feat(standards): drop the site CI variant + require changelog reconciliation before release

- Remove the push-triggered build-and-deploy-site pipeline and every "site"
  reference; Type B is now a single tag-triggered service pipeline
  (service-docker.yaml).
- Inventory now covers packages + the auth-server service only (repos.json
  11 -> 9; docs/mcp are no longer part of the standard).
- Versioning standard: reconcile [Unreleased] against the last tag before
  promoting, and always show proposed entries to the user for approval.
- Update registry.py compliance/release text and list_repos types, build.py
  component descriptions, and rebuild the MCP bundle + lib/wiki HTML.

standards/mcp/drone.json

@@ -16,7 +16,7 @@
       "kind": "drone-service",
       "path": "service-docker.yaml",
       "placeholder": "",
-      "description": "Drone pipeline: build, push, and deploy a Docker service or site."
+      "description": "Drone pipeline: build, push, and deploy a Docker service."
     }
   ]
 }

standards/mcp/modules/repository_inventory.json

@@ -2,7 +2,7 @@
   "module": "repository_inventory",
   "content": {
     "path": "repository_inventory",
-    "docstring": "# Repository Inventory\n\n## Summary\n\nThe canonical list of Aetos repositories covered by the CI and versioning\nstandards, with the artifact each one produces, its version source, and its\nDrone shape. Every entry maps to the contract in\n[11 – Versioning & Changelog](11_versioning_and_changelog.md) and the two CI\nfiles in [10 – Drone Pipelines](10_drone_pipelines.md).\n\nThe same data is published machine-readably as the `registry://repos` MCP\nresource (and the `list_repos` tool), sourced from `standards/src/repos.json`.\nPaths are relative to the `aetos/` workspace root.\n\n---\n\n## Packages (Type A)\n\nA wheel + sdist published to the private index. Version source is\n`pyproject.toml`; Drone file is `python-lib.yaml` (tag-triggered).\n\n| Repo | Path | Docs | MCP server |\n|------|------|------|------------|\n| `dagpipe` | `dagpipe` | lib, wiki | `dagpipe:8006` |\n| `doc-forge` | `doc-forge` | lib, wiki | `docforge:8001` |\n| `hexa` | `hexa` | lib, wiki | `hexa:8008` |\n| `mail-intake` | `mail-intake` | lib, wiki | `mail_intake:8002` |\n| `mongo-ops` | `mongo-ops` | lib, wiki | `mongo_ops:8007` |\n| `omniread` | `omniread` | lib, wiki | `omniread:8003` |\n| `openapi-first` | `openapi-first` | lib, wiki | `openapi_first:8004` |\n| `py-jwt` | `py-jwt` | lib, wiki | `jwtlib:8005` |\n\n---\n\n## Services & sites (Type B)\n\nA container image pushed to the registry and run on the Docker host. Version\nsource is the `VERSION` file; Drone file is `service-docker.yaml`.\n\n| Repo | Type | Path | Trigger | Docs |\n|------|------|------|---------|------|\n| `auth-server` | service | `auth-server` | tag | api, lib, wiki |\n| `docs` | site | `docs` | push | — |\n| `mcp` | site | `mcp` | push | — |\n\nThe **service** variant is tag-triggered and enforces `tag == VERSION`. The\n**site** variant is push-triggered, ships `:latest`, and has no tag guard.