Tags give the ability to mark specific points in history as being important
-
v2.7.1
Release: reference v2.7.1ecc1a8df · ·reference v2.7.1 ### Changed - **An interactive data chart is not a plate, and an app page can link a lighter bundle.** The diagram conventions now say that a chart that resizes with its container or responds to input, such as a d3 chart on a slider, conforms when its colors, type, stroke and dash come from the design tokens. The fixed viewBox, 4px grid, radii, plate scaffold and `retoken.py --check` apply to static plates, and a static chart is still one. An app page whose own classes collide with `chrome/docs/index.css` links only `chrome/docs/tokens.css` and `fonts/fonts.css`, pinned to a tag, in place of the full docs chrome. ### Fixed - **A link or code span that began a source line lost the space before it.** Astro 7 compresses whitespace by default, so `the` and a following `<a>` on the next line built as "thelink": 21 joins in the docs starter and 134 in the reference site. Both sites now set `compressHTML: true`, which keeps that whitespace at under 2% more HTML, and a `check:spacing` step at the end of `npm run build` fails the build if a word and an inline element ever touch again. - **`retoken.py --check` no longer raises `KeyError: 'cx'` on a shape that leaves out a coordinate.** A `<circle>` with `cy` and no `cx`, or a `<rect>` with no `x`, inside a group whose `translate` puts it off the 4px grid, crashed the grid check while it built its message. SVG reads a missing `cx`, `cy`, `x` or `y` as 0, and the check now does too, and reports the shape as a grid finding that says the coordinate is absent. - **A markdown table directly inside a disclosure fits the disclosure.** Since v2.7.0 it took the full width of the disclosure plus the disclosure's own indent, so it ran past the frame and, on a phone, widened the page. The disclosure now declares its indent once, as two custom properties, and the table takes the width left after both.
-
v2.7.0
Release: reference v2.7.0b0b0961a · ·reference v2.7.0 ### Added - **The diagram kit gains a `logbars` template: horizontal bars on a log scale.** It draws quantities that span orders of magnitude, such as artifact sizes from KB to GB, with labeled decade ticks, one bar per row and a value beside each bar. A bar is `112 * log10(value / min)` wide, rounded to the 4px grid, and the template passes `retoken.py --check` and the docs template's plate sanitizer with nothing removed. - **A docs landing page can drop the rail and use the whole shell.** `Layout` takes `landing` (frontmatter `landing: true` on a markdown page), which renders the page without the rail and adds `.page-landing` in `design/chrome/docs/wide.css`, so the content spans the 1400px of `.page-wide` instead of the 1048px beside the rail. The top nav still reaches every section, and a page that leaves `landing` off renders as it did. ### Changed - **The reference's prose no longer uses a double hyphen or an em-dash as a dash.** The authoring rules in AGENTS.md, the voice README and the lab template's AGENTS.md now ask for a rewrite with a comma, a colon, parentheses or two sentences, and the vale job's `NonStandardHyphens` rule is back on to flag a new em-dash. - **The docs and lab templates join page titles with a middle dot.** A tab title now reads `Page · Site` where it read the same two parts split by a double hyphen, and the reference's own site makes the same change. ### Fixed - **The reference's own site loads `clipboard.js` from its own build, like the stylesheet beside it.** The layout linked the script by an absolute, unversioned URL on the live site, so a page built from a branch ran the last deployed script, not its own. It now uses the same `BASE_URL` path as the Phosphor stylesheet, which needs no version and which `just sync` does not rewrite. - **The docs template's `content-path.svg` plate passes the diagram kit's `retoken.py --check`.** It is redrawn at width 960 on the kit's grid, ids, type stacks and accessible name, with rounded nodes and orthogonal connectors. It draws the same five boxes and four connectors, and the guide that shows it reads the same in the light and dark themes. - **A docs site reading another project leaves out that repository's root `hero.svg` instead of failing the build on it.** The hero a README opens with is brand art, not a diagram plate; every other standalone relative SVG on the page is still a plate and still stops the build if the sanitizer rejects it. - **The docs chrome wraps long URLs and tokens in prose and lists.** Links and inline code already broke where they would overflow; an unlinked URL in a paragraph, list item, blockquote or pattern row now does too, and tables keep their column widths. - **A markdown table in a docs chrome article spans the content column, as `standards-table` does.**
-
v2.6.0
