# llmenv — Agent Rules

## Versioning, Changelog & Releases

Before doing **anything** that touches the version number, `CHANGELOG.md`, or a
release — read [`docs/release.md`](docs/release.md) and follow it.

Key invariant (full details in `docs/release.md`):

- **A version only exists once it has been git-tagged.** Until then every change
  goes under `## [Unreleased]` in `CHANGELOG.md`.
- Never bump `Cargo.toml`'s `version` or create a `## [X.Y.Z]` changelog heading
  unless you are cutting a release (renaming `[Unreleased]` → `[X.Y.Z]`, bumping
  `Cargo.toml`, regenerating `Cargo.lock`, all in one release commit, then
  tagging `vX.Y.Z`).
- `git tag -l` is the source of truth. No tag → no version section, no bump.

## Licensing & Attribution

llmenv is dual-licensed `MIT OR Apache-2.0` (`LICENSE-MIT`, `LICENSE-APACHE`).
Full details: [`docs/licensing.md`](docs/licensing.md).

**Hard rule — attribution notices must be documented.** Any code that carries a
license with an attribution requirement — every bundled dependency under MIT,
MIT-0, BSD-3-Clause, ISC, Apache-2.0 (NOTICE), Unicode-3.0, CDLA-Permissive-2.0,
etc., **and** any third-party source vendored/copied into this repo — must have
its copyright/permission notice reproduced in the attribution files so it ships
with the binary and is visible on the docs site.

- Two **generated** outputs, never hand-edited: `THIRD-PARTY-LICENSES.md` (ships
  with the binary/source dist) and `website/docs/third-party-licenses.md`
  (browseable on the docs site). Regenerate both with `scripts/gen-attribution.sh`.
- **Regenerate and commit them in the same change whenever `Cargo.lock`
  dependencies change** (add/remove/bump). A PR that alters dependencies but
  leaves the attribution files stale is incomplete.
- A new license id must be added to **both** `deny.toml` (`[licenses].allow`)
  and `about.toml` (`accepted`) — but only after confirming it is compatible
  with the existing set (no strong copyleft). Then regenerate.
- `cargo deny check` gates the license policy in CI and on pre-push; a rejected
  license fails the build rather than silently shipping.