\n\n---\n\n## Required files per repo\n\n| Type | Version source | Changelog | Drone |\n|------|----------------|-----------|-------|\n| package | `pyproject.toml` | `CHANGELOG.md` | `python-lib.yaml` |\n| service / site | `VERSION` | `CHANGELOG.md` | `service-docker.yaml` |\n\nEvery covered repository must be able to satisfy `tag == version`:\nthe version file (never a commit id) is bumped in the release MR, the MR is\nmerged, and the tag is created on the merged commit.\n\n---\n\n## Reading this at runtime\n\n- Resource: `registry://repos`\n- Tool: `list_repos()`\n- Humans: this page (mirror of `standards/src/repos.json`).\n\n---\n\n## Related\n\n- [10 – Drone Pipelines](10_drone_pipelines.md) · [11 – Versioning & Changelog](11_versioning_and_changelog.md) · [13 – Library Registry](13_library_registry.md)\n",
+    "docstring": "# Repository Inventory\n\n## Summary\n\nThe canonical list of Aetos repositories covered by the CI and versioning\nstandards, with the artifact each one produces, its version source, and its\nDrone shape. Every entry maps to the contract in\n[11 – Versioning & Changelog](11_versioning_and_changelog.md) and the two CI\nfiles in [10 – Drone Pipelines](10_drone_pipelines.md).\n\nThe same data is published machine-readably as the `registry://repos` MCP\nresource (and the `list_repos` tool), sourced from `standards/src/repos.json`.\nPaths are relative to the `aetos/` workspace root.\n\n---\n\n## Packages (Type A)\n\nA wheel + sdist published to the private index. Version source is\n`pyproject.toml`; Drone file is `python-lib.yaml` (tag-triggered).\n\n| Repo | Path | Docs | MCP server |\n|------|------|------|------------|\n| `dagpipe` | `dagpipe` | lib, wiki | `dagpipe:8006` |\n| `doc-forge` | `doc-forge` | lib, wiki | `docforge:8001` |\n| `hexa` | `hexa` | lib, wiki | `hexa:8008` |\n| `mail-intake` | `mail-intake` | lib, wiki | `mail_intake:8002` |\n| `mongo-ops` | `mongo-ops` | lib, wiki | `mongo_ops:8007` |\n| `omniread` | `omniread` | lib, wiki | `omniread:8003` |\n| `openapi-first` | `openapi-first` | lib, wiki | `openapi_first:8004` |\n| `py-jwt` | `py-jwt` | lib, wiki | `jwtlib:8005` |\n\n---\n\n## Services (Type B)\n\nA container image pushed to the registry and run on the Docker host. Version\nsource is the `VERSION` file; Drone file is `service-docker.yaml`.\n\n| Repo | Path | Trigger | Docs |\n|------|------|---------|------|\n| `auth-server` | `auth-server` | tag | api, lib, wiki |\n\nTag-triggered and enforces `tag == VERSION`.\n\n---\n\n## Required files per repo\n\n| Type | Version source | Changelog | Drone |\n|------|----------------|-----------|-------|\n| package | `pyproject.toml` | `CHANGELOG.md` | `python-lib.yaml` |\n| service | `VERSION` | `CHANGELOG.md` | `service-docker.yaml` |\n\nEvery covered repository must be able to satisfy `tag == version`:\nthe version file (never a commit id) is bumped in the release MR, the MR is\nmerged, and the tag is created on the merged commit.\n\n---\n\n## Reading this at runtime\n\n- Resource: `registry://repos`\n- Tool: `list_repos()`\n- Humans: this page (mirror of `standards/src/repos.json`).\n\n---\n\n## Related\n\n- [10 – Drone Pipelines](10_drone_pipelines.md) · [11 – Versioning & Changelog](11_versioning_and_changelog.md) · [13 – Library Registry](13_library_registry.md)\n",
     "objects": {}
   }
 }

