chore(release): bump version to 0.10.4

.bumpversion.toml

@@ -2,7 +2,7 @@
 # SPDX-License-Identifier: Apache-2.0
 
 [tool.bumpversion]
-current_version = "0.10.3"
+current_version = "0.10.4"
 parse = "(?P<major>\\d+)\\.(?P<minor>\\d+)\\.(?P<patch>\\d+)"
 serialize = ["{major}.{minor}.{patch}"]
 

.github/workflows/ci.yml

@@ -5,21 +5,6 @@ name: Zenzic Docs CI
 
 on:
   pull_request:
-    paths:
-      - 'docs/**'
-      - 'i18n/**'
-      - 'src/**'
-      - 'static/**'
-      - 'scripts/**'
-      - 'docusaurus.config.ts'
-      - 'sidebars.ts'
-      - 'package.json'
-      - 'package-lock.json'
-      - 'tsconfig.json'
-      - '.zenzic.toml'
-      - '.github/workflows/ci.yml'
-      - '.pre-commit-config.yaml'
-      - '.pre-commit-hooks.yaml'
   push:
     branches:
       - main
@@ -54,7 +39,7 @@ jobs:
 
     steps:
       - name: Checkout Repository
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
 
       - name: Setup Node
         uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0

.github/workflows/codeql.yml

@@ -39,15 +39,15 @@ jobs:
 
     steps:
       - name: Checkout Repository
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
 
       - name: Initialize CodeQL
-        uses: github/codeql-action/init@7211b7c8077ea37d8641b6271f6a365a22a5fbfa # v3
+        uses: github/codeql-action/init@8aad20d150bbac5944a9f9d289da16a4b0d87c1e # v3
         with:
           languages: ${{ matrix.language }}
 
       - name: Autobuild
-        uses: github/codeql-action/autobuild@7211b7c8077ea37d8641b6271f6a365a22a5fbfa # v3
+        uses: github/codeql-action/autobuild@8aad20d150bbac5944a9f9d289da16a4b0d87c1e # v3
 
       - name: Perform CodeQL Analysis
-        uses: github/codeql-action/analyze@7211b7c8077ea37d8641b6271f6a365a22a5fbfa # v3
+        uses: github/codeql-action/analyze@8aad20d150bbac5944a9f9d289da16a4b0d87c1e # v3

.github/workflows/compliance.yml

@@ -26,7 +26,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout Repository
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.2
         with:
           fetch-depth: 0
 

.github/workflows/dependency-review.yml

@@ -26,7 +26,7 @@ jobs:
     timeout-minutes: 10
     steps:
       - name: Checkout Repository
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
 
       - name: Dependency Review
         uses: actions/dependency-review-action@a1d282b36b6f3519aa1f3fc636f609c47dddb294 # v5.0.0

.github/workflows/npm-audit.yml

@@ -33,7 +33,7 @@ jobs:
 
     steps:
       - name: Checkout Repository
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
 
       - name: Setup Node
         uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0

.github/workflows/release-docs.yml

@@ -26,7 +26,7 @@ jobs:
 
     steps:
       - name: Checkout Repository
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
 
       - name: Setup Node
         uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0

.github/workflows/release.yml

@@ -23,7 +23,7 @@ jobs:
 
     steps:
       - name: Checkout Repository
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
 
       - name: Setup Node
         uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0

.github/workflows/security-posture.yml

@@ -18,7 +18,7 @@ jobs:
 
     steps:
       - name: Checkout Repository
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
 
       - name: Check for SECURITY.md
         run: |

.github/workflows/zenzic.yml

@@ -19,7 +19,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout Repository
-        uses: actions/checkout@v4
+        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
 
       - name: Run Zenzic Quality Gate
         uses: PythonWoods/zenzic-action@v1

.zenzic.toml

@@ -127,6 +127,10 @@ i18n_parity = true
 "docs/tutorials/examples/z1xx-links/z107-circular-anchor.mdx" = ["Z107"]
 "docs/it/tutorials/examples/z1xx-links/z107-circular-anchor.mdx" = ["Z107"]
 
+# Z109: github.com/google/re2 — valid upstream repo; transient connection error in CI network.
+"docs/explanation/architecture.mdx" = ["Z109"]
+"docs/it/explanation/architecture.mdx" = ["Z109"]
+
 # "docs/legacy/**"      = ["Z601"]  # intentional brand refs → -1 pt
 # "docs/migration/*.md" = ["Z101"]  # known broken links → -1 pt
 

CHANGELOG.md

@@ -11,7 +11,10 @@ Versions track the Zenzic Core release line under the Branch Parity Rule.
 
