toothpaste-kit 0.5.0

A MINOR release under docs/releasing.md. The licence moves to Apache 2.0, with REUSE
compliance and a Developer Certificate of Origin sign-off; the ACMM L2, L3 and L4 files arrive;
scripts/gates.sh goes from ten gates to fourteen; and branch and tag names get one rule. No
skill is added and no skill revision is BREAKING.

Added

• docs/document-layers.md, exception 5: a filed reflection entry may be
  reformatted where no word changes (line wrapping or whitespace, or markup
  a new gate requires), and a markup change MUST NOT change what a line
  means; a change to any word needs a superseding entry. The maintainer's
  decision of 2026-10-20, made for ACMM compatibility.
• docs/risk-tiers.md, "Per-tool instruction files": every per-tool
  instruction file (CLAUDE.md, .cursor/rules/agents.mdc,
  .github/copilot-instructions.md) points at AGENTS.md and adds no rule.
  The maintainer's decision of 2026-10-20, made for ACMM compatibility.
• ACMM L3 measurement (pull request #44): docs/metrics.md, the pull request
  acceptance metric; docs/review-rubric.md, the review rubric;
  .github/workflows/ci.yml, the test matrix on Linux and macOS;
  docs/quality.md, the quality dashboard; .claude/session-summary.md, the
  session summary artifact. scripts/reorient now parses under bash 3.2.
• docs/acmm.md: an index of the ACMM levels, naming the file that meets
  each criterion and the pull request that added it.
• REUSE compliance: every file declares its copyright and licence, by an
  SPDX header or, for files that cannot hold one, in REUSE.toml; the
  licence text is also in LICENSES/Apache-2.0.txt. scripts/compliance.sh
  runs reuse lint with a planted-file selftest, and
  .github/workflows/compliance.yml runs it in CI with a pinned reuse.
  scripts/gates.sh still needs nothing installed.
• Branch and tag names: scripts/check-branch-name is the one definition of
  an allowed name, <prefix>/<words> from a fixed prefix list, 40 characters
  at most, and v<major>.<minor>.<patch> for tags. .githooks/pre-push runs
  it before a push, gate 13 selftests it and checks the ruleset's prefix list
  against it, the branch-name job in gates.yml checks a pull request's
  branch, and .github/rulesets/ holds the forge rulesets for the
  maintainer to apply. hooks/hookify.branch-name-guard.local.md is the
  example agent rule: push only to an explicit destination, never skip the
  hooks; its cases are in tests/branch-guard-cases.tsv, run by the hooks
  gate. CONTRIBUTING.md, "Branch and tag names".
• orchestration/rounds.md: the rounds protocol, by which work is checked by
  a seat other than its author before it reaches the maintainer, with report
  and finding numbering and the major, minor and nit severity scale (pull
  request #53).
• scripts/check-hooks.py, gate 12: each rule in hooks/ parses, and each
  blocking rule fires on its planted cases (pull request #51).
• scripts/auto-qa-tuner.py, run weekly by .github/workflows/auto-qa.yml:
  proposes a timeout for each job in .github/auto-qa-tuning.json from its
  last 100 runs, in the job summary, and never edits a workflow (pull
  request #52).
• .github/workflows/ai-fix.yml: an issue labelled ai-fix gets one fixed
  comment routing it to the maintainers. No agent runs in CI and no stored
  secret is used (pull request #48).
• ACMM L4 part a (pull request #45): SECURITY-AI.md, the AI security policy;
  docs/risk-tiers.md, change classification; .github/labeler.yml and its
  workflow, labelling pull requests by path; .github/workflows/nightly.yml,
  the gates selftest every night; and docs/reflections/, filed
  cross-session lessons.
• ACMM L2 (pull request #37): CLAUDE.md, .github/copilot-instructions.md
  and .cursor/rules/agents.mdc point at AGENTS.md;
  docs/prompts/README.md catalogs the skills; docs/corrections.md and an
  empty corrections.jsonl give the Correction Protocol's records a format.
• Contributor files (pull request #30): AGENTS.md, a pull request template,
  .editorconfig, and tests/run with tests/README.md as the test entry
  point. scripts/link-skills.sh --selftest, gate 11.
• docs/glossary.md, each term of art with the file that defines it (pull
  request #29), and docs/concepts.md, a concepts index (pull request #43).

