chore: prepare v0.2.4 release metadata

CHANGELOG.md

@@ -15,6 +15,131 @@ See the LICENSE file in the project root for full license text.
 
 # Changelog
 
+## 0.2.4 - Extensions, Diagnostics, and Release Gate Hardening
+
+ECLI v0.2.4 adds the Extensions Foundation, extension-backed syntax and theme
+integration, F4 diagnostics/linter architecture, OS/artifact-aware provisioning
+evidence, Linux official distro evidence audits, and release gate hardening.
+
+### Added
+
+- Added the curated Extensions Layer under `src/ecli/extensions/` with
+  data-only language, grammar, snippet, configuration, and theme assets.
+
+- Added extension manifest registry, package-data contract coverage, and
+  source-tree tests that reject raw VS Code runtime/source artifacts,
+  generated outputs, media/test assets, and misplaced extension roots.
+
+- Added extension-backed language detection, TextMate grammar catalog lookup,
+  syntax rendering, and multiline comment/string protection for editor text.
+
+- Added theme registry and theme bridge support for extension-backed themes,
+  including numbered theme migration coverage for the current configuration
+  model.
+
+- Added the F4 Diagnostics/Linter architecture with normalized diagnostics
+  models, provider registry, provider utilities, Ruff reference provider,
+  linter microservice metadata, parser coverage, and service/provider
+  selection tests.
+
+- Added OS/artifact-aware F4 linter provisioning contracts, provisioning
+  evidence generation/verification scripts, packaging hooks, and exact
+  21-artifact evidence coverage.
+
+- Added Linux F4 provisioning policy manifests, distro provenance catalog,
+  distro mapping evidence, official Debian evidence promotion, and official
+  evidence drift audit gates.
+
+### Changed
+
+- Project package version is `0.2.4`.
+
+- README now presents v0.2.4 as the current release and describes the
+  Extensions Layer, F4 Diagnostics/Linter architecture, provisioning evidence
+  gates, and current safety boundaries.
+
+- Release validation is separated into source/structural Gate 2, explicit
+  fail-closed built-artifact validation, and exact final GitHub Release asset
+  verification.
+
+- PyPI and GitHub Release publication ordering now requires successful built
+  artifact validation before publication jobs may run.
+
+- Release documentation now preserves the exact 21 ECLI-owned uploaded asset
+  contract, treats GitHub-generated source archives as outside that contract,
+  and keeps checksum sidecars as non-uploaded verification evidence.
+
+### Fixed
+
+- Removed agent-workspace files from the tracked repository and release
+  contract surface.
+
+- Stabilized v0.2.3 runtime/UX edge cases before adding the F4 and extension
+  layers.
+
+- Simplified CLI preload document handling while preserving editor open/create
+  semantics.
+
+- Prevented logging rollover errors from corrupting the TUI.
+
+### Safety Boundaries
+
+- Imported extension assets are data only; ECLI does not execute VS Code
+  extension runtime code.
+
+- F4 provisioning evidence gates are packaging/release contracts and do not
+  redesign the F4 panel UI.
+
+- Clean-machine Debian 13 installer validation has not yet been completed.
+  Repository tests and CI evidence do not replace that physical installation
+  test.
+
+## 0.2.3 - Panel Console Stabilization
+
+ECLI v0.2.3 is a Panel Console Stabilization release on top of the Services
+Foundation. It keeps the existing editor behavior intact, rejects full
+PTY/VT terminal emulator scope for ECLI 0.2.x, and replaces the fragile F11
+terminal experiment with an ECLI-owned PySH Console Panel.
+
+### Added
+
+- Added the F11 PySH Console Panel as the supported command-console panel
+  surface.
+
+- Added F12 focus switching between the editor and right-side panels.
+
+- Added deterministic PySH backend diagnostics and console builtins for `cd`,
+  `pwd`, `clear`, and `exit`.
+
+- Added command cancellation coverage for the console backend path.
+
+### Changed
+
+- PySH is used as a subprocess argv backend only; command execution uses safe
+  argv construction rather than shell interpolation.
+
+- The release explicitly rejects full PTY terminal emulation, VT parsing,
+  xterm behavior, fullscreen terminal application scope, PySH source migration,
+  and PySH monorepo conversion.
+
+- The official GitHub Release asset contract is exactly 21 clean public asset
+  names. Numeric public prefixes were documented as a v0.2.3 staging mistake
+  and are rejected by the release asset verifier after repair.
+
+### Fixed
+
+- Stabilized F11 panel open/focus behavior and F12 editor/panel focus routing.
+
+- Preserved service-panel safety boundaries: System Doctor remains read-only,
+  Command Plan output remains draft/preview-only, and privileged remediation is
+  not enabled.
+
+### Safety Boundaries
+
+- No full PTY/VT terminal emulator is included.
+
+- No VMLab, QEMU, QMP, or privileged remediation runtime scope is included.
+
 ## 0.2.2 - Packaged Runtime Startup Fixes
 