standards/mcp/modules/wiki_development_releasing.json

@@ -2,7 +2,7 @@
   "module": "wiki_development_releasing",
   "content": {
     "path": "wiki_development_releasing",
-    "docstring": "# Releasing & Versioning\n\nHow to cut a release of any Aetos repository. The rule lives in the reference\npage [Versioning & Changelog](../lib/11_versioning_and_changelog/); this is the\nrunbook you follow.\n\nEvery repository is one of two Drone shapes — a **PyPI package** or a **Docker\ndeployment** ([Drone Pipelines](../lib/10_drone_pipelines/)). Both release the\nsame way: the version bump and changelog promotion go **in the merge request**,\nand the tag is created on the merged commit.\n\n---\n\n## 🧾 Before you start\n\n- You have an open **merge request** holding the change, and `main` is green\n  (the Drone quality gate passed on the last run).\n- You know whether this is a **breaking**, **feature**, or **fix** release.\n- The version file exists:\n  - package → `version` in `pyproject.toml`\n  - service / site → `VERSION` at the repo root\n\n---\n\n## 🚦 Pick the next version\n\nThe version file and the tag must be identical. For `0.y.z`, `0.y` is the major\nline (see the reference page); once at `1.0.0`, normal SemVer applies.\n\n| Change | `0.y.z` → | `1.0.0+` → |\n|--------|-----------|------------|\n| Breaking | `0.(y+1).0` | `(x+1).0.0` |\n| Feature | `0.y.(z+1)` | `x.(y+1).0` |\n| Fix | `0.y.(z+1)` | `x.y.(z+1)` |\n\n---\n\n## 🌿 Release in the MR\n\nThe version is known while the change is still a merge request, so the bump\nrides along with it. Do both edits **in the MR**:\n\n- **Promote the changelog** in `CHANGELOG.md`: move the `[Unreleased]` content\n  under a new `## [x.y.z] - YYYY-MM-DD` heading, leave a fresh empty\n  `[Unreleased]` on top, and add the compare links — naming the **version/tag**,\n  never a commit id:\n\n  ```markdown\n  [Unreleased]: https://git.aetoskia.com/aetos/<repo>/compare/x.y.z...HEAD\n  [x.y.z]: https://git.aetoskia.com/aetos/<repo>/compare/x.y.(z-1)...x.y.z\n  ```\n\n- **Bump the version file** to the intended release version: `version = \"x.y.z\"`\n  in `pyproject.toml` (packages) or the `VERSION` file (services/sites).\n\n---\n\n## 🏷️ Tag the merged commit\n\n1. **Merge or squash** the MR into `main`.\n2. **Create the tag** on the resulting commit: `git tag x.y.z` (lightweight).\n3. **Push the tag** (`git push origin x.y.z`) — Drone builds the release.\n\n### 🤖 Agent-assisted tagging\n\nThe agent does not author or merge the MR and never tags before the merge. After\nyou confirm the MR is merged/squashed and tell it to proceed, the agent:\n\n1. Waits for that explicit go-ahead.\n2. Finds the commit that introduced the bump:\n   - package:\n     `git log -S 'version = \"x.y.z\"' -n 1 --format='%H %s' -- pyproject.toml`\n   - service / site:\n     `git log -S 'x.y.z' -n 1 --format='%H %s' -- VERSION`\n3. Verifies that commit's version file equals `x.y.z`, then tags **only** that\n   commit: `git tag x.y.z <sha>`.\n4. Does **not** push — it asks you to run `git push origin x.y.z`.\n\n---\n\n## 🤖 What Drone does\n\n- **Type A (package):** asserts `tag == pyproject version`, then skips if that\n  version already exists on the index, runs the quality gate, builds, and\n  uploads the wheel + sdist.\n- **Type B (service):** asserts `tag == VERSION`, resolves the tag, skips if the\n  image already exists, runs the quality gate, builds, pushes, and restarts the\n  container.\n- **Type B (site):** triggered on push, ships `:latest` and has no tag guard.\n\nIf the guard fails, nothing is published — fix the version file, amend the\ncommit, and move the tag **only** if it was never pushed.\n\n---\n\n## 🛟 Backfill / recovery\n\nIf an older tag never published (a past version-file mismatch, an index\noutage):\n\n- **Package:** run the `backfill-pypi-from-tags` pipeline (custom event). It\n  checks out every tag, verifies `tag == pyproject version` at that commit,\n  and uploads the ones missing from the index. Already-fixed history is never\n  rewritten.\n- **Service:** rebuild the image for the missing tag with a fresh commit and a\n  new patch version; do not move a published tag.\n\n---\n\n## 🔁 If a release is wrong\n\n- Never reuse or force-move a pushed tag.\n- Fix forward: bump to the next patch, promote the changelog, tag again.\n\n---\n\n## Related\n\n- [Testing & Quality Gates](01_testing.md) · [Versioning & Changelog](../lib/11_versioning_and_changelog/) · [Drone Pipelines](../lib/10_drone_pipelines/)\n",
