537 Commits

• fix(hooks): emit suggest-compact via hookSpecificOutput stdout

  The threshold and interval suggestions in suggest-compact.js are written
  to stderr via log(). Per the Claude Code hooks guide, non-blocking
  PreToolUse stderr (exit code 0) is only captured in the debug log — it
  does not reach the model. As shipped, the script's nudge to /compact is
  silent on Claude Code 2.1.x.
  
  Fix: alongside the existing log() call (kept for debug-log capture),
  emit the same suggestion as structured JSON on stdout:
  
    { hookSpecificOutput: {
        hookEventName: "PreToolUse",
        additionalContext: msg
    } }
  
  This is the documented mechanism for a PreToolUse hook to inject
  context into the next model turn without blocking the tool call.
  
  Verified end-to-end on Claude Code 2.1.142 (VSCode native extension,
  Windows 11) — the additionalContext now surfaces in the next turn as
  a <system-reminder> block. Counter increment and exit code behavior
  unchanged.
  
  Tests: 4 new cases in tests/hooks/suggest-compact.test.js covering
  stdout JSON at threshold, stdout JSON at +25 interval, silence below
  threshold, and stderr-retention for the debug log. Suite goes from
  19/19 -> 23/23 (suggest-compact) and full run-all stays clean for
  the unaffected suites (the 4 pre-existing Windows broken-symlink
  failures in ci/validators, lib/session-manager, and lib/utils are
  unrelated to this change).

  richm-spp · 2026-05-15 09:48:28 +10:00
  c802c33abc
• docs: sync ECC Tools judge execution (#1901)
  Affaan Mustafa · 2026-05-14 17:38:03 -04:00
  0e66c838c7
• docs: sync ECC Tools judge contract (#1900)
  Affaan Mustafa · 2026-05-14 17:15:54 -04:00
  cb9702ca99
• docs: sync ECC Tools retrieval planning (#1892)
  Affaan Mustafa · 2026-05-14 16:54:30 -04:00
  f9384427b8
• docs: sync ECC Tools hosted output scoring (#1891)
  Affaan Mustafa · 2026-05-13 23:02:23 -04:00
  4423f10cfb
• docs: sync ECC Tools hosted promotion readiness (#1890)
  Affaan Mustafa · 2026-05-13 22:39:01 -04:00
  3b12fb273f
• feat: add Ruby and Rails rules
  Affaan Mustafa · 2026-05-13 06:27:08 -04:00
  c2762dd569
• ci: gate observability on release safety evidence

  Add release-safety evidence coverage to observability readiness and refresh rc.1 publication gate docs.

  Affaan Mustafa · 2026-05-13 04:14:47 -04:00
  42f04edc03
• fix: harden GateGuard destructive bash tokenizer

  Co-authored-by: Jamkris <dltmdgus1412@gmail.com>

  SeungHyun · 2026-05-13 02:43:04 -04:00
  0e169fecbc
• ci: disable checkout credential persistence in privileged workflows (#1851)
  Affaan Mustafa · 2026-05-13 01:15:49 -04:00
  209abd403b
• docs: gate ECC progress sync readiness

  Make the ECC 2.0 GitHub/Linear/handoff/roadmap progress-sync model part of the local observability readiness gate instead of leaving it as roadmap prose only.
  
  - add `docs/architecture/progress-sync-contract.md` for GitHub, Linear, handoff, roadmap, and work-items sync
  - add a `Tracker Sync` check to `scripts/observability-readiness.js`
  - update observability tests with passing and missing-contract coverage
  - update observability and GA roadmap docs so the local readiness gate is now 18/18 and records #1848 supply-chain hardening evidence
  
  Validation:
  - node tests/scripts/observability-readiness.test.js (9 passed, 0 failed)
  - npm run observability:ready -- --format json (18/18, ready true)
  - npx markdownlint-cli 'docs/architecture/progress-sync-contract.md' 'docs/architecture/observability-readiness.md' 'docs/ECC-2.0-GA-ROADMAP.md'
  - git diff --check
  - node tests/docs/ecc2-release-surface.test.js (18 passed)
  - node tests/run-all.js (2378 passed, 0 failed)
  - GitHub CI for #1849 green across Ubuntu, Windows, and macOS
  
  No release, tag, npm publish, plugin tag, marketplace submission, or announcement was performed.

  Affaan Mustafa · 2026-05-13 00:38:18 -04:00
  63f9bfc33f
• docs: add supply-chain incident response playbook

  Add a repo-level supply-chain incident response playbook for npm/GitHub Actions package-registry incidents, anchored on the May 2026 TanStack compromise and prior Shai-Hulud-style npm incidents.
  
