release: cut MCPg v0.8.0

[devopam]

Summary

Release preparation for MCPg v0.8.0 (MINOR bump — new opt-in behaviour, defaults unchanged), following docs/release-process.md §5/§5.1.

• Version bump: __init__.py → 0.8.0, synced to packaging/mcpb/{manifest.json,pyproject.toml} and server.json via their respective scripted syncers.
• CHANGELOG.md: rolled [Unreleased] into a dated [0.8.0] section; fresh empty [Unreleased] added above it.
• New docs/release-notes-0.8.0.md, mirroring the 0.7.0 notes' structure, linked from docs/index.md.
• Documentation validation pass (§5.1): fixed stale hand-written tool-count references that had drifted behind the real 256-tool maximal snapshot (dynamic session intent's 2 new meta-tools, roadmap 22) — CLAUDE.md, docs/tour.md (count + a broken #tool-index-N-tools anchor), and docs/release-process.md's own checklist row (now count-agnostic to avoid the same drift recurring). docs/PROGRESS.md's stale post-0.6.10 header brought current.
• Dev-tooling fix found during the pre-flight build check: uv run twine check failed on Metadata-Version: 2.5 (hatchling 1.32.0, released 2026-08-11, made 2.5 its default) — root-caused to a stale locked twine==6.2.0; twine 7.0.0 (2026-07-27) fixes exactly this. Upgraded via uv lock --upgrade-package twine; both dist/ artifacts now pass twine check. No production dependency touched.

Verification

• ruff check / ruff format --check: clean
• mypy --strict src/mcpg: clean
• bandit -r src/mcpg: clean (0 High/Medium)
• pip-audit --strict: no known vulnerabilities
• Full unit suite: 2909 passed, 3 skipped
• Full contract suite: green
• python -m build && twine check dist/*: both artifacts PASSED

Advances roadmap row: 22

🤖 Generated with Claude Code

Summary by Sourcery

Prepare and document the MCPg v0.8.0 release with synchronized metadata, updated release documentation, and strengthened CI security.

New Features:

• Add MCPg v0.8.0 release notes covering the new core session-intent preset, opt-in dynamic session-intent growth, and Docker MCP Registry submission.

Bug Fixes:

• Synchronize the checked-in server metadata version and correct stale documentation and progress references.

Enhancements:

• Update the project version and release metadata to 0.8.0 while preserving existing default behavior.
• Document the expanded 256-tool maximal surface and release the changelog from Unreleased.
• Harden the nested pg_turboquant CI workflow and clear repository-wide zizmor findings.

Build:

• Upgrade the locked Twine tooling so built distribution artifacts pass metadata validation.

CI:

• Pin GitHub Actions to immutable commits and restrict workflow permissions and checkout credentials in the nested CI workflow.

Documentation:

• Add and index the v0.8.0 release notes and refresh tool-count, roadmap, and release-process documentation.

[sourcery-ai]

Hey - I've left some high level feedback:

• The various tool-count narratives (254 vs 256, maximal vs default) are slightly inconsistent across docs/release-notes-0.8.0.md, docs/PROGRESS.md, docs/tour.md, and packaging/mcpb/manifest.json (e.g., release notes call 254 the “maximal (all flags on)” ceiling while other docs state 256 maximal / 186 default), so it would be good to pick a single definition and align the wording and counts everywhere.
• In docs/release-notes-0.8.0.md, the paragraphs describing MCPG_SESSION_INTENT=core vs the “static intent (core by default)” are a bit ambiguous about what the default session-intent actually is; consider tightening this section so it clearly states the out-of-the-box default and how core changes behavior relative to that.

Prompt for AI Agents

Please address the comments from this code review:

## Overall Comments
- The various tool-count narratives (254 vs 256, maximal vs default) are slightly inconsistent across `docs/release-notes-0.8.0.md`, `docs/PROGRESS.md`, `docs/tour.md`, and `packaging/mcpb/manifest.json` (e.g., release notes call 254 the “maximal (all flags on)” ceiling while other docs state 256 maximal / 186 default), so it would be good to pick a single definition and align the wording and counts everywhere.
- In `docs/release-notes-0.8.0.md`, the paragraphs describing `MCPG_SESSION_INTENT=core` vs the “static intent (`core` by default)” are a bit ambiguous about what the default session-intent actually is; consider tightening this section so it clearly states the out-of-the-box default and how `core` changes behavior relative to that.

---

Sourcery is free for open source - if you like our reviews please consider sharing them ✨

• X
• Mastodon
• LinkedIn
• Facebook

_{Help me be more useful! Please click 👍 or 👎 on each comment and I'll use the feedback to improve your reviews.}