Base v1.9.0

Release summary

Base v1.9.0 is the Base-owned ecosystem release for the completed v1.9.0 milestone. It introduces and validates an immutable cross-repository compatibility BOM for:

• Base v1.9.0 at ac8d294421e1bfc14afa8c6a2a12f1affb5268ee
• base-cli v0.4.3 at 8a93d22156ba75a99965f7c355f867acba630069
• base-bash-libs v2.1.0 at 36fec50c446dcea8c521a1ba3e7fee2394f169c0
• base-demo v0.1.0 at b8ac2ae490e4965b8131195a11377fd0bd787daf

The compatibility evidence passed on Ubuntu 24.04 and macOS 14. The attached release-bom.json and release-bom.sha256 were produced by the release workflow; the BOM SHA-256 is 52000cc5091fa7a55c24d8842c4b988a2df2aaef2803081c90729ecb6f5b2cf0. See the immutable BOM workflow for the validation evidence.

The v1.9.0 milestone closed with 93 completed issues. Sixteen open follow-ups, including #2115, were carried forward to v1.10.0. The Homebrew tap handoff remains a post-release follow-up.

Added

• Stability compatibility: added v1.8.0-provenance contract fixtures and a
  required CI check for stable command flags, JSON shapes, published schemas,
  and doctor/check finding IDs. The accepted v1.9.0 development baseline
  records the pre-existing retirement of repo init --copyright-holder and
  the clarified meanings of BASE-D105 and BASE-P142. The gate now probes
  command help from the shipped Bash implementations, compares the accepted
  fixture with v1.8.0 provenance, and rejects placeholder migration entries.

• Published the Stable schema for basectl workspace agent-brief --format json
  at docs/schemas/workspace-agent-brief.json and added a CI contract test to
  prevent output drift.

• Enforced repository secret scanning and provider push protection, with a
  required checksum-pinned Gitleaks history scan for generic patterns and
  rotate-first maintainer response guidance.

• Added opt-in --closed-unmerged cleanup to basectl gh branch prune and
  basectl gh worktree prune, with explicit PR-state classification and
  retention details for open, closed-unmerged, and no-PR branches.

Changed

• Added a top-level aggregate status to basectl workspace status --format json, using the existing error, warn, and ok precedence while
  preserving per-project fields.

• Align development dependencies and source-checkout CI workflows with the
  released base-cli 0.4.3 provider.

• Documented stable release versus contributor source installation and made
  mutable source checkouts report the next development line with their Git
  revision instead of reusing the latest published version identity.

• Aligned basectl devcontainer and basectl devenv-report option parsing
  with the shared arg_parse contract while preserving their public options
  and project validation.

• Relicensed Base prospectively under Apache-2.0 starting with v1.9.0 to reduce
  adoption friction for companies with copyleft-averse license review. Existing
  MIT and AGPL releases retain their original licenses.

• Made basectl repo init generate Apache-2.0 licenses by default for new
  repositories.

• Documented the deliberate mutable Homebrew installer default, its runtime
  disclosure, and the paired URL/SHA-256 override path for managed environments.

• Added explicit project-originated IDE mutation consent through
  --allow-project-ide-mutations, with complete app, extension, and user-setting
  plans in setup dry-run output; --yes does not grant this consent.

• Documented and exposed the manifest-only command-trust scope, including
  warnings that referenced scripts and Git state are not independently bound
  to approval.

Fixed

• Workspace init and pull now share one local file:// parser that decodes
  spaces, Unicode, and literal percent signs exactly once while rejecting
  malformed encodings and remote authorities.

• Workspace checks now surface each failed latest-check record write, including
  stable JSON/YAML warnings, while preserving project-health exit semantics and
  successful records from the same run.

• Prevented rejected basectl usage invocations from retaining run bundles,
  logs, or history rows; an explicitly named nonexistent basectl test project
  now returns usage status 2, while accepted-command failures remain
  observable and inherited parent bundles remain untouched.

• Batched branch and worktree GitHub PR-state verification through one
  paginated REST read per prune invocation, avoiding one GraphQL query per
  branch and failing the scan closed when that read is unavailable.

• Suppressed the redundant BASE-P142 pyproject.toml dependency warning for
  projects that explicitly delegate Python dependency synchronization to uv.