@terreno/mcp 57.16.2 → 57.18.0

package/dist/docs/versioned/57.17.0/implementationPlans/unified-mutation-executors.md

@@ -0,0 +1,129 @@
+# Unified mutation executors (MCP → executors)
+
+**Status:** Complete — 2026-08-25  
+**Branch:** `cursor/architecture-ips-a7ec`  
+**Owner:** —  
+**Created:** 2026-08-24  
+**Architecture source:** [model-router-actions.md](../explanation/model-router-actions.md), [model-router-mcp.md](model-router-mcp.md), [pluggable-database-sqlite.md](pluggable-database-sqlite.md)  
+**Task list:** [unified-mutation-executors.md](../tasks/unified-mutation-executors.md)  
+**Depends on:** none  
+**Unlocks:** [can-as-permission-seam.md](can-as-permission-seam.md), [collection-registry.md](collection-registry.md)
+
+## Goal
+
+One write pipeline for create, update, and delete. REST and Sync already call `executeCreate` / `executeUpdate` / `executeDelete` in `api/src/sync/executors.ts`. MCP `handleCreate` / `handleUpdate` / `handleDelete` in `api/src/mcp/handlers.ts` still run permissions, transformers, hooks, and `model.create` / `doc.save` themselves.
+
+When this ships, MCP write tools call those executors. A permission, hook, field-view, or soft-delete fix lands once.
+
+## Non-Goals
+
+- List/read unification (MCP list/read stay handlers; they are not duplicated against executors).
+- Replacing executors with a new `WriteService` class.
+- Implementing the SQLite `DatabaseAdapter` (executors will later call the adapter; this IP does not introduce it). See [pluggable-database-sqlite.md](pluggable-database-sqlite.md).
+- Changing MCP tool names, JSON-RPC transport, or `excludeFields` config shape.
+- Compiling RBAC `access` away from `PermissionMethod[]` (that is [can-as-permission-seam.md](can-as-permission-seam.md)).
+
+## Decisions
+
+| Question | Decision |
+|----------|----------|
+| Interface shape | **A — MCP adapters call existing executors.** Not B (a new `WriteService` wrapping both). Smallest interface: three functions already used by REST and Sync. |
+| Error contract | Executors keep throwing `APIError`. MCP maps `APIError` (and hook failures) onto the existing MCP error `textResult` / `errorResult` envelope. No new error type. |
+| Request object | Pass a real Express `req` when HTTP; otherwise the existing executor `{user}` stub via `createMCPRequest` fields (`user`, `body`). Do not invent a second hook request type. |
+| MCP-only behavior | Keep MCP `excludeFields`, `mcpResponseHandler`, and tool-result JSON wrapping in the handler **after** the executor returns `{doc}`. Executors stay transport-agnostic. |
+| `skipPostHooks` | MCP uses the REST path (`skipPostHooks` unset). Sync keeps the ledger-safe skip. |
+| Compatibility | No app-facing API break. MCP tool argument schemas and success JSON `{data}` stay the same. Error **strings** may align to `APIError.title` where they currently diverge; tests that pin MCP wording update in this slice. |
+| Sequencing | Land before collection-registry and can-as-permission-seam so those IPs do not have to touch two write implementations. |
+
+## Interface shapes considered
+
+**A (chosen).** `handleCreate(entry, args, user)` → `executeCreate({model, options: entry.options, user, body, req: mcpStubReq})` → map `{doc}` / `APIError` to `MCPToolResult`.
+
+**B (rejected).** `class MutationService { create; update; delete }` that REST, Sync, and MCP all call. Deletes the executor module only by renaming it; REST already has the deep module.
+
+## Architecture
+
+```
+Before:
+  MCP handlers ──duplicate──► Mongoose + permissions + hooks
+  REST / Sync ──────────────► executors ──► Mongoose
+
+After:
+  MCP ──map args/errors──► executors ◄── REST / Sync
+                              │
+                              ▼
+                           Mongoose (later: DatabaseAdapter)
+```
+
+`executeCreate` already: `checkPermissions` → `transform` → `preCreate` → `model.create` → populate → `postCreate` (unless skipped). MCP `handleCreate` repeats that and calls `model.create` directly (`api/src/mcp/handlers.ts`).
+
+Handler leftover after this IP:
+
+1. Auth / anonymous gate that is MCP-transport specific.