  - add `docs/security/supply-chain-incident-response.md` with exposure checks, immediate response steps, workflow rules, publication rules, and escalation triggers
  - link the playbook from `SECURITY.md`
  - reject `pull_request_target` workflows that restore or save shared dependency caches
  - add a regression test for the new `pull_request_target + actions/cache` guardrail
  
  Validation:
  - node tests/ci/validate-workflow-security.test.js (12 passed, 0 failed)
  - node scripts/ci/validate-workflow-security.js (validated 7 workflow files)
  - npx markdownlint-cli 'SECURITY.md' 'docs/security/supply-chain-incident-response.md'
  - npx markdownlint-cli '**/*.md' --ignore node_modules
  - git diff --check
  - node tests/run-all.js (2377 passed, 0 failed)
  - GitHub CI for #1848 green across Ubuntu, Windows, and macOS
  
  No release, tag, npm publish, plugin tag, marketplace submission, or announcement was performed.

  Affaan Mustafa · 2026-05-13 00:22:28 -04:00
  cbecf5689d
• ci: require npm audit signature checks

  Require npm registry signature verification wherever workflow npm audit checks run.
  
  - add npm audit signatures to CI Security Scan and maintenance security audit jobs
  - teach the workflow security validator to reject npm audit without signature verification
  - keep the repair and Copilot prompt tests portable across Windows path/case and CRLF frontmatter behavior
  
  Validation:
  - node tests/run-all.js (2376 passed, 0 failed)
  - CI current-head matrix green on #1846

  Affaan Mustafa · 2026-05-12 23:48:56 -04:00
  797f283036
• feat: add GitHub Copilot prompt support

  Adds GitHub Copilot VS Code instruction and prompt files for ECC workflows, with VS Code prompt frontmatter/settings aligned to current docs and tests covering the surface.
  
  Co-authored-by: Girish Kanjiyani <girish.kanjiyani5040@gmail.com>
  Co-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com>

  Girish Kanjiyani · 2026-05-12 23:00:00 -04:00
  766f4ee1d8
• fix: close block-no-verify bypass holes

  Backport Jamkris's fix for case-insensitive core.hooksPath overrides and the git commit -tn template-path false positive. Verified locally on current main with 25/25 block-no-verify tests and node tests/run-all.js passing 2369/2369.

  SeungHyun · 2026-05-12 22:28:12 -04:00
  6be241a463
• ci: harden workflow install boundaries

  - run non-test workflow installs with npm ci --ignore-scripts where lifecycle scripts are not needed\n- reject plain npm ci in workflows with write permissions\n- reject actions/cache in id-token: write workflows to reduce OIDC publish cache-poisoning risk

  Affaan Mustafa · 2026-05-12 21:55:36 -04:00
  daf0355531
• ci: ignore install scripts in release workflows (#1839)
  Affaan Mustafa · 2026-05-12 21:36:36 -04:00
  33db548be3
• docs: add deep-analyzer evaluator scenario
  Affaan Mustafa · 2026-05-12 18:52:09 -04:00
  37c27a60fd
• docs: add skill-quality evaluator scenario
  Affaan Mustafa · 2026-05-12 18:36:25 -04:00
  337ced0828
• docs: add AgentShield policy exception evaluator scenario
  Affaan Mustafa · 2026-05-12 18:19:49 -04:00
  b25d4770f5
• docs: add evaluator harness config scenario
  Affaan Mustafa · 2026-05-12 18:03:30 -04:00
  3dddfc8270
• docs: add evaluator CI failure scenario (#1826)
  Affaan Mustafa · 2026-05-12 17:44:00 -04:00
  cd90c84c32
• docs: add evaluator billing readiness scenario (#1825)
  Affaan Mustafa · 2026-05-12 17:24:34 -04:00
  863519eecf
• docs: add evaluator rag prototype (#1824)
  Affaan Mustafa · 2026-05-12 17:04:39 -04:00
  dcf5668b27
• docs: record rc1 publication dry-run evidence (#1822)
  Affaan Mustafa · 2026-05-12 16:27:52 -04:00
  bfacf37715
• docs: add HUD status control contract (#1821)
  Affaan Mustafa · 2026-05-12 16:09:18 -04:00
  0598af70a5
• docs: record stale salvage gap pass (#1818)
  Affaan Mustafa · 2026-05-12 15:18:13 -04:00
  4f5f612b61
• feat: salvage code-reviewer false-positive guardrails (#1817)
  Affaan Mustafa · 2026-05-12 15:01:46 -04:00
  df60af9619
• feat: salvage frontend design guidance (#1816)
  Affaan Mustafa · 2026-05-12 14:44:17 -04:00
  ab0f0187de
• feat: salvage cost tracking and skill scout (#1815)
  Affaan Mustafa · 2026-05-12 14:23:46 -04:00
  65c1502ecd
• docs: map stale PR salvage sources (#1813)
  Affaan Mustafa · 2026-05-12 13:42:36 -04:00
  5d3ed622c6
• feat: salvage Django Celery workflow (#1812)

