chore(main): release 0.3.0

[jorisjonkers-dev-agents]

🤖 I have created a release beep boop

0.3.0 (2026-10-02)

⚠ BREAKING CHANGES

• the library entry no longer exports the hand-written domain types (Project, Application, Process, Platform, Tier and the vocabulary unions). A checked Intent Set now carries the authored Platform document and each project's Effective Intent.

Features

• add prepare Processes for forward-only setup (#166) (f04b5b6), closes #156
• ci: comment each pull request's shape and publish a release candidate (#116) (4ff3284)
• declare migrations on the Application (#165) (83ba2b4), closes #155
• deliver each Project as a signed artifact pinned by digest (#169) (84a89e2), closes #154
• gate switchover per Application with the Release Gate (#167) (44d115e), closes #152
• give every Application a revision (#164) (bf9a7b9), closes #150
• give the Resolved Deployment and the node contract their metamodels (#135) (179cbe8)
• hand Projects over from fleet-infra one at a time (#172) (ed0a8b7), closes #159
• keep secret rotation outside a release (#170) (db27cce), closes #153
• keep the production implementation portable (#227) (b9ac258)
• lay the compiler out as a chain of steps, and lower to the Effective Intent (#184) (e771f46)
• link a route's and a scrape's names to the Process and surface they mean (#118) (da54c8e)
• make cutover continuous or interrupted and derive blue/green from it (#163) (7e1d8b0), closes #151
• parse the minimal project intent in both implementations and match its oracle (#112) (506619b)
• prove every migration safe and undo a held one (#171) (e7383c4), closes #157
• publish JSON Schemas for the Resolved Deployment, the composition lock and the pin annotations (#211) (0fb5f6c)
• read the Platform document and refuse what it and the project files break together (#120) (ede5e91), closes #41
• refuse a broken document with the code and pointer both implementations agree on (#114) (dede1fa)
• refuse a settled decision that is not accepted (#207) (1be1eb8)
• render data, with Vault delivery, Assets, sidecars and backups (#192) (d4b0719)
• render Flagger-ready objects (#173) (b851060), closes #158
• render minimal's share of the tree through typed objects and one serializer (#186) (4943053)
• resolve auth, with migration, engine grants and placeholders (#194) (621639e)
• resolve data, with grants, Assets, sidecars and the Secret Store (#190) (31380c3)
• resolve every example the production implementation resolves, through QVT-Operational (#216) (c75d586)
• resolve minimal to its Resolved Deployment, with the foundation declared (#185) (7ea3422)
• resolve minimal with QVT-Operational, reading the pinned inputs through their own grammars (#215) (1aa4cdc)
• resolve volumes and render stop-start Processes, and settle engine, size and at-rest (#188) (f06b963)
• run the secret scan locally, not only in CI (#74) (ec9746b)
• share more than secrets between the authored levels (#143) (bdffe10)
• take delivery into the model and retire the push design (#162) (9fdafa7), closes #149
• widen the Project Intent metamodel to every worked example, with its descriptor and JSON Schema (#113) (76919ca)

Bug Fixes

• restore the external names the hierarchy rename rewrote (#107) (4dbaa43)

---

This PR was generated with Release Please. See documentation.

[github-actions]

Shape

bucket	files	additions	deletions
documentation	1	+47	-0
tooling	3	+4	-4

Coverage

Baseline: main @ b9ac258.

metric	this branch	main	diff
statements	99.52%	99.52%	0.00
branches	97.97%	97.97%	0.00
functions	100.00%	100.00%	0.00
lines	99.47%	99.47%	0.00

This pull request changed no covered line.