revert(ci): remove temporary v0.1.6 protobuf exception

.agents/skills/release-captain/SKILL.md

@@ -42,21 +42,6 @@ tag, or start a second `Pre-release` run for a tag; it has no concurrency guard.
   picks the highest `-pre.N` on `main` whose whole `Pre-release` run passed,
   creates the stable tag on that commit, and publishes without requalifying.
 
-### Patch-train protobuf exception
-
-All `v0.1.6-pre.N` candidates have a release-captain-approved protobuf compatibility exception
-in `release-qualification.yml`. The check still compiles both protobuf snapshots
-and runs Buf; only detected breaking changes are allowed. Compilation and tooling
-errors still fail. Other versions retain normal version-based enforcement.
-The run summary and qualification JSON record the exception and reason. Review
-all protobuf findings for each candidate and include migration guidance in the
-release notes; the exception does not accept other compatibility-review findings.
-Squash-merge PR #4976 and, after verifying v0.1.6 publication, prepare a cleanup PR
-reverting its entire squash-merge commit. Follow "Remove the v0.1.6 exception" in
-`CI.md`; remove the checker support and metadata along with the workflow exception.
-A new prerelease number
-within this patch train retains the exception; other patch or minor trains do not.
-
 ## Setup
 
 ```shell

.agents/skills/watch-github-actions/SKILL.md

@@ -169,8 +169,6 @@ the shared `check-protobuf-compatibility` action with `nix run .#check-protobuf-
 During `0.x`, a minor train permits compatibility findings
 as warnings; a patch train or no active train rejects them. Compare the current
 train's version with the latest stable release; commit messages are irrelevant.
-For the patch-train `v0.1.6-pre.N` exception, inspect the run summary and the
-qualification JSON's `exceptions` array; see `release-captain` for disposition.
 Compilation, baseline, and tool errors remain fatal. The `protobuf_compatibility` suite participates in
 the `release-tag-v1` qualification profile. Pre-release calls the reusable
 `release-qualification.yml` workflow after building, in parallel with publication. Release

.github/workflows/release-qualification.yml

@@ -30,10 +30,6 @@ permissions:
 
 env:
   RELEASE_TAG: ${{ inputs.release-tag }}
-  # TEMPORARY (#4976): squash-merge and revert after v0.1.6 publication is verified.
-  # See CI.md's "Remove the v0.1.6 exception" procedure.
-  PROTO_COMPATIBILITY_EXCEPTION_TAG: ${{ inputs.is-prerelease && startsWith(inputs.release-tag, 'v0.1.6-pre.') && inputs.release-tag || '' }}
-  PROTO_COMPATIBILITY_EXCEPTION_REASON: Release captain accepted protobuf breaking changes for the v0.1.6 prerelease train; migration guidance must accompany the release.
 
 defaults:
   run:
@@ -216,11 +212,6 @@ jobs:
             echo "| Docker E2E | ${DOCKER_E2E_RESULT} |"
             echo "| VM E2E | ${VM_E2E_RESULT} |"
             echo
-            if [[ -n "${PROTO_COMPATIBILITY_EXCEPTION_TAG}" ]]; then
-              echo "- Protobuf compatibility exception: \`${PROTO_COMPATIBILITY_EXCEPTION_TAG}\`"
-              echo "- Reason: ${PROTO_COMPATIBILITY_EXCEPTION_REASON}"
-              echo
-            fi
             echo "Advisory compatibility findings do not affect the qualification result."
             echo "See the Compatibility Review job and compatibility-review-run-${GITHUB_RUN_ID}-attempt-${GITHUB_RUN_ATTEMPT} artifact in [this run](${run_url})."
           } >> "${GITHUB_STEP_SUMMARY}"

CI.md

@@ -48,14 +48,6 @@ remains in Actions. This checks
 protobuf compatibility; SDK/configuration compatibility and migration review
 remain separate qualification work.
 
-The release qualification workflow has a release-captain-approved exception
-for all `v0.1.6-pre.N` candidates, including replacement candidates after a failed
-run. It still runs Buf and fails on compilation or tooling
-errors, but accepts detected protobuf breaking changes for that tag. The run
-summary and qualification JSON's `exceptions` array record the scope and reason.
-Other versions retain the normal version policy. Remove the workflow exception
-after promotion; release notes must describe the accepted changes and migration.
-
 Fetch the target and tags to check committed branch changes locally, replacing
 `origin/main` for another target:
 
@@ -75,23 +67,6 @@ For an intentional minor-train incompatibility, record the Buf finding,
