docs: post-swap branch model, PR policy, milestone rule, and Copilot review instructions by cliffhall · Pull Request #1866 · modelcontextprotocol/inspector

cliffhall · 2026-07-31T21:40:54Z

Closes #1873
Closes #1877

Sub-task of #1821 (go-live phase 8) — this PR is the documentation half only; the ordered plan for the rest lives in #1821's description.

Phase-8 docs hygiene — the documentation half of "everything that silently inverts when main becomes v2." Markdown only; no source, config, or workflow files touched.

Branch / release model

Documented canonically in AGENTS.md (as a table) and corrected everywhere it was restated:

Branch	Role	PRs target it?	Publishes to
`v2/main`	Develop — all active v2 work	yes, every v2 PR	— (reaches npm via `main`)
`main`	Release — default branch, latest released v2	no — milestone merges from `v2/main` only	`latest`
`v1/main`	Maintenance — deprecated, security/bug fixes only	yes, every v1 PR, directly	`v1-latest`, straight from the branch

Verified against npm: v1-latest: 1.0.1, latest: 2.0.0.

Two docs stated the inverse of the current reality and would have sent a contributor at the wrong branch:

README.md's "Repo status" callout: "The main branch is the legacy v1 implementation (bug fixes only)" — main now holds v2.
CONTRIBUTORS.md's version table listed v2's base branch as main, as did its "Label by version" paragraph.

Also added to the README release section: a v2 release is cut from main after the milestone merge, not from v2/main.

PR and issue policy

Every PR must reference an issue — from anyone, no exceptions; Closes #N as the first body line. Stated in both AGENTS.md and CONTRIBUTORS.md.
PRs are opened by repo maintainers only. Org write access is not authorization — the constraint is the workflow, not permissions. Everyone else files a detailed issue. CONTRIBUTORS.md gets a new ## Who opens pull requests section.
Branch names start with the target version segment — v2/ci/restore-claude-workflow, not ci/restore-claude-workflow.
Exactly one of v1/v2 at creation, with v2 as the documented default when the target is unclear (previously the rule didn't say "exactly one" and had no tie-breaker).
Every new issue gets a milestone, set at create time, defaulting to the current milestone (the open one with the nearest due date) when the user didn't specify. Unmilestoned issues drop out of release planning the same way unlabeled ones drop out of version filtering. The section's opening callout now reads four steps, not three: labeled, milestoned, boarded, statused.
Screenshots proving a UI/TUI change go in a pr-screenshots/ folder off the root, created if absent. That folder is gitignored, so they're attached to the PR body rather than committed.

Stale content corrected while in there

The TUI coverage bullet was wrong. It described the Ink components / App.tsx / hooks/ as an "interim exclusion pending TUI: extend coverage gate to Ink components (lift interim exclusion) #1501" — TUI: extend coverage gate to Ink components (lift interim exclusion) #1501 closed 2026-06-29 and clients/tui/vitest.config.ts now has include: ["src/**/*.{ts,tsx}"] with only src/tui-servers.ts excluded. Anyone following the old text would have assumed new Ink components were ungated.
The completion checklist contradicted the pre-push gate, saying npm run validate ensured "lint, build, unit tests, and e2e tests" — while §Mandatory pre-push gate says validate is explicitly not acceptable before pushing. Now points at npm run ci.
v1's PR base was given as main; it is v1/main.
Project tree omissions: core/client/, docs/, scripts/ in AGENTS.md; core/client/, docs/ in README.md. core/client is not cosmetic — it's in the web coverage include (so under the ≥90 gate), has tests at clients/web/src/test/core/client/, and is imported by both App.tsx trees.
Added the launcher and npm run test:scripts to the "run the tests" list (launcher was the only client missing, despite having its own ≥90 gate), plus a test-tiers overview — precise that validate runs cli's out-of-process e2e.test.ts but not web's integration project, which runs inside coverage.

