From 1f587f0dbd5bf08a90b4614cfd486575aa0676bd Mon Sep 17 00:00:00 2001 From: Qwynn Marcelle Date: Sun, 26 Jul 2026 18:42:34 -0400 Subject: [PATCH 1/2] docs(release): document the CLI publisher and move pending notes to changesets MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Three fixes that were left inconsistent by the publisher landing in the previous commit, plus the changeset/versioning cleanup they exposed. Docs now match reality. README.md said publishing from this repository was disabled outright and that `@workspacejson/cli` "has never been published. Do not document `npm install @workspacejson/cli` as if it works" — true when written, false the moment publish-cli.yml merges. It now carries a per-package publisher table, the release commands, and the still-accurate constraint that `agents-audit` cannot be published from here until META-243. packages/cli/CHANGELOG.md carried the same claim and records why the version line starts at 0.1.0 rather than continuing `agents-audit`: this is not that package renamed, it is the producer `agents-audit` depends on, the two ship on independent tags, and this binary has a deliberately smaller surface. Stale release metadata: `[0.4.4] - Unreleased` was published on 2026-07-23, and `## 0.4.2` was missing its brackets and date (2026-07-17). Both taken from the registry. Earlier entries have date drift of a day or so against npm; left alone rather than rewriting history on a guess. Changesets had two sources of truth and no way to reconcile them. The pending work lived as hand-written `[Unreleased]` prose while `.changeset/` held no changeset files at all, so `pnpm changeset version` was a silent no-op — it would never have bumped anything, and CI never ran it. The prose is now five changeset files, one per change, and the changelog carries a pointer instead of a duplicate. That conversion also corrects a mislabel. The pending block was headed "Patch Changes" while containing the `generate --check --dry-run` drift gate, which turns an exit 0 into an exit 1 — the same change deferred from 0.4.4 under META-157 *because* it alters exit-code semantics. It is marked `minor`; the other four are `patch`. `changeset status` now resolves the release to 0.5.0. No changeset for @workspacejson/cli: 0.1.0 is its initial release and the manifest already says so. --- .changeset/agents-audit-drift-gate-dry-run.md | 14 +++++++++ .changeset/agents-audit-invalid-file-moved.md | 5 ++++ .../agents-audit-missing-artifact-notice.md | 5 ++++ .../agents-audit-scan-neutral-notice.md | 5 ++++ .../agents-audit-spec-v04-conventions.md | 11 +++++++ README.md | 30 +++++++++++++++---- packages/agents-audit-compat/CHANGELOG.md | 24 +++++---------- packages/cli/CHANGELOG.md | 14 +++++---- 8 files changed, 79 insertions(+), 29 deletions(-) create mode 100644 .changeset/agents-audit-drift-gate-dry-run.md create mode 100644 .changeset/agents-audit-invalid-file-moved.md create mode 100644 .changeset/agents-audit-missing-artifact-notice.md create mode 100644 .changeset/agents-audit-scan-neutral-notice.md create mode 100644 .changeset/agents-audit-spec-v04-conventions.md diff --git a/.changeset/agents-audit-drift-gate-dry-run.md b/.changeset/agents-audit-drift-gate-dry-run.md new file mode 100644 index 0000000..11f1475 --- /dev/null +++ b/.changeset/agents-audit-drift-gate-dry-run.md @@ -0,0 +1,14 @@ +--- +"agents-audit": minor +--- + +**Changed (breaking): `generate --check --dry-run` now fires the drift gate.