chore(release): prepare v0.4.0

CHANGELOG.md

@@ -4,6 +4,8 @@ All notable changes follow Keep a Changelog and Semantic Versioning.
 
 ## [Unreleased]
 
+## [0.4.0] - 2026-09-14
+
 ### Added
 
 - Add source-only documentation guidance, a digest-pinned writing procedure, a
@@ -32,6 +34,8 @@ All notable changes follow Keep a Changelog and Semantic Versioning.
 - Keep reusable migration knowledge separate from repository-owned acceptance
   and verification. Playbook corrections require a separate reviewed change and
   cannot recertify the run that discovered them.
+- Refresh the exact zod, Node type, and TypeScript ESLint dependency pins, with
+  regenerated schema snapshots where zod's JSON Schema output changed.
 
 ## [0.3.2] - 2026-09-09
 

README.md

@@ -12,15 +12,15 @@ candidate. A separate read-only pass reviews that exact commit. Only the
 attended shipper can use your GitHub identity. Draft-only is the default;
 repositories may explicitly enable a separately approved, exact-plan merge.
 
-Mill `0.3.2` is the current qualified public alpha and latest release on
-[GitHub](https://github.com/davidahmann/mill/releases/tag/v0.3.2) and npm. It
-adds bounded integration-adaptation evidence while retaining the preserved
-artifact, provenance, SBOM, independent qualification, and registry/GitHub
-readback required by the release path. GitHub's Latest label does not expand the
-public-alpha support limits. See the [release record](docs/releases/v0.3.2.md)
-for exact evidence and recovery history. The `v0.1.5` genesis release remains
-the historical trust root; the `v0.2.0` tag remains preserved prepublication
-evidence.
+Mill `0.4.0` is the current qualified public alpha and latest release on
+[GitHub](https://github.com/davidahmann/mill/releases/tag/v0.4.0) and npm. It
+adds repository-owned playbooks, read-only run timelines and outcomes, and
+generic development-readiness controls. The preserved artifact, provenance,
+SBOM, independent qualification, and registry/GitHub readback remain required by
+the release path. GitHub's Latest label does not expand the public-alpha support
+limits. See the [release record](docs/releases/v0.4.0.md) for exact evidence and
+recovery history. The `v0.1.5` genesis release remains the historical trust
+root; the `v0.2.0` tag remains preserved prepublication evidence.
 
 ## Why Mill
 
@@ -82,7 +82,7 @@ For its one qualified shape, Mill can:
     specification in this alpha. The operator supplies the structured proposal
     that Mill assesses and freezes.
 
-## Repository playbooks, run timelines and outcomes (unreleased source)
+## Repository playbooks, run timelines and outcomes
 
 The source branch can index small repository-owned playbooks, search compact
 metadata, and bind a selected set into a task's frozen context. A playbook can
@@ -104,9 +104,9 @@ when present. It reports owner acceptance as `not_recorded`; checks, review and
 delivery cannot certify that decision. Invalid, stale or cross-candidate records
 block the projection. See [run outcomes](docs/run-outcome.md).
 
-These source capabilities are not part of the current public-alpha support claim
-or the published `0.3.2` package until they receive their own qualification and
-release.
+These capabilities are included in `0.4.0`, but they are outside the qualified
+public-alpha support claim until separately qualified. They do not grant a
+builder authority to change acceptance criteria, deliver, merge, or release.
 
 The source also contains a constrained pnpm workspace preparation path. It binds
 the pnpm version, lockfile, workspace declaration, and direct workspace package
@@ -140,7 +140,7 @@ Install the qualified public alpha at its exact version with lifecycle scripts
 disabled:
 
 ```sh
-npm install --save-dev --ignore-scripts @davidahmann/mill@0.3.2
+npm install --save-dev --ignore-scripts @davidahmann/mill@0.4.0
 npx --no-install millctl --version
 ```
 
