Make release validation portable

docs/releases/v0.10.0.md

@@ -0,0 +1,140 @@
+# Weatherreporter v0.10.0
+
+Weatherreporter `v0.10.0` makes report execution stateless, adds stable
+weather-specific Promptkit profiles, and turns every successful generation
+into one atomic operator-owned Markdown output.
+
+## Summary
+
+- Ordinary generation no longer creates or depends on a managed workspace,
+  historical run artifacts, metadata, receipts, or prior snapshots.
+- `generate` and `run` now publish directly to operator-selected paths, with
+  useful current-directory defaults when output flags are omitted.
+- Local Recent Changes comparison and the historical `inspect` command family
+  have been removed.
+- Promptkit `v0.5.0` and three embedded logical profiles provide a stable model
+  ladder with complete file- or directory-based overrides.
+- Prompt input and generated-text contracts have been tightened, and output,
+  cancellation, batch preflight, notification, and partial-failure behavior
+  have focused offline coverage.
+
+## Compatibility
+
+This pre-`v1` minor release intentionally breaks CLI, configuration,
+prompt-input, action-summary, and workspace contracts from `v0.9.0`.
+
+- The `workspace:` and `recent_change:` configuration sections are no longer
+  supported. Strict configuration loading rejects them.
+- The `inspect reports`, `inspect metadata`, `inspect modules`,
+  `inspect data-package`, `inspect prior`, and `inspect sources` commands have
+  been removed. Weatherreporter no longer reads V1 or V2 run metadata or other
+  historical workspace artifacts.
+- Every successful `generate` writes exactly one Markdown file. Without
+  `--out`, Daily writes `daily-YYYY-MM-DD.md` and Today, Tomorrow, and Hourly
+  write `today.md`, `tomorrow.md`, and `hourly.md` in the invocation's current
+  directory. `--out` selects that file rather than creating an extra copy of a
+  separately managed report.
+- `run` writes selected outputs beneath the current directory unless
+  `--out-dir` selects another directory. Successful items remain available
+  when another batch item fails.
+- Action summaries no longer expose managed report, metadata, snapshot, data
+  package, prompt preparation, prompt execution, generated-text, render-context,
+  or notification-receipt paths. They retain the final `outputPath`, optional
+  `llmDebugPath`, safe effective profile/backend/model details, validation,
+  warnings, notification status, and safe errors.
+- Batch report items no longer contain per-report notification fields. Batch
+  notification is represented once at the top level. The `total`, `succeeded`,
+  and `failed` counters describe reports only, so notification failure can
+  produce a failed action while `failed` remains `0`.
+- The prompt data package advances from `weatherreporter.data_package.v3` to
+  `weatherreporter.data_package.v4` and removes `recent_changes`. All four
+  embedded prompts advance from `1.1.0` to `2.0.0`.
+- Generated-text schemas now require string-valued `precipitation_timing`; the
+  model returns an empty string when there is no timing text. The unused
+  `confidence` field has been removed and is rejected as an unknown field.
+
+Existing operator-owned Markdown files remain valid. Existing workspace trees
+are ignored rather than migrated or deleted. Distributor continues to receive
+the completed Markdown report, but its source is now the selected operator
+output rather than a managed report copy.
+
+## Upgrade
+
+Before replacing `v0.9.0`:
+
+1. Remove `workspace:` and `recent_change:` from configuration files.
+2. Give scheduled commands a predictable working directory or explicit
+   `--out` or `--out-dir` destination. Confirm that these selected files may be
+   atomically replaced on later successful runs.
+3. Remove historical `inspect` invocations and update action-summary consumers
+   to use `outputPath` and the remaining active-workflow fields.
+4. Decide whether old workspace contents have any external retention value.
+   Weatherreporter no longer reads them; after review, they may be removed
+   manually using the narrowly scoped procedure in the operations guide.
+5. Review Promptkit profile selection and credentials. Hourly defaults to
+   `weather-light`; Daily, Today, and Tomorrow default to `weather-balanced`.
+   A configured `promptkit.profile` still overrides every report in one action.
+
+The embedded logical profiles are:
+
+| Profile | OpenRouter model | Default use |
+| --- | --- | --- |
+| `weather-light` | `deepseek/deepseek-v4-flash` | Hourly |
+| `weather-balanced` | `~google/gemini-flash-latest` | Daily, Today, Tomorrow |
+| `weather-deep` | `~anthropic/claude-sonnet-latest` | Explicit selection |
+
+Override a complete same-ID definition through `promptkit.profile_file` or
+`promptkit.profile_dir` to use different models or a local OpenAI-compatible
+endpoint. Definitions are replaced rather than field-merged, and a malformed
+matching override fails instead of silently falling back.
+
+See the [CLI reference](../cli.md), [configuration
+reference](../config.md), [operations guide](../operations.md), and [Promptkit
+integration](../integrations/promptkit.md) for the exact current contracts.
+
+## Changes
+
+### Stateless Execution And Operator-Owned Outputs
+
+- Removed local forecast-change comparison, prior-snapshot selection, durable
+  module and prompt artifacts, managed reports, metadata compatibility, run
+  discovery, notification receipts, and the complete `internal/state`
+  subsystem.
+- Added an Accepted architecture decision recording the stateless
+  transformation pipeline and operator-owned output boundary.
+- Kept weather, facts, modules, prompt input, generated text, and render context
+  in memory during ordinary execution.
+- Made output publication atomic and ensured cancellation or deadline expiry
+  observed before publication leaves an existing destination unchanged.
+- Added complete batch-destination preflight before the first report prompt,
+  so a structural collision cannot leave an unreported partial batch.
+- Preserved successful outputs after report or Distributor failure. Batch
+  notification runs only after every selected report succeeds.
+
+### Promptkit Profiles And Prompt Contracts
+
+- Upgraded Promptkit from `v0.4.0` to `v0.5.0`.
+- Added embedded `weather-light`, `weather-balanced`, and `weather-deep`
+  profiles and mapped each exact prompt to its logical default.
+- Added embedded-profile fallback after configured `profile_file` or
+  `profile_dir` lookup, allowing operators to replace a logical profile without
+  changing report definitions.
+- Added a maintained local-endpoint example for replacing `weather-light`.
+- Advanced the four prompt definitions to `2.0.0` and the curated data package
+  to v4 after removing Recent Changes.
+- Required `precipitation_timing`, normalized whitespace-only timing to an
+  empty string, and removed the unused confidence value.
+
+### CLI, Reliability, Documentation, And Testing
+
+- Simplified action summaries to active workflow identity, output, model,
+  validation, warning, debug, notification, and safe error information.
+- Made batch counters report-only while retaining failed action status and
+  non-zero exit behavior for batch notification failure.
+- Kept prompt and profile inspection ahead of weather collection and validated
+  every batch candidate before collecting once.
+- Replaced state-oriented workflow fixtures with focused generation, batch,
+  output, cancellation, profile-resolution, Distributor, and CLI coverage.
+- Reconciled user, operator, integration, internal, policy, and ADR
+  documentation around the implemented stateless architecture and removed
+  completed temporary roadmaps.