** It +exits 1 with "manual evidence is untouched" instead of the dry-run branch +silently winning and exiting 0; the JSON projection is still printed under +`--dry-run`. Deferred from 0.4.4 (META-157) precisely because it changes +exit-code semantics; landed here as its own reviewed change with regression +tests watched red against the pre-change CLI. + +This is the reason the release is a minor rather than a patch. Exit codes are the +machine-readable contract of a CLI, and a pipeline running +`agents-audit generate --check --dry-run` goes from green to red on upgrade. diff --git a/.changeset/agents-audit-invalid-file-moved.md b/.changeset/agents-audit-invalid-file-moved.md new file mode 100644 index 0000000..9966859 --- /dev/null +++ b/.changeset/agents-audit-invalid-file-moved.md @@ -0,0 +1,5 @@ +--- +"agents-audit": patch +--- + +**Added:** `generate` now surfaces `invalidFileMoved` (result data that has existed since 0.4.3 but was never displayed): when a previous `.agents/workspace.json` was invalid and moved aside, the CLI prints where it was relocated to and that its manual evidence could not be recovered. diff --git a/.changeset/agents-audit-missing-artifact-notice.md b/.changeset/agents-audit-missing-artifact-notice.md new file mode 100644 index 0000000..739c368 --- /dev/null +++ b/.changeset/agents-audit-missing-artifact-notice.md @@ -0,0 +1,5 @@ +--- +"agents-audit": patch +--- + +**Added:** `renderMissingArtifactNotice`, the neutral replacement used by `scan`. `renderVrekoUpsell` remains exported and unchanged for API compatibility — it is simply no longer called by the CLI, so callers who want it can still invoke it. This export set is additive; no historical export was removed. diff --git a/.changeset/agents-audit-scan-neutral-notice.md b/.changeset/agents-audit-scan-neutral-notice.md new file mode 100644 index 0000000..5d9daba --- /dev/null +++ b/.changeset/agents-audit-scan-neutral-notice.md @@ -0,0 +1,5 @@ +--- +"agents-audit": patch +--- + +**Changed:** `scan` no longer prints a vendor notice when `.agents/workspace.json` is missing or stale. It now names the command that actually fixes the problem — `agents-audit generate` — and still reports the same validation errors. Ratified in META-236: vendor promotion never enters the neutral producer, and is removed or made opt-in in this compatibility package. Exit codes are unchanged and `scan --json` output is byte-identical, so nothing consuming machine-readable output is affected. Human-readable `scan` output does change; this is recorded as an intentional difference in `migration/parity-expected-differences.txt` and enforced by the CI parity gate. diff --git a/.changeset/agents-audit-spec-v04-conventions.md b/.changeset/agents-audit-spec-v04-conventions.md new file mode 100644 index 0000000..ba35302 --- /dev/null +++ b/.changeset/agents-audit-spec-v04-conventions.md @@ -0,0 +1,11 @@ +--- +"agents-audit": patch +--- + +**Changed:** `generate` now emits `specVersion: "0.4"` and populates +`generated.conventions` (META-203). The conventions emitter had been +disconnected since `a3fa85a` while the spec moved to v0.4. v0.4 is a strict +superset of v0.3, so existing readers are unaffected; readers wanting the new +field should check `generated.specVersion === "0.4"`. `coChange` and +`fragility` remain unemitted — optional in v0.4. Console output, exit codes, +manual-evidence preservation and refusal/force behavior are unchanged. diff --git a/README.md b/README.md index 3ec41b8..bf33d67 100644 --- a/README.md +++ b/README.md @@ -83,13 +83,31 @@ Requires Node.js >= 20. ## Publishing -**Publishing from this repository is disabled.** The release workflow has no -enabled trigger, holds no npm credential and contains no publish step. -`workspace-json/agents-audit` remains the sole publisher of `agents-audit` until -the coordinated authority cutover in META-243. +The two packages release independently, on disjoint tag namespaces, so no single +workflow ever holds authority over both. -`@workspacejson/cli` has never been published. Do not document -`npm install @workspacejson/cli` as if it works. +| Package | Publisher | Tag | +| -- | -- | -- | +| `@workspacejson/cli` | this repository, [`publish-cli.yml`](./.github/workflows/publish-cli.yml) | `cli-v*.*.