chore(release): cut development bundle 0.9.5

.gds/bundle.lock.yaml

@@ -2,17 +2,17 @@
 schema_version: 1
 
 bundle:
-  version: "0.9.4-dev"
+  version: "0.9.5-dev"
   release_sequence: 0
   channel: "development"
-  source_tree_digest: "sha256:50743872ba177cd8a1b293d497e4c2f03a21a46b9b6040594e4fb8c3fff755d5"
-  digest: "sha256:215167d571f0a4be0d1af3567bd49396b6069d604905dac742a6d2f633e51858"
+  source_tree_digest: "sha256:6ffdbaca9dc9d603dd6de84164054519389bd54105f2c3ae0bf0fba9eba3a846"
+  digest: "sha256:06908acd8c596322e668ba10b8c0a2a85cd57d90abda7796fd94355af36f44a5"
 
 projection:
-  input_digest: "sha256:dc9842379e787b40c7e71830122e78ef4181c00d5d8aea46a6e5f861be631cef"
-  output_digest: "sha256:b05e1cdccfa2f91c474e16d065df790645d48f6d35854b2939b31a8b07864e72"
+  input_digest: "sha256:4cc633f5be3c7a23262adc6c07f531dd09dd7c9266143e68e9692e372fecf649"
+  output_digest: "sha256:f0ab441dee5add6f3d940768b32f1ee6f96036786d66da12b0d6b109d814cbdb"
   files:
     - path: ".gds/compiled-policy.json"
-      digest: "sha256:37ece9020fd9eeed4ee90582600c5e50cb3a7e32ee773719d1ccfad2d9cd1b6d"
+      digest: "sha256:53a401917322b46ed1c05ee977492fd27f8458af0ca2f6afd8cfe963953ed933"
     - path: ".github/workflows/gds-ci.yml"
-      digest: "sha256:6aac2541813495a8e06db7c5ba36ab666b1d4cf89c207abd9e7394e9031f3ec9"
+      digest: "sha256:5350147b601df89a4539189cad9efd68e8cdbb2e83f3491312172f9afcb731fd"

.gds/compiled-policy.json

@@ -2,8 +2,8 @@
   "schema_version": 1,
   "compiled_policy": {
     "repository_id": "repo_01M0EZ7TB3KNXNSP78Z8M64WXG",
-    "bundle_version": "0.9.4-dev",
-    "digest": "sha256:1b0f8c63bd653f2ff4f2478acd77ed18785a1591d801d51171df93aa7a280092"
+    "bundle_version": "0.9.5-dev",
+    "digest": "sha256:b2af473de6ff13bf6b0eb5339437d82f49f923bdbbb81b22f74cfdea6ab1ef37"
   },
   "sources": [
     {

.github/workflows/gds-ci.yml

@@ -1,8 +1,8 @@
 # GENERATED FILE - DO NOT EDIT DIRECTLY
 # generator: gds
-# bundle: 0.9.4-dev
-# source-tree-digest: sha256:50743872ba177cd8a1b293d497e4c2f03a21a46b9b6040594e4fb8c3fff755d5
-# input-digest: sha256:dc9842379e787b40c7e71830122e78ef4181c00d5d8aea46a6e5f861be631cef
+# bundle: 0.9.5-dev
+# source-tree-digest: sha256:6ffdbaca9dc9d603dd6de84164054519389bd54105f2c3ae0bf0fba9eba3a846
+# input-digest: sha256:4cc633f5be3c7a23262adc6c07f531dd09dd7c9266143e68e9692e372fecf649
 # output-digest: sha256:b9bf3d0c64c0fb371596e7d090e82e62aebbfde91929115fc15fb28644e4fd38
 # edit-source:
 #   - .gds/repository.yaml

CHANGELOG.md

@@ -5,6 +5,8 @@ Versioning.
 
 ## [Unreleased]
 
+## [0.9.5] - 2026-09-15
+
 - Surface the registered device and its `class` (`profile`/`gui`/`docker_mode`/
   `execution_policy`) on `gds context` from the device-local locator bound to
   exactly one `estate/devices/*.yaml`. `gds-orient` reads `context.device`
@@ -22,6 +24,18 @@ Versioning.
 - Record extra-approval false on `main` and pin reusable workflows to current
   module mains.
 
+## [0.9.4] - 2026-09-13
+
+- Validate release evidence before the expensive build gates.
+- Run the full race suite once per release gate.
+
+## [0.9.3] - 2026-09-13
+
+- Make device onboarding consistent and refresh the release toolchain.
+- Validate formatting with the selected Go toolchain.
+- Cover Intel macOS and consume the reviewed workflow library.
+- Refresh generated fixtures and portable Python dependency locks.
+
 ## [0.9.2] - 2026-09-12
 
 - Add a public, exact-attempt harness evidence producer that rejects private

README.md

@@ -73,6 +73,9 @@ seed Go toolchain + `gds` build, and the control-plane staged commands in
 order, with plan/apply gates at each boundary. See
 `docs/runbooks/bootstrap-device.md` for the seam.
 
