feat: ship ReasonKit Think v0.2 governance release

.github/ISSUE_TEMPLATE/bug_report.yml

@@ -0,0 +1,81 @@
+name: Bug report
+description: Report a reproducible defect in the MCP server or its contracts.
+title: "bug: "
+body:
+  - type: markdown
+    attributes:
+      value: >-
+        Do not include secrets or undisclosed vulnerabilities. Use SECURITY.md
+        for private security reports.
+  - type: input
+    id: version
+    attributes:
+      label: Version or commit
+      description: Include the exact crate version or Git commit.
+      placeholder: 0.2.0 or abc1234
+    validations:
+      required: true
+  - type: dropdown
+    id: tool_pack
+    attributes:
+      label: Tool pack
+      options:
+        - core (default, 13 tools)
+        - standard (33 tools)
+        - full (47 tools)
+        - unknown
+    validations:
+      required: true
+  - type: input
+    id: client_protocol
+    attributes:
+      label: Client and negotiated protocol
+      placeholder: Codex CLI; 2025-11-25
+    validations:
+      required: true
+  - type: textarea
+    id: reproduction
+    attributes:
+      label: Minimal reproduction
+      description: Provide ordered steps and a minimal, redacted request.
+    validations:
+      required: true
+  - type: textarea
+    id: expected
+    attributes:
+      label: Expected result
+    validations:
+      required: true
+  - type: textarea
+    id: actual
+    attributes:
+      label: Actual result
+    validations:
+      required: true
+  - type: dropdown
+    id: contract_impact
+    attributes:
+      label: Contract impact
+      options:
+        - Incorrect success or fail-open behavior
+        - Tool discovery or schema mismatch
+        - Persistence or audit mismatch
+        - Startup or transport failure
+        - Other
+    validations:
+      required: true
+  - type: textarea
+    id: logs
+    attributes:
+      label: Redacted diagnostics
+      description: Include stderr only; remove secrets and personal paths.
+      render: text
+  - type: checkboxes
+    id: checks
+    attributes:
+      label: Preflight
+      options:
+        - label: I reproduced this on the stated version or commit.
+          required: true
+        - label: I removed secrets and unrelated private data.
+          required: true

.github/ISSUE_TEMPLATE/config.yml

@@ -0,0 +1 @@
+blank_issues_enabled: false

.github/ISSUE_TEMPLATE/feature_request.yml

@@ -0,0 +1,55 @@
+name: Feature request
+description: Propose a user outcome or auditable contract improvement.
+title: "feat: "
+body:
+  - type: textarea
+    id: problem
+    attributes:
+      label: Problem
+      description: What user problem cannot be solved with the current contract?
+    validations:
+      required: true
+  - type: textarea
+    id: outcome
+    attributes:
+      label: Desired user flow
+      description: Show the smallest useful request-to-audit path.
+    validations:
+      required: true
+  - type: textarea
+    id: evidence
+    attributes:
+      label: Evidence and failure boundary
+      description: What must be supplied, and when must the server stop or fail closed?
+    validations:
+      required: true
+  - type: dropdown
+    id: tool_pack
+    attributes:
+      label: Narrowest justified tool pack
+      options:
+        - core
+        - standard
+        - full compatibility only
+        - no new tool
+        - unsure
+    validations:
+      required: true
+  - type: textarea
+    id: alternatives
+    attributes:
+      label: Existing tools and alternatives
+      description: Explain why composition of current tools is insufficient.
+    validations:
+      required: true
+  - type: checkboxes
+    id: checks
+    attributes:
+      label: Contract checks
+      options:
+        - label: The proposal does not claim access to hidden chain of thought.
+          required: true
+        - label: Model-backed or retrieval-backed behavior has an explicit provider boundary.
+          required: true
+        - label: I checked features/manifest.json for an overlapping planning record.
+          required: true

