[choiyounggi]

Prepares release v0.9.0 and the branch-protection change. Nothing is applied live by merging this PR. The tag push, the pypi environment, PyPI registration and the protection PUT happen after merge.

#244 — protection without required approvals (ccd1b21)

• The test-quality AI gate is now blocking. The other three AI gates stay advisory.
• The reusable AI-gate job no longer sets name:. Every AI gate check is now reported as <gate> / gate. Reason: a job skipped by its own if: is reported under the unevaluated name: template (measured on 4 public repos). That would have left the required check waiting forever on skip-ai-gate-labelled or fork PRs.
• A PR whose changed-file list is empty (deletion-only or empty diff) now fails a blocking gate instead of passing it unread.
• scripts/setup_branch_protection.sh:
  • adds required_conversation_resolution and the test-quality / gate check;
  • lists modeb-linux by default (it is already required live);
  • writes out the PUT-default switches;
  • --check now prints ok:/drift: lines against live main (one read-only GET). Against live today: summary: 2 drift, 15 ok.
• Required approvals stay off: with one collaborator plus enforce_admins, no PR could ever be approved. docs/CI-GATES.md records this and the promotion-criteria exception. OpenSSF Scorecard Code-Review stays unsatisfied.

#245 — v0.9.0 cut + PyPI Trusted Publishing (e3b1b98)

• Version is 0.9.0 at all 7 sites. Generated references were regenerated.
• CHANGELOG.md: Unreleased → ## [0.9.0] — 2026-10-22. All 62 entries are kept, and the 7 breaking entries carry Contract: lines naming docs/compatibility.md contracts.
• release.yml:
  • gates now fails when the tag does not equal the pyproject version.
  • publish-pypi is enabled with needs: [build, release] and environment: pypi. Its only permission is id-token: write, and pypa/gh-action-pypi-publish is pinned to its v1.14.3 SHA.
• docs/RELEASING.md: release cadence (monthly, plus right after a P0 fix), Trusted Publisher values, the environment prerequisite, and a recovery table for a failed publish.

Verification

• Full suite on e3b1b98: Ran 5566 tests … OK (skipped=1).
• ruff, rfc_lint, gen_plugin_references --check and check_version_sync (0.9.0, 7 sites) all pass.
• python -m build + twine check PASSED.
• Mutations each watched red, then reverted:
  • blocking flip;
  • needs flip;
  • conversation-resolution flip;
  • count=0 exit code;
  • version mismatch.

Refs #244, #245 (both are closed manually after the live steps).

🤖 Generated with Claude Code

https://claude.ai/code/session_01Th13jVHptQQ1mCLah7XBay