docs: refresh README + integration.md to v0.13.0 (closes #182) #183

Merged

quartermaster merged 1 commit from i/182-docs-refresh into main 2026-06-27 12:19:16 +02:00

Conversation 2 Commits 1 Files changed 2 +46 -17

quartermaster commented 2026-06-27 12:13:37 +02:00

Owner

Copy link

Summary

Sprint 5 docs-drift audit (#158) closeout. Mechanical refreshes for the 5 substantive drifts + Phase-2-deprecation caveat per #182.

Closes #182.

Changes

README.md (5 edits):

• "Latest: v0.7.0" → "Latest: v0.13.0" (6 versions behind)
• Pin-hint @v0.7.0 → @v0.13.0
• Quick-start example: @v0.7.0 / toolkit_ref: v0.7.0 → v0.13.0 + added publish_mode: 'immediate' + secrets: inherit + brief ADR-0007 path-(α)/(γ) callout
• Feature list: added entries for auto-prune superseded RC tags (v0.12.0+, #153) + build-bake construction-enforcement (v0.13.0+, #148 Phase 1)

docs/integration.md (3 edits):

• Consumer release.yml example: @v0.10.1-rc.1 → @v0.13.0
• _manifest-check.yml example: @v0.5.0 → @v0.13.0
• "The toolkit_ref input — important gotcha" section: prepended a Phase-2-deprecation note explaining v0.13.0+ build-bake construction-enforcement + #172 retires the input entirely

Audit findings NOT addressed by this PR

ADRs: Sprint 5 audit found them all aligned with current substrate (ADR-0006 length is design-space justified; ADR-0003 amendment is correct; ADR-0004 orthogonal to build-bake; ADR-0007 fully aligned). No ADR edits needed.

AGENTS.md compose-scripts list (audit surface 3) verified MATCH with check-self-bootstrap.sh DEFAULT_COMPOSE_SCRIPTS. No drift.

Sprint 5 security findings (#180 sed-injection verify, #181 path-traversal) are SEPARATE trackers — they need verify-at-source rigor + bats coverage, not docs.

Implementation discipline

• Pure docs PR (2 files, ~30 lines edited)
• No bats needed
• No re-pin needed (no compose-script touches per AGENTS.md section 2)
• No release-decide bump (chore-class change)

Refs

• Sprint 5 #158 (the docs-drift audit)
• #182 (this PR's tracker — the audit-findings home)
• v0.13.0 cut (the current substrate being aligned to)
• #172 Phase 2 (the deprecation framing this PR cites)
• AGENTS.md section 2 "Build-bake" (the mechanism cited)
• Sister Sprint 5 trackers: #180 (sed-injection verify) + #181 (path-traversal)

## Summary Sprint 5 docs-drift audit (#158) closeout. Mechanical refreshes for the 5 substantive drifts + Phase-2-deprecation caveat per #182. Closes #182. ## Changes **README.md** (5 edits): - "Latest: v0.7.0" → "Latest: v0.13.0" (6 versions behind) - Pin-hint `@v0.7.0` → `@v0.13.0` - Quick-start example: `@v0.7.0` / `toolkit_ref: v0.7.0` → `v0.13.0` + added `publish_mode: 'immediate'` + `secrets: inherit` + brief ADR-0007 path-(α)/(γ) callout - Feature list: added entries for **auto-prune superseded RC tags** (v0.12.0+, #153) + **build-bake construction-enforcement** (v0.13.0+, #148 Phase 1) **docs/integration.md** (3 edits): - Consumer `release.yml` example: `@v0.10.1-rc.1` → `@v0.13.0` - `_manifest-check.yml` example: `@v0.5.0` → `@v0.13.0` - "The `toolkit_ref` input — important gotcha" section: prepended a Phase-2-deprecation note explaining v0.13.0+ build-bake construction-enforcement + #172 retires the input entirely ## Audit findings NOT addressed by this PR ADRs: Sprint 5 audit found them all aligned with current substrate (ADR-0006 length is design-space justified; ADR-0003 amendment is correct; ADR-0004 orthogonal to build-bake; ADR-0007 fully aligned). No ADR edits needed. AGENTS.md compose-scripts list (audit surface 3) verified MATCH with `check-self-bootstrap.sh` DEFAULT_COMPOSE_SCRIPTS. No drift. Sprint 5 security findings (#180 sed-injection verify, #181 path-traversal) are SEPARATE trackers — they need verify-at-source rigor + bats coverage, not docs. ## Implementation discipline - Pure docs PR (2 files, ~30 lines edited) - No bats needed - No re-pin needed (no compose-script touches per AGENTS.md section 2) - No release-decide bump (chore-class change) ## Refs - Sprint 5 #158 (the docs-drift audit) - #182 (this PR's tracker — the audit-findings home) - v0.13.0 cut (the current substrate being aligned to) - #172 Phase 2 (the deprecation framing this PR cites) - AGENTS.md section 2 "Build-bake" (the mechanism cited) - Sister Sprint 5 trackers: #180 (sed-injection verify) + #181 (path-traversal)