Changed

• .githooks/commit-msg also refuses Assisted-by: and Agent-<name>:
  trailers, and the commit-attribution workflow now runs that hook on each
  commit instead of a copy of its pattern, so the two cannot drift. Gate 14
  runs the hook against tests/attribution-cases.tsv.
• scripts/gates.sh stops with one message when python3 is missing,
  instead of failing gate by gate.
• docs/quickstart.md step 1 says where to install Claude Code and that it
  needs an account.
• Licence: Apache License 2.0 from this release. LICENSE is the
  unmodified official text, and CITATION.cff, README.md, GOVERNANCE.md,
  references.md, docs/security-posture.md and docs/project-state.md name
  it. Releases 0.1.0 to 0.4.0 were published under MIT and stay under it: their
  tags and assets are not rewritten, and what MIT granted for them is not
  revoked. The copyright holder is named in CITATION.cff and README.md, and
  no NOTICE file is added.
• Contributions need a Developer Certificate of Origin sign-off.
  CONTRIBUTING.md gains a licence and sign-off section (inbound licence, the
  DCO, git commit -s, how to add a missing sign-off, and the pause when
  someone else may own the work), GOVERNANCE.md states the pause, and
  .github/workflows/dco.yml fails a pull request containing a commit with no
  sign-off for its author. No contributor licence agreement is asked.
• Four skills (working-preferences, document-standards, technical-documents,
  surface-regimes) each gain one line pointing to skill-creation for making a skill and
  skill-discovery for deciding whether a need justifies one, or locating one.
• docs/security-posture.md rows 3.7 and 4.4 state the rule for every
  workflow instead of a count, which had gone stale twice.
• daily-review step 5: the Most Important Task is the person's first task
  in Next, in the order the review proposes, the rule the lane board marks.
• scripts/reorient names what it skips: a path that is not a repository
  gets a line, MAIL says none when nothing is new, and TASK says
  not checked when ps is missing (pull requests #30 and #36).
• session-log's description names what the capture records, the decisions,
  corrections, open questions and findings, where it said it writes the
  reasoning; orient and session-close describe it the same way (pull
  request #22).

Skill revisions

• daily-review v3 to v4.
• document-standards v4 to v5.
• orient v2 to v3.
• session-close v5 to v6.
• session-log v2 to v3.
• surface-regimes v3 to v4.
• technical-documents v2 to v3.
• working-preferences v5 to v6.

toothpaste-kit 0.4.0

A MINOR release under docs/releasing.md: three new skills, three new scripts, each
with a gate, and the issue #11 fix, which carries one BREAKING skill change. The
scripts/reorient selftest rows for planted positives (pull request #20) were
added after the 2026-10-09 cutoff and change the selftest only.

