From 3dea28dcfcba0d0a5993369c634b9dd3527ad9b5 Mon Sep 17 00:00:00 2001
From: Abhinaysai Kamineni <66816045+askmy-stack@users.noreply.github.com>
Date: Mon, 10 Aug 2026 15:44:25 -0400
Subject: [PATCH] correct unreleased 0.2.0 documentation

---
 CHANGELOG.md          |  5 +++--
 README.md             | 10 ++++++----
 SECURITY.md           |  3 ++-
 docs/github-action.md | 10 +++++-----
 docs/publishing.md    |  7 ++++---
 5 files changed, 20 insertions(+), 15 deletions(-)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index a4e3d91..ac16155 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -7,9 +7,10 @@ All notable changes to Tool-Semantics will be documented in this file.
 ### Added
 - (none yet)
 
-## [0.2.0] — 2026-08-04
+## [0.2.0] — Unreleased
 
-First PyPI release. Install with `pip install tool-semantics`.
+The release artifacts and GitHub release tag have not yet been published. Until
+then, install directly from the repository as documented in the README.
 
 ### Added
 - `tool.output_schema_added` / `removed` / `changed` detection (#8)
diff --git a/README.md b/README.md
index dd43167..1280e38 100644
--- a/README.md
+++ b/README.md
@@ -42,7 +42,7 @@ AI agents do not call tools the way typed clients do. They choose tools from **d
 | 4. Execution | Do calls still succeed with prior argument patterns? |
 | 5. Intent / side effects | Did risk, confirmation needs, or outcomes change? |
 
-The MVP implements deterministic interface snapshots and structural comparison (layers 1–2, with warnings that point at 3–5). Live MCP capture and model-based behavioral testing are on the [roadmap](ROADMAP.md).
+The MVP implements deterministic interface snapshots and structural comparison (layers 1–2, with warnings that point at 3–5), plus local MCP capture over stdio. Remote MCP transport and model-based behavioral testing are on the [roadmap](ROADMAP.md).
 
 ## How it works
 
@@ -105,8 +105,10 @@ Result: breaking
 ## Install (library)
 
 ```bash
-pip install tool-semantics
-# or from source: pip install -e .
+# The first PyPI release is not published yet.
+# Install from this repository for now:
+pip install "tool-semantics @ git+https://github.com/askmy-stack/tool-semantics.git"
+# or, for local development: pip install -e .
 ```
 
 ```python
@@ -195,7 +197,7 @@ docs/assets/          # README visuals
 
 ## Roadmap
 
-See [ROADMAP.md](ROADMAP.md) for milestones: live MCP capture, richer compatibility rules, behavioral contracts, model matrices, PR reporting, and migration adapters.
+See [ROADMAP.md](ROADMAP.md) for milestones: remote MCP capture, richer compatibility rules, behavioral contracts, model matrices, PR reporting, and migration adapters.
 
 ## Contributing
 
diff --git a/SECURITY.md b/SECURITY.md
index 450d9c5..f3ebfd6 100644
--- a/SECURITY.md
+++ b/SECURITY.md
@@ -4,7 +4,8 @@
 
 | Version | Supported |
 | --- | --- |
-| 0.1.x | Yes |
+| 0.2.x | Yes |
+| 0.1.x | No |
 
 ## Reporting a vulnerability
 
diff --git a/docs/github-action.md b/docs/github-action.md
index e1076d1..12e426c 100644
--- a/docs/github-action.md
+++ b/docs/github-action.md
@@ -12,9 +12,9 @@ askmy-stack/tool-semantics/.github/actions/compare
 ## Versioning the Action
 
 Pin the composite Action to a **release tag** (or commit SHA) so consumer CI stays
-reproducible. Tags follow the package version (`v0.2.0`, …). A floating major pin
-such as `@v0` is fine once a `v0` moving tag exists; prefer an exact tag for
-production workflows.
+reproducible. The Action has not been released under a version tag yet, so the
+example below pins the current stable commit. After the first release, use the
+matching version tag (`vX.Y.Z`); a floating major pin (`@v0`) can follow.
 
 `@main` tracks the tip of the default branch and **may break** without notice —
 use it only for local experiments.
@@ -41,10 +41,10 @@ jobs:
       - uses: actions/checkout@v4
       - name: Capture baseline and candidate
         run: |
-          pip install "tool-semantics==0.2.0"
+          pip install "tool-semantics @ git+https://github.com/askmy-stack/tool-semantics.git@64befaa9f65f825d75c6ce088d1f40e35054fdf0"
           tool-semantics capture manifests/baseline.json -o .tool-semantics/baseline.json
           tool-semantics capture manifests/candidate.json -o .tool-semantics/candidate.json
-      - uses: askmy-stack/tool-semantics/.github/actions/compare@v0.2.0
+      - uses: askmy-stack/tool-semantics/.github/actions/compare@64befaa9f65f825d75c6ce088d1f40e35054fdf0
         with:
           baseline: .tool-semantics/baseline.json
           candidate: .tool-semantics/candidate.json
diff --git a/docs/publishing.md b/docs/publishing.md
index f3752a0..92b78c6 100644
--- a/docs/publishing.md
+++ b/docs/publishing.md
@@ -1,8 +1,9 @@
 # Publishing
 
-Tool-Semantics is published to PyPI from GitHub Releases using
-[trusted publishing](https://docs.pypi.org/trusted-publishers/) (OIDC).
-No long-lived PyPI API token is stored in the repository.
+Tool-Semantics will be published to PyPI from GitHub Releases using
+[trusted publishing](https://docs.pypi.org/trusted-publishers/) (OIDC), after the
+one-time PyPI configuration below is complete. No long-lived PyPI API token is
+stored in the repository.
 
 ## One-time PyPI setup