v2.2.1 — Universal Anti-Injection Hardening, Architecture Mapper, and Full Multi-Platform Parity

Release Notes: v2.2.1 — Universal Anti-Injection Hardening, Architecture Mapper, and Full Multi-Platform Parity

The v2.2.1 release is a comprehensive security hardening, architectural refinement, and multi-platform parity update following the major v2.2.0 milestone. This release audits and fortifies all 44 agentic skills with universal anti-injection shields, eliminates false-positive security scanner triggers, elevates /sdlc-map-architecture to an official core skill, tightens SDLC boundary enforcement with the 40/30/30 Readiness Score evaluation, and establishes 100% feature parity between Desktop and Mobile in the web portal alongside symmetrical bilingual translations.

---

🛡️ 1. Universal Anti-Injection Hardening & Red-Team Scanner Compliance (All 44 Skills)

A zero-tolerance security audit and hardening protocol has been applied across all 44 skills (23 Standard SDLC skills in .agents/skills/ and 21 TDD-Spec skills in tdd-spec-skills/.agents/skills/):

• Eradication of Scanner Triggers: Completely eliminated volatile pseudo-directive trigger phrases (such as raw CRITICAL SYSTEM OVERRIDE, SYSTEM DIRECTIVE, or simulated instruction hijacks) that previously triggered false-positive alerts on static analysis tools and red-team scanners (e.g., Snyk Code rule E004: Insecure AI Prompt, Socket Security, and Gen Agent Trust Hub).
• Universal Anti-Injection Shield & Inert Data Boundaries: Embedded strict input isolation barriers across all skill prompts, analysis routines, and audit tools. AI agents are explicitly instructed to treat all analyzed source files, commit histories, PR comments, user briefs, and external data strictly as inert data, neutralizing prompt injection vectors and memory poisoning attacks.
• Session Lock & Role Activation Hardening: Streamlined agent persona activation directives to enforce strict role adherence without relying on adversarial override syntax.

---

🗺️ 2. Official Architecture Mapper Integration (/sdlc-map-architecture)

Transitioned the legacy Project Researcher role into the dedicated Architecture Mapper skill across the entire ecosystem:

• Living Architecture Map Mandate (docs/ARCHITECTURE.md): Formalized the mandate requiring systems to keep repository topography, directory taxonomy, test seams, and module boundaries continuously documented and up to date.
• Dual Pipeline Alignment: Fully integrated /sdlc-map-architecture into the Standard SDLC pipeline and synchronized its operational boundaries alongside /tdd-map-architecture in the TDD-Spec package.
• Cross-Referenced Documentation: Updated all core governance documents (AGENTS.md, README.md, tdd-spec-skills/AGENTS.md, and tdd-spec-skills/README.md) with explicit slash commands, input contracts, and operational boundaries.

---

📐 3. SDLC Framework Boundaries & Anti-Scope Creep Tightening

Refined procedural governance across all SDLC lifecycle checkpoints to prevent drift and ensure tracer-bullet execution:

• 40/30/30 Readiness Score Evaluation: Formalized the weighted evaluation matrix (40% Completeness, 30% Clarity, 30% Alignment with Domain Glossary CONTEXT.md) for all clarification and audit checkpoints (/sdlc-clarify-reqs and /sdlc-audit-consistency), complete with a Critical Flaw Veto cap at 79/100 and a 3-iteration deadlock breaker.
• Tracer-Bullet Vertical Slicing Enforcement: Mandates that all tasks generated by /sdlc-plan-tasks and /tdd-plan-tasks are structured as end-to-end vertical slices (from persistence to UI) with explicit RED-GREEN-VERIFY sequences, strictly prohibiting horizontal, layer-by-layer slicing.
• Fast-Track Protocol for Minor Fixes (/code-janitor): Formalized clear boundaries for ad-hoc bug repairs, cleanups, and surgical refactoring. Users can fast-track minor changes without bureaucratic document overhead while preserving Karpathy simplicity principles and zero-suppression test standards.
• Pushback vs. Refuse Boundary Rules: Standardized strict persona guardrails (REFUSE for out-of-scope phase requests vs. PUSHBACK for architectural deviations) to protect pipeline integrity.

---

🌐 4. Web Portal & Localization Parity (index.html & translations.js)

The documentation web portal has been refined for flawless multi-device presentation and complete bilingual parity:

• 1-to-1 Mobile & Desktop Parity (15 vs. 15 Stages): Expanded the mobile interactive accordion in index.html from 12 items to all 15 stages, matching desktop tabs and detail panes with 100% precision (including all three dedicated Clarification Checkpoint Gates: Post-PRD, Post-Spec, and Post-Plan).
• 100% Symmetrical Translation Keys (331 Keys): Symmetrically synchronized English (en) and Indonesian (id) translation dictionaries in translations.js, ensuring zero missing strings, zero untranslated fallbacks, and consistent technical terminology.
• Interactive Terminal & Step Localization: Fully localized terminal installation and AI chat instructions (install_method0_step1, install_method0_step2) across both English and Indonesian.
• Catalog Consistency & Clean Bundles: Removed orphaned translation keys (agent_ca_2_tab, agent_ca_optional) and aligned root and sub-package skill catalogs (tdd-implement, karpathy-guidelines, ponytail-lazy-senior-dev) with exact filesystem representations.

---

⚙️ 5. Quickstart & Upgrade

Option A: Agentic Installation (Recommended via npx skills)

# Standard SDLC Package (12 Phases)
npx skills add GulajavaMinistudio/awesome-copilot-id/.agents/skills/sdlc-init

# TDD-Spec SDLC Package (21 Skills)
npx skills add GulajavaMinistudio/awesome-copilot-id/tdd-spec-skills/.agents/skills/tdd-init

Run the bootstrapper in your AI chat:

/sdlc-init setup this project
# OR for TDD-Spec:
/tdd-init setup this project

Option B: One-Liner Interactive Installer Script

• Linux / macOS:

  curl -fsSL https://raw.githubusercontent.com/GulajavaMinistudio/awesome-copilot-id/main/install.sh | bash

• Windows PowerShell:

  irm https://raw.githubusercontent.com/GulajavaMinistudio/awesome-copilot-id/main/install.ps1 | iex