v5.14.0

Added

• Every session names the goal beyond the goal (#1824, after Felix Rieseberg's "How to be more ambitious", Altitude): session-start derives an outcome for each Focus option (Dient: <outcome>; beobachtbar durch <measure>), never as a second question (AUQ-001.2); session-plan hands it to the wave-executor, which writes three flat STATE.md keys outcome-statement, outcome-observable, outcome-source via setOutcome; scripts/emit-session.mjs copies them into the sessions.jsonl record as outcome (plus observed, default not-measured) under the same ownership gate as session_profile, additive without a schema bump; the idle reset clears the keys; the vault session note and the session summary (### Outcome served) show it. The telemetry ping stays a closed whitelist, proven by a test on the real buildBatch path. Measured before the change: 0 of 252 real records (658 lines, 226 synthetic, 406 backfilled) carried an outcome.

• /deepen makes a task deeper, not bigger (#1825, Rieseberg's four Depth questions by reference to /plan Brief B): the skill fires on outcome-shaped requests (report, analysis, plan, audit, "go deeper"), bypasses ceiling words (nur, bloß, schnell, just, only, quick), one-step edits, short commands, bug fixes, prompt rewording and dispatched subagents with one Ambition check: bypassed (<reason>) line, shows an ### Ambition Rewrite block and stops until the operator confirms, then runs the judge per the new ## Judge order in skills/plan/prd-premortem-panel.md (executable check, held-out data, fresh-context reviewer, operator as acceptance only) and labels a result without one UNVERIFIED: kein Außenrichter (...) in the summary's ### Unverified section. Eval suite evals/deepen/ (7 cases, pass conditions fixed before the run, decision and action graded separately): with the plugin 5.63 of 6, without 3.44; the skill fired on its own in 6 of 6 expand runs and wrote no file there, the no-plugin arm wrote in 3 of 6.

• The public GitHub mirror carries only what users and the website need (owner decision queue #4923, #1594). The export policy gains an allow-list (include, policy version 2): the npm files set, the loader manifests, docs/, .claude/rules/, site/ with vercel.json (Vercel deploys from GitHub main) and the files GitHub CI and installers read. The root of the mirror goes from 57 to 38 entries; tests/, CLAUDE.md, AGENTS.md, .gitlab-ci.yml, .husky/ and other GitLab-only tooling stay on GitLab. One predicate decides for the snapshot removal, its post-check, verifyExportCommit and the leakage scan, and an exporter older than this change refuses a version-2 policy instead of publishing the wider tree.

• GitHub CI runs a plugin smoke on the slim mirror (npm run test:mirror, scripts/ci/plugin-smoke.mjs): plugin manifests, node --check over hooks/ and scripts/, every runtime dependency and the real SessionStart hook in an isolated environment. The required checks security, test (ubuntu-latest) and test (macos-latest) keep their names; the full suite stays on GitLab. The snapshot probe runs the same smoke on the exported tree.

• /plan new no longer stops without the private baseline (#1811). Without plan-baseline-path it offers the plugin's four bundled archetypes, scaffolds through the /bootstrap public fallback and skips the private setup scripts; a configured but broken baseline still aborts.

• Website: the FAQ sits beside a sticky intro from 960px, the guide and /commands use the full frame of the home page, and the guide has a contents list that marks the section being read (#1767). Three FAQ questions for teams in EN and DE (#1776). /release and /portfolio are marked for maintainers; the /plan card names the decision path and where the PRD lands.

• The replica host can keep just selected repos as learnings inboxes. Host-local owner.yaml learnings.inbox-repos lists absolute or ~/-prefixed repo roots; roles resolve per store, after the env override and before learnings.store-role, so local-only repos remain writers. Invalid entries invalidate the whole section and refuse canonical-store writes. Cross-repo migration skips inbox repos while applying writer repos in the same run; linked worktrees need their own entry (#1754).

• The website and the README explain at a glance what the plugin does, which command fits which situation and what happens afterwards (#1756; #1757, #1758, #1759, #1760):

  • New page /commands: all 30 commands by situation, with the call per coding tool, the effect, the prerequisite and the source, plus a background part for internal skills, agents, hooks and MCP tools.
  • Home page (EN/DE): a concrete example task in the hero; five steps with an interactive session model (site/assets/how.js loads three.js only on wide screens with WebGL and never under reduced motion, otherwise the same model stands as inline SVG); situation → command; the learning loop shown with two real files; a comparison per coding tool.
  • /guide is organised by coding tool, five steps each to the first result. /lead shows a rebuilt Inbox screen with changed names and is about 60 % shorter. The legal pages get a visible menu and no overflow at 320 px.
  • README: a situation table and two Mermaid diagrams ("Which command?" and the learning loop). docs/components.md and docs/USER-GUIDE.md follow.
  • The docs-parity check of claude-md-drift-check now reads a component heading of the form (51: 28 you type, 23 in the background).