+    "docstring": "# Releasing & Versioning\n\nHow to cut a release of any Aetos repository. The rule lives in the reference\npage [Versioning & Changelog](../lib/11_versioning_and_changelog/); this is the\nrunbook you follow.\n\nEvery repository is one of two Drone shapes — a **PyPI package** or a **Docker\ndeployment** ([Drone Pipelines](../lib/10_drone_pipelines/)). Both release the\nsame way: the version bump and changelog promotion go **in the merge request**,\nand the tag is created on the merged commit.\n\n---\n\n## 🧾 Before you start\n\n- You have an open **merge request** holding the change, and `main` is green\n  (the Drone quality gate passed on the last run).\n- You know whether this is a **breaking**, **feature**, or **fix** release.\n- The version file exists:\n  - package → `version` in `pyproject.toml`\n  - service → `VERSION` at the repo root\n\n---\n\n## 🚦 Pick the next version\n\nThe version file and the tag must be identical. For `0.y.z`, `0.y` is the major\nline (see the reference page); once at `1.0.0`, normal SemVer applies.\n\n| Change | `0.y.z` → | `1.0.0+` → |\n|--------|-----------|------------|\n| Breaking | `0.(y+1).0` | `(x+1).0.0` |\n| Feature | `0.y.(z+1)` | `x.(y+1).0` |\n| Fix | `0.y.(z+1)` | `x.y.(z+1)` |\n\n---\n\n## 🌿 Release in the MR\n\nThe version is known while the change is still a merge request, so the bump\nrides along with it. Do all edits **in the MR**:\n\n- **Reconcile the changelog first.** `[Unreleased]` is a **draft, not the source\n  of truth**: diff the change against the last tag\n  (`git log <last-tag>..HEAD`, `git diff --stat <last-tag>..HEAD`) and add an\n  entry for every user-facing change that is missing. **Always show the proposed\n  additions to the user and wait for approval** before promoting — ask rather\n  than guess when an entry is ambiguous.\n\n- **Promote the changelog** in `CHANGELOG.md`: move the (now reconciled)\n  `[Unreleased]` content under a new `## [x.y.z] - YYYY-MM-DD` heading, leave a\n  fresh empty `[Unreleased]` on top, and add the compare links — naming the\n  **version/tag**, never a commit id:\n\n  ```markdown\n  [Unreleased]: https://git.aetoskia.com/aetos/<repo>/compare/x.y.z...HEAD\n  [x.y.z]: https://git.aetoskia.com/aetos/<repo>/compare/x.y.(z-1)...x.y.z\n  ```\n\n- **Bump the version file** to the intended release version: `version = \"x.y.z\"`\n  in `pyproject.toml` (packages) or the `VERSION` file (services).\n\n---\n\n## 🏷️ Tag the merged commit\n\n1. **Merge or squash** the MR into `main`.\n2. **Create the tag** on the resulting commit: `git tag x.y.z` (lightweight).\n3. **Push the tag** (`git push origin x.y.z`) — Drone builds the release.\n\n### 🤖 Agent-assisted tagging\n\nThe agent does not author or merge the MR and never tags before the merge. After\nyou confirm the MR is merged/squashed and tell it to proceed, the agent:\n\n1. Waits for that explicit go-ahead.\n2. Finds the commit that introduced the bump:\n   - package:\n     `git log -S 'version = \"x.y.z\"' -n 1 --format='%H %s' -- pyproject.toml`\n   - service:\n      `git log -S 'x.y.z' -n 1 --format='%H %s' -- VERSION`\n3. Verifies that commit's version file equals `x.y.z`, then tags **only** that\n   commit: `git tag x.y.z <sha>`.\n4. Does **not** push — it asks you to run `git push origin x.y.z`.\n\n---\n\n## 🤖 What Drone does\n\n- **Type A (package):** asserts `tag == pyproject version`, then skips if that\n  version already exists on the index, runs the quality gate, builds, and\n  uploads the wheel + sdist.\n- **Type B (service):** asserts `tag == VERSION`, resolves the tag, skips if the\n  image already exists, runs the quality gate, builds, pushes, and restarts the\n  container.\n\nIf the guard fails, nothing is published — fix the version file, amend the\ncommit, and move the tag **only** if it was never pushed.\n\n---\n\n## 🛟 Backfill / recovery\n\nIf an older tag never published (a past version-file mismatch, an index\noutage):\n\n- **Package:** run the `backfill-pypi-from-tags` pipeline (custom event). It\n  checks out every tag, verifies `tag == pyproject version` at that commit,\n  and uploads the ones missing from the index. Already-fixed history is never\n  rewritten.\n- **Service:** rebuild the image for the missing tag with a fresh commit and a\n  new patch version; do not move a published tag.\n\n---\n\n## 🔁 If a release is wrong\n\n- Never reuse or force-move a pushed tag.\n- Fix forward: bump to the next patch, promote the changelog, tag again.\n\n---\n\n## Related\n\n- [Testing & Quality Gates](01_testing.md) · [Versioning & Changelog](../lib/11_versioning_and_changelog/) · [Drone Pipelines](../lib/10_drone_pipelines/)\n",
     "objects": {}
   }
 }