*` | +| `agents-audit` | `workspace-json/agents-audit` until META-243 | `agents-audit-v*.*.*` once cut over | + +To release `@workspacejson/cli`: + +```bash +pnpm changeset version # bumps packages/cli/package.json + CHANGELOG +git commit -am "release: ..." && git push +git tag cli-v0.1.0 && git push --tags +``` + +The tag is both the trigger and the source of truth for the version: it is +validated as clean semver and asserted equal to the manifest before anything +reaches the registry, so a tag that disagrees with `package.json` fails the run +rather than publishing a version nobody named. + +**`agents-audit` cannot be published from here yet.** `workspace-json/agents-audit` +remains its sole publisher until the coordinated authority cutover in META-243, +which requires, in order: parity complete, the old workflow disabled, the old +token revoked, then a least-privilege token granted here. ## Provenance diff --git a/packages/agents-audit-compat/CHANGELOG.md b/packages/agents-audit-compat/CHANGELOG.md index aee494b..4c35325 100644 --- a/packages/agents-audit-compat/CHANGELOG.md +++ b/packages/agents-audit-compat/CHANGELOG.md @@ -1,22 +1,12 @@ # Changelog -## [Unreleased] + -### Patch Changes - -- **Changed:** `generate` now emits `specVersion: "0.4"` and populates - `generated.conventions` (META-203). The conventions emitter had been - disconnected since `a3fa85a` while the spec moved to v0.4. v0.4 is a strict - superset of v0.3, so existing readers are unaffected; readers wanting the new - field should check `generated.specVersion === "0.4"`. `coChange` and - `fragility` remain unemitted — optional in v0.4. Console output, exit codes, - manual-evidence preservation and refusal/force behavior are unchanged. -- **Changed:** `scan` no longer prints a vendor notice when `.agents/workspace.json` is missing or stale. It now names the command that actually fixes the problem — `agents-audit generate` — and still reports the same validation errors. Ratified in META-236: vendor promotion never enters the neutral producer, and is removed or made opt-in in this compatibility package. Exit codes are unchanged and `scan --json` output is byte-identical, so nothing consuming machine-readable output is affected. Human-readable `scan` output does change; this is recorded as an intentional difference in `migration/parity-expected-differences.txt` and enforced by the CI parity gate. -- **Added:** `renderMissingArtifactNotice`, the neutral replacement used by `scan`. `renderVrekoUpsell` remains exported and unchanged for API compatibility — it is simply no longer called by the CLI, so callers who want it can still invoke it. This export set is additive; no historical export was removed. -- `generate --check --dry-run` now fires the drift gate (exit 1, "manual evidence is untouched") instead of the dry-run branch silently winning and exiting 0; the JSON projection is still printed under `--dry-run`. Deferred from 0.4.4 (META-157) because it changes exit-code semantics; landed here as its own reviewed change with regression tests watched red against the pre-change CLI. -- `generate` now surfaces `invalidFileMoved` (result data that has existed since 0.4.3 but was never displayed): when a previous `.agents/workspace.json` was invalid and moved aside, the CLI prints where it was relocated to and that its manual evidence could not be recovered. - -## [0.4.4] - Unreleased +## [0.4.4] - 2026-07-23 ### Patch Changes @@ -34,7 +24,7 @@ - @workspacejson/rules@0.4.3 - @workspacejson/spec@0.4.3 -## 0.4.2 +## [0.4.2] - 2026-07-17 ### Patch Changes diff --git a/packages/cli/CHANGELOG.md b/packages/cli/CHANGELOG.md index caabd71..9510026 100644 --- a/packages/cli/CHANGELOG.md +++ b/packages/cli/CHANGELOG.md @@ -1,11 +1,13 @@ # Changelog — `@workspacejson/cli` -## [Unreleased] - -**This package has never been published.