+`gds context --json` reports `context.device` when the device-local locator
+binds a descriptor.
+
 ## Verification
 
 ```bash

core/cli/root.go

@@ -22,7 +22,7 @@ import (
 // Version is the development default; a release build overrides it with the
 // exact tag via -X. It carries the -dev suffix so an unstamped binary can
 // never claim to be a released one.
-var Version = "0.9.4-dev"
+var Version = "0.9.5-dev"
 
 type options struct {
 	json    bool

core/cmd/gds-controller/main.go

@@ -25,7 +25,7 @@ import (
 
 // version is the development default; the release builder stamps the exact
 // tag via -X main.version. The -dev suffix keeps an unstamped binary honest.
-var version = "0.9.4-dev"
+var version = "0.9.5-dev"
 
 func main() {
 	ctx, stop := signal.NotifyContext(

core/compiler/types.go

@@ -12,7 +12,7 @@ import (
 // policy-owner checkout. It tracks the current release line with a -dev
 // suffix so a development bundle is dated honestly; the development channel
 // field, not this string, is what classifies the bundle.
-const DevelopmentBundleVersion = "0.9.4-dev"
+const DevelopmentBundleVersion = "0.9.5-dev"
 
 type PolicySource struct {
 	SchemaVersion int               `json:"schema_version"`

docs/contracts/estate-v1.md

@@ -187,6 +187,10 @@ the descriptor's intent and the OS installer it drives cannot disagree. The
 profile/OS consistency and never mutate configuration. The phased bootstrap seam
 that consumes this block is documented in `docs/runbooks/bootstrap-device.md`.
 
+`gds context` binds the device-local locator `device_id` to exactly one
+`estate/devices/*.yaml` as `context.device` (including `class`). A missing
+locator omits the field; context never infers a device from hostname or cwd.
+
 No validator fixes configuration automatically.
 
 Changing a device workspace-root mapping updates desired placement only. GDS

docs/runbooks/bootstrap-device.md

@@ -60,6 +60,10 @@ Cross-field rules are enforced by the schema validator
 `modules/macos-ubuntu-bootstrap/scripts/bootstrap.sh`. A descriptor that omits
 `class:` stays valid and defaults to desktop.
 
+`gds context` binds the device-local locator `device_id` to exactly one
+`estate/devices/*.yaml` as `context.device` (including `class`). A missing
+locator omits the field; context never infers a device from hostname or cwd.
+
 The bootstrap contract also defines the execution seam between classes. A
 `desktop` may run an explicit command on a separately provisioned `server`
 through `modules/macos-ubuntu-bootstrap/scripts/remote-exec.sh`; both

tests/golden/projections/control-plane/.claude/CLAUDE.md

@@ -1,9 +1,9 @@
 <!--
 GENERATED FILE - DO NOT EDIT DIRECTLY
 generator: gds
-bundle: 0.9.4-dev
+bundle: 0.9.5-dev
 source-tree-digest: sha256:0000000000000000000000000000000000000000000000000000000000000001
-input-digest: sha256:c2fad19143a9132f67605c3ba10775dc1e4e0e9fa1a06f335f7ce4891a02aba5
+input-digest: sha256:89a52fd2369d66a4ffc91fe26f958e2c44354e23c036a6b48ad16cf90462d31a
 output-digest: sha256:88cb57297d8d713287872a8afaca8d42f7146ecf7a091e4996e65eee8f962665
 edit-source:
   - .gds/repository.yaml

tests/golden/projections/control-plane/.gds/bundle.lock.yaml

@@ -2,21 +2,21 @@
 schema_version: 1
 
 bundle:
-  version: "0.9.4-dev"
+  version: "0.9.5-dev"
   release_sequence: 0
   channel: "development"
   source_tree_digest: "sha256:0000000000000000000000000000000000000000000000000000000000000001"
-  digest: "sha256:10ac7ebfa7ab684a862bc94b56fe7b5088b1c3e8331f0ada387567d7270a60a7"
