docs: prepare v0.2.2 release

Author: a-a-k

CHANGELOG.md

@@ -1,5 +1,30 @@
 # Changelog
 
+## v0.2.2 - 2026-05-01
+
+Technical-preview patch release focused on post-audit hardening for the `v0.2.x` line.
+
+Included in this release:
+
+- clarified roadmap and assumptions docs so product priorities match the tracker-backed backlog
+- hardened `serve` with explicit HTTP read-header, read, write, and idle timeouts
+- fixed watch-loop error handling so filesystem watcher setup/add failures are reported and closed watcher channels do not spin
+- moved release workflow, Docker builder, and module toolchain pins to Go `1.26.2`
+- fixed Go `1.26` vet compatibility in contract policy errors
+- hardened the default Helm chart security context to run non-root, drop capabilities, and use a read-only root filesystem
+
+Stable within the `v0.2.2` preview:
+
+- the same strict `1.0.0` and `1.1.0` Bering contract acceptance introduced in `v0.2.0`
+- the same deterministic baseline comparison and advanced analysis behavior shipped in `v0.2.0`
+- release validation is clean under `go test`, `go vet`, chart validation, and `govulncheck`
+
+Still experimental in `v0.2.2`:
+
+- long-running `serve` / `watch` service mode remains technical-preview surface despite the hardening fixes
+- local `discover` helper
+- broader operator-facing packaging and operational conventions around image/chart deployment
+
 ## v0.2.1 - 2026-03-22
 
 Technical-preview patch release focused on post-release hardening for the `v0.2.0` line.

README.md

@@ -5,7 +5,7 @@
 [![ci-template-smoke](https://img.shields.io/github/actions/workflow/status/MB3R-Lab/Sheaft/ci-template-smoke.yml?branch=main&label=ci-template-smoke)](https://github.com/MB3R-Lab/Sheaft/actions/workflows/ci-template-smoke.yml)
 [![schema-contract](https://img.shields.io/github/actions/workflow/status/MB3R-Lab/Sheaft/schema-contract.yml?branch=main&label=schema-contract)](https://github.com/MB3R-Lab/Sheaft/actions/workflows/schema-contract.yml)
 [![Go version](https://img.shields.io/github/go-mod/go-version/MB3R-Lab/Sheaft)](https://github.com/MB3R-Lab/Sheaft/blob/main/go.mod)
-[![Status](https://img.shields.io/badge/status-technical_preview-orange)](https://github.com/MB3R-Lab/Sheaft/releases/tag/v0.2.1)
+[![Status](https://img.shields.io/badge/status-technical_preview-orange)](https://github.com/MB3R-Lab/Sheaft/releases/tag/v0.2.2)
 [![Bering support](https://img.shields.io/badge/Bering-1.0%20%7C%201.1-blue)](https://github.com/MB3R-Lab/Sheaft/blob/main/docs/compatibility-matrix.md)
 
 Sheaft is a downstream resilience posture engine and CI/CD gate for model artifacts produced by Bering or another compatible upstream producer.
@@ -21,9 +21,9 @@ It stays downstream of topology discovery. The public surface in this repository
 
 ## Stability / Release Status
 
-The current public release is `v0.2.1`. The `v0.2.x` line is an experimental public release and should be treated as a technical preview, not a stable GA release.
+The current public release is `v0.2.2`. The `v0.2.x` line is an experimental public release and should be treated as a technical preview, not a stable GA release.
 
-Stable within the `v0.2.1` technical preview:
+Stable within the `v0.2.2` technical preview:
 
 - strict acceptance of the baseline Bering contract line: `io.mb3r.bering.model@1.0.0` and `io.mb3r.bering.snapshot@1.0.0`
 - strict acceptance of the advanced Bering contract line: `io.mb3r.bering.model@1.1.0` and `io.mb3r.bering.snapshot@1.1.0`

docs/install.md

@@ -1,6 +1,6 @@
 # Install
 
-The current public technical preview is `v0.2.1`. Prefer release assets for evaluation and automation; use `go install` or `go build` as fallback paths.
+The current public technical preview is `v0.2.2`. Prefer release assets for evaluation and automation; use `go install` or `go build` as fallback paths.
 
