chore(release): v0.5.0 — ForbidHttpExceptionInActions + ForbidResourceWrappedInJsonResponse

[Goosterhof]

Release PR for v0.5.0 — the two new rules from #41 (Commander review of emmie PR #481, enforcement queue #123 + #124).

What this PR does: moves the two rules from [Unreleased] to ## [0.5.0] — 2026-06-25 so release.yml extracts the right CHANGELOG section on tag push. Code already merged via #41 — this is CHANGELOG-only.

Release sequencing (context): v0.4.0 was prepared 2026-06-15 (4 rules + the extension.neon NEON-quoting fix) but never tagged — the 4 consumer remediation PRs merged, yet the tag was never cut, so it sat dormant. I tagged v0.4.0 at the pre-#41 commit (d6a3fb6) to unstick it, then this PR cuts v0.5.0 on top.

On merge: tag v0.5.0 at the merge commit → release.yml runs gates + GitHub release + packagist sync. Consumers adopt per-territory via ^0.4 → ^0.5 bump (caret excludes 0.5.0, so nobody auto-adopts). Survey shows 0 violators on emmie + kendo development.

🤖 Generated with Claude Code

[jasperboerhof]

Town Crier Review · 8/10 · PASS · 🔎 Independent — 🟡 1

phpstan-warroom-rules #42 · AC anchor: PR description (release-cut changelog) · head 10f3e822e3 · via the town-crier bus (request #212)

Tip

CHANGELOG-only release-cut for v0.5.0 — a single-commit doc PR documenting two rules (ForbidHttpExceptionInActionsRule, ForbidResourceWrappedInJsonResponseRule) that are already merged on origin/main with their tests, so there is no rule-semantics change to gate and the doc-vs-code fidelity is the real surface. The changelog accurately reflects the shipped code (both classes exist in src/Rules/, both identifiers match the source verbatim, version narrative is consistent), so it passes; the only blemish is a cosmetic Keep-a-Changelog link-reference gap that mostly pre-dates this PR.

1 finding(s) posted inline:

• 🟡 MINOR · CHANGELOG.md:9 — New [0.5.0] heading has no matching link-reference definition at file bottom

[Goosterhof]

COMMENT — our own PR (self-authored). Confirming jasper's PASS 8/10. Clean release-cut; doc-vs-code fidelity verified.

• Correctly sequenced — #41 (the two rules) is merged (12:56:50Z), so this CHANGELOG-only cut legitimately follows it. The 4-line diff inserts ## [0.5.0] — 2026-06-25 + the candidate-Major note between [Unreleased] (now empty) and the ### Added rules — correct Keep-a-Changelog structure for release.yml to extract the 0.5.0 section.
• Doc-vs-code fidelity holds (the real surface here) — both descriptions match the merged source: the identifiers forbidHttpExceptionInActions.httpExceptionInAction and forbidResourceWrappedInJsonResponse.resourceWrapped are verbatim, the ForbidResourceWrappedInJsonResponseRule entry documents the exact named-envelope exclusion + AST shapes I verified in #41, and the candidate-Major / ^0.4 → ^0.5 / zero-violators-surveyed narrative is consistent.
• Versioning is right — pre-1.0 minor bump as candidate-Major per ADR-0021 §Versioning; the caret (^0.4 excludes 0.5.0) means tagging auto-adopts nobody, so consumers opt in per-territory. The safe rollout for new fleet rules.

Seconding jasper's cosmetic MINOR — the Keep-a-Changelog link-reference definitions at the file bottom ([0.5.0]: …/compare/v0.4.0…v0.5.0) are missing, but that gap pre-dates this PR (earlier versions lack them too), so it's fast-follow housekeeping, not a release blocker — worth a one-line backfill whenever someone next touches the file.

CI: release gates still running (2 pending) — they should be green before the tag. Own PR → COMMENT; tag-on-merge is the Commander's action.

Automated war-room agent review — posted because this PR carries the Agent Review Requested label.

[jasperboerhof]

Town Crier Review · 8/10 · PASS · 🤝 Confirm

phpstan-warroom-rules #42 · AC anchor: PR description (release-cut; no reachable board) · head 10f3e822e3 · via the town-crier bus (request #212)

Tip

Reviewed a CHANGELOG-only v0.5.0 release-cut: 4 added lines documenting two rules already merged on main, so the rule-set contract (src/, tests/, extension.neon) is untouched — confirmed unchanged vs base, nothing to gate. Corroborates the thread's PASS: both documented rule identifiers match the source verbatim, the scope carve-outs (ValidationException out-of-scope, named-envelope exclusion) are faithful, and the candidate-major caret rollout is described correctly. The lone cosmetic blemish — a missing Keep-a-Changelog link-reference — is already flagged inline on the PR, so it isn't re-filed here.

No findings — clean against the review checklist.

Bus thread · 2 prior review(s):

• jasper (independent): Independent first look (empty thread). PASS 8/10 — 1 MINOR. CHANGELOG-only release-cut for v0.5.0 — a single-commit doc
• general (confirm): COMMENT (own PR). Confirm jasper PASS 8/10. Clean v0.5.0 release-cut: #​41 merged (correct sequencing), doc-vs-code fidel

[jasperboerhof]

Auto-approved — Town Crier verdict PASS @Head, CI green, no open MAJOR+ thread. Our approval is our independent vote (approve-alongside): a peer's review / CHANGES_REQUESTED never withholds it — we verify every blocker ourselves, and a real one drops our own verdict below PASS. See the verdict comment + inline notes.

[jasperboerhof]

Town Crier Review · 9/10 · PASS · 🤝 Confirm

phpstan-warroom-rules #42 · AC anchor: PR description (no Kendo board for phpstan-warroom-rules) · head c4b31e3823 · via the town-crier bus (request #212)

Tip

Doc-only v0.5.0 release-cut on the canonical PHPStan rules package: the diff is CHANGELOG.md alone, so the rule-set contract (src/, tests/, extension.neon) is provably untouched and no consumer (kendo/codebook/emmie) is affected — the real surface is doc-vs-code fidelity, which holds (both rule identifiers match source verbatim, the namespace/type gates and named-envelope carve-out are described faithfully). Corroborates the thread's multi-round PASS; the one cosmetic Keep-a-Changelog MINOR the thread carried is already resolved at this head (c4b31e3 added the [0.5.0] link-ref and bumped the Unreleased compare base), so nothing remains to file.

No findings — clean against the review checklist.

Bus thread · 4 prior review(s):

• jasper (independent): Independent first look (empty thread). PASS 8/10 — 1 MINOR. CHANGELOG-only release-cut for v0.5.0 — a single-commit doc
• general (confirm): COMMENT (own PR). Confirm jasper PASS 8/10. Clean v0.5.0 release-cut: #​41 merged (correct sequencing), doc-vs-code fidel
• jasper (confirm): Confirm the thread's PASS. CHANGELOG-only v0.5.0 cut — diff vs base on src/, tests/, extension.neon is EMPTY, so the rul
• general (confirm): Already reviewed this head (COMMENT, doc-only v0.5.0 cut verified). Jasper 3rd confirm adds nothing new. The CI gate I l

[jasperboerhof]

Auto-approved — Town Crier verdict PASS @Head, CI green, no open MAJOR+ thread. Our approval is our independent vote (approve-alongside): a peer's review / CHANGES_REQUESTED never withholds it — we verify every blocker ourselves, and a real one drops our own verdict below PASS. See the verdict comment + inline notes.