sixfold-space/madtea

SHA256

Fork 0

epic: v0.20.0 - breaking: clearer ADR tooling and the write guard on every surface #675

New issue

Closed

opened 2026-09-29 19:31:31 +00:00 by hexajon · 1 comment

hexajon commented

2026-09-29 19:31:31 +00:00

Owner

Breaking changes are fine across more than one release, as long as each release
stands on its own. So the second-contributor sign-off work and the fake-to-real
test migration move to their own later breaking releases.

There is no release until every child below is closed.

Children:

#492 adr check says what is wrong and how to fix it, in plain words, with no
rule codes.
#508 adr rebuild regenerates the index.
#530 cross-repo record links, and the flag rename to --skip-forge-checks.
#632 a link to an issue on another forge is read on that forge, or fails.
#639 remove the legacy docs/adr/ layout.
#658 adr check verifies every file reference in a record.
#670 one guard enforces the recorded limits on every surface (ADR 0046).
#740 every tool result carries the protocol-required resultType.

Moved to their own later breaking releases:

#638 adding dir= to the MCP tools that act on a local repo is an ADR 0027
credential-boundary ruling per tool, not a mechanical change
(status/needs-decision on the issue).
#673 a decided record needs a second contributor's sign-off (ADR 0047,
accepted; its enforcement ships in a later release).
#674 the forge tests move from fake servers to throwaway real ones (ADR 0052).
Internal, no user-facing change; the harness (#677) already exists, so a new
forge feature in this release uses it.

Every forge test in this release follows ADR 0017.

Done when every child above is closed. Then scripts/release.sh cuts v0.20.0, and
the release notes list each break and what a user does about it.

#740

v0.20.0 carries the breaking changes to the ADR tooling - clearer output, multi-repo records, and the removal of the legacy layout - and lands the one write guard on every surface. A v0.19.0 user takes these together. A breaking change bumps the minor version in 0.x (ADR 0028). Breaking changes are fine across more than one release, as long as each release stands on its own. So the second-contributor sign-off work and the fake-to-real test migration move to their own later breaking releases. There is no release until every child below is closed. Children: - #492 adr check says what is wrong and how to fix it, in plain words, with no rule codes. - #508 adr rebuild regenerates the index. - #530 cross-repo record links, and the flag rename to --skip-forge-checks. - #632 a link to an issue on another forge is read on that forge, or fails. - #639 remove the legacy docs/adr/ layout. - #658 adr check verifies every file reference in a record. - #670 one guard enforces the recorded limits on every surface (ADR 0046). - #740 every tool result carries the protocol-required resultType. Moved to their own later breaking releases: - #638 adding dir= to the MCP tools that act on a local repo is an ADR 0027 credential-boundary ruling per tool, not a mechanical change (status/needs-decision on the issue). - #673 a decided record needs a second contributor's sign-off (ADR 0047, accepted; its enforcement ships in a later release). - #674 the forge tests move from fake servers to throwaway real ones (ADR 0052). Internal, no user-facing change; the harness (#677) already exists, so a new forge feature in this release uses it. Every forge test in this release follows ADR 0017. Done when every child above is closed. Then scripts/release.sh cuts v0.20.0, and the release notes list each break and what a user does about it.  - [ ] #740

hexajon added a new dependency

2026-09-29 19:32:18 +00:00

#674 epic: run forge tests against throwaway Forgejo and Gitea servers behind a real proxy

hexajon added a new dependency

2026-09-29 19:32:23 +00:00

#642 feat(adr)!: adr check reads only the Decision issues list

hexajon added a new dependency

2026-09-29 19:32:52 +00:00

#492 adr check: say what is wrong and how to fix it, in plain words, with no rule codes

hexajon added a new dependency

2026-09-29 19:33:07 +00:00

#530 adr check: resolve cross-repo record links, so an impacts pair cannot go one-way or dangle

hexajon added a new dependency

2026-09-29 19:33:15 +00:00

#632 adr check: C11 drops the host from an issue URL and reads the link on the record's own forge

hexajon added a new dependency

2026-09-29 19:33:30 +00:00

#639 adr: remove the legacy docs/adr/ layout, because its folder name lets a record skip every rule

