chore(release): prepare v0.1.0 tag + crates.io publish path (#146)

Add dated CHANGELOG [0.1.0], cutting-a-release runbook, publish metadata,
and version+path CLI deps. klipdot-capture stays publish=false for this cut.

Co-authored-by: KooshaPari <koosha@example.com>
Co-authored-by: Cursor <cursoragent@cursor.com>

Author: 3 people

CHANGELOG.md

@@ -16,6 +16,34 @@ All notable changes to this project will be documented in this file.
 
 ### Security
 
+## [0.1.0] - 2026-07-20
+
+First crates.io-ready workspace release for the Rust journey harness.
+
+### Added
+
+- Release operator runbook: [`docs/guides/cutting-a-release.md`](docs/guides/cutting-a-release.md)
+  (tag `v0.1.0` + ordered `cargo publish` for core → observability → CLI).
+- Publish-ready package metadata on `phenotype-journey-core`,
+  `phenotype-journeys-observability`, and `phenotype-journey` (authors,
+  homepage, keywords, categories, readme).
+- Version+path dependency wiring so the CLI can publish after its library
+  crates are on crates.io.
+
+### Changed
+
+- `klipdot-capture` remains `publish = false` for this cut (local KlipDot
+  daemon; not part of the journey harness crates.io surface).
+
+### Notes
+
+- T0 honesty still applies until T2 publish completes: prefer path/git
+  install (`cargo install --path bin/phenotype-journey` /
+  `cargo install --git …`). Do not advertise crates.io install until
+  `cargo publish` for the three crates above succeeds.
+- npm packages (`@phenotype/journey-viewer`, etc.) stay on the GitHub
+  Packages path — see `npm/PUBLISHING.md`.
+
 ## 🐛 Bug Fixes
 - Fix(journey-viewer): pin lightbox toolbar so caption expansion never clips controls
 

README.md

@@ -28,11 +28,11 @@
 | crates.io | **Not published** — do not use `cargo install phenotype-journey` / `cargo add phenotype-journey-core` |
 | npm | **Not on public npmjs.com**; GitHub Packages publish is documented but packages may be absent — prefer path/git |
 | Install path | from source — see [Install](#install) |
-| Focus | T0 — install/publish honesty + safe Dependabot cargo bumps |
+| Focus | T0 honesty (path/git) → T1 tag `v0.1.0` → T2 crates.io (see [cutting-a-release](docs/guides/cutting-a-release.md)) |
 
 > Honest gap: local `cargo test --locked` is the verification gate. End-user
-> install is path/git only until a tagged release and crates.io (Rust) /
-> registry (npm) publish land (T1).
+> install is path/git only until a tagged release **and** crates.io publish
+> land ([cutting-a-release](docs/guides/cutting-a-release.md)).
 
 # phenotype-journeys
 

bin/phenotype-journey/Cargo.toml

@@ -4,7 +4,13 @@ version.workspace = true
 edition.workspace = true
 license.workspace = true
 repository.workspace = true
+authors.workspace = true
+homepage = "https://github.com/KooshaPari/phenotype-journeys"
+readme = "../../README.md"
 description = "CLI for recording, validating, verifying and syncing Phenotype journey manifests"
+keywords = ["journey", "manifest", "verification", "phenotype", "cli"]
+categories = ["command-line-utilities", "development-tools"]
+# Publish last (after core + observability) — see docs/guides/cutting-a-release.md.
 
 [[bin]]
 name = "phenotype-journey"
@@ -15,8 +21,9 @@ default = []
 vision = ["phenotype-journey-core/vision"]
 
 [dependencies]
-phenotype-journey-core = { path = "../../crates/phenotype-journey-core" }
-phenotype-journeys-observability = { path = "../../crates/phenotype-journeys-observability" }
+# version+path: local builds use path; crates.io publish resolves version.
+phenotype-journey-core = { version = "0.1.0", path = "../../crates/phenotype-journey-core" }
+phenotype-journeys-observability = { version = "0.1.0", path = "../../crates/phenotype-journeys-observability" }
 tracing = "0.1"
 clap = { workspace = true }
 serde_json = { workspace = true }

crates/klipdot-capture/Cargo.toml

@@ -6,6 +6,9 @@ license.workspace = true
 repository.workspace = true
 authors.workspace = true
 description = "KlipDot daemon: terminal image interceptor and clipboard processor"
+# Not part of the journey harness crates.io surface for 0.1.0.
+# Local/path install only until a dedicated KlipDot publish cut.
+publish = false
 
 [dependencies]
 tokio = { version = "1.52", features = ["full", "process"] }

crates/phenotype-journey-core/Cargo.toml

@@ -4,7 +4,13 @@ version.workspace = true
 edition.workspace = true
 license.workspace = true
 repository.workspace = true
+authors.workspace = true
+homepage = "https://github.com/KooshaPari/phenotype-journeys"
+readme = "../../README.md"
 description = "Shared types and verification logic for Phenotype journey manifests"
+keywords = ["journey", "manifest", "verification", "phenotype", "cli"]
+categories = ["development-tools", "command-line-utilities"]
+# First crates.io publish is T2 after tag v0.1.0 — see docs/guides/cutting-a-release.md.
 