Added

• skills/merge-proxy/, a seventh procedure a person invokes. For the session
  it is invoked in, an agent may run and push a merge into a trunk on a
  repository whose remote is internal or absent, after explaining the whole
  plan and halting for approval of each merge. Never on a GitHub or other
  internet remote. The decision stays the person's; only the typing moves.
• scripts/remote-level.sh, the remote classifier merge-proxy runs first:
  none, internal or external from where a repository's remotes point,
  external whenever a host cannot be proven internal. A ninth gate runs its
  --selftest.
• skills/weekly-review/. A once-a-week pass over a task board's slower lanes:
  each Waiting blocker chased, carried work named by its count, the Done lane
  read back against each task's own verification, and one important task given
  a day, never a due date. It proposes and asks; it moves nothing the person
  did not answer.
• skills/monthly-review/. A once-a-month pass: each Someday/Maybe item
  adopted, kept or rejected, long-stalled Waiting work questioned, and the
  tool's archive candidates chosen by the person, leaving as reference or as
  trash. The only review that archives a task the board has been holding, and trash
  never satisfies a dependency (v2, after a second-party check of v1).
• scripts/reorient, the observing half of skills/orient/, which shipped
  without it. Paths come from the workspace's CLAUDE.md and manifest; mail is
  off unless REORIENT_INBOX_REPO is set. A tenth gate runs its --selftest
  on examples/workspace/ and against planted positives, among them mail on a
  sibling branch, a flag filed below Resolved, and a runbook named like a
  capture. orient v2 names it.
• docs/releasing.md says how a skill is versioned and retired (MINOR, a new
  release rule that leaves existing usage working). Three new sections: Skill
  revisions, where a skill's vN lives only in its own CHANGELOG.md and each
  release names the skills whose revision moved; A skill's interface, six
  surfaces, including when a skill fires, and what counts as breaking, labeled
  BREAKING pre-1.0; and Deprecation, announced in one release and removable no
  earlier than the second after it, with experimental skills exempt while the
  kit is pre-alpha. Release notes gain a Deprecated heading.
• docs/installing.md, the installing guide: where each part of the kit goes
  among Claude Code's features, workspace-level against user-level skills and
  why a user-level copy shadows a workspace one, symlink or copy,
  CLAUDE.local.md, enabling the hooks through the hookify plugin, updating,
  removing, and how a workspace grows (a place for unsorted imports, a
  repository, tiers). Reported in issue #11.
• examples/workspace/: the workspace the quickstart copies. CLAUDE.md
  naming the provenance layer and the manifest, index.md, and stubs of the
  standing files under .agents/, each holding comments rather than content.
• An eighth gate, scripts/check-workspace-stubs.py: every stub in
  examples/workspace/ is a file docs/standing-documents.md describes, every
  described file has a stub or a stated exemption, and the stub index.md
  lists every stub under .agents/. It has a planted positive in
  scripts/gates.sh --selftest.
• docs/releasing.md step 9 deletes the release branch once the release is
  published and the local main is pulled.

Changed

• README.md and docs/project-state.md list eighteen skills, with
  merge-proxy, weekly-review and monthly-review among those a person
  invokes; docs/project-state.md and CONTRIBUTING.md describe ten gates,
  with remote-level.sh and reorient under scripts/.
• docs/quickstart.md is one path in six steps, from checking the
  prerequisites to a session log on disk, each step ending with what you should
  now see. It clones the kit, copies examples/workspace/,
  and installs the skills into the workspace with scripts/link-skills.sh. Alternatives, and
  the material on growing a workspace, moved to docs/installing.md. The
  quickstart no longer creates intake/; the guide says what it is for.
  Reported in issue #11.
• README.md: "Installing the skills" points to the quickstart and the
  installing guide instead of carrying its own cp command, the hooks/
  section says the rules need the hookify plugin, and a new examples/
  section describes the example workspace.
• CONTRIBUTING.md lists what scripts/gates.sh needs, and its em dash
  check no longer uses grep -P, which only GNU grep has.
• docs/project-state.md names the example workspace and gains an "In v0.4.0"
  section.
• skills/daily-review/ v2: its Scope Pointer names weekly-review as
  shipped.
• skills/daily-review/ v3 and skills/weekly-review/ v2: the lanes table
  and Scope Pointer (daily) and the Scope Pointer (weekly) name
  monthly-review as shipped. No change to either procedure.
• Every skills/*/CHANGELOG.md relabeled to the shape docs/releasing.md now
  states (PATCH, no entry text changed): one integer vN per heading, unique,
  newest first, title # CHANGELOG. Renumbered: document-standards second
  v2 to v4 (was v2), redaction-gate v2.1 to v3 (was v2.1), and
  daily-review v1.1 to v2. Reordered newest first: document-standards,
  skill-creation, surface-regimes, technical-documents,
  working-preferences.

Fixed

• scripts/gates.sh: the em dash and private task ID gates searched .git,
  because --exclude-dir followed -- and was read as a file name, and
  passed when grep could not run at all. Both now fail on a grep error,
  and the selftest runs the two gates themselves on a planted tree instead of
  a copy of their command line.
• BREAKING skills/session-close/ v5: phase 1 writes provenance to the
  layer the tree's CLAUDE.md names instead of a path from the tree it was
  written in; the phase 3 dash sweeps no longer need GNU grep; and the memory
  store check is stated as the source tree's example, to be substituted, and
  reported as not applicable where a tree keeps no store. Reported in
  issue #11.
  Migration: name your provenance layer in your CLAUDE.md; where it names
  none, the skill now stops and asks instead of writing to
  agents/claude/context/. It skips the deprecation window as a safety fix:
  the old default could put session reasoning in a repository that later
  gains a public remote.
• skills/session-log/ v2: it writes no em dash, headings included, so
  session-close no longer has to correct its captures. Reported in issue #11.