+  digest: "sha256:2b9f7d6d69542bed93f147a7d884541e93e6c95efcb4c0c4711c8c8f84c4e79b"
 
 projection:
-  input_digest: "sha256:c2fad19143a9132f67605c3ba10775dc1e4e0e9fa1a06f335f7ce4891a02aba5"
-  output_digest: "sha256:1306eaf3160de36e18996ae43c959c668117eaea95af65f7f2c72e18f99e399a"
+  input_digest: "sha256:89a52fd2369d66a4ffc91fe26f958e2c44354e23c036a6b48ad16cf90462d31a"
+  output_digest: "sha256:f76240b8d9197d3b80801a93c6c5c43d807e2e5b1bb2b69b1b1035014685a1e9"
   files:
     - path: ".claude/CLAUDE.md"
-      digest: "sha256:7d99813f9897ec6edc73518052cb2fb95316f0facdd4ebab6c5cb473c9072ae8"
+      digest: "sha256:0b48988fd8d85d1494c4313732a3cf3ae75263b5bdf1c672ba1e6c0f769a6b94"
     - path: ".gds/compiled-policy.json"
-      digest: "sha256:0cbdf7a659e32c65f3c41a630fc1541e84c94f259cf86200992e1cc711da80c7"
+      digest: "sha256:d8adff36bb3d58e28183b16d63ea584f06d5f4600c0e3fe14d7aeb023053fa76"
     - path: ".github/workflows/gds-ci.yml"
-      digest: "sha256:73403d1988bcd42be9b8fbdc0a98702163c20f423c6237702c578810926f845f"
+      digest: "sha256:edb78a32e5ae0ac7791619f3adfa5155f38141396a6b7102a4c2b56f55ab4cb2"
     - path: "AGENTS.md"
-      digest: "sha256:4b4fa18e8c85c6570820df7dfc8c956a1ed8df246ce9a89b00f9c62e4fa31f98"
+      digest: "sha256:74cff9085b7a0d60c52238712be8b05f25da877b28e5c85138c290451f397a19"

tests/golden/projections/control-plane/.gds/compiled-policy.json

@@ -2,8 +2,8 @@
   "schema_version": 1,
   "compiled_policy": {
     "repository_id": "repo_01M0EZ7TB3KNXNSP78Z8M64WXG",
-    "bundle_version": "0.9.4-dev",
-    "digest": "sha256:6fe9ed4fb7e146109ccf97d26fb924bac6dd5817b2618568feef8981ba7ec09b"
+    "bundle_version": "0.9.5-dev",
+    "digest": "sha256:6f0bb3414447990bc5e7309d7db331cd835c1ca10b4082a1d4dfc8f3bb710109"
   },
   "sources": [
     {

tests/golden/projections/control-plane/.github/workflows/gds-ci.yml

@@ -1,8 +1,8 @@
 # GENERATED FILE - DO NOT EDIT DIRECTLY
 # generator: gds
-# bundle: 0.9.4-dev
+# bundle: 0.9.5-dev
 # source-tree-digest: sha256:0000000000000000000000000000000000000000000000000000000000000001
-# input-digest: sha256:c2fad19143a9132f67605c3ba10775dc1e4e0e9fa1a06f335f7ce4891a02aba5
+# input-digest: sha256:89a52fd2369d66a4ffc91fe26f958e2c44354e23c036a6b48ad16cf90462d31a
 # output-digest: sha256:b9bf3d0c64c0fb371596e7d090e82e62aebbfde91929115fc15fb28644e4fd38
 # edit-source:
 #   - .gds/repository.yaml

tests/golden/projections/control-plane/AGENTS.md

@@ -1,10 +1,10 @@
 <!--
 GENERATED FILE - DO NOT EDIT DIRECTLY
 generator: gds
-bundle: 0.9.4-dev
+bundle: 0.9.5-dev
 source-tree-digest: sha256:0000000000000000000000000000000000000000000000000000000000000001
-input-digest: sha256:c2fad19143a9132f67605c3ba10775dc1e4e0e9fa1a06f335f7ce4891a02aba5
-output-digest: sha256:819456f92e6f6b6e6c49fdf53a1f73988508e6a9dbc705daa7329203749b63aa
+input-digest: sha256:89a52fd2369d66a4ffc91fe26f958e2c44354e23c036a6b48ad16cf90462d31a
+output-digest: sha256:1b5239dedb05ff781867a8657499790a89ceb040b98818a2fb7340f171a65221
 edit-source:
   - .gds/repository.yaml
   - policies/base/repository-default.yaml
@@ -67,6 +67,6 @@ GDS is the public engine for a multi-owner GitHub estate. It loads an external e
 
 ## Facts
 
-- Repository `repo_01M0EZ7TB3KNXNSP78Z8M64WXG`, roles `control-plane`, bundle `0.9.4-dev`.
+- Repository `repo_01M0EZ7TB3KNXNSP78Z8M64WXG`, roles `control-plane`, bundle `0.9.5-dev`.
 - Canonical inputs: `.gds/repository.yaml`; compiled result: `.gds/compiled-policy.json`.
 - Visibility `public`, data `public`.