chore(release): prepare v0.2.1

[mbeacom]

Summary

• Add the v0.2.1 changelog and maintainer cutover runbook.
• Bump the public package manifests, root manifest, Bun lock workspace metadata, CLI/MCP runtime literals, and both packages/mcp/server.json version fields to 0.2.1.
• Refresh public version copy and distribution docs for the MCP registry and queue@v0 follow-ups.
• Add MCP server version coverage so runtime SERVER_INFO.version cannot drift from the package version again.
• Regenerate the served site/public/og.png social card after the SVG source version bump.
• Tighten the release runbook so workflow success is checked against the exact v0.2.1 tagged commit/run, and tag/npm/registry checks fail closed instead of accepting stale state.

Release-path audit

• No remaining release job step appears to depend on checkout-persisted credentials: the main-ancestor fetch is read-only, gh release uses GH_TOKEN, and release:action-tag sets http.https://github.com/.extraheader only around git ls-remote/git push with an EXIT cleanup trap.
• Defect found and fixed: @adrkit/mcp reported SERVER_INFO.version as 0.1.0 while the package was 0.2.0. That would have shipped stale runtime metadata in v0.2.1 without this fix.

ADR-0016 failure observed

Before fixing MCP runtime version drift, the new regression test failed as intended:

Expected: "0.2.0"
Received: "0.1.0"
(fail) SERVER_INFO > matches the published package version

After making the test cwd-independent, I temporarily restored the stale server version and re-observed the failure:

Expected: "0.1.0"
Received: "0.2.1"
(fail) SERVER_INFO > matches the published package version

Social-card drift gate decision

• Regenerated site/public/og.png; new sha256: 143f616a35f7de792e42c1ae4a0b01181b7865406c148142e3194217457228b7.
• I did not add an SVG→PNG byte gate in this PR. Local generation is repeatable, but the rasterizer uses Sharp/libvips plus generic SVG fonts (Arial, Helvetica, sans-serif), so a CI byte gate would likely be platform/font-stack sensitive unless the project first makes the card render fully deterministic. Known gap: nothing currently gates social-card source/artifact drift.

Validation

• bun test scripts/release-pack.test.ts scripts/release-publish.test.ts scripts/update-action-tag.test.ts packages/mcp/test/version.test.ts
• bun test packages/mcp/test/version.test.ts && cd packages/mcp && bun test test/version.test.ts
• bun run release:pack -- --tag v0.2.1
• bun run release:publish -- --dry-run
• bun run typecheck && bun test && bun run lint
• bun run schema:emit && git diff --exit-code schema/adr.schema.json packages/ci/dist && bun run check:deps && bun run adr lint
• bun run audit:gate
• cd site && bun run build
• Verified packed MCP metadata: 0.2.1 dev.adrkit/mcp ./dist/bin.js 0.2.1.
• Confirmed @adrkit/mcp@0.2.0 still has no published mcpName; confirmed packages/ci/queue/action.yml is missing at v0 and present at efef89b5d747ca175a1947f1ce2f4296dab54fa3.

Refresh after #60, #61, #62, #64 landed

All four merged after this branch was cut, so the release prep it carried had gone stale. main is now merged in and the prep re-verified against it.

Changelog gaps closed. Added the corpus-directory usage-error fix (#60) and the agent-drafted ratifier gate (#64) under Fixed, stated the audit gate's scope under Changed (#62), and corrected the release date, which still read 2026-07-25.

Consumer exposure disclosed, and observed rather than assumed. The Security section previously said only that root overrides yield a clean root bun audit. True, but overrides are not published in package manifests, so it says nothing about consumers. A real npm install of the packed 0.2.1 tarballs into a scratch directory resolves @hono/node-server@1.19.17, and npm audit there reports:

--- @hono/node-server moderate range: <2.0.5 fixAvailable: false
   via Node.js Adapter for Hono: Path traversal in `serve-static` on Windows via encoded backslash (%5C)
       https://github.com/advisories/GHSA-frvp-7c67-39w9 range= <2.0.5

@modelcontextprotocol/sdk@1.29.0 ranges @hono/node-server at ^1.19.9, which can never reach the patched >=2.0.5. So v0.2.1 ships the same exposure v0.2.0 has, and the changelog now says so.