 [dependencies]
 serde = { workspace = true }

crates/phenotype-journeys-observability/Cargo.toml

@@ -4,7 +4,13 @@ version.workspace = true
 edition.workspace = true
 license.workspace = true
 repository.workspace = true
+authors.workspace = true
+homepage = "https://github.com/KooshaPari/phenotype-journeys"
+readme = "../../README.md"
 description = "OTel/OTLP observability for the phenotype-journeys workspace"
+keywords = ["opentelemetry", "otlp", "tracing", "phenotype", "observability"]
+categories = ["development-tools", "development-tools::debugging"]
+# Publish after phenotype-journey-core — see docs/guides/cutting-a-release.md.
 
 [dependencies]
 # Standard tracing facade + OTLP exporter (no external git dep required)

docs/guides/cutting-a-release.md

@@ -0,0 +1,108 @@
+# Cutting a phenotype-journeys release
+
+Operator runbook for tagging `v0.1.0` (T1) and publishing Rust crates to
+crates.io (T2). Do **not** run these until `main` has the release-ready
+CHANGELOG section and local quality gates are green.
+
+T0 honesty still applies until T2 completes: end-user install remains
+**path/git only** — do not advertise `cargo install phenotype-journey` /
+`cargo add phenotype-journey-core` until crates.io publish succeeds.
+
+## Preconditions
+
+```bash
+cd /path/to/phenotype-journeys   # worktree or canonical after merge
+git checkout main
+git pull --rebase origin main
+cargo test --locked
+cargo clippy --workspace --all-targets --locked -- -D warnings
+grep -A2 '## \[0.1.0\]' CHANGELOG.md   # section must exist with a date
+```
+
+Confirm root `Cargo.toml` `workspace.package.version = "0.1.0"` matches the
+CHANGELOG heading.
+
+## Publish order (crates.io)
+
+Publish in dependency order. Do **not** publish `klipdot-capture` in this
+release (`publish = false` — local KlipDot daemon, not part of the journey
+harness crates.io surface).
+
+| Order | Crate | Notes |
+|------:|-------|-------|
+| 1 | `phenotype-journey-core` | No workspace path deps |
+| 2 | `phenotype-journeys-observability` | No workspace path deps |
+| 3 | `phenotype-journey` | Depends on (1) and (2) via version+path |
+
+## T1 — git tag + GitHub Release (no crates.io yet)
+
+Exact commands (annotated tag preferred):
+
+```bash
+git tag -a v0.1.0 -m "phenotype-journeys v0.1.0"
+git push origin v0.1.0
+
+gh release create v0.1.0 \
+  --title "v0.1.0" \
+  --notes-file <(sed -n '/## \[0.1.0\]/,/^## \[/p' CHANGELOG.md | sed '$d')
+```
+
+Alternate notes from the tag:
+
+```bash
+gh release create v0.1.0 --title "v0.1.0" --notes-from-tag
+```
+
+Publishing the GitHub Release triggers
+[`.github/workflows/release-attestation.yml`](../../.github/workflows/release-attestation.yml)
+(SLSA build attestation). GitHub Actions billing may block the run — treat
+attestation as best-effort; do not block crates.io publish on Actions green.
+
+Do **not** run `cargo publish` in T1.
+
+## T2 — crates.io publish
+
+After the tag exists on the release commit:
+
+```bash
+cargo login          # once per machine / token
+
+# Pre-T2 local check (path deps): CLI builds without needing crates.io yet
+cargo build -p phenotype-journey --locked
+
+# 1) library (types + verify)
+cargo publish -p phenotype-journey-core --dry-run --locked
+cargo publish -p phenotype-journey-core --locked
+
+# 2) observability adapter
+cargo publish -p phenotype-journeys-observability --dry-run --locked
+cargo publish -p phenotype-journeys-observability --locked
+
+# 3) CLI — dry-run only works AFTER 1+2 are indexed on crates.io.
+# Before that, expect: "no matching package named `phenotype-journey-core`".
+# Wait a few seconds / retry if the index lags.
+cargo publish -p phenotype-journey --dry-run --locked
+cargo publish -p phenotype-journey --locked
+```
+
+After a successful publish:
+
+1. Prefer `cargo install phenotype-journey --locked` / `cargo add phenotype-journey-core` in README Install.
+2. Update Work State: crates.io = published; keep git tag / Release as done.
+3. npm packages remain on the separate GitHub Packages path (`npm/PUBLISHING.md`).
+
+## Rollback / mistakes
+
+- Wrong tag before push: `git tag -d v0.1.0` (local only).
+- Wrong tag already pushed: do **not** force-delete without explicit operator
+  approval; prefer a patch tag (`v0.1.1`) and a forward CHANGELOG entry.
+- Never `cargo publish` a version that does not match the git tag / CHANGELOG.
+- crates.io versions are immutable — yank only for severe breakage, then ship
+  a patch.
+
+## Related
+
+- [CHANGELOG.md](../../CHANGELOG.md)
+- [docs/slsa.md](../slsa.md) — attestation / provenance
+- [README.md](../../README.md) — install honesty until crates.io lands
+- [npm/PUBLISHING.md](../../npm/PUBLISHING.md) — npm / GitHub Packages