feat(v0.16): CHANGELOG + tag-driven release workflow

Keep-a-Changelog format. 12 sections: [Unreleased] + 11 real
releases v0.8.0..v0.15.0, every bullet with real git SHA pulled
via git log --no-merges. 150 LOC.

.github/workflows/release.yml — 3 jobs, triggered on tag push:
  build-release: 4-platform matrix
    - x86_64-unknown-linux-gnu
    - aarch64-unknown-linux-gnu (continue-on-error)
    - x86_64-apple-darwin
    - aarch64-apple-darwin
    Builds entire _primitives/_rust workspace, emits tar.gz +
    sha256 per target via portable executable-discovery loop.
  release: downloads artifacts, runs local
    kei-changelog --from <prev-tag> --to <tag>, publishes via
    softprops/action-gh-release@v2.
  npm-publish: graceful skip when NPM_TOKEN secret absent
    (steps.have_token.outputs.present gate + || warning wrap
    so one failing package doesn't kill the job).

Companion install support: install/lib-rust.sh gains
have_prebuilt_binaries() + KEI_SKIP_RUST_BUILD=1 guard (shipped
as part of install-split bundle). Users can download tarball
instead of compiling Rust from source.

release.yml validated via yaml.safe_load: 3 jobs parse cleanly,
matrix expands 4-wide, jobs = [build-release, release, npm-publish].

