ci: migrate changesets release tooling to v3

.agents/playbook.md

@@ -320,7 +320,7 @@ the same gates CI uses:
 ```bash
 git add .changeset/<descriptive-name>.md
 node scripts/check-changeset-protocol-scope.cjs origin/main
-npx --yes @changesets/cli@^2.31.0 status --since=origin/main
+npx --yes @changesets/cli@^3.0.0 status --since=origin/main
 ```
 
 The changesets CLI ignores untracked files, so the local check can still fail

.agents/shortcuts/cut-major.md

@@ -73,7 +73,7 @@ CHANGELOG source-of-truth changes to `main` via regular PRs first.
 
 ## 4. Merge the Version Packages PR
 
-On merge, `release.yml` runs `changeset tag` + `createGithubReleases: true`.
+On merge, `release.yml` runs `changeset git-tag` + `create-github-releases: true`.
 Verify afterward:
 
 ```bash
@@ -91,7 +91,7 @@ curl -s https://adcontextprotocol.org/protocol/ | jq '.versions[].version'
 gh pr list --search "snapshot docs for v3.0.0" --state all
 ```
 
-If `changeset tag` didn't create the tag (silent no-op), the most likely
+If `changeset git-tag` didn't create the tag (silent no-op), the most likely
 cause is `privatePackages.tag` not set to `true` in `.changeset/config.json`
 — private packages are skipped by default. If that's the issue, fix config
 and create the tag/release manually:

.agents/shortcuts/prep-for-pr.md

@@ -21,7 +21,7 @@ request.
      `.changeset/*.md` files instead of adding empty ones.
    - If a changeset is present, stage it because the CLI ignores untracked
      files, then run:
-     `git add .changeset/<name>.md && node scripts/check-changeset-protocol-scope.cjs origin/main && npx --yes @changesets/cli@^2.31.0 status --since=origin/main`.
+     `git add .changeset/<name>.md && node scripts/check-changeset-protocol-scope.cjs origin/main && npx --yes @changesets/cli@^3.0.0 status --since=origin/main`.
    - If no changeset is expected, run:
      `node scripts/check-changeset-protocol-scope.cjs origin/main`.
 5. Run code review and address the findings.

.changeset/config.json

@@ -1,5 +1,5 @@
 {
-  "$schema": "https://unpkg.com/@changesets/config@3.1.1/schema.json",
+  "$schema": "https://unpkg.com/@changesets/config@4.0.0/schema.json",
   "changelog": "@changesets/cli/changelog",
   "commit": false,
   "fixed": [],

.changeset/migrate-changesets-v3.md

@@ -0,0 +1,5 @@
+---
+"adcontextprotocol": patch
+---
+
+Migrate release automation to Changesets CLI v3 and changesets/action v2 without changing the published protocol contract.

.changeset/pre.json

@@ -1,8 +1,4 @@
 {
   "mode": "pre",
-  "tag": "beta",
-  "initialVersions": {
-    "adcontextprotocol": "3.1.1"
-  },
-  "changesets": []
+  "tag": "beta"
 }

.github/workflows/changeset-check.yml

@@ -62,4 +62,4 @@ jobs:
             echo "Skipping changesets status because this PR does not touch the protocol release surface."
             exit 0
           fi
-          npx --yes @changesets/cli@^2.31.0 status --since=origin/${{ github.base_ref }}
+          npx --yes @changesets/cli@^3.0.0 status --since=origin/${{ github.base_ref }}

.github/workflows/release.yml

@@ -113,15 +113,15 @@ jobs:
       - name: Create Release Pull Request or Tag Release
         if: steps.release-relevance.outputs.relevant == 'true' && steps.release-artifacts.outputs.has_release_artifacts != 'true'
         id: changesets
-        uses: changesets/action@v1
+        uses: changesets/action@v2
         with:
-          version: npm run version
-          publish: npx --no-install changeset tag
-          commit: 'Version Packages'
-          title: 'Version Packages'
-          createGithubReleases: true
+          github-token: ${{ steps.app-token.outputs.token }}
+          version-script: npm run version
+          publish-script: npx --no-install changeset git-tag
+          commit-message: 'Version Packages'
+          pr-title: 'Version Packages'
+          create-github-releases: true
         env:
-          GITHUB_TOKEN: ${{ steps.app-token.outputs.token }}
           HUSKY: '0'
 
       - name: Sign local protocol tarball if needed

.husky/pre-push

@@ -30,7 +30,7 @@ case "$BRANCH_NAME" in
         grep -Eq '^\.changeset/[^/]+\.md$'; then
         echo "Missing protocol changeset. Add one with 'npx changeset' before pushing."
         echo "Run the full CI-equivalent check with:"
-        echo "  npx --yes @changesets/cli@^2.31.0 status --since=$CHANGESET_BASE"
+        echo "  npx --yes @changesets/cli@^3.0.0 status --since=$CHANGESET_BASE"
         exit 1
       else
         echo "✅ Protocol changeset present"

docs/reference/verifying-protocol-tarballs.mdx

@@ -113,7 +113,7 @@ If you maintain a fourth-party SDK, mirror the regex above. Stay away from liter
 If you're contributing to the spec workflow itself: cosign signing happens during `npm run version` (chained from the `sign-protocol-tarball.sh` step) inside `release.yml`. The OIDC token is minted at signing time, so the cert subject reflects the trigger ref of that workflow run. Tag-based signing would require either:
 
 - A second workflow that runs on `release: published` and re-signs the tarball using the post-tag OIDC subject, or
-- Restructuring the release pipeline so signing happens after `changeset tag` and within a context where `refs/tags/*` is the active ref.
+- Restructuring the release pipeline so signing happens after `changeset git-tag` and within a context where `refs/tags/*` is the active ref.
 
 Today's signed-from-branch shape is intentional — it lets every consumer verify a single canonical artifact without reasoning about tag-vs-branch identity. The regex's `refs/(heads|tags)/.*` is forward-compat in case that changes.