Release: reference v2.6.0c78ef6eb · ·reference v2.6.0 ### Added - **The docs chrome gains a two-part callout, a pattern block and a terminal frame.** A callout with a `.callout-eyebrow` sets the label in a narrow column and the text beside it, and `.pattern` uses the same grid for a pattern's default, recommendation and reason; both stack at 560px. `.callout-note`, `.callout-warning` and `.callout-limit` take new status tints (`--info-subtle`, `--warning-subtle` and `--limit-subtle`, each the status colour mixed into transparent), `.term` frames a transcript, `.theme-toggle-text` styles a theme toggle as the words light and dark (named by its visible words, with `aria-pressed`), and `tokens.css` adds `--border-strong`, `--text-label`, `--track-label` and `--pad`. - **`applies_when_grep`, a content-keyed precondition gate: a standard applies where a file matching a glob also matches a regex.** `applies_when_file` keys on a file existing, so a standard gated on a declaration file skipped every project that never wrote one, which is the project it was for. Forced by `provenance`; it reads the same skip list and sets `$SUBJECT` the same way as `applies_when_file`, and `## Verify` names it as content-keyed. ### Changed - **The docs chrome sets every label in one mono-capitals tier and, on a wide page, one width runs down the page.** Eyebrows, rail headings, breadcrumbs, table heads and card labels share `--text-label` at `--track-label` (.14em), nav links keep their own .08em tracking, the header, shell and footer take their side gutter from `--pad`, and on a `page-wide` page the header and footer bars take the shell's 1400px so their left edge matches the rail. A non-wide page keeps the 960px cap on `.page-in-section`. - **The docs nav underlines the active page and the rail's active link is semibold.** The template's and the reference site's nav links carry `aria-current="page"`; the underline uses the link accent. - **`provenance` applies to a project whose pipeline signs, through `cosign sign` or the catalog's `binary`, `container-sign` or `container-manifest` component, instead of one carrying a `*.lock.toml`.** Every assertion reads only lines outside a comment, and the SBOM and SLSA assertions also accept the catalog components that produce them: `container-sbom`, `attest` and `container-attest`. No consumer carries a lock file, so the standard skipped all twelve that sign; at each one's `main` six now pass and six fail, and none of the twelve runs these checks in CI, so no merge is held. - **`posture-claims` takes an optional `branch_evidence:` per claim, which the verifier reads in place of `evidence:` on a pipeline without a tag.** A branch pipeline builds no release, so a claim whose evidence is a release file failed there every time; a claim without `branch_evidence:` now reports `SKIP` off a tag and runs against `evidence:` on one. The template also installs `gettext-envsubst`, because `alpine:3.20` ships no `envsubst` and every evidence URL expanded to an empty string. - **The `posture-claims` verifier template is two jobs: `posture-verify` on a tag keeps `posture-report.txt` forever, and `posture-verify-branch` on a merge request or a default-branch push keeps it a week.** The release page links the tag job's report, and GitLab sets artifact expiry per job, not per rule, so one job could not keep the release's report without keeping every merge request's too. Both extend `.posture-verify`, which runs in a `verify` stage the including pipeline must declare. ### Removed - **The design bundle no longer renders mermaid.** `js/mermaid-init.js`, the `.mermaid` rules and the vendored renderer are gone, and sites draw diagrams as SVG with the kit in `design/diagrams/`. The `.mermaid-card` styles stay in the lab chrome for the sites that already wrap SVG diagrams in them, and a page pinned to v2.5.0 or earlier still loads `mermaid-init.js` from its pinned path. ### Fixed - **The `pipeline` component index says it lists what the catalog carries, not what a project must include.** Its "Use when" column reads "Every container-shipping project" and "Projects publishing images", so a consumer could take `registry-cleanup` as required, while the standard's check asserts no component. A standard's Verify section, not the index, says what that standard requires. - **`provenance` accepts the spellings its own rule names: `SLSA`, `CycloneDX`, `SBOM`, `SPDX` and `in-toto`.** The patterns took only the lowercase and capitalised forms of `slsa`, `cyclonedx`, `sbom`, `spdx` and `intoto`, so a pipeline describing its "SLSA v1.0" attestation failed. - **Docs chrome links break inside a long URL instead of running past a narrow column.** A URL that is its own link text is one word to the line breaker, so at 390px `/standards/agents-md/` scrolled sideways to 445px on one bare-URL link. Links now take `overflow-wrap: break-word`, as inline code does, which breaks only a word that would overflow and leaves wider layouts unchanged.