docs/releases/v0.10.1.md

@@ -0,0 +1,33 @@
+# Weatherreporter v0.10.1
+
+This release repairs release validation after the `v0.10.0` pipeline failed in
+its privileged build container. Application behavior is unchanged from
+`v0.10.0`.
+
+## Summary
+
+The unreadable-secret configuration test now verifies that its process is
+actually subject to file permission bits before asserting that a mode-`000`
+file cannot be read. This keeps the test meaningful for ordinary users while
+allowing the release suite to run correctly in privileged containers.
+
+## Compatibility
+
+This patch release makes no changes to Weatherreporter's CLI, configuration,
+report output, integrations, prompts, profiles, or operating behavior. It is
+fully compatible with `v0.10.0`.
+
+## Upgrade
+
+No special operator action is required. Use `v0.10.1` in place of `v0.10.0`;
+the `v0.10.0` tag remains immutable, but its failed pipeline did not publish
+release binaries.
+
+## Changes
+
+- Made the unreadable-secret test capability-aware when the test process can
+  bypass filesystem permission bits.
+- Preserved the production contract that genuinely unreadable secret files
+  fail configuration loading.
+- Restored portable release validation in Woodpecker's privileged Go
+  container.

internal/config/config_test.go

@@ -1674,6 +1674,9 @@ func TestLoadSecretsRejectsInvalidDirectoryEntries(t *testing.T) {
 				t.Cleanup(func() {
 					_ = os.Chmod(path, 0o600)
 				})
+				if _, err := os.ReadFile(path); err == nil {
+					t.Skip("test process can read files without permission bits")
+				}
 			},
 			wantErr: "read secret file",
 		},