hexajon added a new dependency

2026-09-29 19:33:59 +00:00

#508 adr: add rebuild to regenerate the README index from the records

hexajon added a new dependency

2026-09-29 19:34:17 +00:00

#638 repo-scope: madt_adr and other MCP tools cannot target a nested repo, because they take no dir=

hexajon added a new dependency

2026-09-29 19:34:25 +00:00

#658 adr check: verify every file reference in a record

hexajon added a new dependency

2026-09-29 19:34:27 +00:00

#670 epic: one guard enforces the recorded limits on every surface

hexajon added a new dependency

2026-09-29 19:34:29 +00:00

#673 epic: a decided record needs a second contributor's sign-off

hexajon referenced this issue

2026-10-03 21:15:59 +00:00

security: consolidate the HTTP clients through one hardened builder (the config client leaks a credential on redirect) #708

hexajon added a new dependency

2026-10-05 12:34:15 +00:00

#710 security: git tag create does not guard the tag name against a leading dash

hexajon added a new dependency

2026-10-05 12:34:15 +00:00

#711 security: repo-flags endpoints build API paths with raw, unescaped segments

hexajon added a new dependency

2026-10-05 12:34:16 +00:00

#712 security: remove the legacy OAuth client-id fallback (it reads the merged git config)

hexajon added a new dependency

2026-10-05 12:34:16 +00:00

#715 security: a credential resolver returns a token without the cleartext-http check

hexajon added a new dependency

2026-10-05 12:34:16 +00:00

#717 security: the gosec gate excludes 7 rule classes with no ADR

hexajon added the

epic

label

2026-10-05 12:34:16 +00:00

hexajon referenced this issue

2026-10-05 14:54:42 +00:00

release: notes surface every breaking change, and a break must carry the ! marker #719

hexajon added a new dependency

2026-10-05 14:56:38 +00:00

#719 release: notes surface every breaking change, and a break must carry the ! marker

hexajon referenced this issue

2026-10-05 15:05:31 +00:00

docs(adr): record the release-notes and attribution gates as 0050 and 0051 #722

hexajon added a new dependency

2026-10-13 17:22:03 +00:00

#740 bug(mcp): tool results omit resultType required by protocol revision 2026-07-28

hexajon referenced this issue

2026-10-13 22:23:04 +00:00

epic: code and supply-chain security hardening #759

hexajon changed title from ~~epic: v0.20.0, the one release that breaks the ADR tooling~~ to epic: v0.20.0 - breaking: clearer ADR tooling and the write guard on every surface

2026-10-14 21:21:55 +00:00

hexajon removed a dependency

2026-10-14 21:26:14 +00:00

#673 epic: a decided record needs a second contributor's sign-off

hexajon removed a dependency

2026-10-14 21:26:14 +00:00

#674 epic: run forge tests against throwaway Forgejo and Gitea servers behind a real proxy

hexajon removed a dependency

2026-10-15 19:47:08 +00:00

#638 repo-scope: madt_adr and other MCP tools cannot target a nested repo, because they take no dir=

hexajon removed a dependency

2026-10-18 05:21:48 +00:00

#719 release: notes surface every breaking change, and a break must carry the ! marker

hexajon commented

2026-10-18 05:30:30 +00:00

Author

Owner

Shipped in v0.20.0: https://git.cheshirecube.cloud/sixfold-space/madtea/releases/tag/v0.20.0

This release carries the breaking changes to the ADR tooling (clearer output, cross-repo record links, the file-reference check, and the removal of the legacy layout) and the one write guard on every surface. The acceptance ran green on both forges at both pinned versions on main.

Two items moved to a later release: the live refresh of the vendored API specs (#538), and the release-notes breaking-change tooling (#719). The write guard ships against the current vendored specs, so a passthrough write to an endpoint that no vendored spec declares is refused until that refresh lands.

Shipped in v0.20.0: https://git.cheshirecube.cloud/sixfold-space/madtea/releases/tag/v0.20.0 This release carries the breaking changes to the ADR tooling (clearer output, cross-repo record links, the file-reference check, and the removal of the legacy layout) and the one write guard on every surface. The acceptance ran green on both forges at both pinned versions on main. Two items moved to a later release: the live refresh of the vendored API specs (#538), and the release-notes breaking-change tooling (#719). The write guard ships against the current vendored specs, so a passthrough write to an endpoint that no vendored spec declares is refused until that refresh lands.

hexajon closed this issue

2026-10-18 05:30:31 +00:00