v0.5.0 — Upgraded repository policy

This release introduces release-readiness core contract version 11.

Added

• Opt-in repository-shape contracts with documented foundational-library, protocol-engine, developer-platform, hosted-service, conformance-suite, and tooling profiles.
• TypeScript, Swift, and Kotlin source policies with native verification requirements.
• A 500-line ceiling for production code and examples, with an 800-line ceiling reserved for separate test files.
• Enforcement of separate tests, thin facade modules, wildcard import and re-export rejection, production panic-shortcut detection, and common string/dynamic error-surface detection.
• Shrinking-only source-size baselines for repositories adopting stricter targets.
• Typed SPDX exclusions with stale-exclusion detection and configurable copyright and license attribution.
• Job-scoped GitHub Actions step validation and explicit npm package payload allowlisting.
• Dual MIT OR Apache-2.0 licensing.

Fixed

• Vendored-core validation no longer misparses regular-expression literals.
• SPDX diagnostics no longer assume ReallyMe ownership when another copyright owner is configured.
• Generated TypeScript exclusions are represented consistently in the consumer template.
• The tooling test-directory profile now matches its documented repository-shape contract.

Migration

Consumers should update the following together:

1. Vendor core contract v11 from this release.
2. Update the expected contract version to 11.
3. Pin automation to commit e67ae34.
4. Configure typed SPDX exclusions.
5. Enable source and repository-shape policies after resolving the reported structural debt.

Consumers should pin the full commit SHA rather than a floating branch or tag.