• The website and the README say how to install the lead Inbox (owner decision, queue #4529): the Inbox pane is a Claude Code mod in the npm package lead-session-orchestrator. /lead, the tool table (EN/DE), llms.txt and the README name the two commands (claude plugin marketplace add "$(npm root -g)/lead-session-orchestrator", claude plugin install owner-inbox@navigator-mods), then /inbox, plus the limits: early access, not sandboxed, Claude Code 2.1.296 or newer.

• /lead gives a new user the whole first run (#1776, measured against the published lead-session-orchestrator 0.3.0): five steps (CLI, Inbox, the lead skill with /lead, automatic check-ins, optional signed rules). Corrected: with no trusted signer every push, merge and other action in the authority file asks (the Limits card read as if free actions were the default), and step 5 names authority.dir in ~/.config/navigator/estate.yaml; the lead sets the order and starts headless runs itself after its checks but never opens an interactive session on its own (not "decides which session runs next"); authority files live in a folder of yours, not in each repository; Codex sessions check in but the Inbox lists Claude Code sessions; operatingSystem is macOS; the Inbox picture explains SO, T12 and "phase unknown" and that Repos and the account line need the fleet option. The main navigation of the home page (EN/DE), /commands and /guide links /lead.

• Security-Delta at /close, stage 1 (#1769): session-end Phase 2.4 runs scripts/security-delta.mjs over this session's range base..head with five checks: lockfile delta against OSV (npm, pnpm, uv, pinned requirements; private scopes and known foreign registries stay off OSV, but -r includes, PIP_INDEX_URL and pip.conf are not read yet, #1772), Node security floors, floating image tags, a gitleaks scan that keeps only file and rule id (no secret values) and the age-gate setting when a lockfile changed. Budget 3000 ms (network 2000 ms); an overrun reads as degraded, never holds the close. New key security-delta.mode, default off: warn reports, strict blocks the close (exit 3) only on an introduced malicious package or a fixable critical vulnerability.

• node scripts/release.mjs --resume-tail --target X.Y.Z finishes an interrupted publish tail in one command (#1791). It first runs the read-only registry check and refuses on an integrity mismatch, then tags the commit recorded in the release proof (an existing tag must point at it; on mirror: curated the GitHub tag's snapshot must carry Source-Commit: of that commit), pushes missing tags, creates the GitHub release, checks the live site and runs --reconcile. A second run changes nothing, and it never publishes. Every push, fetch and ls-remote of the tail runs in its own process group with a 900 s deadline and prints its PID; after the deadline the whole group is killed and survivors are named. Contract change for deep importers: the exported tagAndPush() of scripts/release.mjs now returns a Promise (it shipped synchronous in 5.13.0).

• node scripts/migrate-rule-envelope.mjs --root <repo> [--apply] moves old rule copies to the visible envelope (#1792). Dry run by default; --apply rewrites only lines that are exactly the legacy HTML-comment sentinel, atomically, and refuses a root whose .claude or .claude/rules is a symlink (exit 2). The caller checks the fleet boundary before passing a root.

• The destructive-command guard refuses a worktree removal that would lose state (#1789): a new typed rule worktree-remove-unsafe denies every forced git worktree remove and a plain one whose target still holds gitignored session or fleet state (.orchestrator/runtime/fleet/**, STATE.md under .claude/, .codex/, .cursor/, .pi/ or .orchestrator/, a top-level .orchestrator/*.lock). An operand that is not a path is resolved the way git resolves it (a worktree's unique trailing path component); a target the guard cannot measure is denied, one git cannot find stays allowed. Quoted words, abbreviations of --force (--forc) and calls inside $( … ), bash -c or eval are judged too; python -c, node -e, xargs, script files, a -c payload held in a variable and a few rarer shell spellings are a named ceiling (#1797). The policy now holds 14 blocking rules. session-end Phase 4a and /memory-cleanup hand the forced removal to the operator's own terminal.

• A secret value in Bash output is reported the moment it appears (#1786, SEC-008): hooks/post-bash-write-verify.mjs scans every Bash result (stdout/stderr, or a string on Codex) for values of qualifying env keys of the hook process, raw and JSON-escaped, using the masker's own needle rules (new additive export secretNeedleEntries in scripts/lib/secret-masker.mjs). A hit emits orchestrator.security.secret_emitted with key names and counts only, never a value, plus one systemMessage asking for rotation and an owner-queue item. Measured over 44,382 Bash results of 896 transcripts: 0 of 8 hits false, 0.05 firings per 1000 Bash calls, about 0.05 ms per call. Values a command loads itself (set -a; . ./.env.local) stay invisible; on Cursor only the event is written. A shape-based variant over .gitleaks.toml was measured at 88.9 % false alarms and is not built.

• Session start reports known security problems without a network request, probe 21 security-pulse (#1769, stage 2): it reads a host-private cache and warns when the running Node is below the security floor of its major, when the lockfile findings cached for HEAD include a malicious package or a critical vulnerability (KEV-listed ones counted through their CVE aliases), or, with security-delta.mode not off, when the last real close (backfilled records skipped) wrote no orchestrator.security.delta event of its own session. An absent, incomplete or stale cache gives no banner and is reported as not-measured, degraded or stale, never as clean; it starts the detached refresher scripts/security-pulse-refresh.mjs (one atomic claim per repo per 10 minutes, allowlisted child environment, TTL 6 h, incomplete parts retried after 30 minutes; SO_SECURITY_PULSE_REFRESH=off disables it). Lockfile names and versions reach the banner only in a strict charset. Security-Delta findings now carry the CVE aliases of the fetched OSV records in ids.

