v0.7.0

[0.7.0] - 2026-08-08

Added

• uninstall, the command that was missing. Driven by the lockfile, so it
  removes what it installed and nothing else: detached artifacts stay, a
  *.pre-install.bak is restored over the file the install overwrote, and only
  the hook commands it wired are dropped from settings.json. An artifact
  carrying local edits is kept as *.pre-uninstall.bak rather than dropped,
  a detached hook keeps its wiring, and the .adopted manifest is rewritten to
  the rules that survive. --dry-run lists the removal without performing it.
• The lockfile is validated at the parsing boundary, so every command
  refuses a malformed one instead of one command only. It is a committed file
  in the target repository, so hook:../../../something was a path traversal
  waiting for the first command that deletes on its strength, check --strict
  died in CI with a bare stack trace, and install copied a bad token forward
  into a fresh lockfile. An unreadable lockfile is also no longer reported as
  an absent one, which told users there was nothing to uninstall while their
  .claude/ was full.

Changed

• The CLI is split under src/ (paths, lock, catalog, detect, settings,
  selector, uninstall); install.ts keeps the commands and the argument
  parsing, and re-exports what importers used to get from it.
• The README is organized around what each artifact is for rather than around
  the architecture, with the full skill catalog moved to
  docs/catalog.md and the mechanics to
  docs/distribution-model.md and
  docs/quality-bar.md.

Fixed

• The issue #1 regression guard had stopped guarding anything. It asserted
  that install.ts contains no cpSync, which became vacuously true once
  copyPath moved to src/lock.ts. It now scans every installer source.
• docs/chardon/ shipped in the npm tarball. The files entry docs/
  overrides .gitignore, so local workflow reports, absolute paths included,
  were published with the package.
• tests/*.ts are now typechecked (they were outside the tsconfig.json
  include), which surfaced three unsound casts.
• A batch of documentation claims that no longer matched the code, mostly in
  docs/adopting-a-repo.md, docs/architecture.md and docs/developing.md.

v0.5.3 - a hook is never alone on its event

truncate-output replaced the command it wrapped with an opaque base64 blob. Anything reading updatedInput downstream got that blob: other plugins watching the same PreToolUse event, the transcript, the logs.

The original command now travels as a trailing shell comment:

TRUNCATE_CMD_B64=<b64> node '<hookDir>/truncate-bash-output.mjs' # git log

A shell comment runs to end of line and absorbs quotes and apostrophes without interpreting them, which a leading : 'cmd'; prefix does not.

Bounded git log and git diff are no longer wrapped at all: with --oneline, --stat, --name-only or a count, their output never reaches the truncation threshold, so rewriting them cost readability and broke composition for nothing.

The lesson is now a written rule in hooks/README.md and AGENTS.md: this toolkit installs alongside other plugins observing the same events, but every test until now ran its hooks alone. A hook that rewrites a command must preserve the original in readable form, must not rewrite when the rewrite buys nothing, and must never mask an exit code through a pipe.

Reported by a user running it next to another plugin. Thanks.

v0.5.2 - fix the README shown on the npm page

The README published with 0.5.1 still said "The package is not on npm yet", so the registry page told visitors the package they were reading about did not exist. It now carries a version badge and links back to the project.

No behavior change: if you are on 0.5.1, the hooks already work. This release only fixes what npm displays.

npx ronce-racine install .

v0.5.1 - two shipped hooks were silently dead

If you installed 0.5.0, upgrade. Two of the three hooks it ships never ran: their entry guard tested for a file extension the built output no longer has, so they exited 0 doing nothing. Nothing signalled the failure.

Installed into .claude: 11 rules, 21 skills, 1 scripts, 2 agents, 3 hook(s).
Lockfile: .claude/.ronce-racine.json (ronce-racine@0.5.1) - drift via 'ronce-racine check .'
Rules manifest: .claude/rules/shared/.adopted (11 rules)

Wired 3 hook(s) into .claude/settings.json.
(details: .claude/hooks/README.md)

Review the diff then commit (.claude/ travels via git → team + CI).

Fixed

• Two shipped hooks were silently dead. truncate-output and
  truncate-bash-output guarded their entry point on a .ts extension the
  built .mjs no longer has, so main() never ran: the hook exited 0
  producing nothing, and nothing signalled the failure. The truncate wrapper
  also pointed at a .ts helper the package does not ship.
• hooks/README.md, which ships into every adopting repo, still described the
  pre-0.5.0 wiring: it claimed the target needed tsx and showed
  npx tsx .../hook.ts in every example, while the installer now writes
  node .../hook.mjs.
• The Requirements section overstated "Node only": hooks do run on plain Node,
  but the optional detection scripts still ship as TypeScript and need tsx.

