npm rejects a bare _auth key (ERR_INVALID_AUTH) against a private
registry; derive the host from NPM_REPO_URL and write
//<host>/:_auth=<base64> instead.
Authenticate the quality-gate pip install with the private index URL (scheme-stripped AUTH_URL, --index-url/--extra-index-url) instead of the broken --extra-index-url form, and guard against missing PIP_* secrets. Also drop the fetch-tags inline comments. Regenerated the mcp copy from src.
- Remove the push-triggered build-and-deploy-site pipeline and every "site"
reference; Type B is now a single tag-triggered service pipeline
(service-docker.yaml).
- Inventory now covers packages + the auth-server service only (repos.json
11 -> 9; docs/mcp are no longer part of the standard).
- Versioning standard: reconcile [Unreleased] against the last tag before
promoting, and always show proposed entries to the user for approval.
- Update registry.py compliance/release text and list_repos types, build.py
component descriptions, and rebuild the MCP bundle + lib/wiki HTML.
Add lib page 11 (SemVer contract, pre-1.0 rule, tag==version invariant, Keep a Changelog), the releasing wiki runbook, and canonical release templates (CHANGELOG.md, VERSION). Vendor them into the MCP bundle as templates/release + release.json and expose registry://release with list/get tools. Add a changelog component to the app template. Enforce the tag<->version contract in both Drone shapes: Type A check-version and the backfill loop verify pyproject version; Type B adds a VERSION guard step.
Document the two `.drone.yml` shapes used across the org, derived from the
repos:
- Type A `python-lib.yaml`: build-and-publish-pypi + backfill-pypi-from-tags
- Type B `service-docker.yaml`: build-and-deploy-service + build-and-deploy-site
- add reference page `10_drone_pipelines`
- vendor `src/templates/drone/` into the MCP bundle (`drone.json`)
- expose `registry://drone` + `list_drone_templates` / `get_drone_template`
- wire `build.py` to vendor drone templates; rebuild nav/index (14 modules)