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

.github/workflows/release.yml

@@ -0,0 +1,220 @@
+name: Release
+
+on:
+  push:
+    tags:
+      - 'v*'
+
+permissions:
+  contents: write
+
+jobs:
+  build-release:
+    name: Build ${{ matrix.target }}
+    runs-on: ${{ matrix.os }}
+    continue-on-error: ${{ matrix.experimental }}
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+          - os: ubuntu-latest
+            target: x86_64-unknown-linux-gnu
+            experimental: false
+          - os: ubuntu-latest
+            target: aarch64-unknown-linux-gnu
+            experimental: true
+          - os: macos-latest
+            target: x86_64-apple-darwin
+            experimental: false
+          - os: macos-latest
+            target: aarch64-apple-darwin
+            experimental: false
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+
+      - name: Install Rust toolchain
+        uses: dtolnay/rust-toolchain@stable
+        with:
+          targets: ${{ matrix.target }}
+
+      - uses: Swatinem/rust-cache@v2
+        with:
+          workspaces: _primitives/_rust
+
+      - name: Install aarch64 cross-linker (Linux only)
+        if: matrix.target == 'aarch64-unknown-linux-gnu'
+        run: |
+          sudo apt-get update
+          sudo apt-get install -y gcc-aarch64-linux-gnu
+          mkdir -p .cargo
+          printf '[target.aarch64-unknown-linux-gnu]\nlinker = "aarch64-linux-gnu-gcc"\n' \
+            > _primitives/_rust/.cargo/config.toml
+
+      - name: Build workspace (release)
+        working-directory: _primitives/_rust
+        run: cargo build --workspace --release --target ${{ matrix.target }}
+
+      - name: Package binaries
+        id: package
+        working-directory: _primitives/_rust/target/${{ matrix.target }}/release
+        shell: bash
+        run: |
+          set -euo pipefail
+          # Collect every Cargo-built executable (Linux + macOS: no ext, mode +x).
+          # Portable across GNU + BSD find: iterate, test executability in shell.
+          BINS=()
+          for f in *; do
+            [ -f "$f" ] || continue
+            case "$f" in
+              *.d|*.rlib|*.rmeta|*.so|*.dylib|*.dSYM) continue ;;
+            esac
+            if [ -x "$f" ]; then
+              BINS+=("$f")
+            fi
+          done
+          if [ "${#BINS[@]}" -eq 0 ]; then
+            echo "::error::no release binaries produced for ${{ matrix.target }}"
+            exit 1
+          fi
+          echo "Binaries found: ${BINS[*]}"
+          ARCHIVE="keisei-${{ matrix.target }}.tar.gz"
+          tar czf "$GITHUB_WORKSPACE/$ARCHIVE" "${BINS[@]}"
+          cd "$GITHUB_WORKSPACE"
+          if command -v sha256sum >/dev/null 2>&1; then
+            sha256sum "$ARCHIVE" > "$ARCHIVE.sha256"
+          else
+            shasum -a 256 "$ARCHIVE" > "$ARCHIVE.sha256"
+          fi
+          echo "archive=$ARCHIVE" >> "$GITHUB_OUTPUT"
+
+      - name: Upload artifact
+        uses: actions/upload-artifact@v4
+        with:
+          name: binaries-${{ matrix.target }}
+          path: |
+            keisei-${{ matrix.target }}.tar.gz
+            keisei-${{ matrix.target }}.tar.gz.sha256
+          if-no-files-found: error
+
+  release:
+    name: Publish GitHub Release
+    needs: build-release
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+
+      - name: Install Rust toolchain
+        uses: dtolnay/rust-toolchain@stable
+
+      - uses: Swatinem/rust-cache@v2
+        with:
+          workspaces: _primitives/_rust
+
+      - name: Build kei-changelog
+        working-directory: _primitives/_rust
+        run: cargo build --release -p kei-changelog
+
+      - uses: actions/download-artifact@v4
+        with:
+          path: dist/
+
+      - name: Flatten artifacts
+        run: |
+          set -euo pipefail
+          mkdir -p release-assets
+          find dist -type f \( -name '*.tar.gz' -o -name '*.sha256' \) \
+            -exec mv {} release-assets/ \;
+          ls -la release-assets
+
+      - name: Generate release notes (kei-changelog)
+        id: notes
+        run: |
+          set -euo pipefail
+          TAG="${GITHUB_REF_NAME}"
+          PREV="$(git tag --sort=-creatordate | grep -v "^${TAG}$" | head -n1 || true)"
+          echo "Current tag: ${TAG}"
+          echo "Previous tag: ${PREV:-<none>}"
+          if [ -n "${PREV}" ]; then
+            NOTES="$(./_primitives/_rust/target/release/kei-changelog \
+              --from "${PREV}" --to "${TAG}" --version "${TAG}")"
+          else
+            NOTES="$(./_primitives/_rust/target/release/kei-changelog \
+              --to "${TAG}" --version "${TAG}")"
+          fi
+          if [ -z "${NOTES}" ]; then
+            NOTES="Release ${TAG}. No conventional-commit entries found in range."
+          fi
+          {
+            echo 'notes<<KEISEI_NOTES_EOF'
+            echo "${NOTES}"
+            echo 'KEISEI_NOTES_EOF'
+          } >> "$GITHUB_OUTPUT"
+
+      - name: Publish GitHub Release
+        uses: softprops/action-gh-release@v2
+        with:
+          name: ${{ github.ref_name }}
+          tag_name: ${{ github.ref_name }}
+          body: ${{ steps.notes.outputs.notes }}
+          files: |
+            release-assets/*.tar.gz
+            release-assets/*.sha256
+          fail_on_unmatched_files: false
+
+  npm-publish:
+    name: Publish npm packages (optional)
+    needs: release
+    runs-on: ubuntu-latest
+    # Graceful skip: if NPM_TOKEN secret is not configured, the first step
+    # reports "skipped" and exits 0 — Rust-binary release above still succeeds.
+    steps:
+      - name: Check NPM_TOKEN presence
+        id: have_token
+        env:
+          NPM_TOKEN: ${{ secrets.NPM_TOKEN }}
+        run: |
+          if [ -n "${NPM_TOKEN:-}" ]; then
+            echo "present=1" >> "$GITHUB_OUTPUT"
+          else
+            echo "present=0" >> "$GITHUB_OUTPUT"
+            echo "::notice::NPM_TOKEN not set — skipping npm publish gracefully"
+          fi
+
+      - uses: actions/checkout@v4
+        if: steps.have_token.outputs.present == '1'
+
+      - uses: actions/setup-node@v4
+        if: steps.have_token.outputs.present == '1'
+        with:
+          node-version: '20'
+          registry-url: 'https://registry.npmjs.org'
+
+      - name: Install deps
+        if: steps.have_token.outputs.present == '1'
+        working-directory: _ts_packages
+        run: npm ci
+
+      - name: Build workspaces
+        if: steps.have_token.outputs.present == '1'
+        working-directory: _ts_packages
+        run: npm run build --workspaces --if-present
+
+      - name: Publish each package
+        if: steps.have_token.outputs.present == '1'
+        working-directory: _ts_packages
+        env:
+          NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
+        run: |
+          set -euo pipefail
+          for pkg in packages/*/; do
+            if [ -f "$pkg/package.json" ]; then
+              echo "::group::publish $pkg"
+              ( cd "$pkg" && npm publish --access public ) \
+                || echo "::warning::publish failed for $pkg (continuing)"
+              echo "::endgroup::"
+            fi
+          done

