v1.2.0 — the main path, rebuilt and tested

The story skills are rebuilt around shared helper scripts, a read guard stops whole-file reads of large design docs, the engine references move to Godot 4.7 and Unreal Engine 5.8, and no skill pre-approves every shell command any more. A minor release after 1.1.3.

Highlights

• The main path is rebuilt. /start, /create-stories, /story-readiness, /create-epics, /dev-story and /story-done follow Anthropic's skill-authoring guidance: shorter, with rarely used branches in references/ and fixed steps handed to helper scripts, so the same question gets the same answer each time. /start works out the rigor from what you describe and shows it on one card. /create-stories proposes an S, M or L estimate for each story.
• Stories list their files, and evidence knows when its code changed. The new story template has a ## Files section: /create-stories plans it, /dev-story fills it and /story-done checks scope against it. /dev-story stamps a story's screenshots with the files they prove, and /story-done names any that changed since (#135, proposed by @jiangshoujie).
• A read guard for large design docs. A whole-file read of a doc over 40 KB under design/, docs/architecture/ or production/session-state/ is refused with the doc's headings, so the retry reads one section (#136, #140, suggested by @mamonbleau). It also ends the failed whole-ADR reads reported in #64 by @Shtruk. features.read_guard: off turns it off.
• Session start says when a newer release is out. One line, from at most one GitHub request a day made in the background; nothing about your project is sent. updates.check: false turns it off, and it is always off under CI.
• Engine references for Godot 4.7 and Unreal Engine 5.8. Unity stays on 6.3 LTS and lists 6.4 to 6.6 and the 6.7 beta. /test-setup writes current CI actions. Unreal 5.8 support was first proposed in #121 by @spirit986. Staying on Godot 4.6 or Unreal 5.7? Keep your current engine folder.
• Helper scripts and registry checks. New scripts in .claude/scripts/ read story facts, ADR status, a Markdown section, the stage and the session checkpoint for the skills. More ship for you to run (bug counts, sprint arithmetic, tech-debt scores, flaky-test rates and others), each with --help. registry.sh validates the three registries and hands out IDs that are never reused.
• Warnings for writes the skills never make, such as replacing an existing EPIC.md or project.godot, crossing the prototype boundary or renumbering a registry entry. They warn and never block.
• /sprint-plan checks that the sprint goal can be shown and lists anything it needs that no story builds (based on an idea in #58 and #76 by @FreedomPortal).
• Fixes, among them: the commit check skips GDD copies in design/gdd/ subfolders such as archive/ (#133, reported by @mamonbleau); a repeated modes: key in project.yaml is merged and named instead of wiping the first; a multi-line value in project.yaml is read as text, never as settings; a stage never advances past a gate check that could not run; /architecture-review reuses a saved review only when nothing it read has changed, and single-gdd writes only that system; playtest records count as evidence from production/qa/playtests/; /sprint-plan never takes your answer to its QA-plan question as approval to write; in a Godot project, evidence screenshots under production/ are no longer imported or packed into an export. The full list is in the CHANGELOG.

Security

• Skills pre-approve only the commands they run. 34 skills had a bare Bash entry in allowed-tools, which let them run any shell command without asking in the default permission mode. Each now names its framework scripts and read-only commands. Anything else, including your commands.test, asks first: approve it once, or add Bash(<your command> *) to .claude/settings.local.json.
• Tagging, merging and deploying are flagged before they run. The push check also warns on git tag, git merge, gh release, butler push and steamcmd +run_app_build.
• Agents never file upstream. No agent files or comments on an issue or pull request in an engine, plugin or vendor repository, even when asked; it writes a draft for you to submit.
• The same .env protection with fewer rules, and the local settings template no longer suggests Bash(git *), which approves git push too.

Upgrading from 1.1.3

Take .claude/hooks/ and .claude/scripts/ whole, in the same step: the hooks call the new helpers, and a 1.1.3 yaml-helper.sh breaks /settings and the rebuilt skills. If you edited settings.json, add the four new hooks, remove the PostCompact entry together with post-compact.sh, and add worktree.baseRef: "head" (after a git merge, check these rather than adding them again); UPGRADING.md → v1.1.3 → v1.2.0 lists every merge. If you wrote skill specs, move them from CCGS Skill Testing Framework/ to studio-tests/. If a registry has an unquoted status: superseded_by: ADR-NNNN line, quote it; registry.sh names each one. In a Godot project, take production/.gdignore and delete the .import files Godot made under production/. Staying on Godot 4.6 or Unreal 5.7 and upgrading with git merge? The merge takes the new engine folder without a conflict; run git checkout HEAD -- docs/engine-reference/<engine>/ before you commit it. Run /architecture-review once before the Technical Setup → Pre-Production gate: reports from 1.1.3 count for nothing there. Expect a permission prompt the first time a skill runs a command it no longer pre-approves.

Tested on

• Platforms: Windows, Linux (bash 5 and 3.2) and macOS (bash 3.2 with BSD tools), with and without jq.
• Claude Code: live skill runs on 2.1.296, 2.1.302 and 2.1.303.
• Godot: gdUnit4 6.2.2 on Godot 4.7.2, locally and in the /test-setup CI workflow on GitHub Actions.
• Upgrading: both git routes rehearsed on a 1.1.3 project.

Full changelog: v1.1.3...v1.2.0