v6.1.5

v6.1.5 — 2026-06-15

Kickoff-hardening + config-auto-scaffold + observability release (#147), extended
with two new capabilities — #148 supervised self-heal and #146 capability
auto-discovery — plus a reliability follow-up that repairs the
operator-signaling inversion (the planter under-asked while the shepherds
over-asked), the "Workflow tool is always present" overclaim that made
web/remote sessions give up instead of degrading, and two latent namespace/DB
defects the new kickoff wiring exposed.

Authorized supervised self-heal — AUTONOMOUS-SENTINEL (#148)

• New loop template (references/loop-templates.md §AUTONOMOUS-SENTINEL) +
  binding doctrine (doctrines/autonomous-sentinel.md) for authorized
  supervised autonomy — the supervised-remediation superset of SOAK-LOOP.
  Stages: PROBE (seeded acceptance predicates, live) → CLASSIFY
  (HOLD/REGRESSED/NEW) → ACT (dispatch a ≤S @coder hotfix through the existing
  hotfix-dispatch ladder → gates-before-deploy → re-probe) → TERMINATE (K clean
  ticks / N-HF cap / hard-stop). Hard rails: gates-before-deploy, ≤S / ≤3
  concurrent / ≤N total HF caps, no destructive DB ops, auto-rollback on red,
  paper-only (never flip to live without authorization), operator-override-each-
  tick, full audit trail.
• New config key [close].autonomous_sentinel (default "off" — detection-only).
  It must be "on" AND the seed must declare close: autonomous-sentinel AND a
  complete sentinel_rails block must be present before a single remediation
  fires (three independent opt-in gates). New halt codes SENTINEL-RAILS-MISSING
  / -SCOPE-EXCEEDED / -HF-CAP / -ROLLBACK / -HARD-STOP / -LOOP-CAP.
• Reconciled the depth-3 "remediating inside a watch loop" anti-pattern in
  references/loop-templates.md §SOAK-LOOP and doctrines/outcome-enforcement.md §Seam 4: detection-only stays the DEFAULT and the anti-pattern for the
  UNAUTHORIZED case; the explicitly-authorized AUTONOMOUS-SENTINEL case is carved
  out.

Capability auto-discovery (#146)

• Shepherd now auto-detects the Claude Code plugins/skills available in the
  environment and adapts without operator wiring. A cheap, one-time-per-session
  SessionStart probe (hooks/scripts/capability_discovery.sh) enumerates
  installed plugins + skills and writes an EPHEMERAL capability roster
  (<ns>/cache/discovered-capabilities.json, gitignored) kept strictly distinct
  from the operator-curated toolkit.json — discovery never overwrites intent.
  The roster is merged at read time into the [TOOLKIT] surfaces (SessionStart
  roster + engineer/coder/planter brief injection via the new shctx toolkit discovered), labeled auto-discovered and bounded at 12.
• New doctrine doctrines/capability-discovery.md codifies the guarded-integration
  pattern ("if /remember is available → use at handoff/CLOSE-FINALIZE + resume,
  else shepherd-native"; same for superpowers, pr-review-toolkit), so behavior
  degrades cleanly when a plugin is absent — shepherd never hard-depends on a
  third-party plugin.
• The probe also records whether the native Workflow tool is present;
  web/remote sessions that omit it degrade to in-context Agent(...) fan-out
  instead of giving up (cross-referenced in references/glossary.md).
• New config key [discovery].auto_capabilities (on default | off), resolved
  via cfg_get (local → project → XDG-global precedence). Zero hot-path cost,
  fail-open.

Seed-optional kickoff (#8)

• /shepherd:start (Step 0) and /shepherd:spawn (Hard-stop #2 / Check 6) no
  longer hard-refuse on a missing seed for a single --scope sprint run: derive
  the objective from the repo/issue ledger, or ask ONE batched kickoff question,
  then run — per doctrines/operator-signaling.md §"Seed is recommended, not required". --parallel and multi-sprint --scope patch|minor|version walks
  still HARD-refuse (seeds are load-bearing there for collision detection + walk
  enumeration).

Config auto-scaffold (#15)

• New shctx config init scaffolds .claude/shepherd.toml from the bundled
  minimal template when absent (idempotent): derives [project].name (git
  remote → cwd basename) and [gates] (Cargo.toml→cargo, go.mod→go,
  pyproject/setup.py→pytest+ruff, package.json→npm), and realigns [paths] to
  the active shctx namespace. Adds shctx config get/show/path.
• Wired at kickoff: start/spawn root scaffold → [CONFIG] notice → PROCEED
  (action-biased); plant scaffold → ONE batched AskUserQuestion to refine
  [branching]+[gates] (replaces the #120 hard STOP).