** It is not on npm, and must not be -documented as installable until the coordinated publish-authority cutover -(META-243). The working public command today is `npx agents-audit generate`, -which runs this same producer implementation. +## [0.1.0] - Unreleased + +First published release. The version starts at `0.1.0` rather than continuing +`agents-audit`'s numbering because this is not that package renamed: it is the +producer `agents-audit` now depends on, both ship from this repository on +independent tags, and this binary carries a deliberately smaller surface — no +`scan`, and no config file (see Notes). Sharing a version line would promise a +parity that does not exist. ### Changed From fcb6193404abaa0c462947c41c9ddf304ca55231 Mon Sep 17 00:00:00 2001 From: Qwynn Marcelle Date: Sun, 26 Jul 2026 18:49:09 -0400 Subject: [PATCH 2/2] fix(release): continue agents-audit's version line at 0.5.0; freeze the bridge MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Corrects the previous commit, which read the versioning question backwards. It bumped `agents-audit` to 0.5.0 and wrote a rationale for `@workspacejson/cli` NOT continuing that package's numbering. The opposite is intended: `agents-audit` is frozen and the CLI carries the line forward. `agents-audit` is locked at 0.4.4 for hackathon judging and gets no further releases. The five changesets that would have bumped it are removed and its `[Unreleased]` prose is restored — those changes exist in this tree but will not ship under that name. Where they touched the shared producer they reach users through `@workspacejson/cli`; where they touched this package's own `scan` and presenter surface they stay unreleased. The freeze is now mechanical rather than conventional: no workflow here publishes `agents-audit`, and it is listed under `ignore` in `.changeset/config.json` so a workspace-wide `changeset version` cannot bump it. Verified that ignoring it is a valid configuration — the reverse (ignoring the CLI while `agents-audit` depended on it) was the error this branch started by fixing. `@workspacejson/cli` goes to 0.5.0, not 0.4.5. Against `agents-audit@0.4.4` this binary removes surface — no `scan`, no config file, and the binary is renamed — so a patch would promise a drop-in successor that it is not. Under 0.x, breaking belongs in the minor slot. The changelog carries a migration table for the three differences. 0.5.0 is set directly in the manifest because changesets bumps relative to the current version and cannot jump 0.1.0 to 0.5.0; an empty changeset records that and keeps `changeset status` clean. Also recorded in OWNERSHIP.md: published `agents-audit@0.4.4` declares no dependency on `@workspacejson/cli`, confirmed against the registry. It is self-contained, so freezing it leaves nothing dangling. That dependency exists only in this working tree, which has never shipped. Verified: architecture guard, typecheck, 100 tests, `changeset status` clean, and release:verify-packs against both packed tarballs at their new versions (workspacejson-cli-0.5.0.tgz, agents-audit-0.4.4.tgz). --- .changeset/adopt-agents-audit-version-line.md | 11 +++++++ .changeset/agents-audit-drift-gate-dry-run.md | 14 --------- .changeset/agents-audit-invalid-file-moved.md | 5 ---- .../agents-audit-missing-artifact-notice.md | 5 ---- .../agents-audit-scan-neutral-notice.md | 5 ---- .../agents-audit-spec-v04-conventions.md | 11 ------- .changeset/config.json | 2 +- .github/workflows/publish-cli.yml | 5 +++- OWNERSHIP.md | 20 +++++++++---- README.md | 18 +++++++---- packages/agents-audit-compat/CHANGELOG.md | 30 +++++++++++++++---- packages/cli/CHANGELOG.md | 29 +++++++++++++----- packages/cli/package.json | 2 +- 13 files changed, 89 insertions(+), 68 deletions(-) create mode 100644 .changeset/adopt-agents-audit-version-line.md delete mode 100644 .changeset/agents-audit-drift-gate-dry-run.md delete mode 100644 .changeset/agents-audit-invalid-file-moved.md delete mode 