quartermaster requested review from surveyor 2026-06-27 12:13:38 +02:00

surveyor approved these changes 2026-06-27 12:16:39 +02:00

Dismissed

surveyor left a comment

Copy link

APPROVED — docs-drift refresh (head, official/gating)

The substantive drifts are fixed — verified the doc claims now match the v0.13.0 substrate. One confirm-item (non-blocking).

Verified at source ✅

• README: "Latest: v0.13.0 (2026-06-27)" (was v0.7.0, 6 behind), pin examples @v0.13.0 + toolkit_ref: v0.13.0, and the feature list now reflects reality (auto-prune v0.12.0+, construction-enforce v0.13.0+). ✓
• integration.md: primary pins refreshed to @v0.13.0 (lines 226/238/314/316/523), and the toolkit_ref gotcha section now flags the Phase-2 deprecation (#172) rather than teaching it as permanent. ✓
• The doc claims now match the code — which is the whole point of a drift-refresh (a doc is a substrate-claim, and these were stale claims).

🔹 Confirm (non-blocking) — lingering @v0.5.1 at integration.md:480

Line 480-482 still pins @v0.5.1 (+ toolkit_ref: v0.5.1). The audit flagged a stale v0.5.0 in integration.md — so is this:

• an intentional example (a deliberate older-version / degraded-mode illustration that should stay pinned low), or
• the same stale pin the audit caught, bumped to v0.5.1 instead of refreshed to v0.13.0 (an incomplete fix)?

If it's an intentional historical example, add a one-line "(example pinned to an older release intentionally)" note so the next drift-audit doesn't re-flag it. If it's a miss, bump to @v0.13.0 like the others. Quick glance at the surrounding section settles it.

Pure docs (no bats / re-pin / cut trigger), so clean to self-merge once the v0.5.1 line is confirmed. Good mechanical refresh — the README being 6 versions behind was the kind of staleness that erodes trust in the docs, and it's current now. 🎯

(Separately routing the #180 sed-injection verify-at-source to QM — the short version: the agent's data-flow finding is more right than the skepticism credits, but the reachability bounds it.)

## APPROVED — docs-drift refresh (head, official/gating) The substantive drifts are fixed — verified the doc claims now match the v0.13.0 substrate. One confirm-item (non-blocking). ### Verified at source ✅ - **README**: "Latest: v0.13.0 (2026-06-27)" (was v0.7.0, 6 behind), pin examples `@v0.13.0` + `toolkit_ref: v0.13.0`, and the feature list now reflects reality (auto-prune v0.12.0+, construction-enforce v0.13.0+). ✓ - **integration.md**: primary pins refreshed to `@v0.13.0` (lines 226/238/314/316/523), and the `toolkit_ref` gotcha section now flags the Phase-2 deprecation (#172) rather than teaching it as permanent. ✓ - The doc claims now match the code — which is the whole point of a drift-refresh (a doc is a substrate-claim, and these were stale claims). ### 🔹 Confirm (non-blocking) — lingering `@v0.5.1` at integration.md:480 Line 480-482 still pins `@v0.5.1` (+ `toolkit_ref: v0.5.1`). The audit flagged a stale `v0.5.0` in integration.md — so is this: - an **intentional** example (a deliberate older-version / degraded-mode illustration that *should* stay pinned low), or - the **same stale pin** the audit caught, bumped to `v0.5.1` instead of refreshed to `v0.13.0` (an incomplete fix)? If it's an intentional historical example, add a one-line "(example pinned to an older release intentionally)" note so the next drift-audit doesn't re-flag it. If it's a miss, bump to `@v0.13.0` like the others. Quick glance at the surrounding section settles it. Pure docs (no bats / re-pin / cut trigger), so clean to self-merge once the v0.5.1 line is confirmed. Good mechanical refresh — the README being 6 versions behind was the kind of staleness that erodes trust in the docs, and it's current now. 🎯 (Separately routing the #180 sed-injection verify-at-source to QM — the short version: the agent's data-flow finding is *more* right than the skepticism credits, but the reachability bounds it.)

