Release: Phase 1.3 — Stabilize the MVP (0.1.3)

.git-blame-ignore-revs

@@ -0,0 +1,11 @@
+# Commits that only reformat code. `git blame` skips them once you run
+#   git config blame.ignoreRevsFile .git-blame-ignore-revs
+# (GitHub's blame view reads this file on its own). Add a commit here only if
+# it changes formatting and nothing else, with a comment saying what it was.
+
+# style: apply ruff format across python/ (#1073, part of #765)
+2b2e4da27b09fb6715dd4044bcdbbb39c9b409e5
+
+# style: apply ruff format across python/ (#765), the same pass on the #765
+# branch before #1073 landed it on develop
+3d16756335c4ae94d5fd8895522676d793b6f8c9

.gitattributes

@@ -1,2 +1,21 @@
 # Auto detect text files and perform LF normalization
 * text=auto
+
+# Generated docs (#795): collapsed in diffs; regenerate rather than edit.
+# python/scripts/generate_docs.py writes these two:
+python/README.md linguist-generated=true
+website/content/reference/api.mdx linguist-generated=true
+# website/scripts/generate-llms.mjs writes these:
+website/public/llms.txt linguist-generated=true
+website/public/llms-full.txt linguist-generated=true
+website/public/**/*.md linguist-generated=true
+
+# Images are binary (#757): never normalise line endings in them, never show a
+# textual diff, never attempt a textual merge. SVG stays text on purpose.
+*.png  binary
+*.jpg  binary
+*.jpeg binary
+*.gif  binary
+*.ico  binary
+*.webp binary
+*.avif binary

.github/CODEOWNERS

@@ -0,0 +1,28 @@
+# Code owners for the paths where a bad change reaches users or the release
+# identity without touching SDK behaviour a reviewer would notice (#757).
+# GitHub requests a review from these owners on any PR that changes a matching
+# path; with "Require review from Code Owners" on in the develop and main
+# branch rules, their approval is required to merge.
+#
+# The last matching pattern wins, so keep the specific paths below the general
+# ones. Every owner must have write access to the repository, or GitHub
+# ignores the line.
+
+# Workflows, Dependabot, release-note config and this file: CI runs these
+# with repository tokens, and the publish workflows hold the PyPI identity.
+/.github/                         @tbolis-at-mulesoft @amirkhan-ak-sf
+
+# Package metadata: dependencies, extras, the build backend, tool config.
+/python/pyproject.toml            @tbolis-at-mulesoft @amirkhan-ak-sf
+
+# CI gate scripts (dependency allowlist, fixture scrubbing, verification
+# claims, constraints lock, commit identities) and the fixture capture tool.
+/python/scripts/                  @tbolis-at-mulesoft @amirkhan-ak-sf
+
+# The framework-free core (§1.1), including the verification registry
+# (core/_verify.py, §0.3).
+/python/src/donkey_kit/core/      @tbolis-at-mulesoft @amirkhan-ak-sf
+
+# Captured gateway fixtures and their lock (§2): tests trust these as ground
+# truth, and the scrubber keeps tenant data out of them.
+/python/tests/fixtures/           @tbolis-at-mulesoft @amirkhan-ak-sf

.github/dependabot.yml

@@ -0,0 +1,69 @@
+# Dependabot version updates (#757). Security updates are a repository setting
+# and stay on for every ecosystem regardless of this file.
+#
+# Every entry targets develop (the integration branch; main moves only by
+# promotion), runs weekly, and groups its updates into one PR. `cooldown` holds
+# a new release back for a week before proposing it, so a compromised release
+# that is yanked within days never reaches a PR.
+version: 2
+updates:
+  # Every `uses:` in .github/workflows is pinned to a full commit SHA with a
+  # `# vX.Y.Z` comment; Dependabot moves both together.
+  - package-ecosystem: github-actions
+    directory: /
+    target-branch: develop
+    schedule:
+      interval: weekly
+    cooldown:
+      default-days: 7
+    groups:
+      github-actions:
+        patterns: ["*"]
+    commit-message:
+      prefix: ci(deps)
+    labels: [dependencies]
+
+  # The docs site (website/). Minor and patch updates are grouped; a major
+  # (Next.js, Nextra, React) arrives as its own PR, since it usually needs code
+  # changes alongside the bump.
+  - package-ecosystem: npm
+    directory: /website
+    target-branch: develop
+    schedule:
+      interval: weekly
+    cooldown:
+      default-days: 7
+    groups:
+      website-npm:
+        patterns: ["*"]
+        update-types: [minor, patch]
+    # #1088: two majors the site can't take yet.
+    ignore:
+      # The typings must match the oldest Node the site runs on (engines.node,
+      # and node-version in ci.yml and docs.yml), not the newest Node release.
+      # Bump the major by hand when that floor moves.
+      - dependency-name: "@types/node"
+        update-types: ["version-update:semver-major"]
+      # TypeScript 7 (the native port) has no ts.sys, which twoslash (Nextra's
+      # Shiki highlighting) reads files through, so `next build` fails. Lift
+      # this once twoslash supports TypeScript 7.
+      - dependency-name: typescript
+        versions: [">=7"]
+    commit-message:
+      prefix: chore(deps)
+    labels: [dependencies]
+
+  # Python: version updates are OFF (open-pull-requests-limit: 0). The runtime
+  # requirements in python/pyproject.toml are floors, never ceilings (§8.4,
+  # ADR 0007): raising a floor on a schedule would narrow what consumers can
+  # install for no reason. Version updates are meant to target only the
+  # dev/release toolchain lock that #763 adds; switch this entry to that lock's
+  # directory and lift the limit when it lands. Security updates are not
+  # affected by the limit.
+  - package-ecosystem: pip
+    directory: /python
+    target-branch: develop
+    schedule:
+      interval: weekly
+    open-pull-requests-limit: 0
+    labels: [dependencies]

.github/pull_request_template.md

@@ -10,11 +10,11 @@ Phase N). CONTRIBUTING.md §1, "The PR", has the full rules. -->
 
 ## Test plan
 
-- [ ] `pytest -q`
-- [ ] `mypy`
-- [ ] `ruff check .`
-- [ ] `lint-imports`
-- [ ] `vulture`
+<!-- Run from python/. CONTRIBUTING.md §1, "The pre-PR gate", lists the
+sessions. -->
+
+- [ ] `nox -s typecheck-and-lint test-3.11` (the quick gate)
+- [ ] `nox` (every session: the whole blocking CI gate)
 - [ ] `python scripts/verify_frameworks.py` (adapters or extras changed)
 
 ## ADR needed?