+2. `omitDeniedWriteFields` / MCP `excludeFields` (if not already covered by executor field views — prove with tests; if executor already strips write-denied fields, delete the MCP copy).
+3. Call executor.
+4. `mcpResponseHandler` / `serializeResponse`.
+5. `APIError` → MCP error result.
+
+## Docs in this slice
+
+| Page | Change |
+|------|--------|
+| `docs/explanation/model-router-actions.md` | Writes (CRUD, not named actions) go through executors for REST, Sync, and MCP. |
+| `docs/reference/api.md` (MCP tools) | MCP create/update/delete share REST permission and hook semantics; errors are `APIError` titles. |
+| `docs/implementationPlans/model-router-mcp.md` | Note: write path now executors (status note, not a rewrite of that shipped IP). |
+
+Skip operator how-to: no new env, CLI, or app setup.
+
+## Testing
+
+Public seam: `executeCreate` / `executeUpdate` / `executeDelete` (existing `executors.test.ts`) plus MCP integration tests that assert **behavior** (denied create, preCreate null, hook throw, field omit) against the same fixtures as REST.
+
+Add one MCP test that fails if `handleCreate` uses `model.create` instead of `executeCreate` (spy or shared side-effect: `preCreate` called once with the stub request).
+
+Do not weaken executor tests. MCP tests that duplicate permission matrices can shrink after the adapter is thin.
+
+## Risks
+
+| Risk | Mitigation |
+|------|------------|
+| MCP error strings differ from `APIError.title` | Golden-file or explicit map in handler; update MCP tests in-slice. |
+| `createMCPRequest` missing Express fields hooks read | Inventory hook usage in `api` tests and example-backend; extend stub only for fields executors already pass on HTTP. |
+| Double field-stripping | Single test: write-denied field absent from DB for both REST and MCP. |
+
+## Phases
+
+1. Map MCP create to `executeCreate`; MCP create tests green and share preCreate/permission behavior with REST.
+2. Map update and delete the same way.
+3. Delete duplicated MCP write bodies; keep transport mapping. Docs + changelog fragment.
+
+## Feature Flags & Migrations
+
+None. Internal call-graph change.
+
+## Not Included / Future Work
+
+- Executor calls `DatabaseAdapter` ([pluggable-database-sqlite.md](pluggable-database-sqlite.md)).
+- MCP list/read through a shared query executor.
+- `access.can()` as the permission engine ([can-as-permission-seam.md](can-as-permission-seam.md)).
+
+## Files to Create / Modify
+
+- `api/src/mcp/handlers.ts` — write handlers become adapters
+- `api/src/mcp/handlers.ts` tests / `api/src/mcp/integration.test.ts`
+- `api/src/sync/executors.ts` — only if a missing hook/request field is required for MCP parity; prefer not
+- Docs listed above
+- Changelog fragment for `@terreno/api`
+
+## Acceptance Criteria
+
+- [ ] MCP create/update/delete call `executeCreate` / `executeUpdate` / `executeDelete`.
+- [ ] MCP write handlers contain no `model.create` / `doc.save` / delete persistence.
+- [ ] A `preCreate` / `preUpdate` / `preDelete` hook runs for MCP the same as REST (existing hook tests or new shared cases).
+- [ ] Permission denial for MCP writes matches executor denial (status/title mapped into MCP error result).
+- [ ] `bun test` in `api` covering `mcp/` and `sync/executors` passes.
+- [ ] Docs in this slice match the shipped call graph.
+
+## Task List
+
+[docs/tasks/unified-mutation-executors.md](../tasks/unified-mutation-executors.md)

package/dist/docs/versioned/57.17.0/implementationPlans/upgrade-banner.md

@@ -0,0 +1,279 @@
+# Implementation Plan: Upgrade Banner
+
+**Status:** Complete
+**Closed:** 2026-08-20 — Shipped via `VersionConfig` model, `VersionCheckPlugin` (`GET /version-check`), `AdminVersionConfig`, `useUpgradeCheck` (`@terreno/rtk`), and `UpgradeRequiredScreen` (`@terreno/ui`).
