chore: sync develop with v0.3.1 hotfix

.claude-plugin/plugin.json

@@ -1,5 +1,5 @@
 {
   "name": "adr-toolkit",
-  "version": "0.3.0",
+  "version": "0.3.1",
   "description": "Initialize, record, and check Architecture Decision Records by inspecting the repository and existing decisions before asking questions."
 }

.github/workflows/release.yml

@@ -51,6 +51,14 @@ jobs:
           sha256sum "$ARCHIVE" > "${ARCHIVE}.sha256"
           echo "archive=$ARCHIVE" >> "$GITHUB_OUTPUT"
       - name: Generate build provenance attestation
+        # GitHub's attestation API rejects this for a user-owned private
+        # repository ("Feature not available for user-owned private
+        # repositories") -- discovered on the v0.3.0 tag push, since this
+        # can only be confirmed against a real tag push, not a local dry
+        # run. Skipped while private; starts running automatically once
+        # this repository goes public (see docs/decisions/0016 and the
+        # project's public-transition plan), no workflow change needed.
+        if: ${{ !github.event.repository.private }}
         uses: actions/attest-build-provenance@v2
         with:
           subject-path: ${{ steps.package.outputs.archive }}

SECURITY.md

@@ -29,14 +29,23 @@ signature -- no private key is held or rotated by this project -- proving
 the archive was produced by this repository's own CI, from the exact
 commit the release tag points to.
 
+**While this repository is private, attestation is not generated** --
+GitHub's attestation API rejects it for a user-owned private repository.
+The release workflow skips that step automatically and still publishes
+the archive and its checksum; attestation starts appearing on releases
+once the repository goes public, with no workflow change required. Check
+a given release's assets on the Releases page to see whether an
+attestation is available for it.
+
 To verify a downloaded archive:
 
 ```bash
 # Checksum: confirms the file wasn't corrupted/tampered with in transit
 sha256sum -c adr-toolkit-skill-vX.Y.Z.tar.gz.sha256
 
 # Provenance: confirms the archive was actually built by this repo's CI,
-# not a look-alike release from a compromised account or a different repo
+# not a look-alike release from a compromised account or a different repo.
+# Only available once this repository is public -- see the note above.
 gh attestation verify adr-toolkit-skill-vX.Y.Z.tar.gz -R SHcommit/ADR-toolkit
 ```
 

adapters/antigravity/plugin.json

@@ -1,6 +1,6 @@
 {
   "$schema": "https://antigravity.google/schemas/v1/plugin.json",
   "name": "adr-toolkit",
-  "version": "0.3.0",
+  "version": "0.3.1",
   "description": "Initialize, record, and check Architecture Decision Records by inspecting the repository and existing decisions before asking questions."
 }

adapters/gemini-cli/gemini-extension.json

@@ -1,5 +1,5 @@
 {
   "name": "adr-toolkit",
-  "version": "0.3.0",
+  "version": "0.3.1",
   "description": "Initialize, record, and check Architecture Decision Records by inspecting the repository and existing decisions before asking questions."
 }

changelog.md

@@ -4,6 +4,18 @@ Lightweight human-readable summary of meaningful repository changes.
 
 ## Unreleased
 
+## v0.3.1 (2026-09-02)
+
+- Fixed the release workflow: GitHub's Artifact Attestation API rejects
+  attestation for a user-owned private repository, which broke the
+  `v0.3.0` tag's release run before it could publish anything (that tag
+  exists in git history but has no corresponding GitHub Release -- this
+  release supersedes it). `.github/workflows/release.yml` now skips the
+  attestation step while this repository is private and will start
+  running it automatically once the repository goes public; the
+  packaged archive and its SHA-256 checksum are unaffected and still
+  published on every release. `SECURITY.md` documents this.
+
 ## v0.3.0 (2026-09-02)
 
 - Recorded this release's architectural decisions as ADR-0012 through

skills/adr-toolkit/SKILL.md

@@ -2,7 +2,7 @@
 name: adr-toolkit
 description: Initialize, record, and check Architecture Decision Records by inspecting the repository and existing decisions before asking questions.
 user-invocable: true
-version: 0.3.0
+version: 0.3.1
 ---
 
 # ADR Toolkit

skills/adr-toolkit/VERSION

@@ -1 +1 @@
-0.3.0
+0.3.1