100644 .changeset/agents-audit-missing-artifact-notice.md delete mode 100644 .changeset/agents-audit-scan-neutral-notice.md delete mode 100644 .changeset/agents-audit-spec-v04-conventions.md diff --git a/.changeset/adopt-agents-audit-version-line.md b/.changeset/adopt-agents-audit-version-line.md new file mode 100644 index 0000000..2d8647b --- /dev/null +++ b/.changeset/adopt-agents-audit-version-line.md @@ -0,0 +1,11 @@ +--- +--- + +`@workspacejson/cli` adopts `agents-audit`'s version line at `0.5.0`, set +directly in `packages/cli/package.json` rather than derived from a changeset — +changesets bumps relative to the current version and cannot jump `0.1.0` to +`0.5.0`. This changeset is intentionally empty so `changeset status` stays clean +for a release whose number was chosen, not computed. + +From `0.5.0` onward the normal flow applies: add a changeset, run +`pnpm changeset version`, tag `cli-vX.Y.Z` to match. diff --git a/.changeset/agents-audit-drift-gate-dry-run.md b/.changeset/agents-audit-drift-gate-dry-run.md deleted file mode 100644 index 11f1475..0000000 --- a/.changeset/agents-audit-drift-gate-dry-run.md +++ /dev/null @@ -1,14 +0,0 @@ ---- -"agents-audit": minor ---- - -**Changed (breaking): `generate --check --dry-run` now fires the drift gate.** It -exits 1 with "manual evidence is untouched" instead of the dry-run branch -silently winning and exiting 0; the JSON projection is still printed under -`--dry-run`. Deferred from 0.4.4 (META-157) precisely because it changes -exit-code semantics; landed here as its own reviewed change with regression -tests watched red against the pre-change CLI. - -This is the reason the release is a minor rather than a patch. Exit codes are the -machine-readable contract of a CLI, and a pipeline running -`agents-audit generate --check --dry-run` goes from green to red on upgrade. diff --git a/.changeset/agents-audit-invalid-file-moved.md b/.changeset/agents-audit-invalid-file-moved.md deleted file mode 100644 index 9966859..0000000 --- a/.changeset/agents-audit-invalid-file-moved.md +++ /dev/null @@ -1,5 +0,0 @@ ---- -"agents-audit": patch ---- - -**Added:** `generate` now surfaces `invalidFileMoved` (result data that has existed since 0.4.3 but was never displayed): when a previous `.agents/workspace.json` was invalid and moved aside, the CLI prints where it was relocated to and that its manual evidence could not be recovered. diff --git a/.changeset/agents-audit-missing-artifact-notice.md b/.changeset/agents-audit-missing-artifact-notice.md deleted file mode 100644 index 739c368..0000000 --- a/.changeset/agents-audit-missing-artifact-notice.md +++ /dev/null @@ -1,5 +0,0 @@ ---- -"agents-audit": patch ---- - -**Added:** `renderMissingArtifactNotice`, the neutral replacement used by `scan`. `renderVrekoUpsell` remains exported and unchanged for API compatibility — it is simply no longer called by the CLI, so callers who want it can still invoke it. This export set is additive; no historical export was removed. diff --git a/.changeset/agents-audit-scan-neutral-notice.md b/.changeset/agents-audit-scan-neutral-notice.md deleted file mode 100644 index 5d9daba..0000000 --- a/.changeset/agents-audit-scan-neutral-notice.md +++ /dev/null @@ -1,5 +0,0 @@ ---- -"agents-audit": patch ---- - -**Changed:** `scan` no longer prints a vendor notice when `.agents/workspace.json` is missing or stale. It now names the command that actually fixes the problem — `agents-audit generate` — and still reports the same validation errors. Ratified in META-236: vendor promotion never enters the neutral producer, and is removed or made opt-in in this compatibility package. Exit codes are unchanged and `scan --json` output is byte-identical, so nothing consuming machine-readable output is affected. Human-readable `scan` output does change; this is recorded as an intentional difference in `migration/parity-expected-differences.txt` and