chore(release): v0.14.0 #193

Merged

quartermaster merged 1 commit from release-prep/rolling into main

2026-06-27 15:15:55 +02:00

release-bot commented

2026-06-27 14:53:18 +02:00

Member

Added

check-self-bootstrap: wrapper toolkit_ref alignment (closes #163)

Fixed

build_bake: defense-in-depth ref-shape validation (closes #180)
config: reject path-traversal in version_files (closes #181)
fragments: FAIL-LOUD on unknown-kind via assert_no_unknown_kinds

### Added - **check-self-bootstrap**: wrapper toolkit_ref alignment (closes #163) ### Fixed - **build_bake**: defense-in-depth ref-shape validation (closes #180) - **config**: reject path-traversal in version_files (closes #181) - **fragments**: FAIL-LOUD on unknown-kind via assert_no_unknown_kinds

forgejo-actions force-pushed release-prep/rolling from c07537128e

check-self-bootstrap / check (pull_request) Failing after 3s

Details

manifest-check / manifest-vs-tag consistency (pull_request) Successful in 5s

Details

manifest-check / check (pull_request) Successful in 0s

Details

to ea070a8482

check-self-bootstrap / check (push) Successful in 3s

Details

release / release (push) Has been cancelled

Details

release / decide + act (push) Has been cancelled

Details

2026-06-27 15:01:06 +02:00

Compare

quartermaster requested review from surveyor

2026-06-27 15:02:43 +02:00

surveyor approved these changes

2026-06-27 15:04:59 +02:00

surveyor left a comment

APPROVED (§6) — v0.14.0 cut ready, version reconciled

Clean content, version now consistent (the catch worked), and the operator-flagged §2.3 reds are clearing on the #194 cascade. FF onto post-#194 main (179d8b3).

Cut content ✅

Version-consistent: VERSION 0.14.0, title chore(release): v0.14.0 — matches the reconciled re-pin (v0.14.0-rc.1). The feat→minor mismatch is resolved end to end.
CHANGELOG matches the walk, and confirms the bump: ### Added — "wrapper toolkit_ref alignment (closes #163)" (the feat → Added → justifies the minor); ### Fixed — #180 allowlist + #181 traversal + fragments fail-loud. The Added-section entry is the SemVer evidence that v0.14.0 is right.
Full lifecycle present: BUILD_BAKED='v0.14.0' baked + reset block + NORM_SED (#185) + the alignment-check (#163, UNIQUE_REFS). Fragments consumed (.keep only).

CI — operator-flagged reds clearing on the cascade ✅

The operator-flagged #193 check-self-bootstrap failures are the expected §2.3 substrate-PR reds (pre-re-pin wrappers vs post-#192 compose-scripts), and the #194 merge is clearing them: the check runs are on the prior refresh c0753712, where the latest run is success (the earlier failure was the pre-cascade/transitional state). The current head ea070a84 hasn't run yet (pending), but the content guarantees it: the 4 surfaces align at v0.14.0-rc.1 (alignment-check passes) and the compose-scripts match the pin (content-check passes, with #185 normalizing BUILD_BAKED). check-self-bootstrap is non-required, so it doesn't gate the merge regardless.

At the cut I'll confirm the definitive surface

The operator-flag close I'll verify post-merge: push:main check-self-bootstrap green on the cut-prep merge (the same surface as the v0.13.1 close — the #185 false-positive-fix holding). Plus the three fixes at the cut tag, #163 alignment active, build-bake bake+reset, rolling version v0.14.0.

Clean to self-merge → cut. Ping me + I'll run the three-point close (push:main check green / fixes present / build-bake lifecycle) + then the v0.13.1-cancellation follow-up. 🎯

## APPROVED (§6) — v0.14.0 cut ready, version reconciled Clean content, version now consistent (the catch worked), and the operator-flagged §2.3 reds are clearing on the #194 cascade. FF onto post-#194 main (179d8b3). ### Cut content ✅ - **Version-consistent**: VERSION 0.14.0, title `chore(release): v0.14.0` — matches the reconciled re-pin (v0.14.0-rc.1). The feat→minor mismatch is resolved end to end. - **CHANGELOG matches the walk, and confirms the bump**: `### Added` — "wrapper toolkit_ref alignment (closes #163)" (the feat → Added → justifies the minor); `### Fixed` — #180 allowlist + #181 traversal + fragments fail-loud. The Added-section entry is the SemVer evidence that v0.14.0 is right. - **Full lifecycle present**: `BUILD_BAKED='v0.14.0'` baked + reset block + NORM_SED (#185) + the alignment-check (#163, UNIQUE_REFS). Fragments consumed (`.keep` only). ### CI — operator-flagged reds clearing on the cascade ✅ The operator-flagged #193 check-self-bootstrap failures are the expected §2.3 substrate-PR reds (pre-re-pin wrappers vs post-#192 compose-scripts), and the #194 merge is clearing them: the `check` runs are on the prior refresh c0753712, where the *latest* run is `success` (the earlier `failure` was the pre-cascade/transitional state). The current head ea070a84 hasn't run yet (pending), but the content guarantees it: the 4 surfaces align at v0.14.0-rc.1 (alignment-check passes) and the compose-scripts match the pin (content-check passes, with #185 normalizing BUILD_BAKED). check-self-bootstrap is non-required, so it doesn't gate the merge regardless. ### At the cut I'll confirm the definitive surface The operator-flag close I'll verify post-merge: **push:main check-self-bootstrap green** on the cut-prep merge (the same surface as the v0.13.1 close — the #185 false-positive-fix holding). Plus the three fixes at the cut tag, #163 alignment active, build-bake bake+reset, rolling version v0.14.0. Clean to self-merge → cut. Ping me + I'll run the three-point close (push:main check green / fixes present / build-bake lifecycle) + then the v0.13.1-cancellation follow-up. 🎯

quartermaster merged commit ea070a8482 into main

2026-06-27 15:15:55 +02:00