+**Roadmap issue:** https://github.com/TerrenoLabs/terreno/issues/1079
+
+*When an engineer is assigned to a project but before you begin coding, you should fill in the implementation plan and get feedback from the engineering team. Once you have finished or you make any changes, tag Josh with the @ symbol so he can review. Also tag anyone else that needs to be notified, has conflicting work, etc.*
+
+## Models
+
+### VersionConfig (new, singleton)
+
+```typescript
+// api/src/models/versionConfig.ts
+
+import {createdUpdatedPlugin} from "../plugins";
+import mongoose from "mongoose";
+
+const versionConfigSchema = new mongoose.Schema<VersionConfigDocument>(
+  {
+    webWarningVersion: {
+      type: Number,
+      default: 0,
+      description: "Build number at which web users see a warning toast",
+    },
+    webRequiredVersion: {
+      type: Number,
+      default: 0,
+      description: "Build number at which web users are blocked from using the app",
+    },
+    mobileWarningVersion: {
+      type: Number,
+      default: 0,
+      description: "Build number at which mobile users see a warning toast",
+    },
+    mobileRequiredVersion: {
+      type: Number,
+      default: 0,
+      description: "Build number at which mobile users are blocked from using the app",
+    },
+    warningMessage: {
+      type: String,
+      default: "A new version is available. Please update for the best experience.",
+      description: "Message shown in the warning toast",
+    },
+    requiredMessage: {
+      type: String,
+      default: "This version is no longer supported. Please update to continue.",
+      description: "Message shown on the blocking screen",
+    },
+    updateUrl: {
+      type: String,
+      description: "App store or download URL for mobile updates (optional, falls back to expo-updates)",
+    },
+  },
+  { strict: "throw", toJSON: { virtuals: true }, toObject: { virtuals: true } }
+);
+
+versionConfigSchema.plugin(createdUpdatedPlugin);
+```
+
+**Key design points:**
+- Singleton — only one document in the collection
+- All version fields default to `0` (meaning "no constraint"), so the check returns "ok" until an admin configures thresholds
+- Per-platform version thresholds (web vs mobile), shared messages
+- `updateUrl` is optional — mobile falls back to expo-updates OTA
+
+## APIs
+
+### 1. Version Check (public, built-in)
+
+| | |
+|---|---|
+| Method | `GET /version-check` |
+| Auth | None (public) |
+| Query Params | `version` (integer build number), `platform` ("web" \| "mobile") |
+| Response | `{status: "ok" \| "warning" \| "required", message?: string, updateUrl?: string}` |
+| Notes | Requires explicit registration via `VersionCheckPlugin` (e.g., `app.register(new VersionCheckPlugin())`). Returns `{status: "ok"}` if no VersionConfig document exists. |
+
+**Logic:**
+```
+if platform version < requiredVersion → status: "required", message: requiredMessage, updateUrl
+else if platform version < warningVersion → status: "warning", message: warningMessage, updateUrl
+else → status: "ok"
+```
+
+### 2. Admin: Get Version Config
+
+| | |
+|---|---|
+| Method | `GET /admin/version-config` |
+| Auth | `Permissions.IsAdmin` |
+| Response | The singleton VersionConfig document (or defaults if none exists) |
+
+### 3. Admin: Update Version Config
+
+| | |
+|---|---|
+| Method | `PUT /admin/version-config` |
+| Auth | `Permissions.IsAdmin` |
+| Body | All VersionConfig fields |
+| Response | Updated VersionConfig document |
+| Notes | Upsert — creates if doesn't exist, updates if it does. |
+
+Custom routes (not modelRouter) since it's a singleton — no list, no delete, no `:id` params.
+
+## Notifications
+
+No notifications required for this feature. The upgrade system is passive — it checks on app mount and shows in-app UI only.