  Source: maintainer-owned salvage of useful Django reviewer/build-resolver/Celery work from stale PR #1310 by mrigank2seven.
  
  - add django-reviewer and django-build-resolver agents
  
  - add django-celery skill with timezone-aware scheduling example
  
  - update catalog counts to 60 agents / 221 skills and record the May 12 salvage gap pass
  
  Co-authored-by: MRIGANK GUPTA <mrigank2seven@users.noreply.github.com>

  Affaan Mustafa · 2026-05-12 13:20:33 -04:00
  f239379ebf
• docs: inventory workspace legacy repos (#1789)
  Affaan Mustafa · 2026-05-12 04:08:34 -04:00
  68229a8996
• docs: publish stale PR salvage ledger (#1788)
  Affaan Mustafa · 2026-05-12 03:50:34 -04:00
  8cbf6763c4
• docs: inventory legacy artifacts (#1787)
  Affaan Mustafa · 2026-05-12 03:34:18 -04:00
  de559bddd2
• docs: add release publication readiness gate (#1786)
  Affaan Mustafa · 2026-05-12 03:16:22 -04:00
  008ce3081b
• docs: add data-backed harness adapter scorecard (#1785)

  * docs: add data-backed harness adapter scorecard
  
  * fix: normalize adapter matrix line endings
  
  * test: avoid doubled CRLF simulation

  Affaan Mustafa · 2026-05-12 02:59:52 -04:00
  cdf1b03779
• docs: add harness adapter compliance matrix (#1784)
  Affaan Mustafa · 2026-05-12 02:24:04 -04:00
  969acd9078
• test: harden InsAIts wrapper fake Python shim
  Affaan Mustafa · 2026-05-12 01:13:01 -04:00
  22aabf7d4f
• test: stabilize MCP stderr probe timeout
  Affaan Mustafa · 2026-05-12 01:13:01 -04:00
  901e41997b
• feat: add ECC statusline observability hooks

  Salvages the useful statusline/context monitor work from stale PR #1504 while preserving the current continuous-learning hook runner wiring.
  
  Adds the metrics bridge, context monitor, statusline script, shared cost/session bridge utilities, and tests. Fixes the reviewed false loop-detection hash collision for non-file tools, avoids default-session cost inflation, sanitizes statusline task lookup, and records hook payload session IDs in cost-tracker.

  Affaan Mustafa · 2026-05-11 23:44:06 -04:00
  940135ea47
• feat: add Astraflow provider support
  Affaan Mustafa · 2026-05-11 23:21:46 -04:00
  e9c8845833
• fix: scope SessionStart context injection
  Affaan Mustafa · 2026-05-11 22:56:29 -04:00
  03108bea62
• test: harden mcp health port readiness
  Affaan Mustafa · 2026-05-11 22:40:19 -04:00
  67a8b914ee
• fix: harden opencode project file probes
  Affaan Mustafa · 2026-05-11 22:40:19 -04:00
  6d613f67dd
• docs: salvage F# agent and language guidance
  Affaan Mustafa · 2026-05-11 21:43:17 -04:00
  fd9453f6ee
• test: relax InsAIts monitor timeout
  Affaan Mustafa · 2026-05-11 19:38:21 -04:00
  4220f1b064
• feat: salvage windows desktop e2e skill

  Reintroduce the Windows desktop E2E testing skill from stale PR #1334 with current manifest wiring, package publish coverage, catalog counts, and sanitized environment-path guidance.

  Affaan Mustafa · 2026-05-11 19:15:02 -04:00
  14816289ba
• fix: salvage stale PR plugin install fixes
  Affaan Mustafa · 2026-05-11 18:48:23 -04:00
  9b385c9e30
• feat: add observability readiness gate
  Affaan Mustafa · 2026-05-11 18:33:14 -04:00
  8aa8c32d2a