v1.5.0 - Zeroth

Changed

• Renamed the project to Zeroth. The plugin id is now zeroth (install with
  /plugin install zeroth), the skill lives at skills/zeroth/, the slash command is /zeroth, the
  spec is zeroth.md, and the repository is DouglasVulcano/zeroth-ai (site at
  douglasvulcano.github.io/zeroth-ai/). Update any marketplace add to DouglasVulcano/zeroth-ai.
  Existing installs should reinstall under the new name (/plugin install zeroth).

v1.4.0

Added

• Scaffolder branch-protection guidance is now ruleset-aware. It prints both the classic
  branch-protection command and a Ruleset command (POST /repos/{o}/{r}/rulesets), and a new
  --ruleset flag makes --protect create a ruleset instead of classic protection. Both paths warn
  that enforce_admins is not a status-check context (it is the enforce_admins field in the classic
  API and the bypass_actors list in a ruleset). SECURITY.md documents the ruleset equivalent. This
  closes the gap where hand-adapting the classic JSON into a ruleset could hang a PR at
  "Expected - Waiting for status to be reported".

v1.3.2

Security

• Pinned the repo's own CI action (actions/checkout) to a full commit SHA with a version comment,
  and added .github/dependabot.yml (grouped, weekly) to keep it current. SECURITY.md now states the
  posture accurately: this repo pins to SHA; scaffolded templates default to major-version tags
  (which receive patches) and can be pinned for the strictest posture.

v1.3.1

Added

• README (EN and PT-BR): a single "golden path" quickstart (scaffold, fill AGENTS.md, set
  CODEOWNERS, arm branch protection) plus a "this repo runs on its own standard" note pointing to
  the end-to-end fixtures. The branch-protection step flags the Ruleset gotcha (enforce_admins is
  not a status-check context).

v1.3.0

Added

• Scaffolder now arms the authoritative gate. scaffold.sh prints a branch-protection command
  (gh api ... /branches/<branch>/protection) personalized from the target's origin remote and
  default branch, and an opt-in --protect flag applies it (needs gh + a repo-admin token; honors
  --dry-run, confirms on a TTY). It also warns when the generated verify.yml is the generic
  placeholder, so you do not require a status check that verifies nothing.
• scripts/verify.sh covers the new scaffolder output (branch-protection guidance; --protect
  respects --dry-run).

v1.2.2

Fixed

• Quickstart: the global-skill install snippet referenced the wrong directory after git clone
  (cd ai-engineering-standards should be cd ai_engineering_standards), in README (EN and PT-BR).
• CHANGELOG accuracy: the v1.2.0 note overstated eval automation. CI validates the eval-suite
  structure via verify.sh; the evals themselves run manually (claude plugin eval).

v1.2.1

Security

• Hardened the Bash guard: it now also catches shell-wrapper evasion (bash -c, sh -c, eval),
  piping a download into a shell (curl ... | sh), and writing to secret files via redirection
  (> .env, id_rsa, *.pem, .git-credentials, .npmrc). Still fail-open, still a guardrail and
  not a sandbox.
• Scaffolded Node CI installs with --ignore-scripts; both CI templates document version and action
  SHA pinning.
• Added .github/CODEOWNERS and a "Threat model and trust boundary" plus "Repository hardening"
  section to SECURITY.md (branch protection, required Code Owner review, tagged releases).