 ## [Unreleased]
 
-No changes yet.
+### Changed
+
+- **Fail-closed PR build gate:** Removed `pull_request.paths` filters from `.github/workflows/ci.yml` so the `Build` check runs on every PR and can safely be required in branch protection.
+- **Operational policy docs:** Added explicit branch-protection required-checks guidance (EN + IT) for `zenzic-doc` and `zenzic` in CI/CD integration documentation.
 
 ---
 

CONTRIBUTING.it.md

@@ -60,6 +60,19 @@ uvx pre-commit install               # commit-stage: hygiene + typecheck + zenzi
 uvx pre-commit install -t pre-push   # pre-push: 🛡️ Final Guard runs `just verify`
 ```
 
+Configura la firma SSH dei commit (obbligatoria — tutti i commit devono apparire come **Verified** su GitHub):
+
+```bash
+# Configurazione globale una-tantum (salta se già configurata)
+git config --global gpg.format ssh
+git config --global user.signingkey ~/.ssh/id_ed25519.pub   # adatta il percorso se necessario
+git config --global commit.gpgsign true
+```
+
+Registra poi la tua chiave pubblica come **Signing Key** (non Authentication Key) su
+<https://github.com/settings/ssh>. I commit firmati con una chiave non registrata
+verranno rifiutati dal ruleset del branch.
+
 ---
 
 ## Eseguire il Sito in Locale

CONTRIBUTING.md

@@ -60,6 +60,19 @@ uvx pre-commit install               # commit-stage: hygiene + typecheck + zenzi
 uvx pre-commit install -t pre-push   # pre-push: 🛡️ Final Guard runs `just verify`
 ```
 
+Configure SSH commit signing (required — all commits must appear **Verified** on GitHub):
+
+```bash
+# One-time global setup (skip if already configured)
+git config --global gpg.format ssh
+git config --global user.signingkey ~/.ssh/id_ed25519.pub   # adjust path if different
+git config --global commit.gpgsign true
+```
+
+Then register your public key as a **Signing Key** (not Authentication Key) at
+<https://github.com/settings/ssh>. Commits signed with an unregistered key will
+be rejected by the branch ruleset.
+
 ---
 
 ## Running the Site Locally

README.it.md

@@ -2,28 +2,30 @@
 SPDX-FileCopyrightText: 2026 PythonWoods <dev@pythonwoods.dev>
 SPDX-License-Identifier: Apache-2.0
 -->
+<!-- markdownlint-disable MD033 MD041 MD060 -->
 