CHANGELOG.md

@@ -0,0 +1,150 @@
+# Changelog
+
+All notable changes to this project will be documented in this file.
+
+The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/),
+and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
+
+Entries are generated from the git history via
+`_primitives/_rust/kei-changelog` (a conventional-commits walker).
+Regenerate a single version block with, e.g.:
+
+```bash
+_primitives/_rust/target/release/kei-changelog \
+  --from v0.14.2 --to v0.15.0 --version v0.15.0 --update CHANGELOG.md
+```
+
+## [Unreleased]
+
+> Work in flight on `feat/v0.16-changelog-gen` and follow-up branches.
+> Only placeholders — no corresponding commits exist yet. Any line that
+> ships must be replaced with the real commit summary before release.
+
+### Added
+- Placeholder: CHANGELOG.md generation wired through `kei-changelog` (this file).
+- Placeholder: `.github/workflows/release.yml` — tag-driven multi-platform release.
+- Placeholder: pre-built-binary install path in `install.sh` (`KEI_SKIP_RUST_BUILD=1`).
+
+### Changed
+- Placeholder: plugin / block format refresh targeted for v0.16.0.
+
+### Fixed
+- Placeholder: hook-bypass edge case follow-up to v0.15.1.
+
+## [0.15.0] — 2026-04-22
+
+### Added
+- **primitives:** `kei-artifact` typed handoff pipeline (BMAD-style doc passthrough) (`3f303b7`)
+- **blocks:** 5 cognitive mode blocks + 2 manifest wirings (`fdfc690`)
+
+## [0.14.2] — 2026-04-22
+
+### Added
+- **hooks:** runtime controls via `KEI_DISABLED_HOOKS` + `KEI_HOOK_PROFILE` (v0.14.2) (`1a448e8`)
+
+### Removed
+- genesis-scan from public kit (internal tool, Bundle-only) (`268226b`)
+
+## [0.14.1] — 2026-04-22
+
+### Added
+- **ci:** GitHub Actions workflows + `.claude/worktrees` gitignore (`407e8b7`)
+
+### Changed
+- **readme + install:** reconcile all count drift (F4 RELEASE BLOCKER) (`0199fd4`)
+- **rust:** misc schema/main refactor in 8 crates (assorted CP splits) (`61448b9`)
+- **mock-render:** split `main.rs` 227 LOC into 4 cubes (F5a Constructor Pattern) (`ad5977d`)
+
+### Fixed
+- **kei-auth:** remove `--key` CLI flag (F12 HIGH — `/proc/cmdline` leak) (`b449587`)
+- **kei-refactor-engine:** retract 'git apply-ready' claim (F1 RELEASE BLOCKER) (`f50ef43`)
+- **kei-store:** path-traversal guard (F2 RELEASE BLOCKER) + S3 stub gate (F7) + GitHub RULE 0.1 guard (F8) (`ad9c53f`)
+
+## [0.14.0] — 2026-04-22
+
+### Added
+- **primitives:** 10 Rust crates extracted from LBM (Genesis-scrubbed) (`a5e6649`)
+- **ts-packages:** 6 TS packages — MCP server + 5 external-API adapters (`7b647d5`)
+
+### Changed
+- **rust-core:** Constructor-Pattern splits in `kei-router` + `kei-auth` (`afed921`)
+
+## [0.13.0] — 2026-04-22
+
+### Added
+- **integration:** deep-sleep wired into MANIFEST + sleep-setup Phase 3b + README (`bcd80f6`)
+- **primitives:** 4 Rust crates for deep-sleep — `conflict-scan`, `refactor-engine`, `graph-check`, `store` (`0f75493`)
+- **skills:** `/onboard` auto-project-analyze with 3-mode apply (full-auto / step-by-step / full-manual) (`1396139`)
+
+### Changed
+- **readme:** "Why Rust, not Python" paragraph in author note (`92c918a`)
+- **readme:** clarify "my sample, not claim of originality" in author note (`47d2448`)
+- **readme:** add "double sorry" disclaimer in author note (`3d5d768`)
+- **readme:** move "From the author" to opening, expand with transformer-error context (`fd67315`)
+- **readme:** add "From the author" note (`b103c3d`)
