release: v0.3.0 (require verified platform seal by default)

[bartekus]

release: v0.3.0

Cuts the first release since v0.2.0. Bundles the three unreleased PRs (#5, #6, #7),
one of which is a breaking change to verify-certificate, so this is a minor
bump under 0.x (0.2.0 → 0.3.0).

What ships

• Breaking (feat(001)!: require a verified platform seal by default #7, spec 001): verify-certificate now requires a verified
  platform seal by default. An unsealed certificate (or a sealed one presented
  without --platform-jwks) exits 1 instead of 0. The old --require-sealed
  is the default now and stays only as a hidden, deprecated no-op. Restore the
  prior behavior with the new --allow-unsealed.
• Added (ci(003): assert the manylinux_2_17 glibc floor at release time #6, spec 003): release builds assert the manylinux_2_17 glibc floor;
  a binary that references a GLIBC_x.y symbol above 2.17 fails the release. This
  guard is tag-gated, so v0.3.0 is its first live firing.
• Fixed (fix: harden verify cores, exit-code contract, and release pipeline #5): hardened the verify cores, the exit-code contract, and the
  release pipeline.

Release mechanics

• Version bumped in lockstep across Cargo.toml (workspace + internal dep pins),
  npm/package.json (main + five platform optionalDependencies), and
  py/pyproject.toml; Cargo.lock regenerated. Both publish-time version-lock
  checks (npm --write-main, py --lock-only) verify at 0.3.0.
• New CHANGELOG.md carries the breaking-change migration note so pinned tenants
  are not surprised by the exit-code flip.
• .derived/codebase-index/by-package/tenant-tail.json regenerated by the pinned
  spec-spine (npm package version 0.2.0 → 0.3.0).

Verified locally

cargo fmt --check · clippy -D warnings --locked · build --locked ·
test --locked (8 suites, 132 tests, 0 failures) · spec-spine compile /
index check / lint --fail-on-warn all green.

Spec-Drift-Waiver: Cargo.toml, npm/package.json, py/pyproject.toml release version bump to 0.3.0; a version-number change with no behavioral or spec-content change (the shipped behaviors were authored and spec-coupled in #5, #6, and #7). Mirrors the accepted v0.2.0 release waiver in #4.

[github-actions]

AI Code Review

I have enough context. Here is the review:

---

Review: v0.3.0 Release PR

This PR is a mechanical release: version bumps across four manifests, a new CHANGELOG, and the regenerated npm package shard in .derived/. The functional changes shipped in PRs #5–#7.

---

Spec-spine Compliance

Missing CHANGELOG.md in the spec corpus

CHANGELOG.md is not establishes-d or references-d by any spec. The file is new and sits at the repo root, which is in spec 000-tenant-tail-bootstrap's territory (the workspace). If the coupling gate runs against this diff, it will flag the unclaimed file. Either add a references entry to 000-tenant-tail-bootstrap/spec.md, or add CHANGELOG.md to that spec's establishes list.

--sbom-dir attribution in 0.2.0 entry vs. CLAUDE.md wording

The CHANGELOG 0.2.0 entry attributes --sbom-dir to "OAP spec 203 FR-003". CLAUDE.md currently says "verify-sbom -- deliberately absent, not stubbed. Its core (OAP spec 203) does not exist yet." However, specs/003-distribution/spec.md §2 explicitly reconciles this ("--sbom-dir... folds the SBOM binding check into the certificate verify rather than a separate verb"), so the implementation is correct and the spec is correct. The gap is in CLAUDE.md, which says "OAP spec 203 does not exist yet" without clarifying that FR-003 is partially implemented through --sbom-dir. CLAUDE.md is misleading to future contributors; it should be updated to match the spec.

Derived shard completeness

Only .derived/codebase-index/by-package/tenant-tail.json changed. The spec-registry shards (by-spec/001-*.json, by-spec/003-*.json) and codebase-index spec shards are unchanged. This is correct for this PR — the spec and code files themselves didn't change here. Confirming that the coupling gate was satisfied in PRs #7 and #6 (where the actual code changed) is outside this diff's scope, but the determinism CI job will catch any shard divergence.

---

Bugs / Logic

CHANGELOG links use unverified org name

[0.3.0]: https://github.com/stagecraft-ing/tenant-tail/compare/v0.2.0...v0.3.0

The org stagecraft-ing is only mentioned here and not derivable from the codebase. If the actual repo is under a different org (e.g. stagecraft-eng), all three compare/release links are broken. Verify before tagging.

Semver claim vs. npm range semantics

The CHANGELOG correctly notes ~0.2/^0.2 consumers won't cross this boundary. However, since 0.3.0 is a breaking change under 0.x semver, it could have been a 0.3.0 major bump (minor bump under 0.x is the convention used here and stated explicitly). This is intentional and documented, no action needed — just noting it's a judgment call.

---

Security

No new network surface, signing keys, or user-controlled input paths introduced in this diff. The version bump itself carries no security concerns.

---

Performance

Not applicable to this diff.

---

Summary

One actionable issue: CHANGELOG.md is unclaimed by any spec and will trip the coupling gate. The CLAUDE.md wording about "OAP spec 203 does not exist yet" should be updated to avoid confusing future contributors. The GitHub org name in the compare links should be confirmed before the tag is pushed.

---

Automated review by Claude. Diff size: 78 lines.