enforced by the CI parity gate. diff --git a/.changeset/agents-audit-spec-v04-conventions.md b/.changeset/agents-audit-spec-v04-conventions.md deleted file mode 100644 index ba35302..0000000 --- a/.changeset/agents-audit-spec-v04-conventions.md +++ /dev/null @@ -1,11 +0,0 @@ ---- -"agents-audit": patch ---- - -**Changed:** `generate` now emits `specVersion: "0.4"` and populates -`generated.conventions` (META-203). The conventions emitter had been -disconnected since `a3fa85a` while the spec moved to v0.4. v0.4 is a strict -superset of v0.3, so existing readers are unaffected; readers wanting the new -field should check `generated.specVersion === "0.4"`. `coChange` and -`fragility` remain unemitted — optional in v0.4. Console output, exit codes, -manual-evidence preservation and refusal/force behavior are unchanged. diff --git a/.changeset/config.json b/.changeset/config.json index ec98e35..77f1156 100644 --- a/.changeset/config.json +++ b/.changeset/config.json @@ -7,5 +7,5 @@ "access": "public", "baseBranch": "main", "updateInternalDependencies": "patch", - "ignore": [] + "ignore": ["agents-audit"] } diff --git a/.github/workflows/publish-cli.yml b/.github/workflows/publish-cli.yml index 635a2ab..acafc1d 100644 --- a/.github/workflows/publish-cli.yml +++ b/.github/workflows/publish-cli.yml @@ -11,7 +11,10 @@ name: Publish @workspacejson/cli # Release flow: # pnpm changeset version # bumps packages/cli/package.json + CHANGELOG # git commit -am "release: ..." && git push -# git tag cli-v0.1.0 && git push --tags +# git tag cli-v0.5.0 && git push --tags +# +# The version line continues `agents-audit`, which is frozen at 0.4.4, so this +# package starts at 0.5.0 rather than 0.1.0. # # The tag is both the trigger and the source of truth for the version: it is # validated as clean semver and asserted equal to the manifest before anything diff --git a/OWNERSHIP.md b/OWNERSHIP.md index 5223f15..c2f505d 100644 --- a/OWNERSHIP.md +++ b/OWNERSHIP.md @@ -9,7 +9,7 @@ script is what enforces it. | Directory | Package | Distribution | Role | | -- | -- | -- | -- | | `packages/cli/` | `@workspacejson/cli` | public, published from here on `cli-v*` tags | the neutral workspace.json producer and its `workspacejson` binary | -| `packages/agents-audit-compat/` | `agents-audit` | public, published `0.4.4` | frozen compatibility bridge for the historical `agents-audit` command and API | +| `packages/agents-audit-compat/` | `agents-audit` | public, **frozen at `0.4.4`** — no further releases | frozen compatibility bridge for the historical `agents-audit` command and API | ## Owns @@ -121,16 +121,24 @@ Guard: `neutral-producer-purity`. | Package | Publishable from here | Current authority | | -- | -- | -- | -| `agents-audit` | metadata says yes; **workflow disabled** | `workspace-json/agents-audit` until META-243 | +| `agents-audit` | **No** — frozen at `0.4.4`, no workflow publishes it | `workspace-json/agents-audit` published `0.4.4` and remains its registry owner | | `@workspacejson/cli` | **Yes** — `.github/workflows/publish-cli.yml`, on `cli-v*.*.*` tags | this repository (META-236 settled the name; no prior authority existed) | | `@workspacejson/datahub-adapter` | **No** — extracted under META-248; redefining it here is a guard failure | `workspacejson/datahub-agent` (internal module, unpublished) | | `@workspacejson/spec`, `@workspacejson/rules` | **Never** — not owned here | `workspacejson/standard` | This repository holds one publish-capable secret, `NPM_TOKEN`, scoped to -`@workspacejson/cli`. `agents-audit` remains published by -`workspace-json/agents-audit` until META-243, so the two packages release on -disjoint tag namespaces (`cli-v*` and, later, its own) and no single workflow -holds authority over both. +`@workspacejson/cli`. + +`agents-audit` is frozen at `0.4.4` and locked for hackathon judging; all forward +development