-
v2.5.0
Release: reference v2.5.074a66402 · ·reference v2.5.0 ### Added - **The docs chrome gains a pager and an "On this page" rail group.** `design/patterns/pagination.css` styles `nav.page-pager`, previous and next at the foot of a page, and `design/chrome/docs/rail.css` styles `.section-sidebar-toc`, the current page's sections listed last in the section sidebar, and shows a sidebar wrapped in `details.disclosure` with that disclosure's summary and frame only where the sidebar stacks above the page. Both import from `design/chrome/docs/index.css` and add classes only, so a page that adopts neither renders unchanged. - **Every docs template page carries the rail, a pager and the wide shell.** The home page gets the rail too, every page ends it with an "On this page" group built from its headings, the whole rail folds into a closed "On this page" disclosure on a phone, and the new `Pager` component follows the order `nav.ts` lists. The Layout applies `page-wide` by default (`wide={false}` opts out) and loads `design/js/anchors.js`, so a link into a closed disclosure opens it. - **The docs template renders markdown pages from an Astro content collection, kept in the site or read from another GitLab project, and a page can stay plain GitLab markdown.** The example reads `src/content/guides/` with `localMarkdown()`, and `src/lib/gitlab-repository.ts` takes the same patterns, gives the same ids, and reads another project at a tag or full commit SHA, failing the build on a branch name, an unknown ref or a missing file; both take a page's first level-one heading as its title when the frontmatter has none, turn a relative link to another page's `.md` file into that page's route, and stop on a page with no title; any other relative link on a page from another project opens the file on GitLab at the pinned commit, while on a local page a `.md` link outside the collection stops the build. Local markdown is trusted like the site's code; markdown read from another project has its raw HTML sanitized after its links are rewritten, and its build needs network access to that project's host. - **A `Plate` component inlines an SVG figure, local or fetched, into the docs template's `diagram-frame`, and so does a relative `.svg` image standing alone in a markdown paragraph.** It sets the figcaption and the accessible name, from the alt text for a markdown image, so `var(--token)` colors follow the page and its theme where an `<img>` could not, and gives the SVG its `viewBox` width as `--diagram-width` and the figure `tabindex="0"`, so a frame that scrolls on a phone keeps the drawing at its authored width and is reachable. The build stops, naming what it found and, for a markdown image, the page, on a plate with no usable `viewBox` or caption, on one that carries script, an event handler, a `<style>` element, a `<foreignObject>` or a reference outside the file, and on a relative image in markdown from another project that does not become a plate, which the site could not serve. - **A `Disclosure` component ships the markup `disclosure.css` styles, with an example page in the docs template.** `<Disclosure>` renders `details.disclosure` with a stable id from its summary, taking `-2`, `-3` when the page already has it, as the Layout's heading ids now do. The new Build failures reference page holds one closed row per content-path build message, and the markdown guide links into one to show a fragment link opening it. - **`compliance/unified.yaml` carries `encryption-inherited`, a control for an image whose only cryptography is the module its base image ships.** The `encryption` row claims a variant the project builds against a validated module, and the `fips-validated-crypto` example in `posture-claims` reads the same way, so such an image had no claim it could make without overclaiming. The new row claims the module, never the image, on the two conditions `SECURITY.md#fips` states, the provider build the image carries against the build the certificate lists and FIPS mode on the host kernel, and stays `planned` until a project carries that evidence. - **`design/diagrams/` becomes a diagram kit: a method, conventions, eight SVG templates and a re-token tool.** Sites draw diagrams 960 wide as SVG on the docs chrome tokens; the flowchart, process, timeline, architecture, sequence, train, layers and state templates pass the docs template's plate sanitizer with nothing removed, `retoken.py` moves an existing SVG onto the tokens and names every color it cannot map, and its `--check` fails a plate on every convention a script can test, from the accessible name and the background to the 4px grid, the strokes and the type. The method adapts Cathryn Lavery's diagram-design, which is MIT licensed rather than unlicensed as the README, the design brief and the diagrams page said, and its notice is kept in `design/diagrams/NOTICE`. ### Changed - **`provenance` verifies a release file offline against one `trusted_root.json`, not a copied `~/.sigstore/root/`.** The copied TUF cache stops working once its metadata expires, and cosign accepts `--trusted-root` only with the new bundle format, so the enclave verifies the `attest` component's `<binary>.sigstore.json`, whose subject is the binary's digest, and the legacy `<binary>.bundle` is checked before transfer. The section sets cosign 2.6.5 or later for GHSA-fx35-mq7g-6g98, names the exact `@refs/tags/vX.Y.Z` signer identity in place of a regular expression, and drops the `include_sigstore_trust_bundle` input, which `extra-assets` has never had. - **The docs chrome's figure frame scrolls a wide diagram sideways below 900px instead of shrinking it.** The SVG keeps its authored width there, up to 960px, so a 960-wide plate's smallest label stays at 11px on a 390px screen, where it shrank to 3.6px; above 900px the frame renders as before. A frame takes `tabindex="0"` and its caption as its name so a keyboard can reach and scroll it, and the content column now holds its width instead of growing with a wide child. - **The docs template's figure rule says a token color with a CSS fallback conforms.