[tae898]

Part of #19 (release scripts, item 2 of the latest status comment). Ported from humemai/arcadedb-embedded-python#501 (check_version.py) and humemai/arcadedb-embedded-python#479 (after_tag_verify.sh), adapted to the arcadedb names and to this repository's release.yml. No wheel content changes.

• scripts/check_version.py and tests/test_check_version.py: the counting rule. devN starts at 0 and restarts at 0 when the base A.B.C changes, postN starts at 1, aN/bN/rcN are never used, a number is never reused or skipped, a devN of a released base and a postN of an unreleased base are refused. It only checks. Exit 0 is the correct next version, 1 is not, 2 is a source (git tags, PyPI) that could not be read. The test for the git-remote source asserts that git exists instead of calling pytest.skip, because of the no-skips policy.
• .github/workflows/release.yml: the first job (validate-version) now checks out the code and runs python3 -I scripts/check_version.py "$TAG" --git-remote origin --pypi "$DIST_NAME" after the existing tag-form regex. DIST_NAME is arcadedb. It fails closed, and every other job needs this one, so a tag that breaks the rule builds and publishes nothing. A test pins the wiring. A later native job passes --tag-prefix native-v. Re-running the whole workflow for a version that is already on PyPI now fails this check on purpose; the release page says to re-run only the publish job.
• scripts/after_tag_verify.sh: this applies to the flow here, so it is ported with changes. It targets ArcadeData/arcadedb-python and the distribution arcadedb (import name arcadedb), compares the sha256 of the PyPI files with the release-dist artifact that the publish job uploaded, and takes - as the previous version for the first release: the PyPI file set is then checked against the pyproject.toml classifiers (one wheel per Python version and platform, 20 files at the moment) instead of the previous release. A .devN wheel ships the X.Y.Z-SNAPSHOT engine jar, so the smoke test expects that jar name (the humemai script only handled X.Y.Z and .postN). The docs step is dropped: the Antora component is unversioned and builds in another repository.
• Docs: a new "Release" page in the Antora component (development/release.adoc, in the nav) states the version rule once and describes the check and the after-tag script. CLAUDE.md gets a short pointer.

Checked locally: pre-commit on the changed files (black, isort, shfmt, actionlint, the name check), Bandit as CI runs it on src and tests (clean), tests/test_check_version.py pinned to cores 0-3 (43 passed; run without the wheel-dependent conftest.py, the file needs no wheel), bash -n on the script, and the file-set step of after_tag_verify.sh against synthetic PyPI data (complete set passes, a missing wheel and an extra file fail). The PyPI-facing steps of the script need a real release and were not run.

🤖 Generated with Claude Code