fix: release-skill changelog-heading prose + AGPLv3 license declarations (2.6.1)#151
Merged
Merged
Conversation
Phase 1 of the release skill instructed rolling the new section under a bare `## v<version>` heading, but the repo's CHANGELOG.md -- and every prior GitHub Release -- uses the Keep-a-Changelog `## [<version>]` form, which is also the form the _releaselib notes/date guards (hardened in #150) now match. The roll prose was the last spot still naming the bare-v form, so a literal reading would have written a heading the guards don't recognize. Aligns the roll instruction to the bracket form and pins it with a SkillProseTest assertion. The version bump rides this commit because the change touches the published `plugins/ca/` payload (the version-bump gate requires it). CHANGELOG: the /ca:release skill now documents the Keep-a-Changelog `## [X.Y.Z]` changelog heading, matching the repo convention and the hardened release guards. Claude-Session: https://claude.ai/code/session_015tNUy37dx7DJGDzmVUB8Wf
Two declarations were left stale after the relicense (#147/#149, ADR-0009): - plugins/ca/.claude-plugin/plugin.json still declared "license": "MIT" -- the machine-readable field plugin registries display. Now AGPL-3.0-only, matching the LICENSE file and the README badge. SPDX -only per the v3, no-or-later grant the docs and ADR state (per-file headers were explicitly declined). - The top-of-README License notice still carried the pre-#149 "available separately" offering wording; #149 corrected only the detailed Dual-Licensing section and left this callout. Now uses the same reserves-the-right / not-offered-at-this-time framing as that section. CHANGELOG: the plugin manifest now declares AGPL-3.0-only (was a stale MIT), and the README license notice no longer implies commercial licenses are on offer. Claude-Session: https://claude.ai/code/session_015tNUy37dx7DJGDzmVUB8Wf
SUaDtL
added a commit
that referenced
this pull request
Jun 27, 2026
…aces (#152) * fix(license): finish the AGPLv3 relicense on two stale surfaces The v2.6.0 relicense (ADR-0009) left two more declarations on the old MIT terms, beyond the ca manifest + README callout fixed in #151: - plugins/ca-sandbox/.claude-plugin/plugin.json declared "license": "MIT" -- the sibling plugin's machine-readable field. Now AGPL-3.0-only (the repo LICENSE is AGPLv3 and ADR-0009 carves out no exception for ca-sandbox). 0.1.1 is untagged, so no version bump is required. - .codearbiter/coding-standards.md still stated "License is MIT; copyright holder codeArbiter contributors". Corrected to AGPL-3.0-only / SUaDtL per ADR-0009. CHANGELOG: ca-sandbox's plugin manifest now declares AGPL-3.0-only (was a stale MIT). Claude-Session: https://claude.ai/code/session_015tNUy37dx7DJGDzmVUB8Wf * ci: add a license-consistency check across declaration surfaces A relicense must update several surfaces (both plugin manifests, LICENSE, the README badge + notice) and human review keeps missing some -- the v2.6.0 AGPLv3 relicense left three stale (the ca manifest + README callout fixed in #151, the ca-sandbox manifest fixed in the preceding commit). This adds a mechanical CI guard so a partial relicense fails the build instead of shipping. check_license_consistency.py is stdlib-only with pure functions that degrade to a finding rather than raise. It reads ONLY the enumerated surfaces -- never a repo-wide grep -- so third-party (package-lock) and historical (CHANGELOG/ADR) license mentions can't false-positive. ca's plugin.json `license` is the canonical SPDX; a LICENSE_FAMILIES table maps it to each surface's identifying markers, so the check is license-agnostic (a future relicense adds an entry, not a rewrite). A fixed forbidden-phrase set guards retired commercial-offering prose. Wired as a repo-wide, always-on ci.yml job in the required-checks aggregation. security-reviewer PASS (no untrusted-input / secret / privilege concerns). Spec: .codearbiter/specs/license-consistency-check.md. 23 unit tests cover AC-1..10. Claude-Session: https://claude.ai/code/session_015tNUy37dx7DJGDzmVUB8Wf --------- Co-authored-by: SUaDtL <SUaDtL@users.noreply.github.com>
SUaDtL
added a commit
that referenced
this pull request
Jul 1, 2026
2.6.1 is a security-hardening release: the five P1 enforcement-bypass fixes (#159-#163) plus the #158 task-id fix and the #151 release-skill/AGPLv3 surface alignment. Version (plugin.json) and README badges were already at 2.6.1; this adds the user-facing CHANGELOG section and is the last surface before tagging. Claude-Session: https://claude.ai/code/session_01JqTxpxEkbDHb6AuADohtMR Co-authored-by: Claude <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Two small, related cleanups under the 2.6.1 patch — both trailing inconsistencies from the v2.6.0 release work. Two commits, each type-homogeneous.
fix(release)— changelog roll uses the bracket heading (31bf775)The release skill's Phase-1 prose told the orchestrator to roll the new section under a bare
## v<version>heading, but the repo'sCHANGELOG.md(and every prior GitHub Release) uses the Keep-a-Changelog## [<version>]form — the same form the_releaselibguards hardened in #150 now match. The prose was the last spot still naming the bare-vform. Aligned it and pinned it with aSkillProseTestassertion (## [MAJOR.MINOR.PATCH]present,## vMAJOR.MINOR.PATCHabsent).Because this touches the published
plugins/ca/payload, the version-bump gate requires a bump: 2.6.0 → 2.6.1 (plugin.json+ README version badge), reconciled bycheck_badge_consistency.py.fix(license)— align manifest + README with the AGPLv3 relicense (c8237ed)Two declarations were left stale after the relicense (#147/#149, ADR-0009):
plugin.jsonstill declared"license": "MIT"— the machine-readable field plugin registries display. NowAGPL-3.0-only(SPDX-onlyper the v3, no-"or later" grant the docs/ADR state; per-file headers were explicitly declined), matching the LICENSE file and the README badge.Verification
.github/scripts/test_*.pysuite green (incl. the new SkillProse pin);py_compileclean.check_badge_consistency.pygreen at 2.6.1;plugin.jsonparses (JSON-manifests parity).https://claude.ai/code/session_015tNUy37dx7DJGDzmVUB8Wf