 The machine-readable entrypoint for release consumers is `release-manifest.json`. It records exact archive names, checksums, image references, chart version, and the default config pack asset for a given release.
 

docs/roadmap.md

@@ -18,12 +18,12 @@ This file captures the repository-side audit refreshed on 2026-05-01: current Gi
 
 ## Release Tracking State
 
-- Latest public release shipped: [Sheaft v0.2.1 technical preview](https://github.com/MB3R-Lab/Sheaft/releases/tag/v0.2.1)
-- Historical shipped milestones: `v0.1.0 technical preview`, `v0.1.1 technical preview`, `v0.2.0 technical preview`, `v0.2.1 technical preview`
-- Active backlog milestone: `Post-v0.2.1 technical preview`
-- Previous release-tracking issue: [#80](https://github.com/MB3R-Lab/Sheaft/issues/80)
-- Current release-tracking issue: [#81](https://github.com/MB3R-Lab/Sheaft/issues/81)
-- GitHub issue and milestone sync was refreshed after the `v0.2.1` patch release so the tracker now reflects the shipped release state.
+- Latest public release shipped: [Sheaft v0.2.2 technical preview](https://github.com/MB3R-Lab/Sheaft/releases/tag/v0.2.2)
+- Historical shipped milestones: `v0.1.0 technical preview`, `v0.1.1 technical preview`, `v0.2.0 technical preview`, `v0.2.1 technical preview`, `v0.2.2 technical preview`
+- Active backlog milestone: `Post-v0.2.2 technical preview`
+- Previous release-tracking issue: [#81](https://github.com/MB3R-Lab/Sheaft/issues/81)
+- Current release-tracking issue: TBD after the `v0.2.2` release is published.
+- GitHub issue and milestone sync was refreshed after the `v0.2.2` patch release so the tracker now reflects the shipped release state.
 
 ## Audit Summary
 
@@ -182,6 +182,6 @@ Goal: make the Bering -> Sheaft workflow repeatable beyond a technical preview.
 
 ## Current Execution Note
 
-- Repository-side audit refreshed on 2026-05-01 after the `v0.2.1` technical-preview release and the product-capability backlog review.
-- GitHub issue [#71](https://github.com/MB3R-Lab/Sheaft/issues/71) should stay aligned with this file: latest release `v0.2.1`, active milestone `Post-v0.2.1 technical preview`, and the same trust-first priority order.
+- Repository-side audit refreshed on 2026-05-01 for the `v0.2.2` technical-preview patch release and the product-capability backlog review.
+- GitHub issue [#71](https://github.com/MB3R-Lab/Sheaft/issues/71) should stay aligned with this file: latest release `v0.2.2`, active milestone `Post-v0.2.2 technical preview`, and the same trust-first priority order.
 - The next highest-priority repo task is **R4.3: expand applicability boundaries into concrete do-not-trust signals and detector heuristics**.

release/v0.2.2.md

@@ -0,0 +1,35 @@
+## Sheaft v0.2.2
+
+`v0.2.2` is a technical-preview patch release for the `v0.2.x` line.
+
+### What changed
+
+- roadmap and limitation docs now align with the tracker-backed product backlog
+- `serve` now applies explicit HTTP read-header, read, write, and idle timeouts
+- watch-loop startup reports filesystem watcher setup/add errors instead of silently ignoring them
+- closed filesystem watcher channels no longer cause a tight zero-value receive loop
+- release workflow, Docker builder, and module toolchain pins now use Go `1.26.2`
+- contract policy errors are compatible with Go `1.26` vet checks
+- the default Helm chart security context now runs Sheaft as non-root, drops Linux capabilities, and uses a read-only root filesystem
+
+### Stable within 0.2.2
+
+- strict support for Bering `io.mb3r.bering.model@1.0.0` / `@1.1.0`
+- strict support for Bering `io.mb3r.bering.snapshot@1.0.0` / `@1.1.0`
+- deterministic batch analysis, baseline comparison, and CI gate behavior from the `v0.2.0` line
+- release validation is clean under `go test`, `go vet`, `govulncheck`, and chart validation
+
+### Experimental within 0.2.2
+
+- long-running `serve` / `watch` service mode remains technical-preview surface
+- local `discover` helper remains experimental
+- image/chart operational conventions are hardened but not promoted to a stable GA contract
+
+### Compatibility
+
+Sheaft `v0.2.2` remains compatible with these upstream contracts:
+
+- `io.mb3r.bering.model@1.0.0`
+- `io.mb3r.bering.snapshot@1.0.0`
+- `io.mb3r.bering.model@1.1.0`
+- `io.mb3r.bering.snapshot@1.1.0`