+
+## UI
+
+### Component 1: `UpgradeRequiredScreen` (new, `@terreno/ui`)
+
+- Full-screen page with centered content
+- Warning icon, the `requiredMessage` text, and an "Update" button
+- Update button behavior controlled by `onUpdate` callback prop:
+  - **Web:** calls `window.location.reload()`
+  - **Mobile:** attempts `expo-updates` OTA → falls back to opening `updateUrl` via `Linking`
+- No back button, no navigation, no dismiss — user is stuck here
+- Props: `message: string`, `onUpdate: () => void`
+
+### Component 2: `useUpgradeCheck` hook (new, `@terreno/rtk`)
+
+- Called in consuming app's root layout
+- On mount: `GET /version-check?version={buildNumber}&platform={web|mobile}`
+- If `"warning"`: shows persistent toast with message + "Update" action button
+- If `"required"`: returns a flag for the consuming app to render `UpgradeRequiredScreen`
+- Returns: `{isRequired: boolean, requiredMessage?: string, onUpdate: () => void}`
+- Skips check if build number is missing/unknown (dev environment)
+- `onUpdate` handles platform logic: web refresh, mobile expo-updates or Linking to updateUrl
+
+### Component 3: Admin Version Config Screen (new, `@terreno/admin-frontend`)
+
+- Form with fields: webWarningVersion, webRequiredVersion, mobileWarningVersion, mobileRequiredVersion, warningMessage, requiredMessage, updateUrl
+- Single "Save" button that PUTs the singleton
+- Accessible from the admin model list as a special entry
+
+### Navigation Flow
+
+```
+App mounts → useUpgradeCheck() fires
+  → "ok"       → normal app
+  → "warning"  → normal app + persistent toast with "Update" button + dismiss X
+  → "required" → UpgradeRequiredScreen (blocks everything)
+```
+
+## Phases
+
+### Phase 1: Backend + Admin
+
+- VersionConfig Mongoose model in `@terreno/api`
+- `GET /version-check` public endpoint via `VersionCheckPlugin`
+- `GET/PUT /admin/version-config` admin routes
+- Admin frontend screen for version config
+- Unit tests for the version check logic
+- Example backend wired up
+
+**Deliverable:** Admin can configure version thresholds and the public endpoint responds correctly.
+
+### Phase 2: Client + CI
+
+- `UpgradeRequiredScreen` component in `@terreno/ui`
+- `useUpgradeCheck` hook in `@terreno/rtk`
+- `app.config.ts` helper for build number injection via `expo.extra.buildNumber`
+- Example frontend wired up with the hook
+- GitHub Actions snippet for `git rev-list --count HEAD`
+
+**Deliverable:** Client apps can check version on mount and show warning toast or blocking screen.
+
+## Feature Flags & Migrations
+
+- **No feature flag needed.** The system is inert by default — the endpoint returns `"ok"` until an admin creates a VersionConfig document with non-zero thresholds.
+- **No data migration needed.** New model, new collection, starts empty.
+- **Rollout:** Ship it. Apps that don't call `useUpgradeCheck()` are unaffected.
+
+## Activity Log & User Updates
+
+No activity logging needed for this feature. Version config changes are admin-only and low-frequency.
+
+## Not Included / Future Work
+
+- Per-user or per-role version targeting
+- Gradual rollout / percentage-based enforcement
+- Push notifications for version updates
+- Automatic semver bumping (stays manual via git tags)
+- Periodic polling (only checks on mount for now)
+- Per-app configs for multi-frontend backends
+- Version check middleware on every API response
+- Analytics on how many users are on which versions
+
+
+# Research: Terreno Upgrade Banner System
+
+## Summary
+
+The Terreno codebase already sends `App-Version` and `App-Platform` headers with every API request via RTK's base query. Building an upgrade banner system requires: (1) a backend model + built-in endpoint for version config, (2) admin screens to manage it, (3) a client hook + prebuilt UI, and (4) CI automation for commit-count-based versioning. The existing `AdminApp` plugin pattern, `Banner` component, toast system, and `Page` component provide strong foundations to build on.
+
+## Context
+
+- **Problem:** No mechanism to notify users their app is outdated. Stale clients can hit deprecated APIs or miss critical fixes.
+- **Current state:** RTK already sends `App-Version` (from `Constants.expoConfig?.version`) and `App-Platform` ("web"/"mobile") on every request (`rtk/src/emptyApi.ts:164-177`). But nothing consumes these headers or enforces version constraints.
+- **Goal:** Two-tier system — soft warning (dismissible toast/banner) and hard block (full-screen, no dismiss). Admin-configurable. Auto-versioned via CI.
+
+## Decisions
+
+- **Per-platform config:** Yes — separate thresholds for web vs mobile since web can force-refresh but mobile needs app store update.
+- **Update mechanism:** Platform-specific — web forces page refresh, mobile triggers expo-updates OTA if available, falls back to app store link.
+- **Endpoint location:** `VersionCheckPlugin` registered with `TerrenoApp` — opt-in per app.
