Add scriv-managed changelog

Author: delano

CHANGELOG.rst

@@ -0,0 +1,73 @@
+CHANGELOG
+=========
+
+All notable changes to rots are documented here.
+
+The format is based on `Keep a
+Changelog <https://keepachangelog.com/en/1.1.0/>`__, and this project
+adheres to `Semantic
+Versioning <https://semver.org/spec/v2.0.0.html>`__.
+
+.. raw:: html
+
+   <!--scriv-insert-here-->
+
+.. _changelog-0.4.0:
+
+0.4.0 — 2026-03-02
+==================
+
+Added
+-----
+
+- Surface container health in ``instances list`` — combined status like "active (healthy)"
+- Add ``instances ps`` subcommand for podman-native container view
+- Add ``proxy push`` command for remote Caddyfile template deployment
+- Add ``_path_exists`` and ``_copy_template`` helpers in init module
+
+- Unified image reference parsing with ``parse_image_reference()`` supporting registry ports and digest refs
+- Positional ``reference: ImageRef`` parameter on deploy, redeploy, run, shell, and config-transform commands
+- Precedence chain: positional ref > --tag flag > IMAGE/TAG env vars > @current alias > defaults
+
+Changed
+-------
+
+- Skip SSH connection for local-only ``build`` command
+- Print immediate context feedback showing project dir and config mode during build
+
+- Remove ``--remote`` flag from instance run/shell/config-transform; always use config-based image lookup
+- Replace hardcoded image names with config-driven resolution throughout
+
+- Rename package from ots-containers to rots across source, tests, CI, and pyproject.toml
+- Add ots-shared as co-located workspace package under ``packages/ots-shared/``
+- Add uv workspace config so ots-shared resolves from local path
+
+Fixed
+-----
+
+- DRY ``_get_error_stderr()`` helper in assets.py to deduplicate exception handling (#20)
+- Replace fragile ``type(exc).__name__`` string matching with ``isinstance()`` and lazy paramiko import
+- Fix Caddyfile.template to valkey.conf entry in manifest
+
+Security
+--------
+
+- Fix credential exposure in ``podman login`` — use ``--password-stdin`` instead of CLI flag
+- Wire ``Config.validate()`` into ``__post_init__`` (was dead code)
+- Reject path traversal in IMAGE_RE and REGISTRY_RE patterns
+- Add OTS_REGISTRY hostname validation
+- Add MEMORY_MAX/CPU_QUOTA newline injection prevention
+- Add VALKEY_SERVICE systemd unit name validation
+- Add defense-in-depth checks in quadlet.py
+
+Documentation
+-------------
+
+- Add ADR-002: Split scheduler into rufus (in-process) and systemd timers (batch)
+
+- Update repository URLs and stale references from ots-containers to rots
+
+AI Assistance
+-------------
+
+- Security analysis, test coverage development, and implementation for image reference overhaul

changelog.d/README.md

@@ -0,0 +1,46 @@
+# Changelog Fragments
+
+This directory contains changelog fragments managed by [scriv](https://scriv.readthedocs.io/).
+
+## Developer Workflow
+
+```bash
+# Create a new fragment
+scriv create
+
+# Edit the generated fragment file
+# Add entries under the appropriate categories
+
+# Commit the fragment with your code changes
+git add changelog.d/*.rst
+git commit
+```
+
+## Fragment Categories
+
+- **Added** — New features
+- **Changed** — Changes to existing functionality
+- **Deprecated** — Features marked for future removal
+- **Removed** — Features removed in this release
+- **Fixed** — Bug fixes
+- **Security** — Vulnerability fixes or security improvements
+- **Documentation** — Documentation updates
+- **AI Assistance** — Work developed with AI assistance (security analysis, implementation, testing, code review)
+
+## Release Process
+
+```bash
+# Aggregate all fragments into CHANGELOG.rst
+scriv collect
+```
+
+This merges all fragment files into `CHANGELOG.rst` under a versioned heading
+and removes the individual fragment files.
+
+## Guidelines
+
+- One fragment per PR or logical change
+- Use present tense ("Add feature" not "Added feature")
+- Reference related issues/PRs where relevant (e.g., `#42`)
+- Keep entries concise but descriptive
+- Use the **AI Assistance** category to document AI contributions transparently

changelog.d/scriv.ini

@@ -0,0 +1,5 @@
+[scriv]
+format = rst
+categories = Added, Changed, Deprecated, Removed, Fixed, Security, Documentation, AI Assistance
+version = literal: pyproject.toml: project.version
+main_branches = main, develop