Release v0.5.0 and finish repository settings

[lenhonbp]

The v0.5 real-world intelligence implementation is merged, validated, and published to npm as codex-memory-intelligence@0.5.0. Complete the remaining future-release verification and optional repository administration work.

Engineering complete

• Merge the v0.5 implementation through reviewed PR Build v0.5 real-world project intelligence #5.
• Add incremental scans, .cmiignore, workspace awareness, stronger import resolution, BM25 retrieval, structured context packs, and expanded MCP intelligence.
• Add project schemas, parser fixtures, synthetic benchmarks, release metadata validation, and installed-package smoke tests.
• Pass 20/20 tests on merged main.
• Pass all seven CI jobs on merged main.
• Pass CodeQL on merged main.
• Fix npm bin manifest normalization through reviewed PR Fix npm manifest normalization before v0.5.0 #6.
• Fix local bootstrap provenance handling through reviewed PR Fix bootstrap publish provenance handling #7.

npm bootstrap and publication

• Create an npm account.
• Confirm the npm email address is verified.
• Enable account-level 2FA and save recovery codes securely.
• Link the npm account to GitHub as an additional recovery option.
• Confirm that the unscoped package name codex-memory-intelligence was available.
• Log in locally with npm login and verify with npm whoami (lenhonbp).
• From reviewed commit e2b40f5c9e84691a31e6b3cb9f175d426c3e52a0, run final checks and manually publish 0.5.0 with 2FA.
• Verify registry metadata: version 0.5.0, dist-tag latest, and both cmi and cmi-mcp bin entries.
• Perform a clean temporary-directory installation test using the published registry package: install cleanly, cmi --version returns 0.5.0, sample scan succeeds, all doctor checks pass, and npm reports zero vulnerabilities.
• Create Git tag v0.5.0 and publish the matching GitHub Release as the latest release on commit e2b40f5c9e84691a31e6b3cb9f175d426c3e52a0.
• Update README npm badge, public package status, and global/project-local installation wording through reviewed PR Add trusted npm publishing and update install docs #8.
• Add and merge .github/workflows/publish.yml through reviewed PR Add trusted npm publishing and update install docs #8 with contents: read, id-token: write, release validation, smoke tests, and no long-lived npm token.
• Configure npm Trusted Publishing for GitHub Actions using repository lenhonbp/codex-memory-intelligence, workflow publish.yml, and publish permission. Trust ID: 3b74bef3-804b-4899-a00c-9a1abd459519.
• Require 2FA and disallow bypass-2FA tokens for package publishing; Trusted Publishing remains the intended release path.
• Use the trusted workflow for 0.5.1 and later releases; verify automatic provenance.

Repository settings

• Delete merged release branches so only protected main remains.
• Add topics: mcp, codex, ai-agents, developer-tools, project-memory, code-intelligence, impact-analysis, local-first, monorepo.
• Enable an active Protect main ruleset requiring pull requests, seven GitHub Actions checks, CodeQL results, conversation resolution, squash merges only, up-to-date branches, and blocking force pushes and branch deletion.
• Enable automatic deletion of merged branches.
• Consider enabling Discussions for user questions and ideas.
• Enable private vulnerability reporting.
• Verify repository security advisories are available; no advisories currently exist.

Release evidence

• Published package: codex-memory-intelligence@0.5.0.
• Release commit: e2b40f5c9e84691a31e6b3cb9f175d426c3e52a0.
• Git tag and GitHub Release: v0.5.0, published as latest.
• npm dist-tag: latest → 0.5.0.
• npm bins: cmi → src/cli.js; cmi-mcp → src/mcp.js.
• 20/20 tests passed during the final publish prepack.
• Clean registry install passed on Node.js 24.9.0; sample project initialization, scan, doctor, and status all succeeded.
• Cross-platform CI and CodeQL passed after the final manifest changes.
• Trusted Publishing workflow merged to main at f18154d5e543b463bad0e47ae88c8235e74a2b51.
• npm Trusted Publisher established for GitHub Actions with workflow publish.yml and permission publish.
• Package publishing now requires 2FA and disallows bypass-2FA tokens.
• Active branch ruleset Protect main targets the default branch with no bypass actors and protects merge, CI, CodeQL, deletion, and force-push behavior.
• Repository branch list contains only protected main.
• Repository topics are configured for discoverability.
• Security advisories and private vulnerability reporting are enabled.

The first release was bootstrapped manually with 2FA. Future releases should use npm Trusted Publishing through the reviewed GitHub Actions workflow and short-lived OIDC credentials.

[lenhonbp]

Release bootstrap update (2026-08-06):

• npm account email verified; 2FA enabled; GitHub linked.
• npm CLI authenticated as lenhonbp.
• unscoped package name codex-memory-intelligence remains available (npm view returned E404).
• local verify, benchmark smoke, package smoke, and initial publish dry-run all passed.
• the dry-run exposed npm manifest normalization warnings for both bin paths.
• PR Fix npm manifest normalization before v0.5.0 #6 fixed the bin metadata and added regression checks; it was merged as c9ea60f1084ffd8b02235ef0432c13daef4d4e5f.
• post-merge CI and CodeQL succeeded.

Remaining before manual bootstrap publish: update the clean local clone to c9ea60f1084ffd8b02235ef0432c13daef4d4e5f, repeat the provenance-disabled dry-run, confirm there are no auto-correction warnings, then publish 0.5.0 with 2FA.