.github/pull_request_template.md

@@ -0,0 +1,21 @@
+## Outcome
+
+Describe the user-visible result and why the change is needed.
+
+## Contract impact
+
+- [ ] No public MCP behavior changes.
+- [ ] Tool-pack inventory and `evals/tool-packs.json` are synchronized.
+- [ ] Evidence, provider, and fail-closed boundaries remain explicit.
+- [ ] Persistence, audit, and compatibility effects are documented.
+
+## Verification
+
+List exact commands and results. For behavior changes, include the failing test
+observed before the implementation and its passing result afterward.
+
+- [ ] `just check`
+- [ ] `just eval` when protocol, schema, routing, or governance changed
+- [ ] `just audit` when dependencies changed
+- [ ] Documentation and examples match the implemented behavior
+- [ ] No secrets, local absolute paths, generated caches, or private artifacts

.github/workflows/ci.yml

@@ -6,6 +6,9 @@ on:
   pull_request:
     branches: [main]
 
+permissions:
+  contents: read
+
 jobs:
   reasonkit-think-mcp:
     runs-on: ubuntu-latest
@@ -15,11 +18,34 @@ jobs:
         run: |
           rustup toolchain install 1.95.0 --profile minimal --component rustfmt,clippy
           rustup default 1.95.0
+      - name: Install uv 0.12.1
+        uses: astral-sh/setup-uv@c771a70e6277c0a99b617c7a806ffedaca235ff9 # v9.0.0
+        with:
+          version: "0.12.1"
+          enable-cache: false
       - name: Format
         run: cargo fmt --check
       - name: Clippy
-        run: cargo clippy -- -D warnings
+        run: cargo clippy --all-targets --all-features -- -D warnings
+      - name: Rust unit and integration tests
+        run: cargo test --all-targets --all-features
+      - name: Contract unit tests
+        run: python3 -m unittest discover -s tests -p "test_*.py" -v
+      - name: Package release candidate
+        run: CARGO_TARGET_DIR=target/package-check cargo package --locked
+      - name: Validate MCP Registry schema
+        run: uvx --from check-jsonschema==0.38.0 check-jsonschema --schemafile https://static.modelcontextprotocol.io/schemas/2025-12-11/server.schema.json server.json
+      - name: Install cargo-dist 0.32.0
+        run: cargo install cargo-dist --version 0.32.0 --locked
+      - name: Validate configuration-only cargo-dist manifest
+        run: dist manifest --artifacts=local --output-format=json --no-local-paths
       - name: Build release
         run: cargo build --release
-      - name: Smoke test (stdio MCP)
+      - name: Full-pack smoke test (stdio MCP)
         run: python3 scripts/smoke_test.py
+      - name: MCP contract evaluations
+        run: python3 evals/run_contract_evals.py --binary target/release/reasonkit-think-mcp
+      - name: Install cargo-audit
+        run: cargo install cargo-audit --locked
+      - name: Dependency security audit
+        run: cargo audit --deny warnings

.gitignore

@@ -4,4 +4,5 @@
 .env.*
 /target_check/
 /local-target/
-scripts/__pycache__/
+**/__pycache__/
+*.py[cod]

CHANGELOG.md

@@ -2,8 +2,21 @@
 
 All notable changes to ReasonKit Think are documented here.
 