 linked issue, consumer impact, and migration plan in the PR. Keep the finding
 visible; do not disable the job or add a broad Buf ignore rule.
 
-### Remove the v0.1.6 exception
-
-Squash-merge [PR #4976](https://github.com/NVIDIA/OpenShell/pull/4976) so the
-exception, checker support, qualification metadata, tests, and temporary guidance
-can be removed together with one revert. After verifying stable v0.1.6 publication,
-open a cleanup PR from current `main` and revert that PR's squash-merge commit:
-
-```shell
-git revert --no-commit <PR-4976-squash-merge-sha>
-git commit --signoff -m "revert(ci): remove temporary v0.1.6 protobuf exception"
-```
-
-Use the final squash-merge SHA shown on the merged PR, not a branch commit SHA.
-Validate the reverted workflow with Actionlint and run the normal protobuf check
-before merging the cleanup. Reverting the whole PR restores normal enforcement
-and removes the exception mechanism; do not leave the bypass support behind.
-
 ### Windows validation
 
 Native Windows implementation and releases use the

tasks/scripts/check_proto_compatibility.py

@@ -103,8 +103,7 @@ def compare(candidate: str, baseline: str, allows_breaks: bool) -> int:
         if result.returncode == 100 and allows_breaks:
             print(diagnostics.replace("::error ", "::warning "), end="")
             print(
-                "Breaking changes allowed by the version policy or an explicit "
-                "maintainer exception; review migration guidance."
+                "Breaking changes allowed by the version increment; review migration guidance."
             )
             return 0
         print(diagnostics, end="")
@@ -123,15 +122,6 @@ def main() -> int:
     )
     release = ref.removeprefix("refs/tags/") if ref.startswith("refs/tags/") else None
     stable, train, allows_breaks = train_policy(candidate, release)
-    exception_tag = os.environ.get("PROTO_COMPATIBILITY_EXCEPTION_TAG", "")
-    if exception_tag:
-        if release != exception_tag or not _parse_prerelease_tag(exception_tag):
-            raise ValueError("Protobuf exception must match the exact prerelease tag.")
-        reason = os.environ.get("PROTO_COMPATIBILITY_EXCEPTION_REASON", "").strip()
-        if not reason:
-            raise ValueError("Protobuf exception requires a reason.")
-        print(f"Protobuf compatibility exception for {release}: {reason}", flush=True)
-        allows_breaks = True
     baseline = f"refs/tags/{stable}" if release else candidate
     if not release:
         # merge-tree writes only Git objects, leaving HEAD and the worktree

tasks/scripts/generate-qualification-summary.sh

@@ -22,20 +22,12 @@ require_env() {
 [[ $# -eq 1 ]] || die "usage: $0 OUTPUT"
 output=$1
 current_profile_passed=true
-proto_exception_tag=${PROTO_COMPATIBILITY_EXCEPTION_TAG:-}
-proto_exception_reason=${PROTO_COMPATIBILITY_EXCEPTION_REASON:-}
 
 require_env \
   RELEASE_TAG SOURCE_SHA IS_PRERELEASE GITHUB_RUN_ID GITHUB_RUN_ATTEMPT \
   GITHUB_SERVER_URL GITHUB_REPOSITORY SECURITY_RESULT CONFORMANCE_RESULT \
   FEATURE_INTEGRATION_RESULT DOCKER_E2E_RESULT VM_E2E_RESULT PROTO_COMPATIBILITY_RESULT
 
-if [[ -n "${proto_exception_tag}" ]]; then
-  [[ "${IS_PRERELEASE}" == true && "${proto_exception_tag}" == "${RELEASE_TAG}" ]] ||
-    die "protobuf exception must match the prerelease tag"
-  [[ -n "${proto_exception_reason//[[:space:]]/}" ]] || die "protobuf exception requires a reason"
-fi
-
 for result in \
   "${PROTO_COMPATIBILITY_RESULT}" \
   "${SECURITY_RESULT}" \
@@ -61,8 +53,6 @@ jq -n \
   --arg generated_at "$(date -u +%Y-%m-%dT%H:%M:%SZ)" \
   --arg security "${SECURITY_RESULT}" \
   --arg protobuf_compatibility "${PROTO_COMPATIBILITY_RESULT}" \
-  --arg proto_exception_tag "${proto_exception_tag}" \
-  --arg proto_exception_reason "${proto_exception_reason}" \
   --arg conformance "${CONFORMANCE_RESULT}" \
   --arg feature_integration "${FEATURE_INTEGRATION_RESULT}" \
   --arg docker_e2e "${DOCKER_E2E_RESULT}" \
@@ -82,11 +72,6 @@ jq -n \
       ]
     },
     current_profile_passed: $current_profile_passed,
-    exceptions: (if $proto_exception_tag == "" then [] else [{
-      suite: "protobuf_compatibility",
-      tag: $proto_exception_tag,
-      reason: $proto_exception_reason
-    }] end),
     run: {
       id: $run_id,
       attempt: $run_attempt,