v1.1.0 - Portable plugin

Cloudflare Maxxing can now be installed once and used from any Claude Code or Codex project.

Added

• Installable Claude Code and Codex plugin manifests and repository marketplaces.
• A self-contained Cloudflare skill with its runner, reports, reference catalog, dashboard, and guarded actions.
• Read-only pull-request CI for tests, dependency audits, and the dashboard build.

Changed

• Portable credentials and generated state now live only under <host-project>/.cloudflare-maxxing/.
• The host project's .env, packages, source, and deployment flow stay untouched.
• README, safety docs, token setup, architecture, and the landing-page onboarding are plugin-first.

Verified

• 26 regression tests pass.
• Root and dashboard dependency audits report zero vulnerabilities.
• Skill and plugin validators pass.
• A copied skill initializes and builds its dashboard on Windows.
• The candidate secret and machine-path scan reports zero findings.

v1.0.0 - First public release

v1.0.0 - 2026-07-24 - First public release candidate

Added

• Read-only snapshots with a committed pseudonymized sibling and a local alias vault.
• A 61-check findings report, change attribution, account diffs, plan-limit tracking, and beta
  feature recommendations.
• A local dashboard and a public landing page.
• Guarded action scripts that default to dry-run and require a separate edit token plus an
  explicit break-glass phrase for mutations.
• Claude Code and Codex hooks, Cloudflare-focused agent profiles, and a portable AGENTS.md
  operating contract.
• Node regression tests for pseudonymization, API retry rules, action subprocess isolation,
  fail-closed audit logging, GitHub workflow permissions, site headers, and Codex hook paths.
• Contributor, security, conduct, issue, and pull-request templates for public collaboration.

Security

• Pseudonymized numeric GitHub identifiers and case variants inside structured strings.
• Replaced write-shaped capability probes with read-only permission introspection.
• Limited retries to GET, HEAD, and OPTIONS requests.
• Prevented edit-token inheritance by install, build, and general shell subprocesses.
• Required the action audit record to persist before break-glass can arm.
• Moved dry-run discovery to the read client and delayed edit-token loading until --commit.
• Pinned Wrangler and GitHub Actions dependencies.
• Added CSP, HSTS, Permissions-Policy, MIME-sniffing, referrer, and clickjacking headers.
• Removed account-specific resource names and operator addresses from public action source.

Changed

• The daily snapshot workflow now uploads a public-only artifact and opens a pull request from
  a second job that has no Cloudflare credentials.
• Dashboard tooling now uses Vite 7.3.6 and reports zero known dependency vulnerabilities.
• The landing-page supporting copy uses true white at weight 500 for better readability.
• Public repository history is rebuilt from this release tree so old pull-request diffs cannot
  keep retired account data reachable.