moves to `@workspacejson/cli`, which continues its version line from +`0.5.0`. Two mechanisms keep the freeze from being merely a convention: no +workflow in this repository publishes `agents-audit`, and `.changeset/config.json` +lists it under `ignore`, so a workspace-wide `changeset version` cannot bump it. + +The published `agents-audit@0.4.4` declares no dependency on +`@workspacejson/cli` — it is self-contained, so freezing it leaves nothing +dangling on the registry. That dependency exists only in this working tree, +which has never shipped. ## Migration source and provenance diff --git a/README.md b/README.md index bf33d67..1a1556f 100644 --- a/README.md +++ b/README.md @@ -89,14 +89,19 @@ workflow ever holds authority over both. | Package | Publisher | Tag | | -- | -- | -- | | `@workspacejson/cli` | this repository, [`publish-cli.yml`](./.github/workflows/publish-cli.yml) | `cli-v*.*.*` | -| `agents-audit` | `workspace-json/agents-audit` until META-243 | `agents-audit-v*.*.*` once cut over | +| `agents-audit` | **frozen at `0.4.4`** — not published from here | none | + +`@workspacejson/cli` continues `agents-audit`'s version line, starting at +`0.5.0`. `agents-audit` is locked for hackathon judging and receives no further +releases; it is excluded from changesets via `ignore` so a workspace-wide +version run cannot bump it by accident. To release `@workspacejson/cli`: ```bash pnpm changeset version # bumps packages/cli/package.json + CHANGELOG git commit -am "release: ..." && git push -git tag cli-v0.1.0 && git push --tags +git tag cli-v0.5.0 && git push --tags ``` The tag is both the trigger and the source of truth for the version: it is @@ -104,10 +109,11 @@ validated as clean semver and asserted equal to the manifest before anything reaches the registry, so a tag that disagrees with `package.json` fails the run rather than publishing a version nobody named. -**`agents-audit` cannot be published from here yet.** `workspace-json/agents-audit` -remains its sole publisher until the coordinated authority cutover in META-243, -which requires, in order: parity complete, the old workflow disabled, the old -token revoked, then a least-privilege token granted here. +**`agents-audit` is not published from here, and is not scheduled to be.** It is +frozen at `0.4.4`; `workspace-json/agents-audit` published that release and +remains its registry owner. The unreleased entries in its changelog exist in +this working tree but will not ship under that name — the shared producer +changes among them reach users through `@workspacejson/cli` instead. ## Provenance diff --git a/packages/agents-audit-compat/CHANGELOG.md b/packages/agents-audit-compat/CHANGELOG.md index 4c35325..377e5ff 100644 --- a/packages/agents-audit-compat/CHANGELOG.md +++ b/packages/agents-audit-compat/CHANGELOG.md @@ -1,10 +1,30 @@ # Changelog - +> **`agents-audit` is frozen at `0.4.4`.** The published package is locked for +> hackathon judging and this repository does not publish it. All forward +> development moves to `@workspacejson/cli`, which continues this version line +> at `0.5.0`. +> +> The entries under [Unreleased] exist in this working tree but will not ship +> under the `agents-audit` name. Where they changed the shared producer they +> reach users through `@workspacejson/cli`; where they changed this package's own +> `scan` and presenter surface they remain unreleased. + +## [Unreleased — will not ship under this package name] + +### Patch Changes + +- **Changed:** `generate` now emits `specVersion: "0.4"` and populates + `generated.conventions` (META-203). The conventions emitter had been + disconnected since `a3fa85a` while the spec moved to v0.4. v0.4 is a strict + superset of v0.3, so existing readers are unaffected; readers wanting the new + field should check `generated.specVersion === "0.4"`. `coChange` and + `fragility` remain unemitted — optional