@@ -157,7 +157,7 @@ PATH="$node_bin_dir:$PATH" "$node_bin_dir/npm" run build
 node dist/cli.js --version
 ```
 
-The `alpha` and `latest` npm tags both resolve to `0.3.2`. Downstream
+The `alpha` and `latest` npm tags both resolve to `0.4.0`. Downstream
 repositories should still pin the exact version so a later release cannot alter
 their delivery machinery implicitly. Updating an existing Mill installation is
 deliberate: preserve state and repository snapshots, inspect the release notes,

docs/releases/v0.4.0.md

@@ -0,0 +1,38 @@
+# Mill v0.4.0
+
+`0.4.0` is a public-alpha minor release. It adds repository-owned playbooks,
+read-only run timelines and outcomes, and generic development-readiness controls
+for documentation and routine dependency maintenance.
+
+Playbooks can retain small, digest-bound operational procedures. A task still
+owns its acceptance criteria and native checks. Run timelines and outcomes
+project bounded, schema-checked lifecycle facts without exposing event payloads
+or claiming owner acceptance.
+
+The package also includes a constrained pnpm workspace preparation path and
+downstream Node/npm policy starters. The pnpm path is source-only and
+unqualified. It does not establish support for pnpm workspaces, native builds,
+or a broader application stack.
+
+## Install
+
+```sh
+npm install --save-dev --ignore-scripts @davidahmann/mill@0.4.0
+npx --no-install millctl --version
+```
+
+Pin the exact version. The npm `latest` channel is a distribution pointer, not
+an automatic-update instruction; an existing repository must deliberately
+requalify changed delivery machinery.
+
+## Release evidence
+
+The annotated tag is qualified through two independent builds, a preserved
+tarball, packed greenfield/adoption canaries, the pinned independent policy,
+protected npm OIDC publication, registry requalification, and GitHub asset
+readback. The normal GitHub Release carries the tarball, checksum, SBOM, and
+final evidence after those steps complete.
+
+The public-alpha limits remain unchanged. This release does not add a supported
+stack, grant autonomous merge or deployment authority, or establish customer or
+live-provider compatibility.

package.json

@@ -1,6 +1,6 @@
 {
   "name": "@davidahmann/mill",
-  "version": "0.3.2",
+  "version": "0.4.0",
   "description": "A local-first, repo-native software factory from approved product intent to reviewed draft PRs.",
   "license": "Apache-2.0",
   "author": "David Ahmann",

product/PLAN.md

@@ -1,7 +1,6 @@
 # Mill delivery plan
 
-Status: public-alpha scope complete; generic development-readiness increment
-active
+Status: public-alpha scope complete; generic development-readiness landed
 
 Owner: David Ahmann
 
@@ -28,13 +27,12 @@ synthetic provider-change fixture. It does not turn local evidence into customer
 acceptance, introduce provider monitoring or customer systems, or expand
 public-alpha support.
 
-The active source-only increment is
-[generic development readiness](development-readiness.md). It adds a narrow DCO
-exception for verified Dependabot commits, repository-owned documentation
-guidance, packaged downstream policy starters, and one constrained pnpm
-workspace preparation shape. It does not change branch protection, add a
-product-specific integration, claim Docker qualification, or expand the
-published support matrix.
+The [generic development-readiness](development-readiness.md) increment is
+landed. It adds a narrow DCO exception for verified Dependabot commits,
+repository-owned documentation guidance, packaged downstream policy starters,
+and one constrained pnpm workspace preparation shape. It does not change branch
+protection, add a product-specific integration, claim Docker qualification, or
+expand the published support matrix.
 
 1. **Foundation:** repository constitution, exact-version CLI, compact schemas,
    static source/repository inspection, native CI, and security/release design.

product/impacts/RELEASE_V0_4_0.yaml

@@ -0,0 +1,32 @@
+schemaVersion: "2"
+id: mill-release-v0.4.0
+status: approved
+approved_by: davidahmann
+approval_source: >-
+  Attended Codex conversation on 2026-09-14: “fastforward local main and now
+  lets do new release incl npm and docs update where needed”.
+source_base: 3311f30e907adaf59494899bb324b4db31efd6e2
+authority: product/release-v0.4.0.md
+affected_invariants:
+  - INV-HUMAN-AUTHORITY
+  - INV-EXACT-EVIDENCE
+  - INV-DOWNSTREAM-INDEPENDENT
+material_changes:
+  - Advances the immutable package identity to v0.4.0.
+  - Publishes the already reviewed playbook, timeline, outcome and generic
+    development-readiness capabilities without expanding the support matrix.
+  - Updates installation and release documentation to the new exact version.
+affected_surfaces:
+  - package and CLI version identity
+  - public README, changelog, release record, product plan and task closure
+  - exact release record, npm environment admission, and public distribution
+verification:
+  - native check, exact-candidate audit, complete-diff review, and green PR
+  - annotated-tag identity and two independent candidate builds
