Release 0.6.0

[dzykovic]

What changed

Cuts release 0.6.0. Promotes ## [Unreleased] to ## [0.6.0] — 2026-08-12, bumps the version across the four workspace manifests and the lockfile, and moves the three version-bearing docs (SECURITY.md supported line, README status line, the docs/deployment.md image tag) onto the new line.

The changelog section is not a straight promotion. changelog: continuous was not honoured: of the 86 commits since v0.5.0, only 5 touched CHANGELOG.md, and [Unreleased] covered roughly the last ten — the public-readiness and setup-screen work. The ~75 engine commits in between, almost all of them authored by Operator running against this repository, were absent. This PR reconstructs them from the commit log and the diffs, grouped Added / Changed / Removed / Fixed / Security / Internal.

Why

release_cut: release-pr — master is protected, so the release change-set lands through a PR and the tag goes on the merge commit. A changelog that omits 75 of 86 commits is not a release note; the reconstruction is the substance of this PR.

What this deletes — nothing. One doc correction: docs/deployment.md pinned the Kubernetes manifest to operator-engine:0.5, a tag Build Image has never published (it pushes :latest and :<commit-sha> only). Repointed at :latest with a note to pin a SHA for a reproducible rollout.

---

Release readiness — confirm / reject

Verdict: ship. Gates are green on the release commit and nothing unfinished is inside the tag. Five flags below are for the record, not blockers; two want an owner decision.

Green

Gate	Result
npm run typecheck	pass
npm run lint (eslint + ts-prune + knip)	pass
npm test	pass — 1984 tests / 128 files, 92.69% statements / 93.5% lines, above the 90% gate
master vs origin/master	in sync, clean tree
Tests on last source-touching commit (2364440)	success

Flags

1. CI never exercised the last four commits on master. f95e913 (Dockerfile), 8fb7d28 (docker-compose), c8e0429 and 7fff8ab (docs / intelligence/) fall outside the Tests path filter, so the workflow correctly skipped them — but the two Docker changes ship in this release having been validated by Build Image alone, never by a test run. This PR touches package.json, so Tests runs over the full tree here and closes the code half of that gap. The image half stays on Build Image.

2. The self-hosted deploy runner is offline — needs an owner decision. The nightly Build Image run from 2026-08-11T05:20Z (31461322732) shows build: success but deploy: queued and has sat there for over a day, waiting on the operator-deploy label. The image half is fine — :latest was published — but nothing has reached the operator's own VM since, so the running instance is more than a day behind master and the nightly agent-CLI refresh has not landed either. This does not block the tag; it does mean 0.6.0 will not deploy itself on merge. Bring the runner back, or redeploy by hand, before treating the release as live.

3. Four open PRs sit at ai:in-review and are not in this release — [AI:Finding] F20260806-63E2D28A: Daemon's top-level cycle error boundary discards the error object entirely — a crashed cycle is invisible #51 (daemon's cycle error boundary discards the error object), [AI:Task] T20260705-94A14772: Split closed-pr-recovery.ts under the 200 code-line cap by extracting rejection-issue creation #49 and [AI:Task] T20260705-7E556EBC: Split pr-feedback-supervisor-stage.ts under the 200 code-line cap by extracting the supervisor prompt builder #38 (200-line-cap splits), [AI:Improver] 2026W31 #41 (weekly improver). Each carries blocking findings the supervisor has yet to clear. None is a regression against 0.5.0; [AI:Finding] F20260806-63E2D28A: Daemon's top-level cycle error boundary discards the error object entirely — a crashed cycle is invisible #51 is the one with user-visible weight, since a crashed cycle currently logs nothing useful. Candidates for 0.6.1.

4. The engine's own backlog is not empty and never will be — 19 findings in-progress, 9 pending, 1 task in-progress, 9 pending. That is the closed loop working, not unfinished release work. Called out only so the numbers are not read as a release blocker.

5. The changelog drift is a process defect, not a one-off. continuous only holds if every PR appends its line; 75 commits proved it does not hold by itself. Worth either a CI check that a source-touching PR also touches CHANGELOG.md, or an honest switch of the profile to changelog: assembled. Owner's call — not made in this PR.

Known limitation carried into the release

The Docker volume-permission fix repairs the image, not volumes already created root-owned. An existing deployment needs the one-line chown recorded in the changelog entry and under "Upgrading from 0.5.0".

Checks

All three are CI-blocking and must be green locally before review:

• npm run typecheck
• npm test
• npm run lint

Non-negotiables

• No dead code. Every export is reachable from engine/entry.ts or a colocated test (ts-prune + knip).
• No force-push. Every commit-push sequence is fast-forward-safe, including --force-with-lease.
• One logical change per PR, revertible in a single commit.
• Every bug fix ships with a regression test that fails without the fix. — no code change in this PR; the one fix is a documentation correction.
• Docs and rules updated in this same PR if the change moved a convention.

After merge

tagger: maintainer — the tag is not pushed by this PR. On merge: git tag -a v0.6.0 <merge-sha>, owner confirms, git push origin v0.6.0, then gh release create v0.6.0 --verify-tag --notes-file with the [0.6.0] section.

[Copilot]

Pull request overview

Cuts the 0.6.0 release by updating workspace versions/lockfile and aligning release-facing documentation, with the main substance being a reconstructed and expanded CHANGELOG.md section for the 0.6.0 release.

Changes:

• Promoted/added the 0.6.0 changelog section (dated 2026-08-12) and populated it with reconstructed release notes.
• Bumped versions to 0.6.0 across all workspaces and synchronized package-lock.json.
• Updated release-line references in README.md, SECURITY.md, and the Kubernetes example in docs/deployment.md.

Reviewed changes

Copilot reviewed 8 out of 9 changed files in this pull request and generated no comments.

Show a summary per file

File	Description
SECURITY.md	Updates supported version line to 0.6.x and guidance text accordingly.
README.md	Updates status line to 0.6.0 and reflects “self-managed” positioning.
CHANGELOG.md	Adds the 0.6.0 release section and release notes content.
docs/deployment.md	Fixes Kubernetes example image tag to :latest with guidance to pin SHA.
package.json	Bumps root workspace version to 0.6.0.
package-lock.json	Synchronizes lockfile versions for root + workspaces to 0.6.0.
app/package.json	Bumps @operator/app version to 0.6.0.
packages/core/package.json	Bumps @operator/core version to 0.6.0.
packages/adapters/package.json	Bumps @operator/adapters version to 0.6.0.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.