Skill revisions

• daily-review v1 to v3.
• merge-proxy v1, new.
• monthly-review v2, new (v1 and v2 both in this release).
• orient v1 to v2.
• session-close v4 to v5, BREAKING.
• session-log v1 to v2.
• weekly-review v2, new (v1 and v2 both in this release).

toothpaste-kit 0.3.0

A MINOR release under docs/releasing.md: one new skill, and a release cadence.
Documentation and skill files only; no script changes.

Added

• skills/daily-review/. A once-a-day pass over a task board's lanes: the
  Inbox clarified to empty, carried work counted, finished work offered for
  close, priority read as an Eisenhower quadrant, and the day's order proposed.
  It proposes and asks; it moves nothing the person did not answer. It assumes
  a lane-board tool and says what that tool must print.
• docs/releasing.md has a Cadence section: a release review every two weeks
  on a Tuesday, with a Friday cutoff and a Monday final review, and a release
  only when the review admits one.

Changed

• CITATION.cff lists only the concept DOI, which is the one to cite. Each
  version DOI is recorded under "Where releases stand" in docs/releasing.md
  by the release after it, so a release no longer needs a follow-up pull
  request to record its DOI. Steps 3 and 7 of docs/releasing.md say so.
• README.md and docs/project-state.md list fifteen skills, with
  daily-review among those a person invokes.
• docs/quickstart.md: the example CLAUDE.md names the provenance layer and
  the file that lists the standing files, which the loop skills look for
  before writing.

toothpaste-kit 0.2.0

A MINOR release under docs/releasing.md: three new skills, and a changed
question format in working-preferences. Pre-1.0, so the format change is
allowed in a MINOR bump. Documentation and skill files only; no script changes.

Added

• orchestration/ROLES.md. Operator, lead, aide and minions, defined as an
  axis of authority over a decision, separate from clearance, working surface
  and reach. Persona is stated to be a different thing, and is left unbuilt.
• skills/orient/. The judgement half of a reorientation. The mechanical half
  is delegated to whatever state tool the adopting tree has.
• skills/jot/ and skills/touch/. Partial captures an agent may call at a
  clean boundary: jot records decisions, corrections and findings, and
  touch makes one fact-level update to a standing file.
• docs/partial-captures.md. The rules jot and touch share, including
  that neither satisfies session-log or session-close, and that each marks
  its entry so it cannot be mistaken for one.
• docs/quickstart.md, linked from README.md.

Changed

• working-preferences v5. Adds Context Cadence, which sets when the agent
  reports context size and when it offers a compaction. Replaces the NEXT
  block with Questions and Answers: three labeled questions, each closing
  with the codes it accepts, answered as f q1; 2 q2. An adopter who relies
  on the NEXT block needs to update. Mirrored in docs/interface-contract.md,
  docs/control-layers.md and skills/commands/. Reasons are in the skill's
  own CHANGELOG.md.
• session-close now prefers a tool that judges each memory store by where it
  is and whether it holds data, over the path grep, which has passed while
  the declared store had never been written.
• docs/project-state.md has a section for this release, and task ids on each
  known gap.
• docs/releasing.md step 3 describes setting the citation fields in the tree
  that gets tagged, and steps 4, 7 and 8 no longer describe the first release
  as still to come. Step 5's examples name this release.
• skill-creation v2. The naming convention allows a single verb for a
  procedure an agent runs on its own at a clean boundary, which covers
  orient, jot and touch. A skill that governs a domain still takes a
  noun phrase.

Fixed

• README.md and docs/project-state.md said eleven skills and listed only
  those. Both now list all fourteen in three classes, and the README tells an
  adopter to copy the whole skills/ folder rather than a count.
• orient, jot and touch arrived without the CHANGELOG.md every other
  skill carries. Each now has a v1 entry giving the reasons for its shape.
• Three markdown findings from the gates: two code fences without a language,
  and one double blank line.

toothpaste-kit 0.1.0

First tagged release. Pre-1.0: the orchestration schema and skill interfaces
still move, and a MINOR bump may break something. README.md says pre-alpha and
that remains true.