standards/mcp/release.json

@@ -13,7 +13,7 @@
       "kind": "version-file",
       "path": "VERSION",
       "placeholder": "",
-      "description": "Single-line SemVer source of truth for services and sites."
+      "description": "Single-line SemVer source of truth for services."
     }
   ]
 }

standards/mcp/repos.json

@@ -144,26 +144,6 @@
         "wiki"
       ],
       "mcp": null
-    },
-    {
-      "name": "docs",
-      "type": "site",
-      "path": "docs",
-      "version_source": "VERSION",
-      "drone": "service-docker.yaml",
-      "trigger": "push",
-      "docs": [],
-      "mcp": null
-    },
-    {
-      "name": "mcp",
-      "type": "site",
-      "path": "mcp",
-      "version_source": "VERSION",
-      "drone": "service-docker.yaml",
-      "trigger": "push",
-      "docs": [],
-      "mcp": null
     }
   ]
 }

standards/mcp/templates/app/CHANGELOG.md

@@ -5,6 +5,13 @@ All notable changes to this project are documented here.
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/)
 and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+<!--
+Keep [Unreleased] current as you land changes. On release, reconcile it against
+the change (git log / git diff since the last tag), add any missing user-facing
+entries, and get the user's approval before promoting it into a version heading.
+See standards: Versioning & Changelog (registry://release).
+-->
+
 ## [Unreleased]
 