Added

• tools/skills.ts docs, wired into npm test: compares the documentation
  against what the installer actually generates, so a doc describing a past
  behavior fails the build instead of reaching users.
• The doc-code-parity rule, and builtHook() in the test harness: assertions
  about shipped behavior now run the built artifact, not the source. The
  mutation harness rebuilds when it mutates a build input, so a stale build can
  no longer disguise a real defect as a false positive.

v0.5.0 - adoption without a clone

Installing the toolkit no longer requires cloning this repository.

npx ronce-racine plan .      # read-only: what fits this repo, and why
npx ronce-racine install .

A target repo now needs Node and nothing else: the CLI and the hooks ship
built, so tsx is no longer imposed on adopting projects. Hooks also got 15x
faster to fire (527 ms to 34 ms) by no longer compiling TypeScript on every
invocation.

Not on npm yet. This release prepares the package; publishing is a separate
step. Until then, clone the repo and run npx tsx install.ts plan . from it.

Adoption stops requiring a clone.

Changed

• Adoption no longer needs a clone: npx ronce-racine install .. The
  lockfile records the package version and a content hash instead of a git
  SHA, so check detects a canonical source that changed under the same
  version number. Lockfiles written by the clone-era installer keep working.
• The anti-drift CI template drops the pinned clone for a single
  npx ronce-racine@<version> check . --strict.

v0.4.0 - target repos stop receiving toolkit docs

Changed

• A target repo no longer receives the toolkit's own documentation. Skill
  README.md pages describe THIS repository, so shipping them put roughly
  1300 lines of irrelevant prose into every adopting repo's .claude/. They
  now stay canonical, alongside *.test.ts and eval.yaml. The one deliberate
  exception is hooks/README.md: hooks execute on the target's machine, so
  documenting what runs there is transparency rather than clutter.

Added

• Drift guards for the human documentation layer, which nothing watched before:
  every rule must have a docs/rules/ page whose stated version matches the
  rule and which links the canonical artifact, and every skill must have a
  README.md that links its SKILL.md. Orphan pages documenting a deleted
  artifact now fail the build.

v0.3.0 - evaluated skills, tidied layout

All 34 skills now carry an evaluation manifest and every one of them has been
played through a real agent inside a throwaway fixture: 34/34 pass. The layout
was tidied at the same time, and the deprecated rules.ts is gone.

The most useful thing this release produced is a rule, learned the hard way
over six failing runs: a repo_clean allowlist only fits read-only skills.
A skill that builds something legitimately produces files nobody can enumerate
upfront (tests, configs, adapters, CI jobs, probe scripts), so the allowlist
never converges and each run punishes the agent for obeying its own skill.
Gate the invariant instead - what must not happen.

Added

• docs/developing.md: working on the toolkit itself - repo map, what each
  harness actually protects, the playground, and how to add every artifact
  type (hooks and agents had no guide at all).
• A header illustration on the README.

Changed

• The internal harnesses (skills.ts, tests.ts, mutations.ts, eval.ts)
  moved to tools/. install.ts, the only user-facing entry point, stays at
  the repo root.
• templates/ split by audience: it now holds only what a CONSUMER copies
  into their repo, while the artifact skeletons a CONTRIBUTOR starts from
  moved to docs/templates/.
• docs/writing-a-skill.md rewritten against the current contract. It
  described the pre-0.2.0 world, so a contributor following it produced a
  skill that CI rejects: no mention of the required eval.yaml, the per-skill
  README.md, the bilingual quoted triggers, or the test procedure that any
  script must ship.
• bug-triage-structured 1.1.0 and adversarial-feature-challenge 1.1.0:
  two protocol steps that evaluation runs showed agents skipping (the
  recurrence check, the persona switch) are now mechanical - a command to run
  and a count to state, rather than an instruction to remember.

Fixed

• templates/SKILL.template.md was still entirely in French and carried a
  frontmatter GitHub could not parse (an unquoted colon), so the repository
  home rendered a YAML error banner. Both are now guarded by
  tools/skills.ts templates, wired into npm test.
• Evaluation manifests no longer punish an agent for obeying its own skill:
  build output and dependency lock files are pruned from the snapshot, and
  repo_clean's except accepts a name-* prefix glob for skills whose
  deliverables cannot be named upfront (one ticket per finding).
• The writing-robust-tests fixture can actually run a test suite offline
  (node --test, nothing to install), so the "see it red, then green"
  discipline the skill demands is demonstrable rather than impossible.

Removed

• rules.ts, deprecated since 0.1.x and superseded by
  install.ts install <repo> --rules-only.

v0.2.0 - the toolkit can now test itself

The toolkit can now test itself, at every level: its code, its detection
scripts, and the behavior its prose skills are supposed to produce. Plus the
post-release audit fixes from a full-repo sweep.