Copilot review instructions (folded in from #1878)

GitHub Copilot reads .github/copilot-instructions.md when it reviews a PR. We didn't have one, so Copilot has been reviewing against generic defaults rather than this codebase's conventions. Added as a review-focused distillation of AGENTS.md:

TypeScript — no any, no suppressing error types, no @ts-nocheck/@ts-ignore, and the double-cast rule including when an as unknown as is acceptable and that it must carry a justifying comment.
React/Mantine — dumb components; the props → theme variant → CSS class preference order; no inline styles; no raw color literals; what may live in App.css at all.
The .withProps() rule in full, including the part most often missed — single-use elements are not exempt — the static-vs-dynamic distinction, and all five legitimate exceptions (Box, Accordion, headless components, data-*, non-factory components).
Theme files vs. element components, and that domain variant logic must never go into a theme file.
lib vs utils, the one-way import direction, and that the coverage include is a whitelist — a module outside the named directories silently escapes the gate.
Tests — the ≥90% four-dimension gate, the v8 ignore policy, test placement (web side-by-side vs. __tests__/ for the Node clients), mandatory renderWithMantine.
A "what to prioritize" list putting correctness and security first, since this backend spawns local processes and proxies outbound requests.

Deliberately excluded: board recipes and IDs, milestone/branch mechanics, release procedure, the project tree — no reviewer cites those, and copying them doubles the maintenance surface.

AGENTS.md's "Keep documentation files up to date" now requires mirroring review-relevant changes into that file in the same PR, states that AGENTS.md remains the source of truth, defines what counts as review-relevant, and lists what is deliberately not mirrored.

Known weakness, stated rather than hidden. Nothing detects drift between the two files — no generation step, no CI check. The mirroring rule is all that keeps them in sync, and a stale mirror is worse than none, because Copilot would then review confidently against rules we no longer hold. The file's header says AGENTS.md wins on any disagreement and that drift is itself a review finding. If it drifts in practice, the follow-up is a CI check failing when AGENTS.md's review-relevant sections change without a corresponding mirror change — which is why the rule reads "same PR" and not "eventually."

Testing

Docs-only. No file touched here is read by any gate — the format:check globs cover {ts,tsx,mts,cts,js,jsx,mjs,cjs}, not .md, so npm run ci has nothing to say about this diff. Anchor links used in the new text were checked against the headings they target.

Not addressed here

The first task on #1821 — enabling v2/main → main milestone merges — is worked up in this comment rather than here. Short version: it already works; the branches share a merge base at 4d30d1cd, established by the go-live merge (#1830). A dry run merges cleanly apart from one README.md conflict, and SECURITY.md survives. No graft or --allow-unrelated-histories is needed.

🤖 Generated with Claude Code

https://claude.ai/code/session_01YAt8rqxysNbhYWLhoRm3fU

…entries Part of the go-live phase-8 docs hygiene: everything that silently inverted when `main` became v2. Branch/release model — documented canonically in AGENTS.md and corrected everywhere it was restated: - AGENTS.md: replace the one-line "Base Branches" bullet with a table giving each branch its role (v2/main = develop, main = release, v1/main = maintenance), whether PRs target it, and which npm dist-tag it publishes. - README.md: the "Repo status" callout had it backwards, claiming `main` was the legacy v1 implementation. Also note that a v2 release is cut from `main` after the milestone merge, not from v2/main. - CONTRIBUTORS.md: the version table listed v2's base branch as `main`. PR policy: - Every PR must reference an issue, from anyone, no exceptions. - PRs are opened by repo maintainers only — org write access is not authorization. Everyone else files a detailed issue. - Branch names start with the target version segment (v2/…, v1/…). - Issues and PRs carry exactly one of `v1`/`v2` at creation; default `v2`. - Screenshots proving UI/TUI changes go in the gitignored pr-screenshots/. Corrections to stale content found while in there: - The TUI coverage bullet still described the Ink/App.tsx/hooks exclusion as interim pending #1501, which closed 2026-06-29; the gate now covers all of src/** with only tui-servers.ts excluded. - The completion checklist said `npm run validate` was the gate and covered "e2e tests", contradicting the mandatory-pre-push-gate section (npm run ci). - v1 PR base was given as `main`; it is `v1/main`. - Project tree omitted core/client, docs/, and scripts/ (README: core/client, docs/). core/client is under the coverage gate and imported by both App.tsx trees. Also adds the launcher and `npm run test:scripts` to the "run the tests" list and a tiers overview, since neither was mentioned. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01YAt8rqxysNbhYWLhoRm3fU