Observability dashboard (#13)

• New shctx dash — a one-glance, read-only sprint snapshot composed from
  primitives the root already maintains (focus, graph state, live teammates,
  unread mailbox, open escalations, active loops, GitHub cache freshness). No
  new table/subsystem; bash-3.2-safe; degrades cleanly on missing DB/tmux.
  Monitoring recipe: /shepherd:loop <interval> shctx dash.

Four config toggles (#10)

• shctx config get <key> [default] is the uniform resolver (local→project→XDG)
  the toggles read through. Defaults reproduce pre-v6.1.5 behavior exactly:
  [autorun].on_grade_floor (abort), [autorun].inter_sprint_pause (brief),
  [spawn].max_parallel (4), [spawn].dashboard_cadence (3m). The
  previously-undocumented [autorun] section is now in docs/configuration.md.

Neutralized the bundled example (#9) + subagent-preference (#11)

• examples/axiom/ → examples/rust-service/; scrubbed all domain-specific
  references (finance/polymarket/geo-block) from the example and ~23 doctrine
  teaching snippets. geo-block-law.md rewritten as a generic
  regulated-upstream-API teaching example. Historical .artifacts/ docs are
  intentionally left intact.
• doctrines/agent-excellence.md Rule 6 (token-conservation / subagent
  preference) is now wired into every agent profile.

Reliability follow-up — operator-signaling inversion

doctrines/operator-signaling.md (v6.1.4) was correct, but its posture was
never reproduced into the agent profiles that actually become system prompts at
runtime. AskUserQuestion is granted correctly in every profile — the inversion
was a prose-propagation gap, not a tools-grant bug:

• agents/planter.md: added a standing "the planter asks freely" posture at
  the top of plant mode (previously the ONLY trigger was the rare no-config
  bootstrap branch, so the common case invented answers instead of asking).
• agents/conductor.md: SOLO = AskUserQuestion is a narrow escape valve only;
  TEAMMATE mode MUST NOT call it (the MODE-MISUSE halt code now names the
  tool).
• agents/shepherd.md: root action-bias note — the defined gates are the only
  operator stop points; no invented mid-run confirmation asks.

Reliability follow-up — the Workflow tool is NOT "always present"

• references/glossary.md listed the native Workflow tool alongside
  Agent/Bash/Edit as always-present and blamed any absence solely on "a
  build below the Dynamic Workflows floor." Claude-Code-on-the-web /
  remote-execution sessions omit it even on a supporting build, so a
  spawn/loop that reached for it gave up instead of degrading. Corrected to
  environment-dependent presence, with the visible-tool-list test as the
  only authority and degrade-to-Agent(...) as the documented path (ties into
  #146).

Reliability follow-up — two latent defects the kickoff wiring exposed

Both were invisible to the green suites (the harnesses set neither
CLAUDE_PLUGIN_ROOT nor a shepherd.db registry); #15's config-scaffold pulled
them onto the kickoff hot path:

• shctx_skill_root() returned bare $CLAUDE_PLUGIN_ROOT, but schema/ +
  references/ live at $CLAUDE_PLUGIN_ROOT/skills/context/. scaffold.sh's
  cp references/naming-conventions.md aborted under set -e, so shctx init/config init never created the DB and every downstream shctx command
  failed. Now prefers the dispatcher-exported SHCTX_SKILL_ROOT, else
  $CLAUDE_PLUGIN_ROOT/skills/context. Verified end-to-end (init exits 0,
  creates shepherd.db, copies CONVENTIONS.md).
• 9 hooks hardcoded $ns/root.db while v6.1.2+ shctx init creates
  shepherd.db, so [[ -f "$DB" ]] was always false → silent no-op, disabling
  the spawn-coordination guards (coordinate_drive_guard,
  worktree_teardown_guard, teammate_idle, …) on every modern project. New
  hook_db_path() in hooks/scripts/_lib.sh mirrors the skills-side
  shctx_db_path() (prefer shepherd.db, fall back to an existing root.db,
  default shepherd.db); all 9 assignments route through it.

Tests: hooks 38/38 (+1 for the #146 capability-discovery probe), context 42/42.