chore(release): promote develop → main (week of 2026-07-06)

[aptracebloc]

Release promotion: develop → main

Carried over into the staging release week of Mon 2026-07-06. Head is develop, so PRs merging in before the release update this PR's head and re-trigger Bugbot automatically.

Delta (12 commit(s) ahead of main)

Snapshot as of 2026-07-01 — will change as more lands on develop.

• chore: merge main into develop to resolve PR Update training guide and improve documentation for tracebloc #15 conflicts (chore: merge main into develop to resolve PR #15 conflicts #16)
• chore: sync develop with main and tidy Python conventions (chore: sync develop with main and tidy Python conventions #14)
• ci: add kanban closure-routing caller workflow (ci: add kanban closure-routing caller workflow #9)
• chore: add PR template + customer bump + stale auto-close (chore: add PR template + customer bump + stale auto-close #6)
• ci: add WIP-limit-check caller workflow (ci: add WIP-limit-check caller workflow #10)
• chore: add auto-add to engineer kanban workflow (chore: add auto-add to engineer kanban workflow #5)
• Update LICENSE
• license updated
• license updated
• improvements
• improvements
• added files

---

Note

Low Risk
Changes are CI wiring and documentation/notebook defaults; gates may block merges or flag PR content but do not alter application runtime code.

Overview
Adds two reusable-workflow callers in this repo: an FR gate that runs on PRs targeting staging, main, or master and delegates to shared logic that blocks merges unless linked kanban items are in the right “ready” columns, and a public PII gate that scans PR title, body, and commits for denylisted names/secrets on all pull requests.

The existing WIP limit check caller now also runs when a PR is reopened, not only on open/ready-for-review.

The training guide notebook bumps the documented tracebloc[pytorch] install floor to >=0.14.0 and replaces the model-zoo clone cell with an idempotent check so clone is skipped when ../model-zoo already exists.

^{Reviewed by Cursor Bugbot for commit 4ec3ecb. Bugbot is set up for automated code reviews on this repo. Configure here.}

[cursor]

Cursor Bugbot has reviewed your changes and found 2 potential issues.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit 73f775f. Configure here.}

[shujaatTracebloc]

Review — content safe to promote, but not mergeable as-is 🔴

The develop→main delta is entirely infra/docs (8 new workflows, PR template, .gitignore, CLAUDE.md, Apache-2.0 LICENSE, README rewrite, 2 notebooks) — no application/runtime code. Confirmed via git diff origin/main origin/develop that nothing on main gets clobbered; develop is the strict superset (main's earlier work is already in develop).

HIGH — the PR is CONFLICTING (mergeStateStatus: DIRTY); it can't merge as-is. A test-merge produces two add/add conflicts (files created independently on both branches after merge-base dd1259d):

• .github/workflows/wip-limit-check.yml:5 — develop adds reopened to the trigger list.
• notebooks/traceblocTrainingGuide.ipynb (clone cell) — develop has fix #22 (surface model-zoo clone failures).

Both resolve cleanly by taking develop's side on each (strictly newer). Mechanical.

MEDIUM — confirm PROJECTS_KANBAN_TOKEN is an org secret. add-to-kanban.yml:16 references ${{ secrets.PROJECTS_KANBAN_TOKEN }}; no repo-level secrets exist. Already live on develop with no reported failures, so likely org-scoped — worth a one-line confirmation so it doesn't fail on every issue/PR open.

Security review of the workflows — clean:

• No pull_request_target misuse; both public-facing gates use pull_request.
• No ${{ github.event.* }} interpolated into any run: step → no script-injection surface here.
• All 6 referenced reusable workflows exist in tracebloc/.github; stale-backlog.yml permissions scoped correctly; all 8 workflow files are valid YAML.
• No secrets/debug/half-finished features; LICENSE is standard Apache-2.0 matching the README badge.
• LOW — public-pii-gate-caller.yml / fr-gate-caller.yml use secrets: inherit on pull_request; GitHub withholds secrets for fork PRs on a public repo, so those gates run secret-less on external contributions. Not a concern for this same-repo promotion; note for the gates' own robustness.
• NIT — reusable workflows pinned to @main and third-party actions to version tags rather than SHAs; standard internal convention.

Cursor Bugbot: pass.

Verdict: safe to promote once the two add/add conflicts are resolved in favor of develop (and optionally confirm the kanban secret).

The merge-base changed after approval.