…nt one Adds the rule alongside the version-label rule, since they fail the same way: an unmilestoned issue drops out of release planning as silently as an unlabeled one drops out of version filtering. - Set it at create time (`gh issue create --milestone <title> ...`). - If the user didn't specify one, default to the current milestone — the open milestone with the nearest due date — rather than leaving it blank pending a decision. Includes the `gh api .../milestones` one-liner that identifies it. - Milestones are release buckets, so pick by when the work ships, not by size; sub-issues normally inherit their parent's milestone. Also widens the section's opening callout: an issue is not "created" until it is labeled, milestoned, AND boarded with a Status — four distinct steps, not three. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01YAt8rqxysNbhYWLhoRm3fU

GitHub Copilot reads .github/copilot-instructions.md when reviewing a PR. The repo had no such file, so Copilot reviewed without any of the conventions that actually govern this codebase — the ban on `any` and on unjustified double casts, the Mantine-first styling rules, the `.withProps()` extraction rule, the lib/utils split, test placement, and the per-file >=90% four-dimension gate. The new file is a review-focused distillation of AGENTS.md: the rules a reviewer would cite against a diff, plus a short "what to prioritize" list that puts correctness and security first (this backend spawns processes and proxies outbound requests). Deliberately omitted: board recipes and IDs, milestone and branch mechanics, release procedure, and the project tree — no reviewer cites those, and copying them would double the maintenance surface. AGENTS.md's "Keep documentation files up to date" section now requires mirroring review-relevant changes into it in the same PR, states that AGENTS.md stays the source of truth, and spells out what counts as review-relevant. There is no generation step and nothing detects drift, so the rule is the only thing keeping the two in sync. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01YAt8rqxysNbhYWLhoRm3fU

Copilot

Pull request overview

Documentation-only update to align the repository’s written guidance with the post-swap branch/release model and current contribution workflow, and to add a Copilot-specific distillation of the repo’s review conventions.

Changes:

Correct and expand branch/release-model documentation across top-level docs (v2 development on v2/main, releases from main, v1 maintenance on v1/main).
Clarify contribution/PR policy (issues-first workflow, who opens PRs, issue/label/milestone expectations).
Add .github/copilot-instructions.md as a review-focused mirror of key conventions from AGENTS.md.

Reviewed changes

Copilot reviewed 4 out of 4 changed files in this pull request and generated 4 comments.

File	Description
README.md	Updates repo status + layout docs and clarifies that v2 releases are cut from `main` after milestone merges.
CONTRIBUTORS.md	Clarifies PR policy and corrects version/base-branch guidance for contributors.
AGENTS.md	Updates canonical workflow documentation (branch model, milestones, testing tiers) and reinstates missing context.
.github/copilot-instructions.md	Adds Copilot review instructions distilled from `AGENTS.md` conventions.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

cliffhall · 2026-08-01T00:30:01Z

 - **v1** (`v1/main`) is the legacy Inspector — it takes **security fixes
-  only**.
- **v2** (`main`) is where all current work happens — when in doubt, target v2.
+  only**, and is published straight from that branch to the `v1-latest` npm
+  tag (`npx @modelcontextprotocol/inspector@v1-latest`).


Fixed in 33cc036. Agreed — this was the odd one out. README.md, the AGENTS.md branch table, and the v1 project-board description all say "security and bug fixes"; only this bullet and one AGENTS.md line said "security fixes only". Normalized on security and bug fixes only.

cliffhall · 2026-08-01T00:30:05Z

+## Project Status and Direction
+* The v1/main branch currently contains the legacy version of the Inspector, which we are creating security fixes for in deprecated maintenance mode. It is **published straight from the branch** to the `v1-latest` npm dist-tag — v1 releases never pass through `main`, and v1 PRs therefore target `v1/main` directly.