 ### Added

standards/mcp/templates/drone/service-docker.yaml

@@ -1,29 +1,25 @@
 # Drone standard — Type B: Docker deployment
 #
-# Canonical pipelines for services that build an image, push it to the private
-# registry, and run it on the Docker host (auth-server, docs, mcp).
+# Canonical pipeline for a service that builds an image, pushes it to the
+# private registry, and runs it on the Docker host (auth-server).
 #
-# Two variants ship together:
-#   build-and-deploy-service — a long-running API/worker service: fetch the git
-#                              tag, skip if the image already exists, run the
-#                              quality gate, build, push, restart the container.
-#   build-and-deploy-site    — a static/HTTP site: build, push, restart, on
-#                              every push (no tag, no quality gate).
+#   build-and-deploy-service — fetch the git tag, fail unless it equals the
+#                              repo-root VERSION file, skip if the image already
+#                              exists, run the quality gate, build, push, and
+#                              restart the container.
 #
-# Secrets (Drone): PIP_REPO_URL, PIP_USERNAME, PIP_PASSWORD (service only),
-# REGISTRY_HOST, REGISTRY_USER, REGISTRY_PASS, plus the service's runtime env
-# (for example MONGO_* / JWT_SECRET).
+# Secrets (Drone): PIP_REPO_URL, PIP_USERNAME, PIP_PASSWORD, REGISTRY_HOST,
+# REGISTRY_USER, REGISTRY_PASS, plus the service's runtime env (for example
+# MONGO_* / JWT_SECRET).
 #
 # Placeholders to set per repo:
 #   <app>            image / container / network name (e.g. auth-server).
 #   aetos/<app>      image repository on the private registry.
 #   <host-port>      published host port; <container-port> the in-image port.
-#   <site>           site image name for the site variant (e.g. docs, mcp).
 #   <env-var>        runtime environment variable consumed by the service.
 #
-# Version guard: the tag-triggered service variant fails unless the git tag
-# equals the repo-root VERSION file (see the versioning standard). The
-# push-triggered site variant ships :latest only and has no version to guard.
+# Version guard: the tag-triggered pipeline fails unless the git tag equals the
+# repo-root VERSION file (see the versioning standard).
 ---
 kind: pipeline
 type: docker
@@ -203,75 +199,3 @@ trigger:
   event:
     - tag
 
----
-kind: pipeline
-type: docker
-name: build-and-deploy-site
-
-platform:
-  os: linux
-  arch: arm64
-
-workspace:
-  path: /drone/src
-
-volumes:
-  - name: dockersock
-    host:
-      path: /var/run/docker.sock
-
-steps:
-  - name: build-image
-    image: docker:24
-    volumes:
-      - name: dockersock
-        path: /var/run/docker.sock
-    commands:
-      - echo "Building Docker image for aetos/<site>..."
-      - docker build -t aetos/<site>:latest .
-
-  - name: push-image
-    image: docker:24
-    environment:
-      REGISTRY_HOST:
-        from_secret: REGISTRY_HOST
-      REGISTRY_USER:
-        from_secret: REGISTRY_USER
-      REGISTRY_PASS:
-        from_secret: REGISTRY_PASS
-    volumes:
-      - name: dockersock
-        path: /var/run/docker.sock
-    commands:
-      - echo "Logging into registry $REGISTRY_HOST ..."
-      - echo "$REGISTRY_PASS" | docker login $REGISTRY_HOST -u "$REGISTRY_USER" --password-stdin
-      - docker tag aetos/<site>:latest $REGISTRY_HOST/aetos/<site>:latest
-      - echo "Pushing image to $REGISTRY_HOST..."
-      - docker push $REGISTRY_HOST/aetos/<site>:latest
-
-  - name: stop-old
-    image: docker:24
-    volumes:
-      - name: dockersock
-        path: /var/run/docker.sock
-    commands:
-      - echo "Stopping old container..."
-      - docker rm -f <site> || true
-
-  - name: run-container
-    image: docker:24
-    volumes:
-      - name: dockersock
-        path: /var/run/docker.sock
-    commands:
-      - echo "Starting aetos/<site>:latest ..."
-      - |
-        docker run -d \
-          --name <site> \
-          -p <host-port>:<container-port> \
-          --restart always \
-          aetos/<site>:latest
-
-trigger:
-  event:
-    - push

standards/mcp/templates/release/CHANGELOG.md

@@ -20,9 +20,12 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 ### Security
 
 <!--
-In the release merge request, promote the entries above into a new heading and
-leave a fresh, empty [Unreleased] section. Name the version/tag, never a commit
-id:
+In the release merge request, first reconcile the entries above against the
+change: diff it against the last tag (`git log <last-tag>..HEAD`,
+`git diff --stat <last-tag>..HEAD`) and add any missing user-facing entries.
+`[Unreleased]` is a draft — always show the additions to the user for approval
+before promoting. Then promote the entries above into a new heading and leave a
+fresh, empty [Unreleased] section. Name the version/tag, never a commit id:
 
 ## [0.1.0] - YYYY-MM-DD