** `fill="var(--accent, #fc6d26)"` is a token color, because the page's token wins and the hex renders only where no token is defined, as the template's own architecture figure already writes it. A bare hex outside `var()` does not conform. - **`agents-md` requires `AGENTS.md` alone, and `CLAUDE.md` is optional.** The check no longer asserts `CLAUDE.md`, and the standard, its template, the `docs`, `lab` and `paper` starters and this repository drop the one-line `@AGENTS.md` file, because Claude Code v2.1.277 and later reads `AGENTS.md` directly. A project that keeps a `CLAUDE.md` for an older client makes it the single line `@AGENTS.md`, since a `CLAUDE.md` takes precedence over `AGENTS.md`. - **The AI-disclosure convention is one trailer, `AI-Assisted: yes`, and `AI-Tools:` is optional.** The `contributing` check no longer asserts `AI-Tools:`, and the default drops the tool name in this repository's CONTRIBUTING.md, in every CONTRIBUTING.md template, in the `agents-md` template, and in the merge request template. Nothing is required of a consumer: existing commits are not rewritten, and a project can drop the `AI-Tools:` line the next time it touches its CONTRIBUTING.md. ### Fixed - **A long line in a docs code block scrolls inside the block instead of widening the page.** The sidebar layout's content column took its grid track's content width, so one wide `pre` pushed the column, and the page, past the viewport; it now shrinks to the track. A disclosure opened by a fragment link also lands below the sticky header rather than under it. - **A fragment link scrolls at once, not smoothly, for a reader who prefers reduced motion.** `design/js/anchors.js` now passes `behavior: 'auto'` when `prefers-reduced-motion: reduce` matches, as `design/tokens/motion.css` already does for transitions. - **The docs chrome fits a narrow screen.** At 720px and below the header nav takes a row of its own and the header scrolls away, and a table wider than its column scrolls inside its own box; from 721px to 1151px a nav too long for its row scrolls sideways inside the sticky header and fades at the edge that hides links, and a long inline `code` string wraps instead of widening the page. Headings, `details` and `figure` with an `id` take their `scroll-margin-top` from a new `--header-h` token so an anchor jump lands below the header, and none of the reference's 61 pages or the docs template's 7 is wider than the viewport at any width measured from 390px to 1280px. - **The `pipeline` standard's component index lists the 24 components catalog v6.4.1 ships.** It omitted nine, `container-sign` among them, so an image built from the index had no signing step, and it listed `build-container-buildah`, which catalog v4.0.0 retired. The `binary` row named a `fips_features` input the catalog has never had; a FIPS variant comes from the builder image, and the `container`, `verify`, `extra-assets` and `container-scan-summary` rows now say what those components do. - **A docs template markdown page named `README.md` or `index.md` renders at its directory, as GitLab shows it there.** A root README routed to `readme/` and a link to it, with or without a fragment, followed, so a collection served at `/` could not make its README the home page; `pagePath()` and `pageRoutes()` now give both loaders and the `[...slug]` route the directory. Two files at one route, such as `x.md` beside `x/README.md`, stop the build naming both, and so do two local files with one id, as two from another project already did. - **The docs describe the template and the site as the Astro they build with, and the template as having no Starlight.** Prose across the repository said Astro 6 while both `package.json` files require `^7.0.0`, and `ARCHITECTURE.md` called the docs template an Astro + Starlight site. The docs name no Astro major now, so `package.json` stays the one place that sets it; the template's own `AGENTS.md` and `README.md` also stop naming a `styles/global.css` it does not ship and a font CDN it does not use. -
v2.4.1
Release: reference v2.4.178645fa8 · ·reference v2.4.1 ### Fixed - **`just check` honours the `exemptions:` a project declares in `.reference.yaml`.** A failing assertion an entry covers now prints `EXEMPT` instead of `FAIL`, with the entry's reason, and counts as exempt in each standard's `SUMMARY` and the run's `TOTAL`; through v2.4.0 nothing read the list, so an exempted standard still failed the run. An entry that covers no failure prints a `NOTE` and passes, and an entry naming an unknown standard, or a list the checker cannot read, stops the run with exit 2.
-
v2.4.0
Release: reference v2.4.0e98affb5 · ·reference v2.4.0 ### Added - **`pipeline` asserts that a `needs:` entry naming a job the file does not itself define carries `optional: true`.** Such a job can only come from an include, and the include's `rules:` decide whether it exists on a given pipeline source; without `optional: true` pipeline creation fails outright on any source the include's rules do not cover. The new `check_needs_optional` primitive parses both the bare-string and mapping forms of `needs:`. - **`design/chrome/docs/wide.css` (34 lines) and `design/chrome/docs/disclosure.css` (100 lines) join the docs chrome, both opt-in.** `.page-wide` raises the docs shell from 1280px to 1400px and lifts the 960px content-column cap; the disclosure styling covers native `<details>` markup. Both import at `design/chrome/docs/index.css:19-20` and style no bare element, so a consumer that adopts neither renders unchanged. ### Fixed - **The mermaid renderer is vendored into `design/vendor/mermaid/`, replacing a `cdn.jsdelivr.net` load.** `mermaid@11.17.2`, 3.4 MB, with the upstream MIT license verbatim beside it and a refresh procedure in `design/vendor/mermaid/README.md`. `vendor/` is absent from `sync-design-assets`'s paths, so the published design bundle is byte-identical. - **Every place the repo told a consumer to load mermaid from a CDN now names a project-local copy.** The showcase's Quick start snippet, the lab template page's `<head>` listing, and `design/js/mermaid-init.js`'s usage comment each taught the host design principle 7 forbids. The lab template page also drops a mermaid line its own template has not carried.
