[bipthelin]

What

Release 0.17.0. This moves the version everywhere at once, following CONTRIBUTING's release steps:

• both marketplace manifests (the pinned compliance-assistant entry keeps 0.1.1);
• every piece's two plugin.json files, its VERSION constant and its SKILL.md;
• the fixtures' generated_by;
• version and date-released in CITATION.cff;
• the toolkit-version default in templates/gitlab/*.yml (v0.17.0);
• the ## 0.17.0 — 2026-10-16 section in CHANGELOG.md.

What 0.17.0 ships

From #108:

• change-control takes agent-change-control's ACC012. Each unaccounted branch update becomes a direct_push record with the bypass set, and its only separation is bypass_used. New bypass kinds: direct_push and branch_deletion.
• export/acc.mjs --statement stages acc's in-toto Statement for evidence-push to draft and a person to sign. It never edits a signed manifest.
• The GitLab path through acc is tested, and the README gives its recipe.
• This repository's compliance.yml runs change-control on agent-change-control 0.7.0, pinned by SHA-256 with its build attestation verified.

After merge

Tag the merge commit and create the release. The release workflow then re-runs the gate, publishes the action mirrors, and moves @v0:

git tag v0.17.0 <merge-commit> && git push origin v0.17.0
gh release create v0.17.0 --title v0.17.0 --notes "See CHANGELOG.md"

Testing

Every command from ci.yml passes locally:

• check_repo, check_vendored_lib, contract_test (11 pieces);
• publish_actions --check (51), publish_gitlab_components --check (25);
• test_agent_renewals, test_ci_mode (332), test_ci_review, test_gitlab_ci (53), test_hub;
• test_idempotency (271), test_mcp_exec (88), test_privacy_ci, test_repo_enforcement, test_reviewed_plan;
• test_validators (237), test_collectors.