v0.5.0

Highlights

This release ships two capabilities and one breaking on-disk format change.

⚠️ BREAKING (on-disk format): per-spec index sharding (spec 024)

The single registry.json / index.json are replaced by per-unit shard trees
(spec-registry/by-spec/<id>.json, codebase-index/by-spec/<id>.json,
codebase-index/by-package/<slug>.json). Two PRs that touch different specs or
packages now write disjoint files and never conflict on a shared hash line; the
aggregate view is recomputed from the shard set on read.

The on-disk schema is MAJOR 1.0.0 (registry + index). A 0.x reader rejects a
1.x shard tree (exit 3), so an old binary cannot silently misread the new
format. The crate/package version stays a pre-1.0 minor (0.5.0): the on-disk
schema major is decoupled from the package version by design.

Upgrading from 0.4.0 (committed-artifact adopters):

1. Regenerate: spec-spine compile then spec-spine index.
2. Commit the resulting shard trees (the single registry.json/index.json are
   gone).
3. Repoint any derived-artifact merge-driver .gitattributes globs to the shard
   paths.

NEW: ledger seal (spec 023)

A signed, reproducible corpus attestation: spec-spine attest /
attest --sign / verify-attestation (two-mode recompute + signature).

Distribution

cargo install spec-spine-cli · npm i -D spec-spine · uvx spec-spine /
pip install spec-spine. Each per-triple archive ships with a .sha256 sidecar,
a per-target CycloneDX SBOM (.cdx.json), and an attached SLSA build-provenance
attestation.

---

What's Changed

• feat(023): ledger seal (signed, reproducible corpus attestation) by @bartekus in #26
• chore(ci): rename the dogfood job to self_governance by @bartekus in #27
• feat(024): shard registry + index so concurrent PRs never conflict by @bartekus in #28
• chore(024): ratify per-unit shard storage (draft -> approved) by @bartekus in #29
• chore(release): bump to v0.5.0 (ships spec 023 ledger seal + spec 024 index sharding) by @bartekus in #30

Full Changelog: v0.4.0...v0.5.0