 ### Fixed

README.md

@@ -51,9 +51,9 @@ See the LICENSE file in the project root for full license text.
 
 ## 🚀 About ECLI
 
-**ECLI** (Editor CLI) is a terminal-first engineering operations workbench. It combines a curses-based editor with right-side workflow panels and a typed service foundation for configuration, project discovery, command-plan previews,policy checks, audit logging, privileged-action refusal paths, and read-only system diagnostics.
+**ECLI** (Editor CLI) is a terminal-first engineering operations workbench. It combines a curses-based editor with right-side workflow panels and a typed service foundation for configuration, project discovery, command-plan previews, policy checks, audit logging, privileged-action refusal paths, and read-only system diagnostics.
 
-The v0.2.3 release is a Panel Console Stabilization layer on top of the Services Foundation. It keeps the Services Foundation editor behavior intact, rejects full PTY terminal emulation for ECLI 0.2.x, and replaces the fragile F11 terminal experiment with an ECLI-owned PySH Console Panel. PySH is used as a command execution backend only; this release does not execute remediation, apply command plans, launch VMLab runtimes, add QEMU/QMP runtime scope, migrate PySH source, or perform real privileged operations.
+The v0.2.4 release layers the Extensions Foundation, extension-backed TextMate rendering, the F4 Diagnostics/Linter architecture, and release gate hardening on top of the Services Foundation and v0.2.3 Panel Console Stabilization work. It keeps the existing editor and service-panel safety model intact while adding curated extension assets, deterministic syntax/theme adapters, F4 linter provisioning contracts, Linux official evidence drift checks, and separated release validation gates.
 
 ### ✨ Key Features
 
@@ -491,7 +491,7 @@ Master ECLI with these essential keyboard shortcuts. Press `F1` anytime inside t
 | `Insert` | Toggle Insert / Overwrite mode |
 | `F12` | Switch focus between editor and panels |
 
-The right side of the editor hosts workflow panels. The v0.2.3 panel-console stabilization keeps service panels read-only or preview-only: System Doctor does not mutate host state, Command Plan previews do not execute, the Services panel reports composition status, F11 opens or focuses the PySH Console Panel, and F12 switches focus between the editor and panels.
+The right side of the editor hosts workflow panels. The v0.2.4 release keeps service panels read-only or preview-only: System Doctor does not mutate host state, Command Plan previews do not execute, the Services panel reports composition status, F4 opens the Diagnostics/Linter panel, F11 opens or focuses the PySH Console Panel, and F12 switches focus between the editor and panels.
 