+- **Config storage:** Mongoose model (database-backed) so admins can change without redeploy.
+
+## Findings
+
+### Finding 1: Existing Version Infrastructure in RTK
+
+`rtk/src/emptyApi.ts:164-177` — Every API request already includes:
+```typescript
+const version = Constants.expoConfig?.version ?? "Unknown";
+headers.set("App-Version", version);
+headers.set("App-Platform", IsWeb ? "web" : "mobile");
+```
+
+The version comes from `expo-constants` → `app.json`'s `version` field. Currently `example-frontend/app.json` has `"version": "1.0.0"`.
+
+### Finding 2: Admin Backend Plugin Pattern
+
+`admin-backend/src/adminApp.ts` — The `AdminApp` class provides the pattern:
+- Constructor takes config, `register(app)` adds routes to Express
+- Uses `modelRouter` with `Permissions.IsAdmin` for all CRUD
+- Exposes a `/admin/config` metadata endpoint
+
+### Finding 3: Admin Frontend Patterns
+
+`admin-frontend/` uses a data-driven approach:
+- `useAdminConfig(api, baseUrl)` fetches model metadata
+- `useAdminApi(api, routePath, modelName)` generates CRUD hooks dynamically
+- All screens accept `baseUrl` and `api` props
+- For upgrade config, we need a custom admin screen (singleton config, not a collection)
+
+### Finding 4: UI Components Available
+
+**Banner** (`ui/src/Banner.tsx`) — status variants, persistent dismiss, action button
+**Toast** (`ui/src/Toast.tsx`) — `useToast()` with warn/info/error variants, persistent mode
+**Page** (`ui/src/Page.tsx`) — Full-screen layout for the blocking screen
+**Modal** (`ui/src/Modal.tsx`) — Dialog, but Page is better for hard block (zero escape)
+
+### Finding 5: GitHub Actions & Versioning
+
+Current flow: manual git tag → `publish-on-tag.yml` → selective npm publish.
+No existing build number system. `app.json` version is static.
+`git rev-list --count HEAD` provides simple, monotonically increasing build numbers.
+
+### Finding 6: RTK Store Integration
+
+`example-frontend/store/index.ts` — store combines auth, appState, API reducers.
+`_layout.tsx` checks auth state and routes conditionally — upgrade check follows same pattern.
+
+## Recommendation
+
+**Add to core packages** — spread across:
+- `@terreno/api` — VersionConfig model + public `GET /version-check` endpoint (via `VersionCheckPlugin`)
+- `@terreno/admin-frontend` — Custom admin screen for version config
+- `@terreno/rtk` — `useUpgradeCheck` hook
+- `@terreno/ui` — `UpgradeRequiredScreen` blocking component
+
+**Versioning:** `git rev-list --count HEAD` as integer build number. Helper in CI to set `expo.version` at build time.
+
+**API:** `GET /version-check?version=123&platform=web` — public, no auth. Returns `{status: "ok" | "warning" | "required", message?, updateUrl?}`.
+
+## References
+
+- `rtk/src/emptyApi.ts:164-177` — Existing App-Version header
+- `admin-backend/src/adminApp.ts` — Plugin registration pattern
+- `admin-frontend/src/useAdminApi.tsx` — Dynamic RTK hook generation
+- `ui/src/Banner.tsx` — Banner component
+- `ui/src/Toast.tsx` — Toast notification system
+- `ui/src/Page.tsx` — Full-screen page layout
+- `example-frontend/app/_layout.tsx` — Root layout with auth routing
+- `.github/workflows/publish-on-tag.yml` — Current CI/CD versioning

package/dist/docs/versioned/57.17.0/implementationPlans/upgrade-guides-and-skill.md

@@ -0,0 +1,167 @@
+# Implementation Plan: Upgrade Guides and the `upgrading-terreno` Skill
+
+**Status:** Complete
+**Roadmap issue:** https://github.com/TerrenoLabs/terreno/issues/1013
+**Priority:** High
+**Effort:** Big batch
+**Owner:** unassigned
+**Created:** 2026-07-27
+**Program:** [OSS launch](oss-launch-program.md)
+**Depends on:** [`rtk-to-syncdb-migration-docs`](rtk-to-syncdb-migration-docs.md), [`oss-governance-baseline`](oss-governance-baseline.md) (changelog)
+**RTK deprecation flag:** **Blocked** — the largest upgrade Terreno will ever ask consumers to perform is RTK → syncdb. The skill and the notes must be built around it.
