Skip to content

docs: add auth-scope release labeling policy#8

Merged
y1o1 merged 2 commits into
developfrom
chore/adopt-release-policy
May 12, 2026
Merged

docs: add auth-scope release labeling policy#8
y1o1 merged 2 commits into
developfrom
chore/adopt-release-policy

Conversation

@y1o1
Copy link
Copy Markdown
Contributor

@y1o1 y1o1 commented May 12, 2026

Summary

  • Adds docs/release-policy.md establishing the auth-scope release labeling policy
  • Same canonical content is being added to all 4 OSS repos in the scope (auth.utils / auth.provider / auth.policy-verifier / auth.proxy)
  • This is the auth.utils adoption PR; sibling PRs follow in the other 3 repos
  • No code change in this PR — auth.utils had zero forward-version drift to clean up

Context

A documented drift incident showed that anchoring multi-release planning on future version labels (specifically "1.0 GA") led to:

  • CHANGELOG entries on v0.5.2 / v0.5.3 npm-published packages promising "will be removed at 1.0 GA" for changes that now land in v0.6.0
  • Operator-facing Zod validation error metadata in auth.provider schema referencing "1.0 GA" — already shipping in v0.5.3
  • Internal planning artifacts becoming self-contradictory and silently dropping originally-committed features

The policy codifies six rules (R1-R6) to prevent recurrence:

  1. R1 Past-only rule — code, JSDoc, public docs, config comments, and error message strings reference only released version tags
  2. R2 CHANGELOG ## [Unreleased] until cut — no pre-stamping
  3. R3 JSDoc @deprecated says "since" only — removal timing lives in CHANGELOG, not in JSDoc
  4. R4 PR titles describe what was done, not what release — release assignment is determined by which tag the merge commit lands in
  5. R5 Validation error message strings: factual, not predictive — operator-facing strings use released version names only
  6. R6 Release-cut audit pass — mandatory checklist before tagging

Why this PR per repo

Adopting the policy in each repo's docs/ makes it visible to contributors during local development; folding it into AGENTS.md would mix labeling convention with dev guidelines and risk it getting overlooked.

Test plan

  • CI green on the PR
  • Markdown renders correctly on GitHub
  • No code change introduced (verify diff)

Adds docs/release-policy.md establishing that past version numbers are
facts and future version numbers are predictions; the two must be
treated differently in code, CHANGELOG, JSDoc, error messages, and PR
titles.

The policy is canonical for the 4 OSS repos in the auth scope
(auth.utils / auth.provider / auth.policy-verifier / auth.proxy) and is
mirrored to each repo's docs/ directory so contributors see it as part
of repo-local documentation.

Established in response to a documented drift incident where the
"1.0 GA" planning anchor became internally contradictory and silently
dropped originally-committed features. See the policy doc for full
rationale and the six concrete rules (R1-R6) covering past-only
references, CHANGELOG Unreleased convention, JSDoc since-only,
PR titles, validation error metadata, and release-cut audit pass.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Copilot AI review requested due to automatic review settings May 12, 2026 05:45
Copy link
Copy Markdown

Copilot AI left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull request overview

Adds a new documentation page codifying an “auth-scope” release labeling policy intended to prevent forward-version drift across the auth.* OSS repos.

Changes:

  • Introduces docs/release-policy.md describing rules R1–R6 for referencing versions in code/docs/CHANGELOG/error strings and for release-cut auditing.
  • Documents the retirement of the “1.0 GA” planning label and prescribes how to avoid future forward-version promises.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Comment thread docs/release-policy.md Outdated
Comment thread docs/release-policy.md
Comment thread docs/release-policy.md Outdated
Resolves Copilot review threads on PR #8:

1. Canonical policy doc revised (mirrors fixes applied in sibling PRs):
   - Scope-aware narrative — no longer states v0.5.x/v0.6.0 history as
     fact about "this project"; auth.provider's drift is named
     explicitly, the other 3 repos adopt going forward
   - R5 examples no longer pre-stamp a concrete version (v0.6.0); use
     vX.Y.Z placeholder + "this release" / "(Phase G / M4)" neutral
     wording, since the policy itself must not encode forward-version
     promises
   - R2 explicitly forbids hybrid `## [X.Y.Z] — Unreleased` headers
     alongside the bare-version pre-stamps
   - R3 example references CHANGELOG (always present) instead of
     MIGRATION.md (which is not guaranteed to exist in every repo)
   - Table row generalized from `.claude/` to "internal planning
     artifacts" — `.claude/` is agent-scope convention, not OSS-repo
     content
   - R2 tag-creation wording fixed: a commit doesn't create a tag; the
     tag is created to point at the commit (clarified as separate but
     atomic release-cut step)

2. CHANGELOG.md `## [0.0.4] — Unreleased` → `## [Unreleased]` (R2):
   The hybrid pre-stamp header is exactly the kind of forward-version
   reference R2 prohibits. Restoring the canonical Keep-a-Changelog
   `## [Unreleased]` heading. The 0.0.4 label will be applied at the
   release-cut PR per R6 step 2.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
@y1o1 y1o1 merged commit e81d99c into develop May 12, 2026
1 check passed
@y1o1 y1o1 deleted the chore/adopt-release-policy branch May 12, 2026 07:08
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants