[soulbah]

Spec and outcome

• Spec or repository-only rationale: Repository-only release automation, recorded in docs/adr/007-promoted-releases-and-major-tags.md from the owner direction of 2026-10-07: main moves only by promotion of validated dev, a breaking change is a new major version, and the major tag names a qualified compatible release.
• Accepted outcome: quality runs on pull requests into dev and main only, with a guard that accepts only a fast-forward promotion from this repository's dev. promote.yml fast-forwards main to the exact head that passed quality. release.yml no longer runs on push: an owner dispatch on main requires quality and a published release integration against a stable Rootform release on that exact commit, runs semantic-release with default rules (breaking means major), resumes a tag pushed without its release, then moves the major tag forward to the new release. publish-v1.yml is removed. The commit range check runs where commits enter dev, because a promotion carries already gated commits, including Dependabot commits exempt from that check.
• Explicit non-goals: No release, tag or major tag change in this pull request, no change to the Action runtime surface or bundle, no immutable release setting change.

Done when and evidence

• Done when command or protocol: bun run verify passes in a clean clone, and the foundation validator refuses a push-triggered release workflow and any rule that ships a breaking change below major.
• Evidence path or exact output: Clean clone of 4204219: install_rc=0, verify_rc=0 ("Full verification passed."), commit range check range_rc=0. bun test scripts: 117 pass, 0 fail. actionlint passes. History since v0.1.0 contains two breaking commits (17cf0cb feat!: redesign github actions around forms and native reports #19, 001be5e feat(action)!: prepare only lock-selected external packages #16), so the first release under default rules is v1.0.0, matching the documented @v1 refs.
• Full gate: bun run verify

Risk and privacy

• Security/privacy impact: The release job adds actions: read and checks: read; contents: write stays limited to the release and promotion jobs. The major tag only moves forward to a commit that descends from its current target.
• Offline and determinism impact: None; the published bundle is unchanged.
• Dependency or toolchain change: None.
• Rollback path: Revert this squash commit on dev. No tag or release exists from it.

Review checklist

• Scope matches accepted spec or repository-only rationale.
• Success, boundary, failure, and regression paths have evidence proportional to risk.
• No secret, real Terraform material, private AI material, or generated noise enters Git.
• Primary reviewer inspected final diff and recorded remaining limits.