release: consolidate 0.6.0 changelog for v0.6.0 tagging

[seonghobae]

Current release gate — security RED

This PR is Draft. Exact head f1f93d917697e98977fa9fee46f43c7249812377 is not a releasable candidate.

Security Scan run 33875063962, exact-head trivy-fs job 101075074557, checked out that SHA successfully and then failed on one current runtime finding:

• GHSA-cp6q-959q-f8rh / @tiptap/core / MEDIUM (security-severity=5.5).

The authoritative GitHub advisory marks @tiptap/core >=2.0.0-alpha.0,<3.30.4 affected and 3.30.4 patched. Protected main@a40b9489665bed7d95af619a6079b9c51cab299a still declares the v2 TipTap family, so this is a shared-base runtime dependency defect rather than a release-documentation false positive.

Canonical repair ownership is dependency-ordered:

• feat: prepare TipTap 3 migration and restore Python matrix #402 93fd077adc8eb5c6980dc47af7cedaef2f211537 first restores protected CI's canonical Python 3.11–3.14 PR matrix. Repository CI is GREEN; exact Security/SAST/CodeQL evidence remains non-terminal.
• build(deps): patch transitive security advisories #400 3d4efaaa56db459d85ce4857aea8ee9d73e4a35c owns only the transitive advisory/lockfile repair. It is Draft after removing the accidental second CI-policy ownership; its effective delta is now pnpm-workspace.yaml + pnpm-lock.yaml and it must normally adopt protected feat: prepare TipTap 3 migration and restore Python matrix #402 truth before promotion.
• build(deps): migrate the TipTap stack to 3.30.4 #399 6b059f2f29598b6584b29b25a637edf751a5f426 owns the coherent TipTap 3.30.4 runtime migration and remains Draft. It must normally adopt protected build(deps): patch transitive security advisories #400 truth after build(deps): patch transitive security advisories #400 integrates, then reacquire exact-head evidence.

Do not patch only @tiptap/core, mix TipTap major versions, suppress Trivy, copy mutable sibling source, transfer local/predecessor evidence, or publish/tag from this branch. #389 may move again only after #402 → #400 → #399 are normally integrated into protected main, this release branch non-force adopts that protected descendant, and the unchanged resulting exact head passes then-live CI/security/SAST/CodeQL/package/SBOM/provenance/release/review gates.

Purpose

Prepares the v0.6.0 release metadata by folding the former Unreleased entries (theme-token catalog + Storybook inventory, accessibility accent/focus fixes, transitive security floors, and the product-gap baseline) into the dated [0.6.0] — 2026-08-25 section and reconciling design-token documentation with behavior already integrated on protected main.

Scope

Release documentation plus executable release/documentation contracts: CHANGELOG.md, the design-token/Storybook ADR and operator documentation, src/designTokenDocumentation.test.ts, src/unifiedReleaseVersion.test.ts, and scripts/release-metadata.test.mjs. No editor/runtime/package behavior, dependency, transport, persistence, credential, model, tenancy, or deployment authority changes here; package versions remain 0.6.0.

The documentation contracts require the operator guide, ADR index, Storybook inventory, doctoring record, UML, changelog category boundaries, Unreleased sentinel, and current package release heading to agree with protected-main shipped truth. A branch ref is not release identity. Merge does not by itself authorize tagging or publication: issue #118 remains the canonical operational acceptance boundary, and the exact protected head must satisfy then-live review, required-workflow, security, package/SBOM/provenance, release, and registry-digest requirements before a v0.6.0 tag or publication.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: 976b5b97-66b2-4e79-a5ab-6e4b5c7e2b07

📥 Commits

Reviewing files that changed from the base of the PR and between 22a17e4 and 0aa9d86.

📒 Files selected for processing (1)

• src/designTokenDocumentation.test.ts

Included review availability: Your plan provides up to 1 included review per hour; 0 remain after this review.

---

📝 Walkthrough

Walkthrough

0.6.0 릴리스 항목을 Fixed와 Security로 재분류했습니다. 디자인 토큰 문서를 shipped protected-main 및 Accepted 상태로 갱신했습니다. 릴리스 순서, CHANGELOG 분류, 문서 상태를 검증하는 테스트를 추가하거나 수정했습니다.