-
v2.3.0
Release: reference v2.3.065b7d6c7 · ·reference v2.3.0 ### Added - **The Phosphor duotone icon font is vendored into `design/icons/phosphor/`.** Three files from the `@phosphor-icons/web@2.1.1` npm tarball, 397 KB together, with the upstream MIT license verbatim beside the stylesheet and a refresh procedure in `design/icons/README.md`. The `@font-face` names the one `woff2`; every class rule is byte-identical to upstream. - **The design bundle is published under each release tag, at `design/<tag>/`, alongside the unversioned latest.** `just sync-design-assets` emits one snapshot per released tag at or after v1.3.0, the release that self-hosted the fonts. Publication and pruning policy sits beside the airgap recipe in `standards/design/SKILL.md`: at eight tags, pruning leaves the current major and the one before it. - **`--status-attention` and `--status-alert` join the docs chrome tokens, light and dark.** Attention is a check that could not tell, alert is a check that told us something is wrong, and anything rendering either used to hardcode its own amber and red. The dark variants hold the hue and lift the lightness into the band the three existing status tokens occupy. - **`upkeep` requires the heartbeat be published and the citations pinned.** Clause 3 now asks for both the `when: always` emission and a `pipeline/freshness-heartbeat` include in a stage before the deploy, and states the week-long lag a fresh heartbeat carries. A sixth clause names `.gitlab/freshness.lock.json`, written by `check-freshness pin` at the archive of the stamped release, so a released stamp drifts only when a release lands and the finding names the cited pages that changed in it. - **`design` asserts that a page does not fetch from unpkg, jsdelivr or Google Fonts.** Only the presence of the first-party link was ever asserted, so a page linking both passed. The assertion needed a tree-wide negative, so `check_grep_absent` joins the closed primitive set beside `check_grep`, forced by `standards/design`. ### Changed - **Design principle 7 is scoped to any published page, markup included, not to "any CSS rule".** A `<link>` in a Layout's `<head>` is not a CSS rule, which is how every chrome family in the estate came to load its icon font from a host the principle names as its own forbidden example. The first-party carve-out for the reference's Pages origin is unchanged. - **Both project templates link every design asset by tag, and `just sync` keeps them current.** `sync-versions.sh` repins the versioned URLs from `VERSION` and `validate-versions.sh` reports a template left behind, so a newly-stamped project never starts a release out of date. The unversioned path stays supported and stays the documented default. ### Fixed - **Nothing in the repository fetches Phosphor from unpkg any more, the reference's own production site included.** Both templates and `site/src/layouts/Layout.astro` carried the unpkg stylesheet, so a reader behind an egress filter got a page with no icons. `sync-design-assets` also publishes `design/icons`, without which the vendored font would not reach Pages at all.
-
v2.2.0
Release: reference v2.2.0502afa5c · ·reference v2.2.0 ### Changed - **Catalog component pins are the major, `@6`, so a patch to a component reaches its consumers without an edit in each one.** Minors and patches resolve to the newest matching catalog release at pipeline time; a major bump is the deliberate edit, read against the catalog CHANGELOG's breaking section before the pin moves. Sixteen includes across eight files, plus the paper template's `@~latest`, which was the last floating catalog ref in the tree and the only one that floated across majors. `reference_version` is untouched and stays full semver: the reference is not a catalog resource, so nothing resolves a partial there. - **The `pipeline` standard asks for the major rather than tolerating it.** The rule text is "pin the catalog major (`@6`)" with the reason beside it, and `check.sh` asserts the resolver's own grammar: a bare partial (`@6`, `@6.2`) or a full tag with or without the `v` (`@6.2.2`, `@v6.2.2`). A full pin still passes, for migration rather than as a second recommended form. The assertion also now fails `@v6` and `@v6.2`, which look like pins and resolve to nothing, so a consumer that writes one learns it from the check instead of from a pipeline that cannot start. - **`CATALOG-VERSION` holds the major (`6`), and `just sync` and `just validate` read and write `@6`.** Both scripts match either pin shape, which is what keeps them live: a sync that saw only full pins would collapse them once and then never find a pin again, so the next major bump would propagate to nothing. The validator reads a leftover `@v6.3.0` as drift against the expected `@6`. `SKILL.md`'s catalog link moves from a frozen `/-/tree/<tag>` URL to the project, because a `@6` consumer runs whichever `6.*.*` is newest and a pinned tree link names a version nobody is on. ### Fixed - **The `workspaces-airgap` design example links to the project's new home in `field-notes`.** After the move, all 32 links on `design/examples/workspaces-airgap.html` reached it only through GitLab's redirect; they now name `field-notes/workspaces-airgap` directly.
-
v2.1.0
Release: reference v2.1.02ee5c4cc · ·reference v2.1.0 ### Added - **`upkeep`, a Conditional advisory standard for exhibits that render dated claims about GitLab.** A conforming project declares how its claims go stale in `.gitlab/freshness.yaml`, includes the `pipeline/freshness` tripwire on a weekly schedule, publishes a `freshness.json` heartbeat `when: always`, and links a re-derivation procedure from a README `Maintenance` section. The check asserts the manifest keys, the include, the heading and the link; `unasserted:` names what the closed primitive set cannot reach. - **The catalog pin moves from `v5.0.0` to `v6.3.0`, the release that ships `pipeline/freshness`.** `just sync` propagates it to every include in the repository. Nothing in the `v5.0.0` to `v6.2.2` range changes an input contract on a component the reference includes. - **The tripwire cannot withhold a deploy, which is a different property from never going red.** Exit 1 (a newer release at the declared cadence, a read date past `stale_after_days`, or a citation that returns 404 or 410 or redirects off its host) is red by design, and exit 2 (the check could not see) is the allowed one. Placement keeps it off the critical path: a stage after the deploy, and rules that fire only on scheduled and manually started pipelines.
