release: prepare AWSops 0.10.0 for main promotion

[Atom-oh]

Prepare AWSops 0.10.0 before the pending dev-to-main promotion (#137). Align the web package and lockfile root versions, README version badge and release link, and both English/Korean CHANGELOG release headings. Existing Unreleased feature entries move under the dated release without duplication; the superseded FinOps release-location sentence is amended. Bilingual notes disclose retained 0.8/0.9/legacy 2.x labels and header-less migrations’ apply-time stamping, without rewriting SQL or existing ledger rows. Unreleased remains empty for subsequent work.

Document the promotion contract: version changes land on dev first, the promotion preserves ancestry with a merge commit, and an annotated v<version> tag is created on the verified main merge SHA only after required review/CI passes. Push tags explicitly to samples; never move an existing release tag. Production deployment remains separately approved. Tooling package versions and immutable migration -- since: headers are unchanged.

Validation: six changelog-parser tests passed; the actual bilingual release/version and ledger disclosures parse correctly; displayed/package/lock versions agree; dependency lock content is unchanged apart from root versions; migration fallback resolves to 0.10.0; git diff --check passed.

[github-actions]

🤖 AI Code Review (Claude Fable 5 chair · lens×model matrix)

_Cells (model/lens): codex/L2 claude/L2 codex/L3 claude/L3 codex/L4 claude/L4 codex/L5 claude/L5 _

Status: PASSED — No blocking issues found

All verification complete. The findings that mattered checked out as follows: the omitted lockfile diff is exactly the two root version fields (verified against the staged HEAD object 282d6ab), the eight -- since: 0.9.0 migrations named in the CHANGELOG note are exactly the set on base, and terraform/foundation/migrations/README.md:212 does contain the labeling guidance claude-L5 flagged — but that tension with reality pre-dates this PR (the mislabeled headers already existed on base; this PR discloses rather than creates the mismatch), so I downgraded it from MAJOR to MINOR. Final review below.

---

Chair Review — PR #138: release: prepare AWSops 0.10.0 for main promotion

IMAGE_COVERAGE: NOT_REQUIRED

1. Summary

This is a pure release-preparation PR: CHANGELOG [Unreleased] → [0.10.0] promotion (EN/KO in lockstep), README version badge, web/package.json/web/package-lock.json bump to 0.10.0, and a new "Version and tag on main promotion" section in docs/runbooks/branch-strategy.md. No application, worker, Terraform, IAM, or workflow code changes; the ADR-005 mutation freeze and all release-safety gates are untouched. The chair independently verified the omitted lockfile diff against the staged HEAD commit (exactly the two root version fields change, no dependency/integrity churn) and confirmed the migration-ledger disclosures in the new CHANGELOG note match the actual files on base.

2. Issues per lens

L2 — Code correctness

• No CRITICAL/MAJOR. Both models (claude, codex) agree no executable logic changed. claude-L2 additionally verified the changelog parser (web/lib/changelog.ts) handles the new ## [0.10.0] - 2026-09-17 heading, that the empty [Unreleased] section is filtered by ChangelogVersion.tsx, and that no semver-ordering code exists that the lexicographically tricky 0.10.0 could break — all confirmed reasoning, no findings.
• MINOR (claude-L2, unverified lockfile) — resolved by chair verification: git diff of merge-base..HEAD on web/package-lock.json is 2 insertions/2 deletions, both root version fields now 0.10.0. Not a finding.

L3 — Security / AWS mutation safety

• No CRITICAL/MAJOR. Both models agree: no new mutation path, no IAM delta, no secrets. The eight named migrations are not modified, preserving checksum immutability.
• MINOR (claude-L3 docs(changelog): document the AI Code Review CI fix #1, lockfile supply-chain gap) — resolved by chair verification (see L2); no resolved/integrity entries changed.
• MINOR (claude-L3 only): the new runbook says "verify its URL with git remote -v" for the samples remote but never states the expected URL literally next to the push instruction. Stating github.com/aws-samples/sample-awsops explicitly would close the gap where a misconfigured remote receives a release tag. Hardening suggestion, not a defect.