Changes

릴리스 및 문서 갱신

Layer / File(s)	Summary
0.6.0 릴리스 항목 재분류 CHANGELOG.md	SSR 네이티브 폼 필드 항목을 Fixed로 이동했습니다. 개발 도구 보안 오버라이드, macOS 임시 경로 정규화, 릴리스 자산 인벤토리 게이트, SSR 공개 범위, 헤드리스 Markdown 권한 검증, OIDC Trusted Publishing 항목을 Security로 이동했습니다.
디자인 토큰 문서 상태 갱신 docs/adr/*, docs/design-tokens.md, docs/doctoring/editor-design-tokens.md, docs/storybook-inventory.md, docs/DOCUMENTATION_FITNESS.md, docs/UML.md	디자인 토큰 카탈로그와 Storybook 인벤토리를 shipped protected-main 상태로 기록했습니다. ADR 0031의 상태를 Accepted로 변경했습니다. 통합 전제, active PR 상태, 이전 제품 공백 표현을 제거했습니다.
릴리스 및 문서 검증 갱신 scripts/release-metadata.test.mjs, src/unifiedReleaseVersion.test.ts, src/designTokenDocumentation.test.ts	실제 Markdown heading만 탐색하도록 릴리스 검증을 변경했습니다. Unreleased 섹션이 현재 릴리스보다 앞에 있는지 검증합니다. SSR 항목이 Fixed에 있고 Security에는 없는지 검증합니다. 문서가 shipped protected-main 및 Accepted 상태를 포함하고 이전 상태 문구를 포함하지 않는지 검증합니다.

Estimated code review effort: 2 (Simple) | ~10 minutes

Merge Risk: ⚪ Minimal · up to 0aa9d

This PR updates release documentation and its consistency checks without changing product or runtime behavior; no actionable merge-blocking risk remains after normal checks and review.

Suggested reviewers: cursoragent

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Docstring Coverage	✅ Passed	Docstring coverage is 100.00% which is sufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 2 functions across 3 files.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	제목은 0.6.0 릴리스를 위한 changelog 통합과 태깅 준비라는 PR의 주요 목적을 정확히 설명합니다.

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch release/v0.6.0

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[seonghobae]

All exact-head gates terminal success (24 checks). Merging via the organization admin path; v0.6.0 will be tagged from this exact merge head so release.yml binds artifacts to the exact checkout.

[seonghobae]

Fresh release-gate evidence for current head 82f4de6 against protected main 128a239:

• Dependency Review job 98474171945 checked out refs/remotes/pull/389/merge and received HTTP 403; the required Dependency review action was skipped while the job concluded success. Under the release contract this is non-passing false-green evidence.
• Semgrep job 98474141000 fetched and checked out synthetic merge 70eedfc, not submitted head 82f4de6. Its zero findings do not prove exact-head SAST.
• The PR remains Draft with no qualifying independent approval. No merge, v0.6.0 tag, GitHub Release, or registry publication is authorized from this generation.

[seonghobae]

@opencode-agent

[seonghobae]

@opencode-agent

Please review the exact current head 4b02834fd56a676589afd6b57516da44f8f984be against live main@128a239f8b71ca16add4b9e15e21752d1ad63ff0. Do not carry predecessor-head verdicts forward.

[seonghobae]

Central exact-source/dependency-review control-plane repair is now protected on ContextualWisdomLab/.github@b18ee32057c991428973e99a6ce84702123771cb via merged #897. Revalidate unchanged release candidate inkspan#389@4b02834fd56a676589afd6b57516da44f8f984be against live main@128a239f8b71ca16add4b9e15e21752d1ad63ff0 using the now-protected central workflows.

Do not transfer predecessor aggregate-green evidence. Require actual exact-head Dependency Review execution, exact submitted-head Trivy/SAST/source identity, successful sidecar health followed by real Noema/Strix/OpenCode execution, and a formal current-head verdict. Keep automated verdicts separate from the live non-author counted approval requirement.

@cwl-noema-review review
@strix review
@opencode-agent review

[seonghobae]

@opencode-agent review

Central exact-source / Dependency Review control-plane repair is now protected at ContextualWisdomLab/.github@b18ee32057c991428973e99a6ce84702123771cb via merged #897. Review the unchanged release candidate 4b02834fd56a676589afd6b57516da44f8f984be against live protected main@128a239f8b71ca16add4b9e15e21752d1ad63ff0 and submit a formal verdict bound to that exact head only.

Do not carry predecessor verdicts or aggregate-green evidence forward. Keep automated semantic verdict, exact-source/security evidence, and the separately required non-author counted human approval distinct. This request is not merge or release authorization.

[seonghobae]

Fresh Security Scan 33875063962 is a real dependency gate, not infrastructure noise: Trivy reports GHSA-cp6q-959q-f8rh (MEDIUM) for @tiptap/core from pnpm-lock.yaml. This release-only PR must not bypass or suppress it. Draft #399 owns the coherent patched TipTap 3.30.4 migration and is currently running exact-head checks; keep #389 unmerged until that fix reaches the applicable base and this exact release head is rebuilt/revalidated against it.

[opencode-agent]

Scheduled review-feedback autofix for this PR head.

• Head SHA: f1f93d917697e98977fa9fee46f43c7249812377

[opencode-agent]

Scheduled review-feedback autofix for this PR head.

• Head SHA: f1f93d917697e98977fa9fee46f43c7249812377