Enforce numeric semantic version tags

README.md

@@ -12,6 +12,12 @@ PastureStack is an independent community effort to preserve, audit, and moderniz
 - A machine-readable [repository policy](standards/repository.yml) for future automation.
 - Optional workflow templates for migration integrity and Go module projects.
 
+New PastureStack release and image versions use only numeric semantic versions
+(`vMAJOR.MINOR.PATCH` or `MAJOR.MINOR.PATCH`). Brand, platform, candidate, and
+maintenance text belongs in package names and provenance metadata, not in a
+new version tag. Existing published tags remain immutable historical records;
+see the [release standard](docs/REPOSITORY_STANDARD.md#7-releases-and-packages).
+
 GitHub applies supported community health files from this repository only when a target repository does not provide its own file of the same type. Repository-specific guidance always takes precedence.
 
 ## Important limitations

docs/REPOSITORY_STANDARD.md

@@ -90,6 +90,17 @@ Required for maintained releases:
 - identify the source commit and build inputs;
 - publish checksums for downloadable artifacts;
 - document image names, tags, and digests;
+- use only `vMAJOR.MINOR.PATCH` or `MAJOR.MINOR.PATCH` for every new
+  PastureStack-owned Git tag, GitHub Release, package version, and image tag;
+- reject brand, platform, candidate, rebuild, branch, or maintenance text in a
+  new version (for example `-pasturestack.N`, `-windows-*`, or `-rcN`);
+- express platform differences through distinct package or image names, and
+  record source boundaries and rebuild metadata in OCI labels, SBOM,
+  attestations, commits, and release notes instead of the version string;
+- preserve every existing published tag as immutable history rather than
+  deleting, moving, or reusing it;
+- enforce the `Require numeric semantic version tags` GitHub tag ruleset on
+  version-like tags (`v*` and digit-prefixed tags), without a bypass actor;
 - avoid reusing upstream release tags for rebuilt artifacts; and
 - publish compatibility and upgrade notes.
 

standards/repository.yml

@@ -51,6 +51,18 @@ public_default_branch_rules:
   required_checks: add-after-check-names-stabilize
 
 release:
+  version_format: numeric-semver
+  optional_v_prefix: true
+  text_qualifiers_allowed: false
+  preserve_published_tags: true
+  tag_ruleset:
+    name: Require numeric semantic version tags
+    enforcement: active
+    bypass_allowed: false
+    include:
+      - refs/tags/v*
+      - refs/tags/[0-9]*
+    regex: '^v?[0-9]+\.[0-9]+\.[0-9]+$'
   reuse_upstream_tags_for_rebuilds: false
   checksums_required: true
   source_commit_required: true