-
v2.0.0
Release: reference v2.0.06f52f36a · ·reference v2.0.0 ### Changed - **Every enforcement claim now describes what the code does.** `standards/registry.yaml` is the single source for the Mandatory and Conditional split; `renovate`, `pipeline` and `agents-md` move to the group their own `check.sh` puts them in. Nothing here runs `just check` against a consumer's merge request. - **Chrome is chosen by what a page is for, not by page count or build tooling.** Documentation renders with `chrome/docs/`, and an evidence record (a lab notebook, an ADR, a proving-ground result) renders with `chrome/lab/`. ### Removed - **The start surface is one page with one first move, and `/start/adopt/` is gone.** Its body now opens `/start/`, where the bundle URL is the page's first content, followed by the agent-flow figure, the harness list, and one-line pointers to the pipeline standard and the templates. The consumption-tier table and the home page's capability card grid leave with it, so a reader meets the lede, the architecture diagram, and the one instruction. - **`README.md` states the same first move the site states.** `## How to use it` opens with the bundle URL and names `AGENTS.md` in the checkout sentence below it; `## Adoption` is deleted, having pointed at a `/fleet/` page the site does not publish. `## Start a new project` is unchanged. - **An exemption is now `standard` + `reason` and means one thing: the standard does not apply to this project.** `until`, `owner` and `resolution` leave the schema and `scripts/audit-expiry.sh` is deleted, so a gap the project means to close is an issue rather than a dated entry, which `standards/conformance-config/SKILL.md` states. The next release is v2.0.0, because removing declared schema keys is a MAJOR change. - **`applicable_standards` and `adoption_phase` are removed from the schema, so `.reference.yaml` is one required scalar plus the exemptions list.** Severity comes from the standard's tier: a blocking-tier FAIL exits non-zero, an advisory-tier finding does not. No field declares it and no project chooses it. - **The reference's second exemption register is deleted, along with the only script that read it.** `compliance/exemptions.yaml` and `scripts/check-with-exemptions.sh` are gone, and the reference's own `.reference.yaml` is the one register, read by `just check` the way every consumer's is. `just check-self` and the `self-conformance` CI job run `just check` against this repository. - **A template nothing referenced and nothing rendered leaves `standards/design/`.** `single-file-site.html` pointed at design paths that had lost their `/design/` segment, loaded mermaid from a third-party CDN the design principles forbid, and named classes no chrome ships. `astro-imports.ts` stays. - **`check_toml_key` leaves the closed primitive set, which is now ten primitives.** No `check.sh` called it, and `_lib.sh` holds that a primitive whose coverage never grew past one call site is vocabulary without leverage. `just guard` reports the set's size. ### Added - **`/doctrine/groundskeeper/`, and a `Doctrine` section to hold it.** The version-independent reasoning for sustaining a standing demonstration estate: what decays and on which clock, the no-backdating constraint and the two verbs it leaves, the one-engine-many-estates architecture, plan before apply with its exit taxonomy, the guardrails, and the order an estate adopts it in. Four inline-SVG diagrams carry the two verbs on a timeline, the decay-mode-to-surface map, the catalog-to-estate boundary and one upkeep cycle; the page states its own dividing test, so engine field names and keeper vocabulary stay in the component's documentation, which it links without pinning a version. ### Fixed - **Three nav pages were absent from the agent surface's discovery array and are now registered.** `principles/timelessness`, `design/diagrams` and `design/authoring` render on the site and appear in the sidebar, but the hand-maintained `STATIC_PAGES` array in `site/integrations/llms-txt.ts` did not list them, so `/llms-full.txt` omitted their prose and no `/<route>/index.md` was emitted for them. The matching `/llms.txt` link-index entries land with them, so the two surfaces agree. - **`just validate` now fails when the sidebar nav and the agent surface disagree about which pages exist.** `just validate-agent-surface` compares every page route in `site/src/lib/sections.ts` against the `STATIC_PAGES` array in `site/integrations/llms-txt.ts` in both directions, exempting only the standards pages the integration emits from `SKILL.md`. It parses the two modules with a bracket-balanced scanner that refuses shapes it does not model rather than skipping them, `--selftest` holds that refusal to seventeen fixture cases on every run, and the script's header records why both directions exit non-zero. - **`just check REPO=.` exits 0 on a conformant repository.** `check` and `check-one` resolve `REPO` to an absolute path before the per-standard `cd`, so a relative path no longer resolves against the standard's own directory. A path that is not a directory is refused by name. - **`renovate` reads the config its own gate found.