 ### Minimal Service CLI
 
@@ -572,12 +572,22 @@ Complete documentation is organized by audience:
 
 ## 🏗️ Architecture
 
-ECLI v0.2.3 keeps the existing editor/TUI behavior and Services Foundation infrastructure, then adds Panel Console Stabilization for the ECLI-owned PySH Console Panel:
+ECLI v0.2.4 keeps the existing editor/TUI behavior, Services Foundation infrastructure, and Panel Console Stabilization baseline, then adds the Extensions Foundation, TextMate-backed syntax rendering, and F4 Diagnostics/Linter architecture:
 
 * **Core Editor**: curses-based terminal editor with async task integration
 
 * **Right-Side Panels**: Help, Diagnostics/Lint, AI Code Assistant, System Doctor, Git, File Manager, Services, and Command Plan previews
 
+* **Extensions Layer**: curated data-only language and theme assets under `src/ecli/extensions/`, consumed through deterministic ECLI adapter code
+
+* **Syntax Service**: extension-backed language detection, TextMate grammar catalog lookup, scope rendering, and multiline comment/string protection
+
+* **Theme Registry**: extension-backed theme registry and bridge with numbered theme selection and migration compatibility
+
+* **F4 Diagnostics/Linter**: normalized diagnostics service, provider registry, Ruff reference provider, and linter microservice metadata under `src/ecli/extensions/linters/`
+
+* **F4 Provisioning Contracts**: OS/artifact-aware linter provisioning evidence gates, Linux official distro evidence, and exact 21-artifact coverage for release readiness
+
 * **PySH Console Panel**: F11 opens or focuses an ECLI-owned command console panel backed by PySH subprocess execution
 
 * **ConfigService**: typed layered configuration loading
@@ -596,7 +606,7 @@ ECLI v0.2.3 keeps the existing editor/TUI behavior and Services Foundation infra
 
 * **ServiceRegistry**: explicit composition root without global service-locator state
 
-**Safety boundaries for v0.2.3:**
+**Safety boundaries for v0.2.4:**
 
 * SystemDoctor is read-only.
 
@@ -606,11 +616,15 @@ ECLI v0.2.3 keeps the existing editor/TUI behavior and Services Foundation infra
 
 * Service panels are visible in the UI but do not execute remediation.
 
+* Imported extension assets are data-only; ECLI does not execute VS Code extension runtime code.
+
+* F4 provisioning evidence gates are release/packaging contracts and do not change F4 panel UI behavior.
+
 * Full PTY terminal emulation, VT parsing, xterm behavior, and raw interactive PySH inside curses are not included.
 
 * PySH is used as a command execution backend only; PySH source migration and monorepo conversion are not included.
 
-* VMLab runtime behavior, QEMU runtime scope, and QMP runtime scope are not included in v0.2.3.
+* VMLab runtime behavior, QEMU runtime scope, and QMP runtime scope are not included in v0.2.4.
 
 For detailed architecture information, see [Architecture Overview](https://github.com/SSobol77/ecli/blob/main/docs/architecture/current-architecture.md).
 

docs/architecture/command-plan-service.md

@@ -906,7 +906,7 @@ Required schema:
   "source": "user",
   "details": {},
   "metadata": {
-    "ecli_version": "0.2.3",
+    "ecli_version": "0.2.4",
     "schema_revision": "audit-v1"
   }
 }

docs/install/windows.md

@@ -60,7 +60,7 @@ For source/development builds on Windows, install:
 PowerShell checksum verification should be performed before first execution:
 
 ```powershell
-$version = "0.2.3"
+$version = "0.2.4"
 $file = "ecli_${version}_win_x86_64_setup.exe"
 $expected = (Get-Content "$file.sha256" -Raw).Trim().Split()[0]
 $actual = (Get-FileHash -Algorithm SHA256 -LiteralPath $file).Hash.ToLowerInvariant()

docs/release/README-release.md

@@ -46,6 +46,7 @@ Authoritative files:
 - `release-process.md`
 - `release-checklist.md`
 - `artifact-verification.md`
+- `v0.2.4.md`
 - `v0.2.3.md`
 - `v0.2.2.md`
 - `v0.2.1.md`