Defect found: the audit gate would have gone stale on publish. KNOWN_CONSUMER_ADVISORY_ACCEPTANCES recorded the exposure against @adrkit/mcp@0.2.0 and @hono/node-server@1.19.15. Publish 0.2.1 and the gate names a version nobody installs — which reads as false safety for the version that is actually shipping. This is the same drift class as the SERVER_INFO.version bug this PR already fixes. Both fields now match the observed consumer install, and the test asserts against packages/mcp/package.json rather than a literal, so the next release-prep PR is forced to re-observe instead of inheriting a stale record.

Per ADR-0016 the test was changed first and observed failing:

Expected: "0.2.1"
Received: "0.2.0"
(fail) audit-gate — evaluateAudit > records the known upstream-blocked @adrkit/mcp consumer advisory without hiding the scope gap

Then 19 pass / 0 fail.

Runbook gap closed. ADR-0017 decides that published-artifact consumer audits belong in release evidence rather than PR CI — but docs/RELEASING.md had no such step; it never mentioned consumer installs, npm audit, or advisories at all. Added the packed-tarball consumer audit with the rule that every reported advisory must reconcile against KNOWN_CONSUMER_ADVISORY_ACCEPTANCES with a matching id, an unexpired acceptedUntil, and an affectedPublishedVersion equal to the version being cut. Also de-staled the cutover preamble, which still listed three already-merged branches as blockers.

Re-verification after the merge

• bun run build && bun run schema:emit && git diff --exit-code schema/adr.schema.json packages/ci/dist — no drift (this is the check that would have caught a stale CI bundle after fix(core): require ratifiers for agent-drafted ADRs #64 rebuilt it on a different base).
• bun run typecheck, bun run lint, bun run check:deps, bun run adr lint (17 records, 0 errors, 0 warnings).
• bun test — 789 pass, 0 fail, 95 files.
• bun run release:pack -- --tag v0.2.1, bun run release:publish -- --dry-run — + @adrkit/mcp@0.2.1.
• bun run audit:gate — PASSED, now reporting @adrkit/mcp@0.2.1 ... resolves @hono/node-server@1.19.17.
• cd site && bun run build — 26 pages.

Branch reconciliation

A GitHub "Update branch" merge landed on this branch while I had also merged main locally. Reconciled with a merge rather than a force push; the resulting tree hash was byte-identical before and after (e376243…), so the remote update contributed no content that could have been lost.

Sequencing note

This version bump should still be the last thing merged before tagging v0.2.1. Nothing else is open against the release. If anything new merges ahead of it, refresh the changelog and re-run the local simulation before cutting the tag.

[gemini-code-assist]

Caution

The consumer version of Gemini Code Assist on GitHub has been sunset. All code review activity has officially ceased.

[Copilot]

Pull request overview

Prepares the coordinated v0.2.1 release across packages, runtime metadata, documentation, and release procedures.

Changes:

• Bumps all public packages and runtime version literals to v0.2.1.
• Adds MCP runtime/package version regression coverage.
• Updates changelog, distribution guidance, site copy, and release runbook.

Reviewed changes

Copilot reviewed 18 out of 20 changed files in this pull request and generated 1 comment.

Show a summary per file

File	Description
package.json	Bumps root version.
bun.lock	Updates workspace versions.
packages/core/package.json	Bumps core package.
packages/evaluator/package.json	Bumps evaluator package.
packages/cli/package.json	Bumps CLI package.
packages/cli/src/index.ts	Updates CLI runtime version.
packages/mcp/package.json	Bumps MCP package.
packages/mcp/src/server.ts	Corrects MCP runtime version.
packages/mcp/server.json	Updates registry versions.
packages/mcp/test/version.test.ts	Adds version-drift regression test.
CHANGELOG.md	Adds v0.2.1 release notes.
docs/RELEASING.md	Adds release cutover runbook.
docs/DISTRIBUTION.md	Updates MCP publication sequencing.
README.md	Updates published version.
site/src/content/docs/quickstart.mdx	Updates quickstart version.
site/src/content/docs/index.mdx	Updates site release status.
site/src/content/docs/ci.mdx	Updates immutable Action tag.
site/src/components/Hero.astro	Updates hero version copy.
site/scripts/og-card.svg	Updates social-card version.
site/public/llms.txt	Updates agent-facing version copy.

[mbeacom]

Fixed in e8cadc1. The runbook now resolves the v0.2.1 tagged commit, finds the release.yml run for that exact head SHA, and watches that run with gh run watch "$release_run_id" --exit-status. I also tightened the adjacent checks: manifest/package/MCP metadata assertions, the v0 versus v0.2.1 SHA comparison, and the registry grep now fail closed instead of accepting stale state.