-<div align="center">
+<p align="center">
   <a href="https://zenzic.dev/it">
     <picture>
-      <source media="(prefers-color-scheme: dark)" srcset="static/assets/brand/svg/zenzic-nav-dark.svg">
-      <source media="(prefers-color-scheme: light)" srcset="static/assets/brand/svg/zenzic-nav-light.svg">
-      <img src="static/assets/brand/svg/zenzic-nav-dark.svg" alt="Zenzic" height="64" />
+      <source media="(prefers-color-scheme: dark)" srcset="static/assets/brand/svg/zenzic-wordmark-doc-dark.svg">
+      <img alt="Zenzic / doc" src="static/assets/brand/svg/zenzic-wordmark-doc.svg" width="350">
     </picture>
   </a>
-</div>
-
-# Guida per Sviluppatori zenzic-doc
-
-[![ci-status](https://img.shields.io/github/actions/workflow/status/PythonWoods/zenzic-doc/ci.yml?branch=main&label=ci&style=flat-square)](https://github.com/PythonWoods/zenzic-doc/actions/workflows/ci.yml)
-<!-- zenzic:audit-badge -->
-[![zenzic-audit](https://img.shields.io/badge/%F0%9F%9B%A1%EF%B8%8F_zenzic--audit-passing-22c55e?style=flat-square)](https://zenzic.dev/it/docs/reference/scoring-algorithm)
-<!-- zenzic:score-badge -->
-[![zenzic-score](https://img.shields.io/badge/%F0%9F%9B%A1%EF%B8%8F_zenzic--score-96_%2F_100-f59e0b?style=flat-square)](https://zenzic.dev/it/docs/reference/scoring-algorithm)
-[![REUSE 3.x compliant](https://img.shields.io/badge/REUSE-3.x%20compliant-0d9488?style=flat-square)](https://reuse.software/)
-[![License](https://img.shields.io/badge/license-Apache--2.0-0d9488?style=flat-square)](LICENSE)
-[![Documentation: Diátaxis](https://img.shields.io/badge/Docs-Di%C3%A1taxis-brightgreen?style=flat-square)](https://diataxis.fr/)
-[![Zenzic](https://img.shields.io/badge/Zenzic-v0.10.3-blue?style=flat-square)](https://github.com/PythonWoods/zenzic)
+</p>
+
+<p align="center">Il portale di documentazione Docusaurus ufficiale per Zenzic — costruito su Diátaxis, distribuito come sito unico con docs utente, docs sviluppatore e blog.</p>
+
+<p align="center">
+  <a href="https://github.com/PythonWoods/zenzic-doc/actions/workflows/ci.yml"><img alt="ci-status" src="https://img.shields.io/github/actions/workflow/status/PythonWoods/zenzic-doc/ci.yml?branch=main&label=ci&style=flat-square"></a>
+  <!-- zenzic:audit-badge -->
+  <img src="https://img.shields.io/badge/%F0%9F%9B%A1%EF%B8%8F_zenzic--audit-passing-22c55e?style=flat-square" alt="zenzic-audit">
+  <!-- zenzic:score-badge -->
+  <img src="https://img.shields.io/badge/%F0%9F%9B%A1%EF%B8%8F_zenzic--score-94_%2F_100-f59e0b?style=flat-square" alt="zenzic-score">
+  <a href="https://reuse.software/"><img alt="REUSE 3.x compliant" src="https://img.shields.io/badge/REUSE-3.x%20compliant-0d9488?style=flat-square"></a>
+  <a href="LICENSE"><img alt="license" src="https://img.shields.io/badge/license-Apache--2.0-0d9488?style=flat-square"></a>
+  <a href="https://diataxis.fr/"><img alt="Documentation: Diátaxis" src="https://img.shields.io/badge/Docs-Di%C3%A1taxis-brightgreen?style=flat-square"></a>
+  <a href="https://github.com/PythonWoods/zenzic"><img alt="Zenzic" src="https://img.shields.io/badge/Zenzic-v0.10.4-blue?style=flat-square"></a>
+</p>
 
 ---
 

README.md

@@ -2,28 +2,30 @@
 SPDX-FileCopyrightText: 2026 PythonWoods <dev@pythonwoods.dev>
 SPDX-License-Identifier: Apache-2.0
 -->
+<!-- markdownlint-disable MD033 MD041 MD060 -->
 
