docs: establish release changelog baseline

[seonghobae]

Customer outcome

Release consumers can now distinguish the current development baseline from a protected, published release and use one canonical changelog entry point.

Scope

• Add a SemVer-oriented top-level CHANGELOG.md.
• Record that 0.1.0 is the current unreleased development baseline.
• Define the evidence required before publishing a release: protected main, required Checks, independent review, and release artifacts.

Verification

• git diff --check

This is documentation-only and intentionally does not bump the package version or claim a release.

---

[coderabbitai]

Warning

Review limit reached

@seonghobae, you've reached your PR review limit, so we couldn't start this review.

Next review available in: 11 minutes

Limit details: You’ve used the included review currently available.

You've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository.

How can I continue?

Wait for the limit to reset, then comment @coderabbitai review or push new commits to the PR.

An organization admin can change what happens after included review limits in Billing.

How do review limits work?

CodeRabbit enforces per-developer PR review limits within each organization.

For paid Pro and Pro+ reviews, CodeRabbit uses a developer's included PR review attempts over the past 7 days to set the current hourly allowance. At typical activity levels, the full plan allowance applies. Higher sustained activity can lower the allowance until earlier attempts leave the 7-day window.

Please refer docs for additional details.

Review details

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: 5650b6a7-5228-42c0-8d17-a55385a54bfd

📥 Commits

Reviewing files that changed from the base of the PR and between e226e11 and 236a28b.

📒 Files selected for processing (1)

• CHANGELOG.md

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[devin-ai-integration]

✅ Devin Review: No Issues Found

Devin Review analyzed this PR and found no bugs or issues to report.

[seonghobae]

@opencode-agent review exact current HEAD 236a28b3f73380aaa39aa7b19a2bc475c2cbdf6f against main; verify the changelog baseline does not claim a release, has no version drift, and preserves the protected release evidence boundary.

[seonghobae]

Devin Review completed pass on exact HEAD 236a28b3f73380aaa39aa7b19a2bc475c2cbdf6f; the PR is now protected auto-merge (squash) armed. Required hosted Checks and independent approval remain the only merge gates.

[seonghobae]

Please review exact current HEAD 236a28b3f73380aaa39aa7b19a2bc475c2cbdf6f against main and publish findings or explicit no-findings. Devin reported no issues; merge remains gated by independent approval and terminal required Checks.

[seonghobae]

Exact-head review for 236a28b3f73380aaa39aa7b19a2bc475c2cbdf6f against main: no code or documentation defects found. CHANGELOG.md correctly declares 0.1.0 as an unreleased development baseline, matches pyproject.toml, and does not claim protected release evidence. git diff --check passes. Hosted required Checks are still running; protected merge remains gated on their terminal success and an independent approving review.

Next action: let the current-head Checks finish, then obtain the required independent approval; auto-merge is already armed.

[seonghobae]

@devin review exact current HEAD 236a28b. This release-metadata PR is intentionally limited to CHANGELOG.md and documents that 0.1.0 remains unreleased until protected-main checks and independent review pass. Revalidate the exact diff and report current findings only.

[seonghobae]

Current exact-head review refresh: HEAD is 236a28b. Review findings and protected Checks must be evaluated against this SHA; no prior-head evidence is reused.

[seonghobae]

Exact-head validation — PR #792

• Current HEAD: 236a28b3f73380aaa39aa7b19a2bc475c2cbdf6f
• Documentation-only diff: adds the SemVer/release-evidence CHANGELOG.md baseline.
• Hosted Checks at this exact HEAD: Tests, Security, Security Scan, SAST Semgrep, Fuzz, CodeRabbit, and Devin Review all succeeded.
• Review threads: 0 unresolved.
• Independent approval: not present; protected merge remains unavailable.

@opencode-agent please independently review exact current HEAD 236a28b3f73380aaa39aa7b19a2bc475c2cbdf6f for changelog accuracy, release-gate wording, and consistency with the repository's current release authority contract. Report only findings against this SHA.

[seonghobae]

Current-head validation for documentation-only 236a28b3f73380aaa39aa7b19a2bc475c2cbdf6f:

• git diff --check: passed
• Changelog scope reviewed: SemVer baseline, unreleased 0.1.0, and protected release evidence requirements
• Exact-head protected workflows: Fuzz, Security Scan, SAST Semgrep, Security, Tests — all success
• Current review threads: none
• Independent approval: still required; do not merge until the protected approval is supplied

@opencode-agent Review only exact current HEAD 236a28b3f73380aaa39aa7b19a2bc475c2cbdf6f. Check that the changelog does not claim a published release, names the protected evidence needed for publication, and uses the canonical package name. Do not approve or merge.

[seonghobae]

Exact current HEAD 236a28b was revalidated as the release changelog baseline.

• pyproject version remains 0.1.0 and CHANGELOG.md explicitly marks it as unreleased until protected-main evidence exists
• repository security metadata, product planning, and commercial release-candidate proof: 15 passed
• git diff --check passed; current-head Checks have no completed failures and review threads are clean

Please review and run protected Checks for this exact HEAD only.

[seonghobae]

Exact-head validation — PR #792

• Current HEAD: 236a28b3f73380aaa39aa7b19a2bc475c2cbdf6f
• Changelog/conventions/planning/commercial release-artifact/security contracts: 63 passed.
• git diff --check: passed.
• CHANGELOG.md keeps 0.1.0 explicitly unreleased until protected main, required Checks, independent review, and release artifacts are verified; no premature version bump is claimed.
• Current live PR remains BLOCKED/REVIEW_REQUIRED; no merge or release authority is claimed.

@opencode-agent please review only exact current HEAD 236a28b3f73380aaa39aa7b19a2bc475c2cbdf6f, focusing on SemVer/changelog wording, release evidence boundaries, and no unsupported release claim. Do not approve or merge.

[seonghobae]

Superseded by main's CHANGELOG.md introduced with #771 (84a40cb), which already uses proper Keep-a-Changelog structure with [Unreleased]. The unique residue here (SemVer statement, release-evidence requirement) will be folded into main's changelog in a follow-up commit instead of resolving this add/add conflict.