toothpaste-kit 0.5.0

2026-10-27

Version 0.5.0 is a MINOR release under docs/releasing.md. The licence moves to Apache 2.0, with REUSE compliance and a Developer Certificate of Origin sign-off. The ACMM L2, L3 and L4 files arrive, scripts/gates.sh goes from ten gates to fourteen, and branch and tag names get one rule. No skill is added, and no skill revision is BREAKING.

A new licence

From this release the kit is under the Apache License 2.0, and LICENSE is the unmodified official text. Releases 0.1.0 to 0.4.0 were published under MIT and stay under it: their tags and assets are not rewritten, and what MIT granted for them is not revoked.

Every file now declares its copyright and licence, by an SPDX header or, for files that cannot hold one, in REUSE.toml. scripts/compliance.sh runs reuse lint with a planted-file selftest, and a CI workflow runs it with a pinned reuse. scripts/gates.sh still needs nothing installed.

Signing off contributions

Contributions now need a Developer Certificate of Origin sign-off. CONTRIBUTING.md gains a licence and sign-off section, covering git commit -s, how to add a missing sign-off, and the pause when someone else may own the work. .github/workflows/dco.yml fails a pull request that contains a commit with no sign-off for its author. No contributor licence agreement is asked.

The ACMM files

• ACMM L2: CLAUDE.md, .github/copilot-instructions.md and .cursor/rules/agents.mdc point at AGENTS.md; docs/prompts/README.md catalogs the skills; and docs/corrections.md with an empty corrections.jsonl gives the Correction Protocol's records a format.
• ACMM L3: the pull request acceptance metric in docs/metrics.md, the review rubric in docs/review-rubric.md, a test matrix on Linux and macOS, and the quality dashboard in docs/quality.md.
• ACMM L4 part a: SECURITY-AI.md, the AI security policy; change classification in docs/risk-tiers.md; pull requests labelled by path; the gates selftest every night; and docs/reflections/, filed cross-session lessons.

docs/acmm.md indexes the levels, naming the file that meets each criterion and the pull request that added it.

Branch and tag names, and more gates

scripts/check-branch-name is the one definition of an allowed name: <prefix>/<words> from a fixed prefix list, 40 characters at most, and v<major>.<minor>.<patch> for tags. .githooks/pre-push runs it before a push, and gate 13 selftests it. Among the other new gates, gate 12, scripts/check-hooks.py, checks that each rule in hooks/ parses and that each blocking rule fires on its planted cases. Gate 14 runs .githooks/commit-msg, which now also refuses Assisted-by: and Agent-<name>: trailers, against its test cases.

Also new

• orchestration/rounds.md, the rounds protocol, by which work is checked by a seat other than its author before it reaches the maintainer.
• docs/glossary.md, each term of art with the file that defines it, and docs/concepts.md, a concepts index.
• scripts/reorient names what it skips, and it now parses under bash 3.2.

Sources

Every claim above comes from the "0.5.0 (2026-10-27)" section of CHANGELOG.md.