** `applies_when_file` publishes the matched path as `$SUBJECT` and the assertions read it, taking the shallowest match so the choice does not depend on traversal order. Describe mode publishes the declared glob, so `## Verify` is machine-independent. - **`check_json_key` FAILs an absent subject file instead of SKIPping it.** A missing subject file is not inapplicability: the standard applies and has failed, which is the rule `require_file` already states. Scoping a standard stays `applies_when_file`'s job, at the top of `check.sh`. - **Three `presentation` assertions reported the estate's own conventions as defects.** The H1 rule bans the punctuation a tagline or a path arrives as, not capitals and spaces; the hero embed accepts any alt text. The tagline is a short-form and expanded-form pair, not one phrase. - **Two `presentation` surfaces cited standards that no longer exist.** `templates/README-footer.md` credits this standard for the footer assertion, and the badge-row section drops its link to `../naming`, a path that stopped resolving when `naming` converged here. - **The lab starter uses the classes its chrome ships.** `templates/lab/site/index.html` carried three names absent from `chrome/lab/`: `skip-link` for `.skip`, `diagram-frame` from `chrome/docs/`, and `evidence-body` for `details.evidence > .body`. A class a starter names must exist in the chrome that starter loads. - **The lab starter's TL;DR block uses the shape its chrome documents.** `templates/lab/site/index.html` carried a `.tldr-eyebrow` paragraph and a bare list, neither of which `chrome/lab/tldr.css` styles. Cells now flow inside `.tldr-grid`, each one an `h3` over a single `p`. - **The patterns layer no longer plans a figure frame that already ships.** `design/patterns/README.md` and `design/DESIGN-LANGUAGE.md` listed `diagram-frame.css` among the patterns v0.2 authors, but `.diagram-frame` lives in `chrome/docs/chrome.css`. A pattern never re-authors a chrome component. - **The design language no longer says the sidenote pattern is implemented.** `design/DESIGN-LANGUAGE.md` pointed at `patterns/sidenote.css`, a file `design/patterns/` does not hold. The bullet now says what the v0.2 plan list above it already says: the pattern is planned, not shipped.
-
v1.4.0
Release: reference v1.4.0457af000 · ·reference v1.4.0 ### Added - **`details.idx-group` in `design/patterns/disclosure-index.css`, the scanning layer above the rows.** A named group of index rows behind its own disclosure, its summary carrying a count, the group's name as a real heading, and one line on why to open it: the rows are not cut, they move one level down, which is THE MODEL the pattern already states applied one level up. The group carries `idx-group` alone and never `evidence` beside it, and the file's header records why before a maintainer reaches for the shorter selector; frame and metrics match the lab chrome's evidence-step disclosure, so the first consumer, the offline-readiness notebook, drops its page-local `details.evidence.mech-group` rule and renders unchanged. - **A fourth ruling on `/design/authoring/`: items read as written today, and the changelog carries the history.** A record that corrects itself in place accumulates archaeology, the "an earlier version said X, that was wrong" passages that serve the author's conscience and cost every later reader. Every correction earns a dated changelog line so a withdrawal stays findable, compressed on the way in rather than relocated, and the page states the trap beside the rule: a correction note usually has a live finding inside it, so it is sorted sentence by sentence, world-facts rewritten positively in the item's own voice and editing-facts moved out. - **A fifth ruling on `/design/authoring/`: past roughly forty index rows, introduce a grouping layer and make the group the scanning unit.** The sharper form of root-orients-while-disclosures-carry, and it only arrives on a long page: the rows are not cut, they move one level down, and the `details.idx-group` primitive added above is the built shape. The corollary ships beside the rule because it is the tempting mistake, that a gist is how a reader decides what to open, so shrinking the gists to hit a number trades comprehension for a smaller measurement. ### Fixed - **The index row's name no longer renders smaller than its own gist.** `.idx > details.item > summary` in `design/patterns/disclosure-index.css` set `font-size: var(--text-sm)` where the frame it restates uses 0.9rem, and `.i-name` takes its size from the summary, so an item's name rendered a step smaller than the gist beside it and inverted the row's reading order. The file's header records why 0.9rem is the row's type size. - **The release page carries the version's CHANGELOG section, rather than the words `Release vX.Y.Z`.** The catalog release component passes the annotated tag body straight to the release page with no template of its own, so a tag built with `-m "Release $ref"` published a surface that said nothing while the notes for that version sat finished two files away. `scripts/release-notes.sh` now builds the body from that section and refuses the tag rather than ship a stub, `just validate-release-notes` catches an unextractable section on the merge request that wrote it, and both scripts carry the reasoning in their headers.
