[aepfli]

Stops #447 from cutting the conformance assets as 1.0.0.

Why it proposed 1.0.0

.release-please-manifest.json carries "specification/assets/provider-tck": "0.0.0". release-please reads 0.0.0 as no release yet, so it never bumps from it — it falls back to its default initial version, which is 1.0.0. bump-minor-pre-major: true is already set and had no effect here, because there is no prior version to bump minor-instead-of-major.

Why 1.0.0 is the wrong number

It is a compatibility claim, and go get is where it gets read.

• Appendix F, which gives these assets their meaning, is not merged (#439) and marks itself experimental.
• The capability vocabulary is still under review, and tags are the suite's public surface: adding, splitting or renaming one changes what every adopter's run means. @string-typing was split out of @fully-typed-values during review, which is exactly the kind of change 1.0.0 promises not to make.
• The control-API surface (openapi/control-api.yaml) and the report schema (#425) are both open questions.
• #430 and #433 are open gaps in what the assets assert.

What this changes

One line: initial-version: "0.1.0" on the assets package.

0.1.0 rather than 0.0.1 because the first release is a feature, not a fix, and because it leaves both digits meaningful — patch for fixture corrections, minor for new scenarios. Both are expected: the testbed already owes two fixtures (flagd-testbed#392), and the open questions above will add scenarios.

What to expect on merge

release-please re-runs on push to main and should update #447 to propose 0.1.0, tagging specification/assets/provider-tck/v0.1.0 once that is merged. Nothing is tagged by this PR.

Four conformance implementations currently pin these assets by commit, because no tag exists yet. That tag is what lets Go name a version instead of a pseudo-version, so the number it carries is worth getting right before the first one is published — a tag is not practical to take back.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

• Configuration used: Organization UI
• Review profile: CHILL
• Plan: Advanced
• Run ID: 08928488-7198-45a0-9894-c2802daa3ddb

📥 Commits

Reviewing files that changed from the base of the PR and between 2c5e8bb and ceb526d.

📒 Files selected for processing: 1

• release-please-config.json

Included review availability: This review used your included allowance. Your plan provides up to 4 included reviews per hour; 3 remain after this review.

📝 Walkthrough

The specification/assets/provider-tck package configuration now sets its initial version to 0.1.0.

Changes: Provider TCK Version

Layer / File(s)	Summary
Set initial package version release-please-config.json	The provider-tck package configuration now specifies 0.1.0 as its initial version.

Priority: ⬇️ Low

Estimated code review effort: 1 (Trivial) | ~2 minutes

Change: Other

Merge Risk: ⚪ Minimal · up to ceb52

Provider TCK’s initial release will be proposed as 0.1.0 rather than 1.0.0, avoiding a premature stable-compatibility signal. The pinned release workflow honors the setting, so no material merge risk remains.

Security architecture risk: ⚪ Minimal · up to ceb52

The change selects 0.1.0 for the assets’ first release without changing release permissions, credentials, package boundaries, or tag ownership. No material security risk was identified.

Retained concerns
No architecture-level concerns identified.

Security review details

Security Blast Radius

• inferred — The changed setting affects the initial release number within the existing provider-tck package namespace. The exact comparison provides no introduced expansion of credential authority, release targets, or independently writable package scope.

Pre-merge checks: 5

Passed checks: 5 passed

Check name	Status	Explanation
Title check		The title clearly states the main change: set the conformance assets release to 0.1.0 instead of 1.0.0.
Description check		The description directly explains the release-version problem, the one-line configuration change, and the expected release-please behavior.
Docstring Coverage		No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0…
Linked Issues check		Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check		Check skipped because no linked issues were found for this pull request.

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

_{Comment @coderabbitai help to get the list of available commands.}