v0.12.0 - the architecture map: planning grounded in the code that exists

Planning gets ground truth: a generated architecture map closes the feature-after-feature loop - finish a feature, and the next one's plan is grounded in the code that now exists. Plus a diagrammed, up-to-date README. 16 commits since v0.11.0.

Highlights

• ritual architect - one budgeted headless survey writes .ritual/architecture.md: modules, data flows, conventions, extension seams ("new X plugs in here, copy Y"), and boundaries. The agent writes a candidate (architecture.md.new); ritual validates it (run outcome, real content, required sections) and installs it atomically with rollback - no failure path can damage the live map, and the previous version survives as .bak. Knobs: budget_architect_usd, [models] architect, [architect] enabled / auto_refresh.

• Grounded planning - once the map has real content, the plan stage is told to align with it and route new work through its extension seams (divergence must be justified in the plan), and plan-review receives it as ground truth (RITUAL_ARCHITECTURE_FILE, same rail as the constitution) to flag plans that rebuild what already exists or violate a stated boundary. Code reviews stay map-free - they judge the diff.

• Honest freshness, everywhere advice lives - the map is stamped with a .ritual-scoped tree fingerprint: ritual's own artifacts (plans, findings, the sidecar itself) never stale it; source edits and commits do - advisory only, same semantics as the dual-review staleness marker. Missing/stale surfaces in the TUI sidebar, ritual status, ritual doctor (Warn, never Fail), and the plan stage-detail (i). Unknown is never reported stale (non-git trees, legacy docs).

• The loop closes itself - when ritual complete reaches genuine completion it auto-refreshes the map while the feature's context is hot, so the next feature plans against post-feature reality. Never on --check (the CI gate stays token-free), skipped offline/over budget with a note, and a failed refresh warns without failing completion.

• TUI: palette architect action - live stream on the Live tab, finalization inside the task (the stamp is settled before the result is reported - TUI and CLI share one failure-handling path), x cancels the daemon with the live map untouched, and an external ritual architect clears the sidebar nudge live via the mtime gate.

• README, diagrammed - three mermaid diagrams with one semantic palette (orange = claude, teal = codex, purple = cross-model, amber = artifacts, green = gates/done): the pipeline with the grounding/auto-refresh loop, the daemonized-run + findings data flow, and an ecosystem map of every required/optional integration. The optional-prerequisites list is now complete (pal MCP + Gemini consensus and nvim were missing), the roadmap entries carry their version labels, and the version badge finally moved off 0.10.1.

Hardening (from this release's own dual-review)

• finalize is transactional: an install failure mid-swap rolls the backup back; a stamp failure after a successful install drops the stale sidecar (Unknown never lies) and says the map WAS installed.
• The TUI architect run is cancellable (x kills the daemon; the tail finalizes the cleanup) instead of claiming "no active run".
• ritual status only nudges ritual architect where a .ritual/ actually exists.

Install

cargo install --path . --locked      # or: cargo build --release

Full changelog: v0.11.0...v0.12.0

v0.11.0 - whole-project audit, coverage stage, live pipeline guidance

The biggest release since the pipeline itself: a whole-project audit, a seventh coverage stage that proves the work is actually done, live pipeline guidance in the TUI, and a broad hardening sweep. 66 commits since v0.10.1.

Highlights

• Whole-project audit — ritual audit (with --discover) runs parallel blind lanes across the codebase, then a cross-vendor judge adjudicates every candidate into standard findings that land in the normal triage flow. New knobs: budget_audit_usd and audit_max_lanes; the judge's budget cap scales with the lane count so a big audit doesn't starve mid-run.

• Coverage stage + ritual complete — a new 7th pipeline stage judges your deliverables against the spec's checklist and gates on zero gaps, so "done" means done. ritual complete is a bounded auto-driver that loops (coverage → drive the gaps → re-check) until the feature is complete; ritual complete --check is a scriptable predicate. Budgets and loop bounds live under [complete].

• Pipeline guidance in the TUI — the sidebar now tells you what to do next. Done stages show a stale marker when the spec, plan, or code moved after they ran (tracked via document mtimes and a tree fingerprint persisted at each stage's finish). A » next: strip names the next actionable stage and its top blocker or warning ("62 confirmed finding(s) open", "plan.md missing — run plan first", "check.sh is red"). Press i on any stage for a detail overlay: status, when it finished, the last run's cost/model, exactly why it's stale, what it unlocks, and the suggested action.