Fixed in 33cc036. Same normalization as the CONTRIBUTORS.md comment — this line now reads "in deprecated maintenance mode — security and bug fixes only, no new features", matching the branch table below it and the README callout.

cliffhall · 2026-08-01T00:30:30Z

+Status option IDs (`--single-select-option-id`) — **last verified 2026-07-27**. 

 | Status | Option ID |
 | --- | --- |
 | Todo | `fbdaf21e` |


Fixed in 33cc036 — real inconsistency, and the table was the correct half. Verified against the live board with gh project field-list 28 --owner modelcontextprotocol, whose Status options are now exactly Todo / In Progress / In Review / Done.

V2 Go Live no longer exists, so its id would be rejected today and the stale instruction was the bug. Removed the (or **V2 Go Live** …) parenthetical from the work-begins step, and restored the removed-column id list this PR had dropped — now including V2 Go Live (b3a6966e) alongside the four columns retired earlier — so a reader who finds an old id in a script can tell it is dead rather than mistyped.

- Align the v1 maintenance policy on "security and bug fixes only" in AGENTS.md and CONTRIBUTORS.md; both said "security fixes only" while the README callout, the branch table, and the board description said "security and bug fixes". - Drop the stale "or V2 Go Live" instruction from the work-begins step — that column no longer exists on board #28 (verified via `gh project field-list 28`), so the option id it implied would be rejected. Restore the removed-column id list the same edit dropped, now including V2 Go Live, and re-date the table to today's verification. - Fix "contains the the new version" typo. - Strip a stray trailing blank line at the end of AGENTS.md. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01YAt8rqxysNbhYWLhoRm3fU

Copilot

Pull request overview

Copilot reviewed 4 out of 4 changed files in this pull request and generated no new comments.

Suppressed comments (1)

AGENTS.md:8

In the Project Structure tree, the root is shown as v2/main/, but there is no v2/ directory in the repository checkout. This reads like a filesystem path rather than a branch name and can mislead readers running commands from the repo root.

v2/main/

The tree is a filesystem layout — every child is a real directory (`clients/`, `core/`, `test-servers/`). Labeling its root `v2/main/` named a branch instead, which reads as a path that does not exist in a checkout and diverged from the identical tree in README.md, which still says `inspector/`. The branch model is documented in its own table under Repository & Project Boards; the tree does not need to restate it. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01YAt8rqxysNbhYWLhoRm3fU

cliffhall · 2026-08-01T00:33:34Z

Copilot review round 2 produced no new inline comments, but its suppressed comment on AGENTS.md:8 was correct and is now fixed in eebf9f2:

In the Project Structure tree, the root is shown as v2/main/, but there is no v2/ directory in the repository checkout. This reads like a filesystem path rather than a branch name and can mislead readers running commands from the repo root.

Agreed — the tree is a filesystem layout (every child is a real directory: clients/, core/, test-servers/), and labeling its root with a branch name both invented a path that doesn't exist in a checkout and diverged from the identical tree in README.md, which still reads inspector/. Restored to inspector/. The branch model has its own table under Repository & Project Boards, so the tree doesn't need to restate it.

Recording it here since a suppressed comment has no thread to reply to.

Copilot

Pull request overview

Copilot reviewed 4 out of 4 changed files in this pull request and generated no new comments.

Reverses the direction the Copilot round took in 33cc036. That commit normalized the six v1-policy sites onto "security and bug fixes" because that was the majority wording — but majority is the wrong tiebreak here. The policy is set by what we told contributors: the #1819 backlog close note, posted to 120 closed PRs, says "v1 will receive security fixes only", and the five PRs retained for 1.0.5 are all security fixes. So the two sites that already said "security fixes only" were the correct ones, and the four that said otherwise are now aligned to them: - AGENTS.md: the `v1` label description, the branch-role table, and the v1 board line. - README.md: the "Repo status" callout. CONTRIBUTORS.md and AGENTS.md's Project Status bullet already read correctly and are unchanged. This is the substance of #1813, which is why that issue's PR is now reduced to its PR-template-link half — the wording work landed here to avoid two PRs editing the same lines in opposite directions. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01YAt8rqxysNbhYWLhoRm3fU

cliffhall · 2026-08-01T00:37:32Z

Reversing one of the Copilot fixes in 33cc0366, in commit ee020ff2.

