions and document pre-`1.0.0` instability | A project declares a public contract and its first release is authorized | +| Versioning | Published releases are `developer_primitives` at `v0.2.0` and `tool_call_trace` at `v0.2.1`; `cert_viewer` at `v0.1.2`; `json_yaml_swiss` and `jwt_inspector` at `v0.1.1`; `csv_sculptor` at `v0.1.0-alpha.5`; `pe_version_info` at `v0.1.0-alpha.4`; `color_atlas`, `curl_builder`, `data_toolbox`, and `md_porter` at `v0.1.0-alpha.1`; `mcp_doctor` at `v0.1.13`; and `cron_maker`, `diff_viz`, `dmg_background`, `encoding_toolbox`, `favicon_kit`, `image_to_icns`, `qr_forge`, and `recoverable_delete` at `v0.1.0` | Use Semantic Versioning for public versions and document pre-`1.0.0` instability | A project declares a public contract and its first release is authorized | | Changelog | This governance repository contains only an `Unreleased` section | Maintain Keep a Changelog categories and move entries to a dated version only during release | A reviewed release candidate is approved; do not create historical entries without release evidence | | Git tags | Every published release above has a `vMAJOR.MINOR.PATCH` tag; repository rules protect current release tags from deletion or mutation | Use protected, immutable `vMAJOR.MINOR.PATCH` tags that point to the reviewed release commit | Tag protection is verified, the release commit and version agree, and tag creation is explicitly authorized | | Artifacts | Release assets and verification material are project-specific; binary projects publish checksums, SBOMs, and attestations defined by their release contract | Publish platform artifacts with cryptographic checksums, an SBOM, and provenance appropriate to the build system | Artifact generation is reproducible, consumer verification instructions exist, and the release is approved |