• Honest, context-aware which-key — the ? overlay now advertises exactly the keys that work in the current tab and context, with a durable test that fails loudly on drift. g/G/j/k genuinely work on every tab — the History tab finally scrolls — and long sidebar/live-stream text wraps instead of clipping mid-sentence.

• ritual reset-plan (CLI + TUI) — re-plan from the spec while keeping your code, with an exact-branch match so a reset can never touch another feature's findings.

• offline = true is now a real kill-switch — it blocks agent runs before any process spawns (chat and audit refuse identically), not just a preflight skip.

Hardening sweep

• Provenance chain survives parallel runs — an flock around the last-link→meta write plus linkage-order verification, so concurrent runs (e.g. an 8-lane audit) keep the chain intact and verifiable.
• Durable state — writer-unique atomic writes and CLI reload-merge-save, so a background daemon and a foreground command can't clobber each other's stage updates.
• Runner stream/lifecycle robustness — lossy-UTF8 stdout, a stderr sidecar, SIGTERM-aware failure metadata, and incremental tail draining.
• Gates fail closed — a git snapshot error blocks rather than green-lights; dual-review preflights the diff so it can't produce a vacuous green review; code-fix enforces its git guardrail with --disallowedTools and leaves failed attempts in the tree for inspection.
• Branch-slug collisions contained — raw-branch reset matching plus doctor/TUI warnings.

Docs

• GitHub-safe README (no Nerd Font private-use glyphs that render as tofu on github.com), with the audit / coverage / complete workflows, budget knobs, and the offline kill-switch documented.

Install

cargo install --path . --locked      # or: cargo build --release

Full changelog: v0.10.1...v0.11.0

v0.10.1 - code-fix never deletes the attempt; names why + attach hint

Fixes two real problems with the v0.10.0 code-fix, both from a live failure (41 findings, Opus ran 17 min, exited 1, and the batch was silently reverted):

• Never delete the work. A failed code-fix used to git restore the touched files, throwing away the attempt. Worse, when the target code is UNTRACKED in the repo (a subtree that was never git added) the restore could only delete newly-created files while leaving modifications, yet still reported "reverted". Now, pass OR fail, the attempt is always left in your working tree - git is the undo. A pass marks the findings fixed; a failure leaves them queued and you review the attempt with git diff, keep the good parts, or discard with git restore . / git stash.
• Say why, and let you inspect it. A failure now names the reason and offers ritual attach <id> to replay the run, instead of a bare "exit 1".
• Dropped the git-based auto-restore and the tree-changed gate (the re-review is the arbiter, and git can't see edits to untracked files anyway). The re-review agent reads the code directly to cover the untracked gap.

Note: for the cleanest verification, keep the code you're fixing inside a git repo (tracked, or its own repo) so the diff is complete.

v0.10.0 - LLM batch-fix for dual-review code findings

Dual-review CODE findings can now be fixed by an LLM, not just plan findings.

• Queue them like plan findings: F queues a confirmed code finding for the batch (or unqueues/applies it), and A queues EVERY confirmed code finding on the feature at once ("fix all").
• One run fixes them all: a single headless broad-edit run resolves the whole queue in one pass (so fixes can't rot each other's anchors), capped by the new budget_code_fix_usd (default $5).
• Verified against the global context: after the fix, ritual runs ./check.sh (full), then an independent, read-only re-review of the diff confirms every finding is actually resolved and nothing regressed. A batch is accepted only if BOTH pass.
• git is the undo: a passing fix is LEFT in your working tree - review it with git diff and keep or discard it with git. Any gate failure (red check.sh or a re-review that flags an unresolved finding or a regression) git-reverts the whole batch and leaves the findings queued.
• Prefer to fix by hand? m + Q still route code findings to nvim's quickfix.

420 cargo tests + 80 token-free live checks.

Full context: ROADMAP.md and the README roadmap.

v0.9.5 - implement overlay: no selectable text, clipboard + primary

The paste was picking up the rendered box - the float border and the sidebar behind it - because the prompt was drawn as selectable text and a mouse drag (or copy-on-select) grabbed the whole rows and clobbered the clean clipboard.