L4 — Observability / data-integration correctness

• No findings. Both models agree. claude-L4 verified against base that resolveAppVersion (scripts/v2/migrate-core.mjs) uses APP_VERSION → web/package.json → 'unknown' and that the version stamp is documentation-only ("never gates application"), so the bump affects only future header-less ledger labels — exactly what the new CHANGELOG note and runbook claim. No Steampipe/CIS/AgentCore data path reads this value.

L5 — Docs/ADR consistency

• MINOR — downgraded from claude-L5's MAJOR (1/2 models flagged; codex-L5 did not): terraform/foundation/migrations/README.md:212 still instructs authors to "List a release's DB changes in CHANGELOG.md from the migrations whose -- since: matches that version," and lines 22–25 use a legacy -- since: 2.1.0 example — both now in tension with the new policy ("audit by Git tag/commit and checksums, not app_version filtering"; "declare the intended next application release"). Chair verified the README text exists as claimed. However, the underlying label/release mismatch pre-dates this PR (the 0.9.0-headed migrations for 0.10.0 features were already merged and checksum-frozen on base); this PR discloses the mismatch and adds the corrective forward-looking rule. The README staleness is real and should be fixed — ideally in this PR, since it's the doc migration authors actually read — but it does not make this diff incorrect, so it does not gate.
• MINOR (2/2 models agree — codex-L5 and claude-L5 independently): README badge cluster now spans three repo URLs (Atom-oh/awsops for stars/forks/issues/CI, aws-samples/sample-awsops for the version badge link). Independent convergence confirms the inconsistency is genuine; align or document the split.
• MINOR (claude-L5): CHANGELOG link-definition inconsistencies — [0.10.0] uses a releases/tag/ URL while every prior version uses compare/, and [Unreleased]/[0.10.0] point at the new org while [0.9.0] and older still point at whchoi98/awsops. Both new links 404 until the tag is pushed post-merge, which the runbook's own ordering makes unavoidable — acceptable, but a compare/v0.9.0...v0.10.0 form would match convention.
• MINOR (claude-L5): the new runbook's alignment checklist omits the CHANGELOG reference-link definition lines that this very PR had to edit; the next release will leave them stale unless added.
• MINOR (claude-L5): docs/runbooks/CLAUDE.md index summary for branch-strategy.md doesn't mention the new version/tag content.
• MINOR (claude-L5): the ledger note is a bold preamble paragraph outside any ### category. Root CLAUDE.md explicitly exempts a cross-feature shared-migration disclosure from the one-bullet-per-feature rule, so this is style only. The FinOps entry was correctly amended in place (not duplicated), and no PR/round numbers were introduced — CHANGELOG conventions satisfied.

3. Suggestions

1. Update terraform/foundation/migrations/README.md (line 212 and the 2.1.0 example) in this PR or an immediate follow-up so the release-labeling policy is stated once, not contradictorily in two places.
2. State the expected samples remote URL literally in the runbook's tag-push step.
3. Add the CHANGELOG [Unreleased]/[x.y.z] link-definition lines to the runbook's release checklist, and consider normalizing the [0.10.0] link to the compare/ form.
4. Align the README badge repo targets (or add a one-line note explaining the intentional split during the org migration).
5. Refresh the branch-strategy.md summary line in docs/runbooks/CLAUDE.md.

4. Verdict

No CRITICAL or MAJOR findings survive verification. The two candidate blockers — the unverifiable lockfile and the migrations-README contradiction — were resolved by direct inspection of the staged HEAD object (lockfile is clean) and by scoping (the ledger-label mismatch pre-exists on base; this PR is the disclosure, not the cause). Image manifest is empty; all eight panel cells and the chair declare coverage not required.

---

Triggered by commit 282d6abef8314c880c04cc7d2eaa56b8bd5c2a6f · workflow: .github/workflows/pr-review.yml