+
+## Goal
+
+Make upgrading Terreno a solved problem before we ask the public to depend on it. The machinery is half-built: `terreno_get_upgrade_guide` exists and concatenates per-release notes, and a `terreno_upgrade` prompt exists — but only two upgrade notes have ever been written (`0.20.0.md`, `0.21.0.md`) against a current version of 0.26.0. Five releases have no notes, so the tool returns nothing useful for any recent range. There is no `upgrading-terreno` skill; the only upgrade skill in the repo is `upgrading-expo`, which handles the Expo SDK portion and nothing Terreno-specific.
+
+An open-source framework that ships breaking changes in lockstep across eleven packages and cannot tell you what changed is not adoptable.
+
+## Non-Goals
+
+- Upgrading the Expo SDK (delegate to the existing `upgrading-expo` skill — do not duplicate its content).
+- Automated codemods (see [`rtk-to-syncdb-migration-docs`](rtk-to-syncdb-migration-docs.md) question M6 — agent-assisted, not codemod).
+- Changing the lockstep versioning scheme.
+- Retroactively rewriting git history or release notes.
+
+## Blocking questions
+
+**Recorded 2026-07-29** (defaults accepted).
+
+| # | Decision |
+|---|----------|
+| U1 | One consolidated **0.21 → 0.26** upgrade note; per-release notes from next version onward |
+| U2 | Upgrade note required when changelog has **Deprecated / Removed / Changed** (CI-enforced) |
+| U3 | Skill **performs** upgrade with confirmation gate + clean git tree |
+| U4 | **Direct multi-version jump** with sequential fallback on failure |
+| U5 | **Wrap `upgrading-expo`** at the correct point in the sequence |
+| U6 | Publish **deprecation window policy** (≥3 minors until 1.0; align RTK sunset with program P6) |
+
+## Architecture
+
+### Three artifacts
+
+1. **Upgrade notes** (`mcp-server/src/docs/upgrades/<version>.md`) — the data. Consumed by `terreno_get_upgrade_guide`, readable directly, and referenced from the changelog.
+2. **The `upgrading-terreno` skill** — the executor. Wraps note application, dependency bumps, Expo delegation, codegen, and verification.
+3. **A versioning and deprecation policy** (`docs/explanation/versioning-policy.md`) — the promise. What lockstep means, what a minor can break before 1.0, how long deprecations last.
+
+### Upgrade note format
+
+Standardize on the shape the existing notes already use, with required sections so the concatenated output from `terreno_get_upgrade_guide` reads coherently across several versions:
+
+```markdown
+# Upgrading to <version>
+
+**Action required:** Yes | No
+**Affected packages:** @terreno/api, @terreno/ui, ...
+
+## Summary
+## Breaking changes
+### <change title>
+**What changed** / **Why** / **Migration** (before/after code)
+## Deprecations
+## New capabilities
+## Verification
+```
+
+The `Verification` section matters most for automation: it gives the skill a concrete way to confirm each version's upgrade succeeded before moving to the next.
+
+### The upgrade ordering problem
+
+Order is the thing consumers get wrong, and it is not obvious:
+
+```mermaid
+flowchart TD
+  A["1. Clean git tree + branch"]
+  B["2. application_info:<br/>current @terreno/* versions"]
+  C["3. terreno_get_upgrade_guide<br/>current → target"]
+  D["4. Backend packages<br/>api, ai, admin-backend, feature-flags, api-health"]
+  E["5. Backend tests + compile"]
+  F["6. Expo SDK<br/>delegate to upgrading-expo"]
+  G["7. Frontend packages<br/>ui, syncdb, admin-frontend, admin-spa"]
+  H["8. Regenerate typed client"]
+  I["9. Compile + lint + tests"]
+  J["10. Run the app, verify UI"]
+  A --> B --> C --> D --> E --> F --> G --> H --> I --> J
+```
+
+Backend first because the OpenAPI spec is the contract the frontend generates from; regenerating the client against an un-upgraded backend produces a client for the wrong API. Expo before the Terreno frontend packages because `@terreno/ui` pins peer dependencies against Expo's versions.
