[justinmerrell]

What changes

This PR releases v2 of every family (core, component, blueprint and listing) as 2.0.0 and retires v1.

• One vocabulary. Every concept now has one name and every name one meaning. The names come from a
  terminology-science pass: ISO 704 / 1087 criteria, prior art in about 25 ecosystems, and the platform glossary,
  Pelorus and engineering-conventions vocabularies.
• Machine-checked term records. docs/terminology.yaml holds the records. It is enforced by task check:terms
  and a generated Vale style (task check:prose), and generates the docs/terminology.md glossary.
• Connections for any protocol. POSTGRES, REDIS and S3 join the two LLM protocols.
• Source and build recipe. Uploads, a build context and build secrets are added, and builds are pinned
  through a sources and a build resolution stage.
• Every narrowing that v2 could otherwise never make is made now. Each "Not supported in v2" row closes by
  relaxation.

v1's tags, immutable releases, ledger entries and pinned URLs are untouched; its directories leave main.

Why

• ADR 0038: one vocabulary, and v1 retires
• ADR 0039: connections for any protocol
• ADR 0040: source and build recipe
• ADR 0041: engineering-conventions 0.9.1

The headline renames:

Area	v1	v2
Deployment	installation, installer, deployment.installer.*, installationSnapshot	deployment, deployer, deployment.creator.*, deploymentSnapshot
Blueprint graph	spec.components	spec.nodes
${{ }}	reference	placeholder
Validation phases	capability; resolution used but never declared	admission and resolution
Scope and profiles	two profile lattices	one validation scope lattice: parser ⊂ structural ⊂ document ⊂ publication ⊂ deployment
Exposure access	AUTHENTICATED	RESTRICTED
Exemptions	accessExemptions on component and on blueprint	component exemptibleRequests (the offer); blueprint accessExemptions (the grant)
Listing	Markdown description, sourceRepoURL	overview, sourceRepositoryURL, plus gettingStarted
Values	origin, supplier, supply and source	origin; "source" is only a workload source
Releases	edition, line	core release, major version

Each spec ends its scope section with a complete Migration from v1 table, and
docs/downstream-v2-adoption.md lists what each consumer changes.

Decisions you asked to see

• Listing categories (final v2 set):
  • The set: AGENTS AUTOMATION COMMUNICATION DATABASES DEVELOPER_TOOLS INFRASTRUCTURE MEDIA MODELS NETWORKING OBSERVABILITY PRODUCTIVITY SECURITY STORAGE.
  • Dropped: AI_ML, which maps to AGENTS or MODELS, and GAMING, which maps to MEDIA.
  • Added: MODELS, DATABASES and OBSERVABILITY, now, because adding them after 2.0.0 would carve subsets out of
    existing shelves.
• Media bounds:
  • Size, checked in the semantic phase: icon at most 1 MiB, screenshot at most 5 MiB.
  • Dimensions, checked at admission from image headers only: icon square and at least 256 px, screenshot at most
    4096 px per side.
• SPDX membership is checked at admission against the SPDX list the platform pins.
• Kept on purpose:
  • specVersion stays REQUIRED.
  • EXTERNAL stays, not CONNECTOR.
  • blueprint stays, despite Render's Blueprints.
  • connection and binding stay as two concepts; their v1 leftovers are removed.

Independent review

A cold review of the drafted v2 found 2 critical and about 20 major defects, all fixed here:

• Build secrets. The build stage now runs after values resolve, so a build can read its secrets.
• Connection members. Members can be optional with defaults, so a protocol can grow by relaxation, and the
  connection url is derived instead of stored.
• Sources. Upload extraction is specified, git URLs and commits are tightened, and every resolution diagnostic
  names its stage.
• Rules. Every rule a document can violate has an ID, a phase, a code and a path.

Compatibility

• Breaking: a new major of every family, declared in ADR 0038 and in each spec's Migration from v1 section.

release-please proposes exactly 2.0.0 for each family: v2 packages with initial-version: 2.0.0 and a 0.0.0
manifest (see docs/publication.md). Release order: core, then component, then
blueprint and listing.

Also in this PR

• engineering-conventions 0.7.0 → 0.9.1, with conventions check --fail-on warning clean:
  • committed replaces the old commit tooling;
  • PR titles require a scope;
  • Taskfile fragments are flattened;
  • the Vale gate (COPY-01..03) is added;
  • the agent brief moves from .claude/CLAUDE.md to AGENTS.md (AGENT-16).
• Dependabot updates folded in: build(deps): bump ghcr.io/devcontainers/features/common-utils from 2.7.0 to 2.7.1 #178, build(deps): bump ghcr.io/devcontainers/features/node from 2.1.0 to 2.1.1 #179, ci(deps): bump actions/upload-artifact from 7.0.1 to 7.0.2 #182, ci(deps): bump actions/create-github-app-token from 3.2.0 to 3.3.0 #186, build(deps-dev): bump wrangler from 4.141.0 to 4.151.0 in /tools #187, ci(deps): bump jdx/mise-action from 4.3.0 to 5.1.2 in /.github/actions/setup-tools #188, build(deps-dev): bump the tooling group across 1 directory with 4 updates #189.

Closes #176, closes #177, closes #184, closes #185, closes #190, closes #191, closes #192, closes #193, closes #194.

#149 (repository name) stays open: its REPO-08 waiver runs to 2027-03-27.

Downstream, after release:

• catalog: migrate 78 documents, keep one component per component item, and check that n8n's SUL-1.0 is on the
  pinned SPDX list;
• platform-api;
• Pelorus: Installer becomes Creator, and the connection-edge definition retires;
• host-agent: probe forwarding headers;
• musher-cli;
• the SDKs.

Checklist

• task check passes locally
• Schemas edited under schemas/src/ only
• Conformance fixtures added for every behavioural change, each citing a clause (654 cases)
• Normative prose updated in each affected spec.md
• Conventional, scoped commit messages
• Commits are DCO signed off

🤖 Generated with Claude Code