The kit at this release is eleven skills, the orchestration protocol with its
two JSON schemas and a four-vendor registry, seven inert hook rule examples, and
four scripts. Most of it is not new at 0.1.0; the version exists because having
no release at all blocks the OpenSSF badge, a Zenodo DOI, and having a version
to report a vulnerability against.

Added

• GOVERNANCE.md. One maintainer, stated as a governance model rather than left
  implicit, with bus factor one named as a known risk. Merges, tags and pushes
  are not delegated, and the document says why that boundary is the main control
  keeping review meaningful in a project where agents do much of the editing.
• docs/releasing.md. Repo-wide semantic versioning, cut as an annotated tag.
  Chosen over per-skill version strings because skills here reference each other
  by name and load as a set, so a reader needs to know which set they have. The
  absence of any release was blocking the OpenSSF badge, a Zenodo DOI, and
  having a version to report a vulnerability against.
• docs/security-posture.md. One row per control, with an evidence column that
  names a file or says the thing is absent. Organised by control area rather than
  by criterion ID until the criterion lists are transcribed from their published
  source, because inventing criterion IDs would produce a document that looks
  authoritative and cites nothing.
• scripts/gates.sh and .github/workflows/gates.yml. The seven mechanical
  gates CONTRIBUTING.md states as rules, now enforced. The gates live in the
  script and the workflow calls it, so a contributor's local run and CI are the
  same text rather than two copies that can drift.
• scripts/gates.sh --selftest, which plants a positive for each gate and
  confirms the gate fires before the real pass runs. A gate that has never
  returned a hit has not been shown capable of returning one.
• .github/dependabot.yml, github-actions only. The repository ships no package
  manifest, so the actions used by the two workflows are its entire declared
  dependency surface.
• permissions: contents: read on the new workflow.
• scripts/mdlint.py, a seventh gate. Eighteen markdown structure rules using
  markdownlint's own rule IDs, standard library only. markdownlint itself was
  rejected on the same grounds the CI design note rejected third party actions:
  npx fetches at run time, which is a supply chain surface attached to the
  thing meant to increase trust, and a package manifest is the other half of
  that cost in a repository that deliberately ships none. Four of the rules are
  accessibility rules mapped to WCAG techniques in docs/document-accessibility.md.
• docs/document-accessibility.md, the output-side companion that
  docs/accessibility.md section 8 listed as open. Technique IDs read from
  local W3C captures or from a supplied URL, never from recall, and the document
  says plainly that the project does not claim conformance.
• A Succession section in GOVERNANCE.md, naming what a successor needs and the
  state of each item. Nobody is listed as a maintainer without written consent.

Changed

• README.md restructured around an index of descriptive anchor links, with the
  narrative moved into philosophy.md. One h1, no skipped heading levels.
• philosophy.md deduplicated. ## The name was fully contained in the
  Toothpaste Repairman section and pointed at a README passage that had moved
  into the same file, so it was removed rather than rewritten. The author's own
  sections are unchanged, verified byte for byte against the committed original.
• Three mechanical rules in CONTRIBUTING.md, stated before they could block
  anyone: every .json parses, a registry entry is self-consistent, and every
  SKILL.md carries name and description. A blocking check that no document
  promises would reject a contributor under a rule they had no way to read.

Fixed

• docs/project-state.md was twelve days stale. It called five committed
  documents uncommitted, and described the code of conduct's reporting contact as
  a placeholder when it is a real address.
• A typo in the README.md overview.

Known

• scripts/mdlint.py has a quadratic-time residual that is bounded per line
  and not per file. Six py/polynomial-redos alerts are dismissed as
  won't fix rather than as false positives, because the patterns are real:
  four of them were independently reproduced on a second host at 15x to 16x
  scaling when the input quadruples, against a known-quadratic control at 11x.
  MAX_LINE caps analysis at 2000 characters and its guard precedes every
  affected call site, so a worst-case line costs roughly 29 ms. Nothing caps how
  many such lines one file may hold, so a hostile input makes the check slow
  rather than making it hang. docs/security-posture.md row 4.10 carries the
  full reasoning.