v0.6.7

Validate GitHub Action repository identity while continuing to require full commit SHA pins. Reviewed action SHA updates can now be made in consumer workflows without changing duplicated hashes in the shared checker.

The consumer template now checks bufbuild/buf-action and reads exact Buf, Buffa, and cargo-fuzz versions from workflow environment values. Node jobs may use any explicit numeric Node version of at least 24. Existing explicit action and tool version policy options remain available when a fixed revision is required.

Update the documentation and regression coverage for these policies. The packaged runner retains its executable permission.

v0.6.6

Move protobuf release policy to the pinned external runner model. New consumers reference their repository-specific checker rather than a vendored shared core.

Strengthen workflow-change coverage with structural trigger validation, canonical path enforcement, and fail-closed handling for ignored, negated, conflicting, or duplicate filters. Update the consumer template and add regression coverage for malformed and bypass-oriented inputs.

v0.6.5

Fix runner-bound core ownership when the pinned release-readiness checkout is located beneath the consumer repository root. The core is authenticated by the runner-provided canonical file URL and enforced package version, regardless of checkout location. Includes a regression test matching the GitHub Actions checkout layout.

v0.6.4

Consumer repositories now load the immutable policy core supplied by the pinned public runner instead of maintaining a byte-for-byte local copy. The runner binds the core path and version before enforcing tracked-source policy. Legacy vendored-core consumers remain supported during migration.

v0.6.2

Highlights

• Adds a public, example-neutral repository archetype matrix and clearer selection tests.
• Corrects application-collection protobuf ownership to allow shared schemas in crates/proto alongside application-owned schemas in apps//contract/proto.
• Supports Rust, TypeScript, and mixed standalone applications while preserving explicit implementation lanes.
• Documents that application collections may contain Rust-only, TypeScript-only, or mixed members.
• Clarifies the compatibility and release-lifecycle boundary between application collections and product workspaces.

Validation

• All 105 automated tests pass.
• Repository self-check and package dry-run pass.
• The public package contains the archetype documentation and excludes local repository mappings.

v0.6.1

Highlights

• Adds the product-workspace archetype for cooperating applications that jointly implement one product and share domain, protocol, client, or SDK foundations.
• Defines facade as an optional Cargo crate role, permits at most one facade, and rejects facade-only repositories with nothing to aggregate.
• Clarifies the selection boundary between application, application-collection, product-workspace, hosted-service, platform-workspace, and runtime-composition.
• Standardizes application-owned protobuf schemas on apps/<app>/contract/proto and keeps product-wide schemas in crates/proto.
• Requires application collections and product workspaces to declare at least two application sublanes.
• Documents the complete directory vocabulary and closed Cargo crate-role vocabulary, with self-checks preventing policy/documentation drift.

Consumer migration

• Vendor the 0.6.1 core.mjs byte-for-byte.
• Set the vendored-core version to 0.6.1 and pin remote CI to this release commit by full immutable SHA.
• Replace apps/<app>/contracts/proto with apps/<app>/contract/proto in application collections.
• Use product-workspace when applications share product semantics or a canonical protocol; use application-collection only when applications remain independently bounded.
• Declare a crate as facade only when it is a thin curated consumer surface; preserve each consumer repository’s existing licensing configuration.

v0.6.0

Highlights

• Unifies the package, Git release, and vendored core under semantic version 0.6.0.
• Replaces numeric core-contract identifiers with one exact semantic release version.
• Adds application, application-collection, taxonomy, and documentation-site repository archetypes.
• Strengthens protocol-engine, hosted-service, conformance-suite, and tooling layout enforcement.
• Extends audit-oriented Rust, TypeScript, Swift, and Kotlin source policies, including 500-line production and 800-line separate-test ceilings.
• Standardizes source SPDX defaults on 2026 ReallyMe LLC and MIT OR Apache-2.0, while leaving Markdown and plain-text documents header-free by default.

Consumer migration

• Vendor the 0.6.0 core.mjs byte-for-byte.
• Set vendoredCore.version to 0.6.0.
• Remove numeric contractVersion configuration.
• Update opted-in repository-shape declarations to satisfy the strengthened archetype requirements.

v0.5.1 — Harden source policy and repository profiles

Contract 12. Adds organization-neutral runtime-composition, infrastructure, and platform-workspace repository profiles. Enforces non-configurable 500-line authored production and 800-line separate-test ceilings across Rust, TypeScript, Swift, and Kotlin; requires complete tracked-source coverage; permits explicit matched generated-source exclusions; and requires every detected source language to invoke its shared policy.

v0.5.0 — Upgraded repository policy

This release introduces release-readiness core contract version 11.

Added

• Opt-in repository-shape contracts with documented foundational-library, protocol-engine, developer-platform, hosted-service, conformance-suite, and tooling profiles.
• TypeScript, Swift, and Kotlin source policies with native verification requirements.
• A 500-line ceiling for production code and examples, with an 800-line ceiling reserved for separate test files.
• Enforcement of separate tests, thin facade modules, wildcard import and re-export rejection, production panic-shortcut detection, and common string/dynamic error-surface detection.
• Shrinking-only source-size baselines for repositories adopting stricter targets.
• Typed SPDX exclusions with stale-exclusion detection and configurable copyright and license attribution.
• Job-scoped GitHub Actions step validation and explicit npm package payload allowlisting.
• Dual MIT OR Apache-2.0 licensing.

Fixed

• Vendored-core validation no longer misparses regular-expression literals.
• SPDX diagnostics no longer assume ReallyMe ownership when another copyright owner is configured.
• Generated TypeScript exclusions are represented consistently in the consumer template.
• The tooling test-directory profile now matches its documented repository-shape contract.

Migration

Consumers should update the following together:

1. Vendor core contract v11 from this release.
2. Update the expected contract version to 11.
3. Pin automation to commit e67ae34.
4. Configure typed SPDX exclusions.
5. Enable source and repository-shape policies after resolving the reported structural debt.

Consumers should pin the full commit SHA rather than a floating branch or tag.