Base v1.7.0

Added

• Added stable, versioned --format json inspection envelopes for basectl repo check, basectl release check, basectl gh issue readiness, and
  basectl gh branch stale, including structured findings and controlled
  usage or upstream failures without changing text defaults or exit policy.
• Added consistent explicit, positional, and nearest-manifest project selection
  to basectl run, build, test, and demo; run/build now expose stable
  read-only JSON lists and Bash/Zsh complete manifest command and target names.
• Added basectl workspace agent-brief to report local repository baseline,
  agent-guidance, AI-context, environment, and validation evidence for a workspace
  handoff as read-only text or stable JSON.
• Added --ci mode to basectl setup, basectl check, and basectl doctor
  as the preferred CI-safe command surface while keeping basectl ci as a
  compatibility alias.
• Added bootstrap.sh --ensure-bash to verify or install only the Bash 4.2+
  prerequisite on macOS and Ubuntu/Debian before the full Base setup path is
  available.
• Added basectl workspace onboarding to summarize first-day repository
  readiness, missing clone actions, and project setup/check/test commands from
  a workspace manifest without mutating repositories.
• Added basectl devcontainer to preview or write .devcontainer/devcontainer.json
  from Base project manifests, with JSON output that reports supported,
  unsupported, and ambiguous manifest fields.
• Added basectl devenv-report to classify Base manifest fields as supported,
  unsupported, lossy, or project-owned for Nix/devenv adoption planning without
  generating files or requiring Nix.
• Added basectl history --report to generate local Markdown or JSON activity
  summaries from recent command history and log metadata without dumping raw
  logs or uploading telemetry.
• Added a bounded copilot-setup-steps workflow and documentation for optional
  GitHub Copilot cloud-agent setup without changing normal local development or
  CI behavior.
• Added basectl repo init --agent-ready to seed AGENTS.md and skills.md
  alongside the standard repo baseline.
• Added basectl repo check --agent-ready to verify the agent-ready repo
  guidance contract without changing default baseline checks.
• Added basectl gh issue readiness to check issue body sections, labels,
  assignees, and optional GitHub Project fields before assigning agentic
  implementation work.
• Added explicit, repeatable basectl repo init --language <csv> profiles that
  record normalized project.languages metadata and opt Python baselines into
  python.manager: uv.
• Added shared issue-backed branch validation to basectl gh pr create and an
  active GitHub ruleset that rejects noncanonical non-default branch names.
• Added a trusted Issue Branch Policy workflow and required PR-head status that
  verify the branch prefix matches the referenced issue's single category
  label, including for raw Git and third-party AI tools. The workflow rejects
  impossible dates, aggregates open pull requests sharing a commit, queues
  head-SHA-serialized default-branch revalidation after issue relabeling or
  synchronization, and binds enforcement to the GitHub Actions integration.

Changed

• Required Base runtime startup to use the corrected 1.x base-bash-libs
  release line at version 1.3.0 or newer, with clear rejection of stale or
  incompatible library checkouts.

• Updated Base CI to consume the published base-bash-libs v1.3.0 release
  commit.

• Migrated generic Git branch, worktree, upstream, merge, remote, and default
  branch consumers to canonical git_* helpers and synchronized CI with the
  merged base-bash-libs implementation.

• Migrated generic branch, worktree, default-branch, upstream, merge, and
  remote inspection consumers to the canonical git_* APIs from
  base-bash-libs, leaving base_gh_* as the command-facing wrapper layer.

• Registered every Python-owned remote shell installer in one policy and added
  paired URL/SHA-256 overrides for verified uv and mise bootstrap on
  Debian-family Linux, while explicitly disclosing unverified mutable defaults.

• Clarified CI-safe setup/readiness/diagnostics help and docs so --ci mode is
  not confused with running tests, launching GitHub Actions, or creating
  Ubuntu/Multipass VMs.

• Changed Base-owned repo init, repo agent-guidance, and repo installer-template pull request flows to require an issue number and create
  canonical issue-backed branches.

• Changed basectl gh issue start and basectl gh pr create to fail closed for
  missing, ambiguous, inaccessible, or mismatched issue category metadata, and
  aligned issue start repository selection with explicit --repo/-R,
  GH_REPO, then origin precedence.

Fixed

• Aligned basectl leaf help, exact-command argument errors, and Bash/Zsh
  completions, including scoped release options and GitHub Project flags, while
  grouping root help around the first-run and daily project journeys.
• Stopped shell-only project setup, check, doctor, workspace status, and
  onboarding from requiring a project virtual environment solely to host
  Base's own Python control-plane dependencies. Manifests that explicitly
  declare python: or a python-package artifact keep the existing project
  Python environment behavior.
• Made basectl onboard --yes reach unattended setup consent and added a
  read-only, workspace-wide manifest trust review step that never grants trust
  automatically or prompts for metadata-only manifests.
• Made the legacy basectl ci setup|check|doctor compatibility syntax pass
  arguments directly to the canonical lifecycle parsers, restoring option,
  help, validation, and exit-code parity.
• Required explicit relative or absolute paths for Base runtime scripts so a
  same-named file in the current directory cannot shadow a basectl control
  command.
• Reported basectl setup, check, and doctor runtime chain diagnostics up
  front and rejected x86_64 Base virtual environments under Apple Silicon
  Homebrew before profile setup reaches later brew install steps.
• Hardened Ubuntu GitHub Actions package installs against hosted-runner
  third-party apt source failures before Base test jobs install their tools.