Copilot correctly spotted that the v1-policy wording was inconsistent across six sites, and that fix normalized them onto "security and bug fixes" because that was the majority wording. Majority is the wrong tiebreak here: the policy is set by what we told contributors. The #1819 backlog close note — posted to 120 closed PRs — says "v1 will receive security fixes only", and all five PRs retained for 1.0.5 are security fixes.

So the two sites that already said "security fixes only" were the correct ones. The four others are now aligned to them: the v1 label description, the branch-role table, and the v1 board line in AGENTS.md, plus README's "Repo status" callout. CONTRIBUTORS.md and AGENTS.md's Project Status bullet already read correctly.

This is the substance of #1813, so that issue's PR is reduced to its PR-template-link half — two PRs editing the same lines in opposite directions was the risk being avoided.

The "Repo status" callout edit here patched `(bug fixes only)` → `(security fixes only)` on the callout as it exists on v2/main. But #1866 replaces that entire callout, because the surrounding sentence is false today: it still says "The `main` branch is the legacy v1 implementation", when `main` now holds the latest released v2. So this edit both collides with #1866 on the same line and, taken on its own, would preserve the false statement while correcting only the parenthetical. #1866 already sets the v1 policy wording to "security fixes only" across AGENTS.md and README (ee020ff), so nothing is lost by dropping it here. This PR is now exactly its intended half: the two branch-pinned `blob/main/CONTRIBUTORS.md` links in .github/pull_request_template.md, made relative. That file is untouched by #1866, so the two PRs no longer overlap on any line. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01YAt8rqxysNbhYWLhoRm3fU

Reverts the branch description introduced in c7fbf35. That change was made to match README.md:17 and AGENTS.md — but those are precisely the stale sentences PR #1866 exists to correct. `main` has not been the legacy v1 implementation since the go-live tree swap; it is the release branch holding the latest released v2, and the deprecated v1 line lives on `v1/main`. So the comment now describes the real model: v2/main is the develop branch, main is release-only and receives milestone merges, v1/main is maintenance and takes security fixes only. The rest of c7fbf35 stands — the bug_report.md change (asking reporters for the version checkbox rather than to apply a label they lack permission to set) was a genuine catch. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01YAt8rqxysNbhYWLhoRm3fU

This PR edited the `See [CONTRIBUTORS.md](./CONTRIBUTORS.md)` link in AGENTS.md, which is the exact line #1866 rewrites — guaranteeing a one-line conflict when this merges after it. Handing that line to its owner instead: #1866 now writes the link as `CONTRIBUTING.md` directly, so this PR is a pure `git mv` and the two touch no common line. No conflict to resolve at merge time. The tradeoff is a short window between the two merges where AGENTS.md links to a filename that doesn't exist yet. That's deliberate and bounded: #1866 is first in the merge order and this is third. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01YAt8rqxysNbhYWLhoRm3fU

This PR rewrites the paragraph holding the only in-repo link to the contributing policy, so it owns that line. #1884 renames the file CONTRIBUTORS.md -> CONTRIBUTING.md; having #1884 also edit this line would guarantee a one-line conflict between the two. Writing the new filename here instead makes #1884 a pure `git mv` with no overlapping line, so neither PR conflicts with the other. Between this merging and #1884 merging, the link points at a filename that doesn't exist yet. That window is deliberate and bounded — this PR is first in the merge order (#1821) and #1884 is third. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01YAt8rqxysNbhYWLhoRm3fU

cliffhall · 2026-08-01T02:54:46Z

Added a commit pointing the AGENTS.md policy link at CONTRIBUTING.md.

This PR rewrites the paragraph containing the only in-repo link to the contributing policy, so it owns that line. #1884 renames CONTRIBUTORS.md → CONTRIBUTING.md; having #1884 also edit this line guaranteed a one-line conflict between the two. Writing the new filename here instead makes #1884 a pure git mv, and the two PRs now share no file.

Between this merging and #1884 merging, the link points at a filename that doesn't exist yet — deliberate and bounded, since this is first in #1821's merge order and #1884 is third.