+
+### Release-process enforcement
+
+The `release` skill currently does not require an upgrade note. Add:
+
+1. A required step: if the release's changelog section contains `Breaking`, `Deprecated`, `Removed`, or `Changed`, write `mcp-server/src/docs/upgrades/<version>.md` before tagging.
+2. A CI check in `repo-policies.yml` that fails a release tag when the note is missing.
+
+Without mechanical enforcement this decays again — that is exactly what happened between 0.21.0 and 0.26.0.
+
+## Models / APIs
+
+No new models. `terreno_get_upgrade_guide`'s behavior with a range containing no notes needs improving: it should say "no notes recorded for 0.22–0.24" rather than returning empty, so an agent does not conclude nothing changed.
+
+## Notifications
+
+An Announcements discussion post per breaking release, per [`public-roadmap-github`](public-roadmap-github.md) Task 5.3.
+
+## UI
+
+None.
+
+## Phases
+
+1. **Backfill** — the consolidated 0.21 → 0.26 note plus the note format and template.
+2. **Policy** — `docs/explanation/versioning-policy.md`.
+3. **Skill** — `upgrading-terreno` with the correct ordering and Expo delegation.
+4. **Enforcement** — release skill step and CI check; improve the tool's empty-range response.
+5. **Validation** — perform a real upgrade of a consumer app using only the skill.
+
+## Feature Flags & Migrations
+
+None.
+
+## Not Included / Future Work
+
+- Codemods.
+- Automatic dependency-bump PRs (Dependabot covers third-party deps, not intra-Terreno lockstep bumps).
+- A compatibility matrix across Expo SDK versions (worth doing once there is more than one supported SDK).
+- Downgrade guidance.
+
+## Files to Create / Modify
+
+**Create**
+
+- `mcp-server/src/docs/upgrades/README.md` (format + template)
+- `mcp-server/src/docs/upgrades/0.26.0.md` (consolidated 0.21 → 0.26)
+- `mcp-server/src/docs/upgrades/<syncdb-version>.md` (owned by the migration IP; referenced here)
+- `docs/explanation/versioning-policy.md`
+- `docs/how-to/upgrade-terreno.md`
+- `.rulesync/skills/upgrading-terreno/SKILL.md`
+- `.rulesync/skills/upgrading-terreno/references/ordering.md`
+
+**Modify**
+
+- `mcp-server/src/tools.ts` (`terreno_get_upgrade_guide` empty-range response)
+- `mcp-server/src/prompts.ts` (`terreno_upgrade` prompt points at the skill)
+- `.rulesync/skills/release/SKILL.md`
+- `.github/workflows/repo-policies.yml`
+- `CHANGELOG.md` (link notes per version)
+- `docs/how-to/README.md`, `docs/explanation/README.md`
+
+## Task List
+
+See [`docs/tasks/upgrade-guides-and-skill.md`](../tasks/upgrade-guides-and-skill.md).
+
+## Acceptance Criteria
+
+- [ ] `mcp-server/src/docs/upgrades/README.md` defines the required note format with a template.
+- [ ] A consolidated note covers everything a consumer must know to move from 0.21.0 to 0.26.0, derived from real release notes and diffs.
+- [ ] `terreno_get_upgrade_guide` for the range 0.21.0 → current returns useful content, and for a range with no recorded notes returns an explicit "no notes recorded" message rather than empty output.
+- [ ] `docs/explanation/versioning-policy.md` states what lockstep versioning means, the pre-1.0 breaking-change policy, and the minimum deprecation window.
+- [ ] The `upgrading-terreno` skill exists with all mirrors committed and enforces a clean git tree before starting.
+- [ ] The skill follows the documented ordering, delegates the Expo SDK portion to `upgrading-expo`, and regenerates the typed client only after the backend is upgraded.
+- [ ] The skill runs compile, lint, and tests between phases and stops on first failure with the failing step named.
+- [ ] On a multi-version jump failure, the skill retries version by version to isolate the breaking version.
+- [ ] The release skill requires an upgrade note when the changelog section contains a breaking, deprecated, removed, or changed entry.
+- [ ] A CI check fails a release tag whose upgrade note is missing when required.
+- [ ] An upgrade of a real consumer app across at least two minor versions succeeds using only the skill, and the transcript is captured.
+- [ ] `bun run mcp:build`, `bun run lint`, and `bun run rules:check` pass.