+
+## [0.12.0] — 2026-04-22
+
+### Added
+- **integration:** Phase A incubation wired into trigger + install + README (`d72de64`)
+- **skills:** `/sleep-on-it` 6-phase wizard + `kei-sleep-queue` CRUD + incubation prompt (`30df6cb`)
+
+## [0.11.0] — 2026-04-22
+
+### Added
+- **integration:** `--with-sleep-sync` flag + README Cloud REM sync section (`1dd05c6`)
+- **skills:** `/sleep-setup` 5-phase wizard (click + 1 free-text URL) (`b658f81`)
+- **hooks:** `session-end-dump` calls `kei-sleep-sync` after ingest (`1ab39d5`)
+- **primitives:** `kei-sleep-setup` wizard + `kei-sleep-sync` helper + trigger template (`4fdaab6`)
+
+## [0.10.0] — 2026-04-22
+
+### Added
+- **integration:** register `genesis-scan` in MANIFEST core+full + README + `install.sh` sizing (`93ba0a0`)
+- **hooks:** `git-pre-commit-genesis` — template for repo symlink into `.git/hooks/pre-commit` (`670af3f`)
+- **primitives:** `genesis-scan` Rust — patent-IP leak detector (CI / pre-commit) (`5db8548`)
+- **integration:** wire `kei-memory` into MANIFEST + settings-snippet + README for v0.10 (`0b5da5a`)
+- **skills:** `/self-audit` 5-phase triage pipeline (`334a867`)
+- **hooks:** 3 self-audit triggers — stop / milestone / error-spike (`a5c3896`)
+- **primitives:** `kei-memory` Rust crate — offline session analyzer (Genesis-clean) (`448fc07`)
+
+## [0.9.1] — 2026-04-21
+
+### Added
+- **install:** interactive menu (whiptail / dialog / plain) + confirm screen + `--yes` / `--no-execute` (`4809269`)
+
+## [0.9.0] — 2026-04-21
+
+### Added
+- **install:** modular profiles + `--add` / `--remove` / `--list` incremental install (`b1b8de0`)
+- **primitives:** `MANIFEST.toml` — SSoT for 21 primitives + 6 profiles (`764a999`)
+
+### Changed
+- **readme:** install profiles table + migration note for v0.9.0 (`47931a3`)
+
+> BREAKING: default install profile is now `minimal` (was `full`).
+> Re-run with `--profile=full` to preserve prior behaviour.
+
+## [0.8.0] — 2026-04-21
+
+### Added
+- **install:** copy `_primitives/` + build Rust workspace; register `agent-fork-logger` + `site-wysiwyd` hooks (`b0d9389`)
+- **hooks:** `site-wysiwyd-check` PostToolUse(Edit | Write) drift advisory (`c2041b4`)
+- **skills:** `/site-create` pipeline (phases 0–4 — phases 5–6 deferred) (`839ae57`)
+
+### Changed
+- **compose-solution:** prior-art grep paths + phase-5 cross-refs for 10 pipelines + 21 primitives (`f664cbc`)
+- **readme:** v0.8.0 — 73 blocks / 34 skills / 21 primitives / 6 hooks / 11 bridges + pipelines section (`ed7d566`)
+
+[Unreleased]: https://github.com/KeiSei84/KeiSeiKit/compare/v0.15.0...HEAD
+[0.15.0]: https://github.com/KeiSei84/KeiSeiKit/compare/v0.14.2...v0.15.0
+[0.14.2]: https://github.com/KeiSei84/KeiSeiKit/compare/v0.14.1...v0.14.2
+[0.14.1]: https://github.com/KeiSei84/KeiSeiKit/compare/v0.14.0...v0.14.1
+[0.14.0]: https://github.com/KeiSei84/KeiSeiKit/compare/v0.13.0...v0.14.0
+[0.13.0]: https://github.com/KeiSei84/KeiSeiKit/compare/v0.12.0...v0.13.0
+[0.12.0]: https://github.com/KeiSei84/KeiSeiKit/compare/v0.11.0...v0.12.0
+[0.11.0]: https://github.com/KeiSei84/KeiSeiKit/compare/v0.10.0...v0.11.0
+[0.10.0]: https://github.com/KeiSei84/KeiSeiKit/compare/v0.9.1...v0.10.0
+[0.9.1]: https://github.com/KeiSei84/KeiSeiKit/compare/v0.9.0...v0.9.1
+[0.9.0]: https://github.com/KeiSei84/KeiSeiKit/compare/v0.8.0...v0.9.0
+[0.8.0]: https://github.com/KeiSei84/KeiSeiKit/releases/tag/v0.8.0