docs(release): curated notes for v0.5.0; core 0.9.5; robots fix

[jfrench9]

Three changes for the v0.5.0 minor.

• .github/release-notes/v0.5.0.md covers the series since v0.4.0 (chore(setup): accept a region argument in bootstrap.sh #249–chore(deps): @robosystems/client 1.17.2, report-components 0.7.0 #332). This is the app's first curated release note: roboinvestor.ai as the public research home with a page for every SEC filer, Company Research in the app, the AI beside filings and shared reports, and the account moving to robosystems.ai. The shared tag-release.yml uses it verbatim when it exists at the tagged ref, so it has to merge before create-release.yml is dispatched. release-notes/README.md no longer predicts that 1.0.0 would be the first curated note.
• @robosystems/core 0.9.4 → 0.9.5, which changes documentation links only; the published bundle is identical. The notes' dependency line already says 0.9.5.
• robots.ts disallows /companies/ and /reports/. Both are signed-in routes that shipped without an entry. A new test reads the (app) route group and fails when a top-level segment is missing from the list; it failed on exactly these two before the fix.

The notes were written from the PR bodies across the series, not from titles. Deploy notes checked: every API dependency is in v1.12.8 (already in production), and the series' CloudFormation changes already reached production with the v0.4.x patches. Security-adjacent changes are described at the level of what the user sees.

Verified locally: prettier on the notes; the pre-commit gate on each commit (201 tests with the new robots test).

🤖 Generated with Claude Code

[github-actions]

Change classification: normal — platform or application code changed.

A normal change carries a documented automated review on this pull request before merge, in place of a second human approver. The change-classification job requests that review and passes once it has been posted. Recorded by the change-classification job.

[jfrench9]

@claude please review this PR

[claude]

Claude finished @jfrench9's task in 1m 15s —— View job

---

Reviewing PR #333

• Gather context (PR body, changed files)
• Read changed files in detail
• Check diff against origin/main
• Post review feedback

Review

This is a clean, low-risk docs/chore PR. Went through all 6 changed files and cross-checked the robots.ts fix against the actual route tree.

.github/release-notes/v0.5.0.md (new)

• Reads well and matches the stated scope (since v0.4.0, chore(setup): accept a region argument in bootstrap.sh #249–chore(deps): @robosystems/client 1.17.2, report-components 0.7.0 #332). Sections are organized sensibly (public research, in-app research, portfolio reports, account handoff, console/MCP, public site, bug fixes, breaking changes, infrastructure, deploy notes).
• The bug-fix line search engines are kept off the signed-in Company Research and report pages (#333) correctly self-references this PR, since the robots.ts fix (commit 5440173) and the note updating this file for it (commit 4f801de) both landed in this same PR — internally consistent.
• Deploy notes claim no API/CloudFormation changes are pending; not independently verifiable from this checkout, but plausible given the description and matches the "already in production" framing used elsewhere in the file.
• Minor: the PR description says "Two commits for the v0.5.0 minor" but the branch actually has four (chore(deps), docs(release) notes, fix(seo), and a follow-up docs(release) note for the fix) — harmless, just a stale description if anyone reads it later.

.github/release-notes/README.md

• Wording update is accurate: replaces the old "1.0.0 will likely be first" speculation with the factual "v0.5.0 is the first release to use this mechanism." Good cleanup, no stale claims left behind.

src/app/robots.ts + src/app/__tests__/robots.test.ts

• Verified /companies/ and /reports/ against the actual src/app/(app)/ directory listing — companies, console, entities, entity, graphs, home, portfolio, reports, repositories, search, settings are all present in disallow, so the fix is correct and complete.
• The new test is a good structural improvement: it derives the expected disallow list from the filesystem instead of a hand-kept array, so the exact regression here (/companies and /reports shipping without an entry) can't recur silently.
• Minor robustness note (not a blocker): the test filters out __tests__ but not other potential non-route directories under (app)/ (e.g. a future shared components/ or _lib/ folder). If one is ever added, the test will demand a matching disallow entry even though it isn't a real route. Easy to fix later (e.g. skip dirs starting with _ or without a page.tsx), not worth blocking on now since no such directory exists today.

package.json / package-lock.json

• @robosystems/core 0.9.4 → 0.9.5, consistent with the notes' dependency line. Couldn't independently verify the "docs links only" claim against the published package (no network access from this sandbox), but the diff shape (single dependency bump, small lockfile diff) is consistent with a patch-level release.

Verification limits: I wasn't able to run npx vitest or gh pr view in this sandbox (both required approval that wasn't available), so I verified the robots fix by manually diffing the disallow list against the real (app) route directories rather than executing the test. If you'd like me to actually run test:all, the Bash tool needs npx vitest/gh allowed.

No blocking issues found — the changes are accurate, well-scoped, and the new test meaningfully closes the gap that caused the /companies//reports regression in the first place.