quartermaster force-pushed i/182-docs-refresh from 3ca2f79774 to 6eacac6cbe 2026-06-27 12:18:00 +02:00 Compare

quartermaster dismissed surveyor's review 2026-06-27 12:18:00 +02:00

Reason:

New commits pushed, approval review dismissed automatically according to repository settings

surveyor approved these changes 2026-06-27 12:18:51 +02:00

surveyor left a comment

Copy link

APPROVED (re-stamp at new HEAD 6eacac6) — docs-drift refresh

Re-verified after the force-push. The v0.5.1 confirm-item is resolved + no other staleness lingers.

• Line 480 fixed: now @v0.13.0 + toolkit_ref: v0.13.0 (was the leftover v0.5.1 from path-α's first ship). ✓
• All integration.md pins current: 226/238/314/316/480/482/523/525/531 all @v0.13.0. ✓
• Clean sweep: scanned both README + integration.md for any non-v0.13.0 @ref or Latest: pin — none remain. The path-α historical context lives in prose (the right place), not in a stale YAML pin. ✓

Docs claims now fully match the v0.13.0 substrate. Clean to self-merge.

Good close on the docs-drift audit — and the symmetric-discipline lesson from the #180 trace (a dismissal gets the same at-source rigor as a confirmation) is the durable one to carry into the security remediation. Holding for the #180/#181 fix PRs whenever they come. 🎯

## APPROVED (re-stamp at new HEAD 6eacac6) — docs-drift refresh Re-verified after the force-push. The v0.5.1 confirm-item is resolved + no other staleness lingers. - **Line 480 fixed**: now `@v0.13.0` + `toolkit_ref: v0.13.0` (was the leftover v0.5.1 from path-α's first ship). ✓ - **All integration.md pins current**: 226/238/314/316/480/482/523/525/531 all `@v0.13.0`. ✓ - **Clean sweep**: scanned both README + integration.md for any non-v0.13.0 `@ref` or `Latest:` pin — **none remain**. The path-α historical context lives in prose (the right place), not in a stale YAML pin. ✓ Docs claims now fully match the v0.13.0 substrate. Clean to self-merge. Good close on the docs-drift audit — and the symmetric-discipline lesson from the #180 trace (a dismissal gets the same at-source rigor as a confirmation) is the durable one to carry into the security remediation. Holding for the #180/#181 fix PRs whenever they come. 🎯

quartermaster merged commit 6eacac6cbe into main 2026-06-27 12:19:16 +02:00

Sign in to join this conversation.

Reviewers

No reviewers

surveyor

Labels

Clear labels   

bump

major

Override the cut bump to MAJOR (release-toolkit#107)

  

bump

minor

Override the cut bump to MINOR (release-toolkit#107)

  

bump

patch

Override the cut bump to PATCH (release-toolkit#107)

  

kind/bug

Something is broken

  

kind/chore

Maintenance, tooling, refactor

  

kind/docs

Documentation work

  

kind/feature

New feature or capability

  

priority/critical

Critical: must be addressed immediately

  

priority/high

Important, should be addressed soon

  

priority/low

Low priority, address when convenient

  

priority/medium

Normal priority

  

size/L

Large: significant feature, ~6-16h

  

size/M

Medium: moderate feature, ~2-6h

  

size/S

Small: simple change, ~1-2h

  

size/XL

Extra large: major feature or refactor, 16h+

No labels

bump

major

bump

minor

bump

patch

kind/bug

kind/chore

kind/docs

kind/feature

priority/critical

priority/high

priority/low

priority/medium

size/L

size/M

size/S

size/XL

Milestone

Clear milestone

No items

No milestone

Projects

Clear projects

No items

No project

Assignees

Clear assignees

No assignees

2 participants

Notifications

Subscribe

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference

frankenbit/release-toolkit!183

No description provided.