Prepare v1.4.0 release and changelog guard

.github/workflows/release.yml

@@ -46,6 +46,11 @@ jobs:
           candidate="$(find dist -path '*linux_amd64*' -type f -name memory-bank-cli -perm -u+x | head -n 1)"
           test -n "$candidate"
           E2E_BINARY="$candidate" E2E_SCOPE=release bash scripts/e2e-init-update.sh
+      - name: Validate release changelog
+        if: github.event_name == 'workflow_dispatch'
+        env:
+          RELEASE_VERSION: ${{ inputs.version }}
+        run: bash scripts/check-release-changelog.sh "$RELEASE_VERSION"
 
   release:
     name: Publish release

AGENTS.md

@@ -0,0 +1,21 @@
+# Repository instructions
+
+## Releases
+
+When asked to make a release, update `CHANGELOG.md` as part of the release
+without waiting for a separate request:
+
+1. Choose the next semantic version from the user-visible changes since the
+   latest release.
+2. Move the relevant entries from `Unreleased` into a
+   `## [X.Y.Z] - YYYY-MM-DD` section and leave an empty `Unreleased` section.
+3. Keep the changelog entry in the same commit that will be tagged. Do not
+   publish a release from a commit that lacks its versioned changelog section.
+4. Run the Go tests, vet, GoReleaser configuration check, snapshot build, and
+   release E2E validation before publishing.
+5. Publish through `.github/workflows/release.yml`, wait for it to complete,
+   install the exact released tag locally, and verify `memory-bank-cli
+   --version`.
+
+The release workflow enforces step 3 with
+`scripts/check-release-changelog.sh`.

CHANGELOG.md

@@ -0,0 +1,84 @@
+# Changelog
+
+All notable changes to `memory-bank-cli` are documented in this file.
+
+The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/),
+and this project follows [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
+
+## [Unreleased]
+
+## [1.4.0] - 2026-07-24
+
+### Added
+
+- Add `memory-bank-cli push` to publish managed downstream Memory Bank changes
+  through a dedicated upstream branch and GitHub pull request.
+
+### Fixed
+
+- Prefer the canonical template payload over a project-local `memory-bank`
+  copy when resolving managed source files.
+- Harden upstream publication with base validation, reserved branch names,
+  rollback-safe failure handling, and a pinned GitHub repository target.
+
+## [1.3.0] - 2026-07-24
+
+### Added
+
+- Support templates whose Memory Bank payload is nested under
+  `template/memory-bank`.
+
+## [1.2.2] - 2026-07-24
+
+### Changed
+
+- Republish the template source-root support later released as `v1.3.0`.
+
+## [1.2.1] - 2026-07-24
+
+### Added
+
+- Add hermetic local `init` and `update` end-to-end release validation.
+
+### Changed
+
+- Allow manually dispatched releases to publish after automated validation
+  without a separate GitHub environment approval.
+
+## [1.2.0] - 2026-07-24
+
+### Changed
+
+- Derive the template profile from the selected payload root.
+
+## [1.1.0] - 2026-07-23
+
+### Added
+
+- Translate template source payload paths when applying downstream updates.
+- Add stable downstream smoke tests and scheduled compatibility canaries.
+
+## [1.0.1] - 2026-07-23
+
+### Fixed
+
+- Preserve the project prompt catalog while updating managed blocks.
+
+## [1.0.0] - 2026-07-23
+
+### Added
+
+- Publish the standalone `memory-bank-cli` executable with `init`, `update`,
+  `lint`, and read-only `doctor` workflows.
+- Add opt-in GitHub workflow integration and managed Memory Bank blocks.
+- Add Go install, Homebrew, and platform-specific release artifacts.
+
+[Unreleased]: https://github.com/dapi/memory-bank-cli/compare/v1.4.0...HEAD
+[1.4.0]: https://github.com/dapi/memory-bank-cli/compare/v1.3.0...v1.4.0
+[1.3.0]: https://github.com/dapi/memory-bank-cli/compare/v1.2.2...v1.3.0
+[1.2.2]: https://github.com/dapi/memory-bank-cli/compare/v1.2.1...v1.2.2
+[1.2.1]: https://github.com/dapi/memory-bank-cli/compare/v1.2.0...v1.2.1
+[1.2.0]: https://github.com/dapi/memory-bank-cli/compare/v1.1.0...v1.2.0
+[1.1.0]: https://github.com/dapi/memory-bank-cli/compare/v1.0.1...v1.1.0
+[1.0.1]: https://github.com/dapi/memory-bank-cli/compare/v1.0.0...v1.0.1
+[1.0.0]: https://github.com/dapi/memory-bank-cli/releases/tag/v1.0.0

README.md

@@ -13,19 +13,21 @@ Without `--dry-run`, `push` creates a fresh upstream branch, commits only change
 
