Releases are done by hand, so a refused commit can still be followed by a tag and a push #41

What happened (2026-10-01, releasing v0.1.6)

The release was done by hand, as every mindForge release has been: commit, version bump, annotated tag, push. The scrub hook refused the docs commit, correctly (a private word had gone into a TODO line). But the tag and push were on the next line of the same command. A here-document ends a command line, so the && chain stopped at the refused commit and the next line ran anyway.

v0.1.6 went public on the wrong commit, the code commit whose VERSION still said 0.1.5, for a few minutes. No release page existed yet and mindForge is not packaged anywhere, so nobody could have installed it. With the maintainer's OK the tag was deleted and put on the right commit.

Why a script, not more care

The order of a release is the same every time and checkable every time. A refused commit should make a wrong tag impossible, not merely unlikely. Asking for more care is the "better reminder" this method's own doctrine rejects: when a rule keeps breaking, change the shape of the work.

The fix: scripts/release.sh <version>

Runs under set -euo pipefail and refuses, with a reason and before anything is tagged or pushed, when:

• the version is not X.Y.Z
• the working tree has uncommitted or untracked changes
• the branch is not main, or it is behind or has diverged from origin/main
• VERSION in bin/mindforge is not the version being released
• docs/CHANGELOG.md has no ## vX.Y.Z entry
• the tag already exists, here or on GitHub
• bash testing/run-tests.sh does not pass

Only then does it make the annotated tag (its message is the changelog entry) and push main and the tag. The GitHub Release page, closing issues and the Vault entry stay human steps; the script prints them as a checklist at the end. Its output goes to logs/ with a -latest link and an OK last line.

Tests, in the failing direction: each refusal is triggered on a sandbox repo and must leave no tag, locally or on the remote; the one good run must tag the commit whose VERSION matches.