-
v1.3.0
Release: reference v1.3.0946dd24d · ·The design system absorbs its first heavily iterated consumer page, and conformance settles on tier follows control backing. - **Added.** The `license` standard (blocking); the `/design/authoring/` page carrying three page-composition rulings; `design/patterns/disclosure-index.css`, the first authored pattern, with its class contract; a generated `## Verify` block in every standard, derived from its own `check.sh`; an advisory severity tier. - **Changed.** The lab TOC primitive is a vertical ordered list; the chrome self-hosts its fonts and makes only same-origin requests; catalog pins move to v5.0.0; `renovate`, `security-md`, and `presentation` assert properties rather than wording; `design`, `llms-txt`, and `posture-claims` move to the advisory tier, because tier follows control backing. - **Removed.** The `ai-assisted` standard, folded into `contributing`; the `reference-check` story everywhere it was told. - **Fixed.** Four token-layer contrast failures, corrected for every consumer at once; the `codeowners` template's automerge deadlock; the `pipeline` standard's host anchoring; `presentation`'s unparseable frontmatter. The version-scheduled enforcement flips in the v1.0.0 notes, including the mode flip announced for this version, belonged to the retired `reference-check` architecture. This release performs no flip: per-repo enforcement stays with the catalog's narrow components. - **Artifact.** The Pages design CDN and agent surface: https://gitlab-com.gitlab.io/public-sector/reference/design/ - **Documentation.** https://gitlab-com.gitlab.io/public-sector/reference/ - **CHANGELOG.** https://gitlab.com/gitlab-com/public-sector/reference/-/blob/v1.3.0/CHANGELOG.md#130--2026-08-24
-
-
v1.1.0
f353b999 · ·v1.1.0 -- paper template, build-time previews, agent surface expansion. Second release of the Public Sector reference. Substantive additions across templates, build system, agent surface, and the reference site itself. No breaking schema changes; consumer .reference.yaml files keep working. Templates: - templates/paper/ -- third project template alongside lab/ and docs/. Two-column academic LaTeX with design/typeset/gitlab.sty (slate/steel palette, preprint watermark, amsmath/amssymb/cleveref/tikz preloaded). `make new-project TEMPLATE=paper` stamps a working paper repo wired to the paper@~latest catalog component. Build system: - Ephemeral build-time template-preview capture (site/scripts/capture-template-previews.mjs). Stamps each template, screenshots lab + docs via Playwright Chromium, renders paper via tectonic + pdftoppm. Decoupled from `make build` so contributors without TeX + Playwright + python3 can still build the site locally. - New CI job capture-template-previews using the catalog's ci-latex image (pinned to the SHA that baked Node + Chromium runtime libs via gitlab-com/public-sector/pipeline!53). Pages job picks up the three PNG artifacts via stage-cascade. - design/chrome/docs/ as single source of truth for docs-template tokens + chrome CSS. The reference's own site @imports from this directory; `make new-project TEMPLATE=docs` vendors a copy into the consumer's site/public/design/. - sync-versions.sh and validate-versions.sh now sweep every .reference.yaml in the tree, not just the root one. Architectural fix: prior behavior silently downgraded every newly-stamped project to the predecessor reference version. Agent surface: - Root-level .ai/*.md and template-level authoring guides (templates/docs/.ai/docs-authoring.md, templates/lab/.ai/ lab-authoring.md) publish as /agents/<topic>/ via the llms-txt integration. Tools that consume llms.txt get a complete dispatch table out of the box. llms-full.txt expanded to ~330 KB. - site/src/lib/url.ts withBase() helper propagated into the docs template; every internal link goes through it so projects deploying under a path prefix resolve correctly. Site: - Start section restructured: /start/ is a landing page; /start/adopt/ and /start/contribute/ are first-class pages. - Nine-capability home page replaces the prior five-card layout. - README \"Paths\" section replacing the prior \"Pick a door\" phrasing for a professional tone consistent with the rest of the voice. Standards: - standards/repository/SKILL.md codifies the brand-artifact discipline: heroes and avatars do not track versions, never depict a layout tree, prefer SVG over mermaid, prefer principles over instance-specific labels. Catalog pin: - Pipeline catalog bumped v3.0.0 -> v3.3.0 across includes (vale, pages) and template starters (standards/pipeline/templates/.gitlab-ci.yml, standards/provenance/templates/release-pipeline-include.yml). Deferred to a follow-up release: - pipeline/reference-check catalog component. Until it lands, consumers run `make check REPO=\$CI_PROJECT_DIR` in a project-side CI job. The .reference.yaml schema this release stabilizes is forward-compatible. - Sector-specific control subsets (NIST 800-171 for DoD, HIPAA Security Rule for Health, etc.). The unified matrix already lists every framework; the subset bundles for one-line applicable_frameworks: dod selection ship in a later minor. - Standard-status flips on the v1.0.0 schedule (security-md, agents-md to enforcing at +30 days). Statuses remain at their v1.0.0 values in this release.
-
v1.0.0
04167837 · ·v1.0.0 -- Initial release of the Public Sector reference. A conformance contract published as Markdown: 17 standards under standards/, each with prose (SKILL.md), executable assertions (check.sh) restricted to a closed 9-primitive set, and lift-and-replace templates. The Astro site serves both human pages and an agent surface (llms.txt + per-standard Markdown). Schema: - One exemptions: list in .reference.yaml keyed by until: date (replaces the earlier deferred: + deviations: split). - Standards declare project-shape preconditions via applies_when_file (the 9th primitive added at v1.0.0): a standard that does not apply to a project's shape SKIPs rather than FAILs. The reference's own pipeline dogfoods the catalog (pages@v3.0.0, vale@v3.0.0). Pre-push CI lint via glab; in-pipeline parallelism via needs: []; xlarge SaaS runners for tight wallclock. Out of scope at v1.0.0: - reference-check catalog component (planned for catalog v3.1.0). - Live release verification (signature, SBOM, SLSA freshness) -- owned by GitLab's Compliance product downstream.