 ## Install
 
-Install a released version with Go:
+Install the latest released version with Go:
 
 ```sh
-go install github.com/dapi/memory-bank-cli/cmd/memory-bank-cli@vX.Y.Z
+go install github.com/dapi/memory-bank-cli/cmd/memory-bank-cli@latest
 ```
 
-The first release under the `memory-bank-cli` executable identity will be
-`v1.0.0`. After it is published and installed, run:
+For a reproducible install, replace `latest` with a tag such as `v1.4.0`.
+After installation, run:
 
 ```sh
 memory-bank-cli --version
 ```
 
+See [CHANGELOG.md](CHANGELOG.md) for release notes.
+
 ## Upgrade
 
 Install the desired newer semantic version with the same command:

memory-bank/ops/release.md

@@ -2,7 +2,7 @@
 title: memory-bank-cli Release
 doc_kind: ops
 doc_function: canonical
-purpose: "Canonical owner confirmed release-build facts and release unknowns."
+purpose: "Canonical release procedure and verification requirements."
 derived_from:
   - ../engineering/architecture.md
   - ../features/FT-001-migrate-cli-source-and-rename-executable/brief.md
@@ -12,20 +12,24 @@ status: active
 # Release
 
 The repository has `.goreleaser.yml`; the release configuration builds only
-`memory-bank-cli`. A prior public module version predates the current
-executable identity and is not installation evidence for it.
+`memory-bank-cli` and publishes GitHub and Homebrew artifacts. Releases are
+created by manually dispatching `.github/workflows/release.yml` from `main`
+with a complete `v`-prefixed semantic version.
 
-[FT-003](../features/FT-003-establish-memory-bank-cli-releases/brief.md) is the
-active release-delivery design for the first `memory-bank-cli` publication:
-validation before a `v1.0.0` GitHub release, Go-install verification and
-install/upgrade documentation. Its `design.md` owns the selected pipeline;
-this document remains the owner of observed release configuration facts.
+## Procedure
 
-## Verification Gap
+1. Select the next semantic version from user-visible changes since the latest
+   tag.
+2. Update `CHANGELOG.md`: move the release changes out of `Unreleased`, add a
+   dated `## [X.Y.Z]` section, and update comparison links.
+3. Commit and merge the changelog with the exact source commit to be released.
+4. Run `go test -count=1 -race ./...`, `go vet ./...`, `goreleaser check`, a
+   GoReleaser snapshot build, and the release-scoped local E2E validation.
+5. Dispatch the release workflow with the selected version. The workflow
+   verifies the changelog section before creating the tag and publishing.
+6. Wait for successful publication, install the exact tag with `go install`,
+   and verify the reported version.
 
-The repository workflow runs the target validation path for pull requests,
-`main` and manually dispatched releases. Its publication job depends on
-successful validation and the required-reviewer protection rule on the GitHub
-`release` environment. No `v1.0.0` publication evidence exists yet. Public
-publication also requires every credential declared by `.goreleaser.yml`;
-artifact platforms and configured destinations remain unchanged.
+`AGENTS.md` makes the changelog update an automatic part of every agent-driven
+release request. `scripts/check-release-changelog.sh` prevents a manually
+dispatched release from bypassing the same requirement.

scripts/check-release-changelog.sh

@@ -0,0 +1,29 @@
+#!/usr/bin/env bash
+
+set -euo pipefail
+
+if [ "$#" -ne 1 ]; then
+  echo "usage: $0 vX.Y.Z" >&2
+  exit 2
+fi
+
+release_version="$1"
+numeric_identifier='(0|[1-9][0-9]*)'
+prerelease_identifier="(${numeric_identifier}|[0-9A-Za-z-]*[A-Za-z-][0-9A-Za-z-]*)"
+semver_regex="^v${numeric_identifier}\\.${numeric_identifier}\\.${numeric_identifier}(-${prerelease_identifier}(\\.${prerelease_identifier})*)?(\\+[0-9A-Za-z-]+(\\.[0-9A-Za-z-]+)*)?$"
+
+if ! [[ "$release_version" =~ $semver_regex ]]; then
+  echo "release version must be a complete, v-prefixed semantic version" >&2
+  exit 2
+fi
+
+changelog_version="${release_version#v}"
+escaped_changelog_version="$(printf '%s\n' "$changelog_version" | sed 's/[][\\.^$*+?{}|()]/\\&/g')"
+release_heading_regex="^## \\[${escaped_changelog_version}\\] - [0-9]{4}-[0-9]{2}-[0-9]{2}$"
+
+if ! grep -Eq "$release_heading_regex" CHANGELOG.md; then
+  echo "CHANGELOG.md must contain a dated ## [$changelog_version] release section" >&2
+  exit 1
+fi
+
+echo "CHANGELOG.md contains release section for $release_version"