…1880) * docs: converge README Test servers section with main's restructure Transplants main's restructured "Test servers" section (#1836) onto v2/main — the "Serving the modern protocol era" and "Showcase configs" headings, the config table, and the per-config subsections — replacing the eight long paragraphs v2/main still carried. Folds in v2/main's #1846 correction: main's copy still claims Mcp-Param-* mirroring is skipped in the browser, which stopped being true when the Inspector took over building the mirrored headers itself. The blockquote callout keeps main's shape with the corrected wording. Scoped to that section only — the whole file is deliberately NOT copied from main, so #1866's repo-status callout and release-section edits (and every other v2/main-only line) are untouched. Shrinks the first v2/main -> main milestone merge from a whole-section conflict to a single 3-line hunk. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01YAt8rqxysNbhYWLhoRm3fU * docs: point the #1846 reference at the issue, not a nonexistent PR URL #1846 is the issue; the fix shipped as PR #1847. The callout's link used /pull/1846, which 404s. Per Copilot review. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01YAt8rqxysNbhYWLhoRm3fU --------- Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com>

…e policy (#1884) * docs: rename CONTRIBUTORS.md to CONTRIBUTING.md (#1883) GitHub's contributing-guidelines banner — shown when someone clicks "New issue" or opens a pull request — keys on the exact filename CONTRIBUTING.md. Naming the file CONTRIBUTORS.md left that prompt dark precisely where the "open an issue, not a PR" policy needs to land. Renamed with `git mv` so history follows the file; contents are unchanged (its heading already reads "Contributing to MCP Inspector"). Updated the one in-repo reference, in AGENTS.md. The two links in .github/pull_request_template.md are deliberately untouched — PR #1879 makes them relative so they follow the rename. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01YAt8rqxysNbhYWLhoRm3fU * docs: drop the AGENTS.md link edit; #1866 owns that line This PR edited the `See [CONTRIBUTORS.md](./CONTRIBUTORS.md)` link in AGENTS.md, which is the exact line #1866 rewrites — guaranteeing a one-line conflict when this merges after it. Handing that line to its owner instead: #1866 now writes the link as `CONTRIBUTING.md` directly, so this PR is a pure `git mv` and the two touch no common line. No conflict to resolve at merge time. The tradeoff is a short window between the two merges where AGENTS.md links to a filename that doesn't exist yet. That's deliberate and bounded: #1866 is first in the merge order and this is third. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01YAt8rqxysNbhYWLhoRm3fU --------- Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com>

#1879) * docs: say "security fixes only" for v1 and unpin the PR-template links The v1 maintenance policy was stated two different ways across the docs — "security fixes only" in CONTRIBUTORS.md, "bug fixes" in README.md. The #1819 PR triage told 120 contributors that v1 is security-fixes-only, so that is the wording we keep. Also make the PR template's two CONTRIBUTORS.md links relative instead of pinned to blob/main/. `main` is release-only, so those resolved against the last released tree rather than the branch the reader is on. The remaining AGENTS.md occurrences are left alone deliberately: PR #1866 rewrites those exact lines and lands first. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01YAt8rqxysNbhYWLhoRm3fU * docs: drop the README change; #1866 owns that line The "Repo status" callout edit here patched `(bug fixes only)` → `(security fixes only)` on the callout as it exists on v2/main. But #1866 replaces that entire callout, because the surrounding sentence is false today: it still says "The `main` branch is the legacy v1 implementation", when `main` now holds the latest released v2. So this edit both collides with #1866 on the same line and, taken on its own, would preserve the false statement while correcting only the parenthetical. #1866 already sets the v1 policy wording to "security fixes only" across AGENTS.md and README (ee020ff), so nothing is lost by dropping it here. This PR is now exactly its intended half: the two branch-pinned `blob/main/CONTRIBUTORS.md` links in .github/pull_request_template.md, made relative. That file is untouched by #1866, so the two PRs no longer overlap on any line. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01YAt8rqxysNbhYWLhoRm3fU --------- Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com>