-## Unreleased
+## Unreleased — 0.2.0 release candidate
 
+- Added explicit `--version`, `--help`, and secret-free `doctor --json`
+  diagnostics, including fail-closed backend validation, without changing the
+  no-argument MCP stdio contract.
+- Upgraded the official Rust MCP SDK from `rmcp` 1.6.0 to 3.1.4 while keeping
+  the server stdio-only and extending negotiation checks through MCP 2026-07-28.
+- Added startup-fixed `core` (13, default), `standard` (33), and `full` (47)
+  tool packs with a full-pack compatibility rollback and pack-aware guidance.
+- Added `reasoning://config/tool-packs` and dual text plus
+  `structuredContent` JSON for successful results and handler-generated
+  application errors.
+- Removed the unbound `reasonkit-mem` cache dependency. The full-pack
+  `think_query` compatibility route now fails closed with
+  `experimental_memory_unavailable` instead of simulating empty retrieval.
 - Added `run_thinking_mode` as the recommended user-facing entry point for Auto,
   Quick, Explore, Map, Sketch, and Test workflows.
 - Added native MCP resource discovery/read support for `reasoning://thinking-modes`
@@ -19,3 +32,20 @@ All notable changes to ReasonKit Think are documented here.
   `get_thinking_history` with `deliberation_id`, and boolean-like audit flags.
 - Removed default pseudo-evidence from Auto/autopilot verification; unsupported
   claims remain `DATA_DEFICIT` until caller evidence is supplied.
+- Preserved verification blockers across repeated verification calls, prevented
+  assumptions from self-verifying without evidence, enforced ReAct action and
+  observation transitions, and rejected unknown pipeline stages.
+- Made verification criticality monotonic across normalized-claim upserts,
+  made assumption `critical: true` authoritative over conflicting lower
+  criticality, and kept pipeline and consensus policy overrides call-scoped.
+- Required an agent-authored frontier for consensus, excluded heuristic
+  scaffold/root nodes from allowed answers, and blocked failed pipeline gates
+  and unresolved checkpoints. Authorship is provenance- and node-type-backed;
+  reserved-tag spoofing is rejected, and answer provenance lists only selected
+  candidates. Blocked MCP responses use the exact `consensus_blocked` code and
+  omit the candidate final answer.
+- Added deterministic canonical JSON and PR-ready Markdown reasoning audits with
+  consistent artifact IDs and neutralized caller-controlled Markdown content.
+- Added deterministic protocol, pack, eight-check adversarial governance,
+  packaging, Registry, cargo-dist, and dependency-audit gates for CI and local
+  release checks.

CONTRIBUTING.md

@@ -0,0 +1,44 @@
+# Contributing to ReasonKit Think
+
+ReasonKit Think is an auditable stdio MCP server. Contributions should preserve
+its fail-closed evidence boundaries, deterministic contracts, and small default
+tool surface.
+
+## Set up
+
+Install Rust 1.95, Python 3, `uv`, and `just`, then work from a source checkout:
+
+```sh
+cargo build --locked
+just check
+```
+
+`just check` runs formatting, Clippy, Rust tests, and Python contract tests. Run
+`just eval` for protocol, schema, tool, routing, or governance changes. Run
+`just audit` for dependency changes; the zero-warning baseline and prior cleanup
+are documented in [`docs/dependency-audit.md`](docs/dependency-audit.md).
+For release-metadata changes, run `just package-check` and `just registry-check`.
+If editing `dist-workspace.toml`, install cargo-dist 0.32.0 with
+`cargo install cargo-dist --version 0.32.0 --locked`, then run `just dist-check`.
+
+## Make a focused change
+
+1. Open an issue for behavior that changes a public tool, schema, or policy.
+2. Add a failing test before changing behavior.
+3. Keep stdout reserved for MCP frames; diagnostics belong on stderr.
+4. Update documentation and contract fixtures with the implementation.
+5. Use Conventional Commits, for example `fix(protocol): reject unknown stages`.
+
+Tool discovery is pack-aware. Any tool-surface change must update
+[`evals/tool-packs.json`](evals/tool-packs.json) and preserve exact lexical
+counts for every affected pack. New tools should land in the narrowest justified
+pack; `full` is the compatibility escape hatch, not the default.
+
+## Pull-request evidence
+
+Describe the user-visible outcome, contract or security impact, tests run, and
+any known limitation. Include the exact failing-then-passing test for behavior
+changes. Do not commit secrets, local absolute paths, generated caches, private
+planning material, or release automation that publishes on a tag.
+
+By contributing, you agree that your work is licensed under Apache-2.0.