+  - independent policy, registry-package, npm provenance, and GitHub-asset
+    readback
+exceptions:
+  - This attended maintainer release may merge, create and push the annotated
+    v0.4.0 tag, add its exact npm-environment rule, publish one preserved
+    artifact, create the normal GitHub Release, and promote only its alpha and
+    latest npm dist-tags as specified in its authority record.

product/release-v0.4.0.md

@@ -0,0 +1,28 @@
+# v0.4.0 attended release authority
+
+## Authorization
+
+David Ahmann authorized this release in the attended Codex conversation on
+2026-09-14: “fastforward local main and now lets do new release incl npm and
+docs update where needed”.
+
+The authorization covers the exact `v0.4.0` public-alpha release from the
+reviewed current-main candidate: version and documentation updates; the exact
+GitHub `npm` environment tag rule; an annotated tag; candidate and protected
+publish workflows; one preserved npm artifact; the normal GitHub Release; npm
+`alpha` and `latest`; and provider readback.
+
+It does not authorize a wildcard, bypass, weaker trusted publishing, a change to
+prior tags, releases or packages, or a broader public support claim.
+
+## Scope and stop conditions
+
+The candidate ships the generic development-readiness and already merged
+playbook, timeline and outcome capabilities through the existing independently
+qualified release path. Historical tags, published package versions, release
+records, and provider evidence remain immutable.
+
+Stop before publication if the candidate tag, source tree, preserved artifact,
+candidate run, qualification, npm provenance, registry readback, or GitHub asset
+identity differs. A failed candidate or ambiguous external effect requires a new
+reviewed version; it never permits retagging or republishing.

product/tasks/DEVELOPMENT_READINESS.yaml

@@ -1,6 +1,6 @@
 schemaVersion: "2"
 task_id: mill-development-readiness
-status: approved
+status: closed
 owner: davidahmann
 base_commit: b41dea8d41753fdc0c5f10c3032344aef8273417
 execution_mode: approved_native_maintainer
@@ -42,3 +42,18 @@ constraints:
 stop_conditions:
   - ambiguous authority, secret disclosure or unavailable mandatory gate
   - recurring same-subsystem P0 or P1 finding
+closure:
+  status: completed
+  owner: attended_maintainer_not_builder
+  recorded_at: 2026-09-14
+  implementation_merges: [13a9178, 7face17, 3311f30]
+  disposition: >-
+    The generic controls, regression coverage, documentation and packed policy
+    starters merged through reviewed pull requests. The source-only pnpm path
+    remains unqualified, and no downstream setting, customer system or release
+    was changed by this implementation increment.
+  evidence:
+    - product/development-readiness.md
+    - https://github.com/davidahmann/mill/pull/43
+    - https://github.com/davidahmann/mill/pull/44
+    - https://github.com/davidahmann/mill/pull/45

product/tasks/RELEASE_V0_4_0.yaml

@@ -0,0 +1,48 @@
+schemaVersion: "2"
+task_id: mill-release-v0.4.0
+status: approved
+owner: davidahmann
+base_commit: 3311f30e907adaf59494899bb324b4db31efd6e2
+execution_mode: approved_native_maintainer
+authority: product/release-v0.4.0.md
+impact_manifest: product/impacts/RELEASE_V0_4_0.yaml
+objective: >-
+  Ship the exact v0.4.0 public-alpha artifact with current installation and
+  release documentation.
+allowed_paths:
+  - package.json
+  - package-lock.json
+  - src/version.ts
+  - README.md
+  - CHANGELOG.md
+  - docs/releases/v0.4.0.md
+  - product/PLAN.md
+  - product/development-readiness.md
+  - product/release-v0.4.0.md
+  - product/impacts/RELEASE_V0_4_0.yaml
+  - product/tasks/DEVELOPMENT_READINESS.yaml
+  - product/tasks/RELEASE_V0_4_0.yaml
+authority_preparation_paths:
+  - product/**
+  - docs/releases/**
+acceptance_items:
+  - R040-01 public installation and current-release documentation name v0.4.0
+  - R040-02 the package and CLI identify v0.4.0
+  - R040-03 the source-only pnpm boundary remains explicit in release material
+  - R040-04 native check, exact-candidate audit, complete review, and PR checks
+    pass
+  - R040-05 annotated tag, candidate, protected publication, readback, release,
+    and npm alpha/latest pointers all bind to the same preserved artifact
+validation_commands:
+  - npm run check
+  - node dist/cli.js --json --cwd . audit
+  - MILL_RELEASE_TAG=v0.4.0 node scripts/verify-release-tag.mjs
+required_reviews:
+  - read-only review of the complete committed Mill release-preparation diff
+constraints:
+  - single attended maintainer writer
+  - exact v0.4.0 environment-tag admission only; no wildcard or bypass
+  - preserve all historical tags, npm versions, releases, and evidence
+stop_conditions:
+  - ambiguous tag, tree, artifact, candidate-run, provenance, or provider effect
+  - unavailable independent verification or recurring P0/P1 release finding

src/version.ts

@@ -1,3 +1,3 @@
 export const MILL_PACKAGE = "@davidahmann/mill";
-export const MILL_VERSION = "0.3.2";
+export const MILL_VERSION = "0.4.0";
 export const RESULT_SCHEMA_VERSION = "1";