chore(release): version packages

packages/cli/CHANGELOG.md

@@ -1,5 +1,14 @@
 # contentrain
 
+## 0.7.12
+
+### Patch Changes
+
+- Updated dependencies [c189b6f]
+  - @contentrain/mcp@2.1.1
+  - @contentrain/rules@0.6.0
+  - @contentrain/skills@0.6.0
+
 ## 0.7.11
 
 ### Patch Changes

packages/cli/package.json

@@ -1,6 +1,6 @@
 {
   "name": "contentrain",
-  "version": "0.7.11",
+  "version": "0.7.12",
   "license": "MIT",
   "description": "CLI for Contentrain — AI content governance infrastructure",
   "type": "module",

packages/mcp/CHANGELOG.md

@@ -1,5 +1,21 @@
 # @contentrain/mcp
 
+## 2.1.1
+
+### Patch Changes
+
+- c189b6f: fix(mcp): stop DEFAULT_INSTRUCTIONS advertising a universal dry_run
+
+  The MCP server instructions told every client to "preview writes with
+  dry_run:true, then re-run with dry_run:false" — but `dry_run` exists only on
+  `contentrain_apply`. On every other write tool the unknown key is stripped by
+  the schema, so an agent following the instructions performed a real write
+  while believing it had previewed. The instructions now state the actual
+  safety model: writes land on isolated `cr/*` branches, `content_save`
+  validates before committing, destructive tools require `confirm:true`, and
+  `dry_run` is the `contentrain_apply` preview. Still under the 512-character
+  client-UI budget; no tool behavior changes.
+
 ## 2.1.0
 
 ### Minor Changes

packages/mcp/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@contentrain/mcp",
-  "version": "2.1.0",
+  "version": "2.1.1",
   "mcpName": "io.github.Contentrain/contentrain",
   "license": "MIT",
   "description": "Local-first MCP server for AI-generated content governance — 24 deterministic tools (19 core + 5 media), stdio + HTTP transports, Local / GitHub / GitLab providers",