• Session start shows the fleet boundary from the navigator's conditions file word for word (#1809): node scripts/fleet-auflagen.mjs <session_id> --render prints, after the unchanged JSON line, the grenze field of an accepted conditions file under one header line, byte for byte (new pure helper renderAuflagenNotice() in scripts/lib/fleet-protocol.mjs). A grenze with a control character other than tab and newline, a bidi, zero-width or line-separator character, a BOM or an invisible tag character (U+E0000–U+E007F) is withheld with one notice line, and under --render the JSON line writes those characters as \uXXXX escapes, so none reaches the terminal raw; without --render the output is unchanged. An absent or rejected file prints nothing extra. Phase 7.6 calls --render and carries the block verbatim into subagent prompts that search across repos.

• Session start reports dead links in the memory index (#1801): readDreamSignals() in scripts/lib/auto-dream.mjs counts [text](target) links in MEMORY.md whose target is not an existing file, line by line in linear time (<…> targets and "…", '…', (…) titles read; schemes, pure anchors, [[wiki]] links and links inside inline code skipped; targets outside the memory folder are never stated; lines over 4096 characters skipped; null when there is no MEMORY.md, never 0). The new export listDeadIndexLinks() gives the same list to /memory-cleanup, whose new first step and final check call it instead of a GNU-only grep -oP. The maintenance-due banner adds memory: <N> tote Index-Links — /memory-cleanup when N > 0, also when nothing else is due or the housekeeping cooldown runs, without changing when auto-dream is due. Measured 2026-10-26 06:43 UTC on the development host (readDreamSignals() over every ~/.claude/projects/*/memory/MEMORY.md): 0 of 38 memory folders would show the line today (an earlier cleanup removed 96 dead links), so it appears only when links are lost again.

• orchestrator.probes.completed names which follow-up step overran (#1735): a budget-exceeded (or threw) ci-status element now carries follow_up_stage (pushed-sha, red-history or head-sha), so the pushed-SHA requery and the red-history read are counted apart.

Changed

• Install records cover the slim GitHub snapshot (#1764): on 2026-10-26 the plugin installed from the slim GitHub snapshot into empty profiles with Claude Code 2.1.310 and Codex CLI 0.160.1 (marketplace and clone installer), and Cursor's project install ran. A session with model calls was not part of the run because the empty profiles had no login; Pi is not installed on the test host.

• "Animate workshop" on the home page now animates the workshop (#1808, owner request 2026-10-25): the old loop was a 9-second camera move over the still, nothing in the picture moved. The new 10-second loop (site/video/agent-production-motion.{webm,mp4}, 0.4 and 0.7 MB instead of 1.9 and 2.8 MB) is the hero illustration animated with fal.ai kling/v4/image-to-video, start frame = end frame: the person types, the robots pin a note, fit parts, inspect and shelve cubes, and a part rides the belt and arrives as a finished cube. marketing/vidlab gains a fal.ai door (lab.sh … fal, END_IMAGE for an end frame) and heroloop.sh, which sets the clip onto the 3:2 still, closes the seam and gates seam and size. The Remotion kit no longer renders the loop; the old loop files and the unused poster are gone. The site test now also checks that the hero video's files exist.

• vitest and @vitest/coverage-v8 4.1.11 → 4.1.12 (#1783): clears three moderate dev advisories (vitest, @vitest/mocker, @vitest/coverage-v8); npm audit reports 0.

• The README is half as long and loads without diagrams (#1595, owner feedback 2026-10-24): 1886 → 763 words (wc -w), 5 → 2 tables, the four Mermaid diagrams replaced by one committed lifecycle image (light and dark SVG). GitHub's diagram viewer gave up after about 10 s on a first visit, also on the mermaid project's own README. Install now follows the tagline. The platform matrix, so-hud, the add-on details, "What you get" and "What it writes into your repository" moved to docs/install.md and docs/USER-GUIDE.md, the Codex command names to docs/codex-setup.md.

• The secret masker and the SEC-008 detector also cover DSN keys and URLs with a password (#1799): keys ending _DSN and a bare DSN qualify, and keys ending _URL or _URI qualify only when the value carries a password in the userinfo (scheme://user:password@…, also behind jdbc:) or in a password=/pwd=/pass= query parameter, so API_BASE_URL=https://host/v1 stays unmasked. The rule sits in one decision point (qualifiesAsNeedle in scripts/lib/secret-masker.mjs) used by all its readers.

• On Cursor, non-blocking postToolUse and afterFileEdit hook hints are passed on as additional_context (#1799) instead of being dropped, up to 3,000 characters. Whether Cursor reads this field on a non-blocking event is not verified live yet.