in v0.4. Console output, exit codes, + manual-evidence preservation and refusal/force behavior are unchanged. +- **Changed:** `scan` no longer prints a vendor notice when `.agents/workspace.json` is missing or stale. It now names the command that actually fixes the problem — `agents-audit generate` — and still reports the same validation errors. Ratified in META-236: vendor promotion never enters the neutral producer, and is removed or made opt-in in this compatibility package. Exit codes are unchanged and `scan --json` output is byte-identical, so nothing consuming machine-readable output is affected. Human-readable `scan` output does change; this is recorded as an intentional difference in `migration/parity-expected-differences.txt` and enforced by the CI parity gate. +- **Added:** `renderMissingArtifactNotice`, the neutral replacement used by `scan`. `renderVrekoUpsell` remains exported and unchanged for API compatibility — it is simply no longer called by the CLI, so callers who want it can still invoke it. This export set is additive; no historical export was removed. +- `generate --check --dry-run` now fires the drift gate (exit 1, "manual evidence is untouched") instead of the dry-run branch silently winning and exiting 0; the JSON projection is still printed under `--dry-run`. Deferred from 0.4.4 (META-157) because it changes exit-code semantics; landed here as its own reviewed change with regression tests watched red against the pre-change CLI. +- `generate` now surfaces `invalidFileMoved` (result data that has existed since 0.4.3 but was never displayed): when a previous `.agents/workspace.json` was invalid and moved aside, the CLI prints where it was relocated to and that its manual evidence could not be recovered. ## [0.4.4] - 2026-07-23 diff --git a/packages/cli/CHANGELOG.md b/packages/cli/CHANGELOG.md index 9510026..63f4053 100644 --- a/packages/cli/CHANGELOG.md +++ b/packages/cli/CHANGELOG.md @@ -1,13 +1,26 @@ # Changelog — `@workspacejson/cli` -## [0.1.0] - Unreleased - -First published release. The version starts at `0.1.0` rather than continuing -`agents-audit`'s numbering because this is not that package renamed: it is the -producer `agents-audit` now depends on, both ship from this repository on -independent tags, and this binary carries a deliberately smaller surface — no -`scan`, and no config file (see Notes). Sharing a version line would promise a -parity that does not exist. +## [0.5.0] - Unreleased + +First release under the `workspacejson` name, and the continuation of +`agents-audit`'s version line. That package is frozen at `0.4.4` — locked for +hackathon judging — and all forward development happens here, so the numbering +carries over rather than restarting. + +**Why `0.5.0` and not `0.4.5`.** Measured against `agents-audit@0.4.4`, this +binary *removes* surface: there is no `scan` command, no config file (see +Notes), and the binary itself is renamed from `agents-audit` to `workspacejson`. +A patch bump would promise a drop-in successor, and the first thing a migrating +user would hit is a missing command. Under 0.x, breaking changes go in the minor +slot. + +Migrating from `agents-audit@0.4.4`: + +| Before | After | +| -- | -- | +| `npx agents-audit generate` | `npx workspacejson generate` | +| `npx agents-audit scan` | no equivalent — the producer does not audit | +| `.agentsauditrc` | not read (see Notes) | ### Changed diff --git a/packages/cli/package.json b/packages/cli/package.json index ab8cbbb..cd2164f 100644 --- a/packages/cli/package.json +++ b/packages/cli/package.json @@ -1,6 +1,6 @@ { "name": "@workspacejson/cli", - "version": "0.1.0", + "version": "0.5.0", "description": "The workspace.json producer — scans a repository and generates .agents/workspace.json deterministically, preserving human-authored manual evidence.", "license": "Apache-2.0", "author": "workspace.json contributors",