v0.15.0

0.15.0 (2026-10-06)

Features

• agents: require human approval to accept licenses; prefer unencumbered tools (#163) (a4179ca)
• data: canonical security scanner registry + NIST mapping (#155) [MERGE FIRST] (#157) (058ad89)
• docs: frontmatter crosswalk to Dublin Core / schema.org + guard (#209) (#213) (8685971)
• generate: add generated repo-root llms.txt for agent navigation (#212) (#218) (f717345)
• generate: landscape summary/phase + ROADMAP metrics from source (#142) (#196) (aa9aa0c)
• generate: neutral document inventory from INDEX.yaml (#199) (#206) (c0d6ab4)
• generate: re-land framework registry + NCCoE casing fix (#198) (#223) (1ba74f8)
• generate: re-land TRACEABILITY control matrix from frontmatter + NIST OSCAL (#197) (#221) (60313c0)
• meta: add CITATION.cff; stop calling the repo's own content 'guidance' (#214) (#219) (46ac233)
• validator: enforce doc freshness — optional stale_after + staleness check (#210) (#216) (042ad32)
• validator: guard prose count-drift + generate landscape/control counts (#184) (#188) (010c41f)
• validator: guard SECURITY-CONTROLS.md control-count integrity (#121) (#170) (44e0001)

Bug Fixes

• ci: bump js-yaml override to 4.3.1 in linters (CVE-2026-59870) (#194) (2e77ad8)
• ci: bump js-yaml to 4.3.2 to clear a high-severity CPU-DoS advisory (#290) (e6d2968)
• ci: bump smol-toml to 1.7.1 to clear an infinite-loop DoS advisory (#291) (e557daf)
• ci: pin markdownlint-cli2 once, clear GHSA-253c, align the ruff rev (#296) (bf88af6)
• ci: promote pre-deploy to gating via per-line self-scan marker (#263) (#272) (cdf4653)
• ci: repair Link Check — OWASP agentic URL + relative-path/403 config (#220) (6fd93d7)
• ci: replace markdownlint-cli2 with markdownlint-cli (#304) (7d0f4b3)
• config: enforce mandated size/complexity limits; drop vestigial FRAMEWORK_VERSIONS (#261) (#274) (d5ba978)
• contract: copied probe recognizes inline flow-mapping frontmatter (#154) (#190) (f162a9d)
• contract: fail closed when the provisioned contract isn't the universal one (#262) (a726bdb)
• contract: reconcile contract version to 1.0.0 + guard against drift (#191) (#192) (bd940a3)
• deps: commit uv.lock + require lock files to be git-tracked, not just present (#271) (0daa0da)
• deps: resolve npm audit highs in CI linter deps (#164) (1be25ec)
• docs: correct automation self-docs + guard contract-probe drift (#250, #251) (#275) (45f3a80)
• generate: generate AGENTS.md nist_controls from body citations (#238) (#277) (d6d1045)
• generate: generate PLAYBOOK skill table + fill em-dash word-counts (#254, #256) (#276) (9bca89a)
• landscape: make FEDERAL-AI-LANDSCAPE.md freshness date evergreen from the registry (#142) (#229) (cd75062)
• landscape: scope Federal Register query + source-aware relevance gate (#182) (#195) (cae911f)
• new-project: catch backtick dangling refs + exclude playbook-doc navigators (#189) (#201) (89b9f4a)
• skills: add symlink fallback resolution for playbook-source refs (#287) ([94be9b9](94be9b9fe1...

v0.14.1

0.14.1 (2026-07-21)

Maintenance

• deps: bump actions/setup-node from 6.4.0 to 7.0.0 (#158) (5597ac9)
• deps: bump ruff from 0.15.20 to 0.15.21 (#159) (6eb55c4)

v0.14.0

0.14.0 (2026-07-07)

Features

• eliminate playbook drift in generated projects (#144) (4479561)

Maintenance

• deps: bump actions/setup-python from 6.2.0 to 6.3.0 (#149) (b6d1ea0)
• deps: bump ruff from 0.15.18 to 0.15.20 (#150) (6500e64)

v0.13.0

0.13.0 (2026-06-30)

Features

• landscape: add agency_report category + source-code/IP/provenance entries (#141) (540a548)

Documentation

• agents: add work-tracking, e2e-validation, and plan-proportionality disciplines (#131) (0bcab52)
• policy: add canonical AI-Assisted Contribution Policy (#143) (a7300a2)

v0.12.1

0.12.1 (2026-06-29)

Bug Fixes

• docs: use canonical 'Co-authored-by:' casing so GitHub links co-authors (#133) (5335350)

Maintenance

• ci: add scripts/ci-local.sh to run the CI gate locally (#138) (d421669)
• deps: bump actions/checkout from 6.0.3 to 7.0.0 (#134) (03844aa)
• deps: bump pytest from 9.1.0 to 9.1.1 (#137) (24bf0b5)
• deps: bump ruff from 0.15.17 to 0.15.18 (#136) (fd5de21)
• deps: bump zizmorcore/zizmor-action from 0.5.6 to 0.5.7 (#135) (e59be37)

v0.12.0

0.12.0 (2026-06-23)

Features

• docs: add Laziness Ladder simplicity guidance + ADR (ponytail-inspired) (#126) (ef56304)

v0.11.4

0.11.4 (2026-06-22)

Documentation

• add missing docs to index; correct control count to 35 (#123) (b6a85de)

Maintenance

• remove redundant root CODEOWNERS; consolidate to .github/CODEOWNERS (#125) (2782868)

v0.11.3

0.11.3 (2026-06-22)

Maintenance

• deps: bump pytest from 9.0.3 to 9.1.0 (#115) (c351875)
• deps: bump ruff from 0.15.16 to 0.15.17 (#119) (7d47db8)
• deps: pin js-yaml 4.2.0 + markdown-it 14.2.0 in linters; add npm dependabot coverage (#117) (0fdf9dd)

v0.11.2

0.11.2 (2026-06-17)

Documentation

• security: remove secret literals from credential examples (#113) (f06ed5c)

v0.11.1

0.11.1 (2026-06-12)

Documentation

• codify PR-title Action as commit-validation standard + squash-merge preference (#109) (aaf68b3), closes #108
• fix accuracy issues from cross-repo docs review (#111) (9aa432f)