-<div align="center">
+<p align="center">
   <a href="https://zenzic.dev">
     <picture>
-      <source media="(prefers-color-scheme: dark)" srcset="static/assets/brand/svg/zenzic-nav-dark.svg">
-      <source media="(prefers-color-scheme: light)" srcset="static/assets/brand/svg/zenzic-nav-light.svg">
-      <img src="static/assets/brand/svg/zenzic-nav-dark.svg" alt="Zenzic" height="64" />
+      <source media="(prefers-color-scheme: dark)" srcset="static/assets/brand/svg/zenzic-wordmark-doc-dark.svg">
+      <img alt="Zenzic / doc" src="static/assets/brand/svg/zenzic-wordmark-doc.svg" width="350">
     </picture>
   </a>
-</div>
-
-# zenzic-doc Developer Guide
-
-[![ci-status](https://img.shields.io/github/actions/workflow/status/PythonWoods/zenzic-doc/ci.yml?branch=main&label=ci&style=flat-square)](https://github.com/PythonWoods/zenzic-doc/actions/workflows/ci.yml)
-<!-- zenzic:audit-badge -->
-[![zenzic-audit](https://img.shields.io/badge/%F0%9F%9B%A1%EF%B8%8F_zenzic--audit-passing-22c55e?style=flat-square)](https://zenzic.dev/docs/reference/scoring-algorithm)
-<!-- zenzic:score-badge -->
-[![zenzic-score](https://img.shields.io/badge/%F0%9F%9B%A1%EF%B8%8F_zenzic--score-96_%2F_100-f59e0b?style=flat-square)](https://zenzic.dev/docs/reference/scoring-algorithm)
-[![REUSE 3.x compliant](https://img.shields.io/badge/REUSE-3.x%20compliant-0d9488?style=flat-square)](https://reuse.software/)
-[![License](https://img.shields.io/badge/license-Apache--2.0-0d9488?style=flat-square)](LICENSE)
-[![Documentation: Diátaxis](https://img.shields.io/badge/Docs-Di%C3%A1taxis-brightgreen?style=flat-square)](https://diataxis.fr/)
-[![Zenzic](https://img.shields.io/badge/Zenzic-v0.10.3-blue?style=flat-square)](https://github.com/PythonWoods/zenzic)
+</p>
+
+<p align="center">The official Docusaurus documentation portal for Zenzic — built on Diátaxis, shipped as a single site with user docs, developer docs, and blog.</p>
+
+<p align="center">
+  <a href="https://github.com/PythonWoods/zenzic-doc/actions/workflows/ci.yml"><img alt="ci-status" src="https://img.shields.io/github/actions/workflow/status/PythonWoods/zenzic-doc/ci.yml?branch=main&label=ci&style=flat-square"></a>
+  <!-- zenzic:audit-badge -->
+  <img src="https://img.shields.io/badge/%F0%9F%9B%A1%EF%B8%8F_zenzic--audit-passing-22c55e?style=flat-square" alt="zenzic-audit">
+  <!-- zenzic:score-badge -->
+  <img src="https://img.shields.io/badge/%F0%9F%9B%A1%EF%B8%8F_zenzic--score-94_%2F_100-f59e0b?style=flat-square" alt="zenzic-score">
+  <a href="https://reuse.software/"><img alt="REUSE 3.x compliant" src="https://img.shields.io/badge/REUSE-3.x%20compliant-0d9488?style=flat-square"></a>
+  <a href="LICENSE"><img alt="license" src="https://img.shields.io/badge/license-Apache--2.0-0d9488?style=flat-square"></a>
+  <a href="https://diataxis.fr/"><img alt="Documentation: Diátaxis" src="https://img.shields.io/badge/Docs-Di%C3%A1taxis-brightgreen?style=flat-square"></a>
+  <a href="https://github.com/PythonWoods/zenzic"><img alt="Zenzic" src="https://img.shields.io/badge/Zenzic-v0.10.4-blue?style=flat-square"></a>
+</p>
 
 ---
 

RELEASE.md

@@ -8,9 +8,9 @@
 
 | Field    | Value      |
 | :------- | :--------- |
-| Version  | v0.10.3     |
+| Version  | v0.10.4     |
 | Codename | Magnetite   |
-| Date     | 2026-06-08 |
+| Date     | 2026-06-09 |
 | Status   | Stable     |
 
 ## Release Checklist
@@ -47,11 +47,11 @@ git checkout main
 git pull origin main
 
 # 3. Tag the main branch and push
-git tag v0.10.3
+git tag v0.10.4
 git push origin main --tags
 ```
 
-- [ ] Create GitHub Release from the tag, using the `## v0.10.3` CHANGELOG section as the release body.
+- [ ] Create GitHub Release from the tag, using the `## v0.10.4` CHANGELOG section as the release body.
 
 ## Changelog Reference