[goosewobbler]

Description

Roadmap housekeeping, split out of #651 where it didn't belong.

• Ticks LLM notes security pack: neutralize releasekit marker sequences in LLM/edited output; harden prompts against injection #540 and LLM notes: require an explicit llm.model (no curated defaults); enum-validate provider #541 (shipped in 0.41.0) and LLM notes reliability batch: per-task soft-fail, thinking-model text path, retry classification, chunking, concurrency bound #543 (shipped in 0.41.1). All three were closed but still unchecked.
• Rewords the LLM notes: require an explicit llm.model (no curated defaults); enum-validate provider #541 line to match what shipped: llm.model is required and validated at config load, with no shipped model defaults (ADR-0005). The roadmap still described curated per-provider tiers.
• Replaces the Unify per-ecosystem enablement: detection enables, config opts out (version + publish) #554 paragraph, which still described the pre-0.41.0 asymmetric publish defaults. It now states the symmetric rule (ADR-0004) and lists two known gaps:
  • crates.io and pub.dev publishing stays off when the config has no publish block (crates.io and pub.dev publishing stays off when the config has no publish block #667, found in review here);
  • version-groups mode doesn't yet bump pubspec.yaml or honour version.pub.enabled (Group strategy tags Dart packages without bumping pubspec.yaml or recording the update #649).

Related Issue(s)

#540, #541, #543, #554, #649, #667

Type of Change

• feat — New feature
• fix — Bug fix
• docs — Documentation change
• refactor — Code refactoring
• test — Adding or updating tests
• chore — Maintenance, dependencies, tooling
• Breaking change — Requires major version bump

Scope

• @releasekit/version
• @releasekit/notes
• @releasekit/publish
• @releasekit/config
• @releasekit/core
• CI / workflows
• Root / monorepo

Checklist

• Lint passes (pnpm lint)
• Tests pass (pnpm test) — no code changes
• Typecheck passes (pnpm typecheck) — no code changes
• Documentation updated (if applicable)
• Breaking changes noted in description (none)

Testing Notes

ROADMAP.md only. Issue states and milestones were checked on GitHub: #540, #541 and #543 are closed with milestones 0.41.0 / 0.41.0 / 0.41.1, and #649 is open. Both ADR links resolve. The #667 gap was reproduced with the built @releasekit/publish: no publish block gives npm on, cargo and pub off; "publish": {} gives all three on.

🤖 Generated with Claude Code

https://claude.ai/code/session_01HQN3v9Z4f1mu3xK4Z7K44e

[github-actions]

Standing release PR: #614 · v0.42.0 queued (4 packages) · open 81d 21h 45m · ✅ ready to merge

Release Preview — v0.41.2 → v0.41.3

Note: Labels on this PR are advisory in standing-pr mode. Bumps come from conventional commits in the standing PR; override by editing labels on the standing PR itself. Add release:immediate to bypass the standing PR and release this PR directly.

These changes will be added to the release PR (#614) when merged:

Changelog

monorepo 0.41.2 → 0.41.3

Changed

• note the no-publish-block default gap (roadmap)
• tick off shipped LLM-notes work and refresh the enablement note (roadmap)

All packages → 0.41.3 (sync versioning)

• @releasekit/version
• @releasekit/notes
• @releasekit/publish
• @releasekit/release

After merge — predicted release

No version escalation — this PR's changes will be included in the queued release without affecting the projected versions.

Package	Standing PR	This PR	After merge
monorepo	0.42.0	0.41.3	0.42.0

---

Updated automatically by ReleaseKit