v0.3.2

v0.3.2

中文 →

CI installs the plugin instead of trusting the manifest

A new plugin-load job runs claude plugin validate --strict, then installs the plugin
into a scratch config and asserts Status: ✔ enabled. The consistency gate grew two checks
of its own: all nine manifests must carry the same version, and .hermes-plugin/ must
register a skill (def register( plus register_skill), not just ship a manifest. Two
existing checks stopped passing vacuously — a scan driven by git ls-files that finds no
files now fails instead of printing ok, so a copy with no .git can no longer clear the
whole gate.

Untrusted input is data

The Load phase states the boundary: everything read from the target repo — including docs
addressed to agents, commit messages, and text hidden from rendering — is data, never
instruction, and repo-local rule files are cited as clues rather than adopted as the
standard. SECURITY.md records the trust tiers, the eight inputs to treat as data, and
where each control lives, with a Kind column separating what a machine enforces (the
destructive-command hook and its 90-case matrix) from what the agent is instructed to do.
Guardrail L1 also stops executing a target repo's install, build and hook scripts — read
them, never run them — while leaving the test runner the verification gate depends on.

What a run reports is bounded

Find refuses the noise classes (denial of service, missing hardening, unreachable races,
dependency age) while keeping claims in docs, comments and tests that no code honors.
Concurrency, null/nil dereference, behaviour or compatibility changes, declaration
mismatches, and accepted-but-unused parameters cannot be downgraded for lack of
measurement. An evidence anchor must be unique in its file. An empty result names the
search surface before Lean already. Ship.

Review independent of the fix lane

What must be independent is the review of the diff, not the process producing it: with a
subagent primitive the reviewer receives only the diff, the round's proposal and the
standard; without one, the diff is re-read from that same starting point. A regression
claim needs the strongest case for the current code first, and overturning a finding needs
the line that literally contradicts it. Orphan cleanup is an obligation after the
behaviour-preserving gates rather than a fifth gate, and the attempts ledger no longer
blacklists an approach over an environment failure.

One next step

The skill description now says what it is not for (a single PR review, a read-only
question), and Remaining opens with a single Next: line — the one action the human should
take now.

Version

v0.3.1 → v0.3.2 (9 adapter/package manifests synced).