Added

• Skill evaluation harness (eval.ts): plays a skill through headless
  claude -p inside a throwaway fixture, then verdicts it with mechanical
  gates derived from the skill's own exit conditions, plus an adjunct LLM
  judge for what stays subjective (a judge verdict without a verbatim
  quote as evidence is downgraded to a failure). Verdicts: PASS, FAIL(gate),
  JUDGE-FAIL(criterion), ERROR(infra, never a regression).
• An eval.yaml manifest for every skill (34/34), co-located with the
  skill. Closed gate vocabulary: file_exists, file_absent, grep_zero,
  grep_count, repo_clean, transcript_contains, transcript_absent,
  exit_ok. Manifests stay canonical and are never distributed to targets.
• npm run eval:dry validates every manifest with no agent call, no network
  and no auth - wired into CI. Real runs (eval.ts run [--only <skill>]) are
  on demand and before a release, never per push.
• Mutation harness (npm run test:mutation): 14 declared mutations must
  each turn their covering tests red; a surviving mutation fails CI.
• install.ts --pick <token...> installs exactly the named artifacts.
• Playground fixtures with planted defects and an EXPECTED.md ground truth:
  flawed-app, buggy-app, shipped-feature, design-system,
  audit-target.
• CI matrix on Node 18 (the documented minimum) and 22.
• docs/evaluating-skills.md.

Changed

• Test harness split by domain (tests/) plus one co-located test procedure
  per executable skill script (skills/<skill>/scripts/*.test.ts); 80 tests.
  *.test.ts files are never distributed to target repos.
• bin now points at install.ts. Anyone who linked the package got the
  deprecated rules.ts CLI before this release.
• The interactive selector's keyboard logic is a pure, unit-tested reducer;
  the TTY shell only does I/O.
• Em dashes replaced with plain punctuation across the toolkit.

Fixed

• CI now triggers on main, the public default branch. It previously only
  listened to master and therefore never ran on the public repository.
• Installer: pre-existing artifacts are backed up to *.pre-install.bak on
  first install instead of being silently overwritten (data loss); a
  settings.json whose hooks section has an unexpected shape no longer
  crashes mid-install; a truncated scan is announced instead of silently
  missing deep signals.
• Audit suite: every domain scores with the flat mean defined in
  scoring-model.md (dead weight formulas removed); orchestrator
  contradictions resolved; performance-frontend restored in $ARGUMENTS.
• worktree-env-setup hook: broken .env symlinks are repaired.
• subscription-leak-scan.ts and templates/.adopted.example translated to
  English; docs no longer recommend the deprecated rules.ts sync;
  package.json description translated and engines declared.

v0.1.0 - first public release

First public release (pre-1.0: the API and artifact set may still change).

Added

• MIT LICENSE, CONTRIBUTING.md, CODE_OF_CONDUCT.md, SECURITY.md.
• GitHub Actions CI running typecheck + the validation harness.
• A human documentation layer: a README.md per skill and a docs/rules/<name>.md per rule.
• Bilingual (English + French) invocation triggers on every skill.
• Deterministic behavioral tests (tests.ts) exercising the installer (plan/install/check/detach, drift, detached preservation, settings.json merge, --rules-only) and the hooks - wired into npm test.
• install.ts --rules-only (rules-only distribution under the unified lockfile drift).
• The installer now auto-merges hook wirings into .claude/settings.json (deep-merge by event/matcher, idempotent, settings.json.bak backup, preserves unrelated settings) instead of printing a snippet to hand-merge.

Deprecated

• rules.ts (sync/check) - superseded by install.ts --rules-only; still works, prints a notice, to be removed later.

Changed

• Public rebrand to Ronce Racine; the whole public repo is now English-facing (US spelling).
• Example project names in routing hints are fictional (acme-app, beta-app).
• Trimmed duplication in the per-skill READMEs (SKILL.md stays the source of truth for the steps).

Fixed

• Installer no longer overwrites detach-ed (customized) artifacts on re-install; check no longer crashes when a canonical file was removed upstream.
• session-inject now uses the correct SessionStart output schema (nested additionalContext); session-precompact persists the memo instead of an ineffective systemMessage.
• bash-npm-silent preserves the real exit code (no output pipe) and only touches a bare npm install/ci; truncate-output runs via npx tsx (any Node) and no longer conflicts with it.
• Anti-drift CI template pins the canonical clone to the lockfile SHA, avoiding false-positive drift.
• Broken README cross-links, false changelog clauses, and untranslated leftovers.

Removed

• Internal design/spec documents that were specific to other projects.

Baseline (pre-OSS, 2026-06-19): 34 skills, 12 rules, 8 hooks, 2 agents and the install.ts CLI, validated by the npm test harness.