Fixes:

• When the auto-copy succeeds, the overlay renders no prompt text at all - nothing to drag-select. It just says "✓ the implement instruction is on your clipboard. Press enter, then paste (Ctrl+Shift+V / middle-click)."
• Clipboard writes now set both the clipboard and the primary selection, so paste works whether you use Ctrl+Shift+V or middle-click.
• The prompt text is only shown as a manual fallback if no clipboard tool is reachable.

Just press enter and paste - no selecting.

v0.9.4 - auto-copy the implement prompt to the clipboard

Selecting the implement prompt with the mouse also grabbed the sidebar rows behind the float. Now the prompt goes straight to the system clipboard - no selecting.

• Opening the implement overlay copies the ready instruction to the clipboard automatically (tries wl-copy → xclip → xsel → pbcopy, with an OSC 52 escape-sequence fallback for terminals/SSH without a tool).
• The overlay confirms ✓ copied to your clipboard - paste it once it opens; press enter to open the session and paste. c re-copies if needed.
• No-op under cargo test, so the test suite never clobbers your clipboard.

v0.9.3 - implement launch overlay with a copy-paste prompt

An interactive claude --resume can't be handed an opening message (that only works with --print, which is non-interactive), so implement no longer tries to auto-send one.

Instead, implement resumes the exact pinned tests-red session and first shows a small launch overlay with the ready-to-paste instruction:

• The tests-red session reopens with full context.
• Copy the suggested prompt from the overlay, press enter to open the session, and paste it to start.
• No pinned session yet → the overlay leads into the bare --resume picker so you pick the right one.
• esc cancels without launching.

This makes the (unavoidable) manual kickoff explicit and one paste away, instead of silently doing nothing.

v0.9.2 - bare --resume picker fallback (kickoff no longer lands in search)

Patch fix for the v0.9.1 handoff.

claude's --resume [value] takes an optional value that is either a session id or a picker search term. The no-session fallback launched claude --resume "<implement prompt>", so the whole kickoff prompt was consumed as that value - the resume picker opened with the prompt sitting in its search box instead of resuming anything.

Fixed: the no-id fallback is now a bare claude --resume (clean picker). The kickoff prompt still rides as the trailing positional in the normal path, where a real --session-id-pinned id precedes it (claude --resume <uuid> "<prompt>").

Note: features whose tests-red ran before v0.9.1 have no pinned session, so implement uses this picker - pick the tests-red conversation. Run tests-red under v0.9.1+ and the handoff resumes by id automatically.

v0.9.1 - deterministic tests-red → implement session handoff

Makes the pipeline's tests-red → implement handoff deterministic.

implement used claude --continue ("continue the most recent conversation in the current directory") - ambient state that any other Claude session, in another terminal, could hijack, so implement would reopen the wrong conversation and nothing happened.

Now ritual owns the handoff:

• tests-red launches claude --session-id <uuid> with a ritual-minted id stored under the feature.
• implement launches claude --resume <uuid> - the exact conversation that wrote the failing tests - and auto-sends an implement instruction so it starts working.
• No pinned session (legacy feature, or tests-red never run) → the claude --resume picker, so you choose consciously; never a silent wrong-session grab.
• a (takeover) now works for these interactive stages too.

No new dependency (the UUID is minted from the existing hash + time/pid/counter). 386 cargo tests + 80 token-free live checks.

Full context: ROADMAP.md and the README roadmap.

v0.9.0 - in-TUI settings editor (S)

Configuration you can change without leaving the TUI.

• S opens a settings editor over the practical knobs: budgets, model/effort routing, theme/icons/transparency, notifications, redaction, offline, base ref, check timeout.
• Each row shows the effective value after layering plus its source - default / user / project / flag.
• Edits write the project config with your comments and formatting preserved (via toml_edit); empty input clears an optional key so the layer below shows through.
• Transactional live-apply: the config reloads and applies immediately (theme included), and if the result would be invalid the file is restored byte-for-byte.

379 cargo tests + 80 token-free live checks.

Full context: ROADMAP.md and the README roadmap.