* chore: restore repo files dropped by the v2 tree swap A sweep of the pre-swap tree (ac3c1a1) against v2/main turned up 14 files the tree swap dropped and that were never restored to either branch. Most are correctly gone (v1 CI workflows, v1 sample-config, husky hook, two 0-byte files, v1-specific prettier config). These four are worth having: - .github/dependabot.yml — rewritten, not restored. v1's covered only github-actions at /; this covers github-actions plus the six npm manifests v2 actually has (root + four clients), monthly rather than weekly, grouped to one PR per ecosystem/directory, targeting v2/main, and labeled `v2` so the version-label rule holds for bot PRs too. - .github/ISSUE_TEMPLATE/bug_report.md — rewritten. v1's asked for an "Inspector Version e.g. 0.16.5" and had no client or version field. Under the issues-only policy this template is the primary intake, so it now asks the routing questions first (v1 vs v2, which client) and points at the prompt-not-a-diff path. - .gitattributes — restored byte-for-byte (package-lock.json linguist-generated=true). More useful in v2 than v1: there are now six lockfiles, and they dominate dependency-bump diffs. - CODE_OF_CONDUCT.md — restored byte-for-byte, so GitHub surfaces it as a community standard. Left unformatted deliberately: it is verbatim upstream Contributor Covenant text, v1 listed it in .prettierignore for that reason, and no v2 format glob reaches root markdown. CONTRIBUTING.md is deliberately not restored here — it is handled by renaming CONTRIBUTORS.md to that name, which also lights up GitHub's contributing banner without leaving two files to keep in sync. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01YAt8rqxysNbhYWLhoRm3fU * docs(dependabot): state the documented target-branch/security-update rule Copilot review: the comment read as if `target-branch` had no bearing on security updates. Per GitHub's Dependabot options reference, an entry whose `target-branch` names a non-default branch is not applied to security updates at all — so the schedule/labels/groups here shape version updates only, and security PRs continue to be raised against the default branch. Comment-only; the configured settings are unchanged. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01YAt8rqxysNbhYWLhoRm3fU * docs: correct the branch description and the labeling ask Two suppressed Copilot comments, both correct: - dependabot.yml called `main` "release-only". It isn't — README.md and AGENTS.md both describe it as the legacy v1 implementation taking security and bug fixes only. Reworded to match, keeping the point that matters (Dependabot reads config from the default branch). - bug_report.md asked reporters to label the issue `v2`/`v1`, which most external reporters have no permission to do. It now asks only for the version checkbox and says a maintainer labels it at triage. Comment/prose only; no configured Dependabot setting changed. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01YAt8rqxysNbhYWLhoRm3fU * docs(dependabot): describe main as release-only, not "legacy v1" Reverts the branch description introduced in c7fbf35. That change was made to match README.md:17 and AGENTS.md — but those are precisely the stale sentences PR #1866 exists to correct. `main` has not been the legacy v1 implementation since the go-live tree swap; it is the release branch holding the latest released v2, and the deprecated v1 line lives on `v1/main`. So the comment now describes the real model: v2/main is the develop branch, main is release-only and receives milestone merges, v1/main is maintenance and takes security fixes only. The rest of c7fbf35 stands — the bug_report.md change (asking reporters for the version checkbox rather than to apply a label they lack permission to set) was a genuine catch. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01YAt8rqxysNbhYWLhoRm3fU --------- Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com>

cliffhall added the v2 Issues and PRs for v2 label Jul 31, 2026

cliffhall linked an issue Jul 31, 2026 that may be closed by this pull request

go-live 8/9: post-swap docs, labels, boards, and integration hygiene #1821

Closed

cliffhall mentioned this pull request Jul 31, 2026

go-live 8/9: post-swap docs, labels, boards, and integration hygiene #1821

Closed

cliffhall linked an issue Jul 31, 2026 that may be closed by this pull request

Post-swap docs: correct the branch model, PR policy, and stale AGENTS.md content #1873

Closed

cliffhall mentioned this pull request Jul 31, 2026

Converge README.md on v2/main with main's restructured Test servers section #1874

Closed

cliffhall mentioned this pull request Jul 31, 2026

docs: reconcile the v1 policy wording and fix branch-pinned PR-template links #1813

