From 7dce11a555cbff3e8eb6d901f0b6f52dbbc9aff2 Mon Sep 17 00:00:00 2001
From: "github-actions[bot]"
 <41898282+github-actions[bot]@users.noreply.github.com>
Date: Fri, 17 Jul 2026 17:54:15 +0000
Subject: [PATCH] chore(release): version packages

---
 .changeset/server-instructions-dry-run.md | 15 ---------------
 packages/cli/CHANGELOG.md                 |  9 +++++++++
 packages/cli/package.json                 |  2 +-
 packages/mcp/CHANGELOG.md                 | 16 ++++++++++++++++
 packages/mcp/package.json                 |  2 +-
 5 files changed, 27 insertions(+), 17 deletions(-)
 delete mode 100644 .changeset/server-instructions-dry-run.md

diff --git a/.changeset/server-instructions-dry-run.md b/.changeset/server-instructions-dry-run.md
deleted file mode 100644
index 1175e6c..0000000
--- a/.changeset/server-instructions-dry-run.md
+++ /dev/null
@@ -1,15 +0,0 @@
----
-"@contentrain/mcp": patch
----
-
-fix(mcp): stop DEFAULT_INSTRUCTIONS advertising a universal dry_run
-
-The MCP server instructions told every client to "preview writes with
-dry_run:true, then re-run with dry_run:false" — but `dry_run` exists only on
-`contentrain_apply`. On every other write tool the unknown key is stripped by
-the schema, so an agent following the instructions performed a real write
-while believing it had previewed. The instructions now state the actual
-safety model: writes land on isolated `cr/*` branches, `content_save`
-validates before committing, destructive tools require `confirm:true`, and
-`dry_run` is the `contentrain_apply` preview. Still under the 512-character
-client-UI budget; no tool behavior changes.
diff --git a/packages/cli/CHANGELOG.md b/packages/cli/CHANGELOG.md
index 354ae7b..ecf7e2a 100644
--- a/packages/cli/CHANGELOG.md
+++ b/packages/cli/CHANGELOG.md
@@ -1,5 +1,14 @@
 # contentrain
 
+## 0.7.12
+
+### Patch Changes
+
+- Updated dependencies [c189b6f]
+  - @contentrain/mcp@2.1.1
+  - @contentrain/rules@0.6.0
+  - @contentrain/skills@0.6.0
+
 ## 0.7.11
 
 ### Patch Changes
diff --git a/packages/cli/package.json b/packages/cli/package.json
index 0df00af..5625856 100644
--- a/packages/cli/package.json
+++ b/packages/cli/package.json
@@ -1,6 +1,6 @@
 {
   "name": "contentrain",
-  "version": "0.7.11",
+  "version": "0.7.12",
   "license": "MIT",
   "description": "CLI for Contentrain — AI content governance infrastructure",
   "type": "module",
diff --git a/packages/mcp/CHANGELOG.md b/packages/mcp/CHANGELOG.md
index 336776d..92c94b5 100644
--- a/packages/mcp/CHANGELOG.md
+++ b/packages/mcp/CHANGELOG.md
@@ -1,5 +1,21 @@
 # @contentrain/mcp
 
+## 2.1.1
+
+### Patch Changes
+
+- c189b6f: fix(mcp): stop DEFAULT_INSTRUCTIONS advertising a universal dry_run
+
+  The MCP server instructions told every client to "preview writes with
+  dry_run:true, then re-run with dry_run:false" — but `dry_run` exists only on
+  `contentrain_apply`. On every other write tool the unknown key is stripped by
+  the schema, so an agent following the instructions performed a real write
+  while believing it had previewed. The instructions now state the actual
+  safety model: writes land on isolated `cr/*` branches, `content_save`
+  validates before committing, destructive tools require `confirm:true`, and
+  `dry_run` is the `contentrain_apply` preview. Still under the 512-character
+  client-UI budget; no tool behavior changes.
+
 ## 2.1.0
 
 ### Minor Changes
diff --git a/packages/mcp/package.json b/packages/mcp/package.json
index 4851f38..30c2074 100644
--- a/packages/mcp/package.json
+++ b/packages/mcp/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@contentrain/mcp",
-  "version": "2.1.0",
+  "version": "2.1.1",
   "mcpName": "io.github.Contentrain/contentrain",
   "license": "MIT",
   "description": "Local-first MCP server for AI-generated content governance — 24 deterministic tools (19 core + 5 media), stdio + HTTP transports, Local / GitHub / GitLab providers",