Closed

cliffhall changed the title ~~docs: correct post-swap branch model, PR policy, and stale gate/tree entries~~ docs: post-swap branch model, PR policy, milestone rule, and Copilot review instructions Aug 1, 2026

cliffhall mentioned this pull request Aug 1, 2026

docs: add .github/copilot-instructions.md and require mirroring into it #1878

Closed

cliffhall requested a review from Copilot August 1, 2026 00:26

Copilot started reviewing on behalf of cliffhall August 1, 2026 00:26 View session

Copilot AI reviewed Aug 1, 2026

View reviewed changes

This was referenced Aug 1, 2026

docs: unpin the branch-pinned CONTRIBUTORS.md links in the PR template #1879

Merged

docs: converge README Test servers section with main's restructure #1880

Merged

cliffhall requested a review from Copilot August 1, 2026 00:30

Copilot started reviewing on behalf of cliffhall August 1, 2026 00:31 View session

Copilot AI reviewed Aug 1, 2026

View reviewed changes

cliffhall requested a review from Copilot August 1, 2026 00:33

Copilot started reviewing on behalf of cliffhall August 1, 2026 00:34 View session

Copilot AI reviewed Aug 1, 2026

View reviewed changes

cliffhall mentioned this pull request Aug 1, 2026

chore: restore repo files dropped by the v2 tree swap #1871

Merged

cliffhall linked an issue Aug 1, 2026 that may be closed by this pull request

Add .github/copilot-instructions.md so Copilot reviews against our actual conventions #1877

Closed

This was referenced Aug 1, 2026

Rename CONTRIBUTORS.md → CONTRIBUTING.md so GitHub surfaces the contributing policy #1883

Closed

docs: rename CONTRIBUTORS.md to CONTRIBUTING.md so GitHub surfaces the policy #1884

Merged

cliffhall merged commit 3ac34e4 into v2/main Aug 1, 2026
1 check passed

cliffhall deleted the v2/docs/post-swap-branch-model-and-pr-policy branch August 1, 2026 03:00

This was referenced Aug 1, 2026

Post-swap docs: correct the branch model, PR policy, and stale AGENTS.md content #1873

Closed

Add .github/copilot-instructions.md so Copilot reviews against our actual conventions #1877

Closed

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

docs: post-swap branch model, PR policy, milestone rule, and Copilot review instructions - #1866

docs: post-swap branch model, PR policy, milestone rule, and Copilot review instructions#1866
cliffhall merged 7 commits into
v2/mainfrom
v2/docs/post-swap-branch-model-and-pr-policy

cliffhall commented Jul 31, 2026 •

edited

Loading

Uh oh!

Copilot AI left a comment

Uh oh!

cliffhall Aug 1, 2026

Uh oh!

cliffhall Aug 1, 2026

Uh oh!

Uh oh!

cliffhall Aug 1, 2026

Uh oh!

Copilot AI left a comment

Uh oh!

cliffhall commented Aug 1, 2026

Uh oh!

Copilot AI left a comment

Uh oh!

cliffhall commented Aug 1, 2026

Uh oh!

cliffhall commented Aug 1, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

		## Project Status and Direction
		* The v1/main branch currently contains the legacy version of the Inspector, which we are creating security fixes for in deprecated maintenance mode. It is published straight from the branch to the `v1-latest` npm dist-tag — v1 releases never pass through `main`, and v1 PRs therefore target `v1/main` directly.

Uh oh!

Conversation

cliffhall commented Jul 31, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Branch / release model

PR and issue policy

Stale content corrected while in there

Copilot review instructions (folded in from #1878)

Testing

Not addressed here

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

cliffhall Aug 1, 2026

Choose a reason for hiding this comment

Uh oh!

cliffhall Aug 1, 2026

Choose a reason for hiding this comment

Uh oh!

Uh oh!

cliffhall Aug 1, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

cliffhall commented Aug 1, 2026

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

cliffhall commented Aug 1, 2026

Uh oh!

cliffhall commented Aug 1, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

cliffhall commented Jul 31, 2026 •

edited

Loading