v0.2.2

Changelog

• 562cb65 gnhf 39: Fixed two public-release first-run defects — writ claiming "not inside a git repository" when git itself is missing from PATH, and the README's false "no runtime dependencies" claim (writ requires git + POSIX sh, ships for macOS/Linux only) — plus proved the last never-verified README claim (fish completion loading) natively on macOS and audited that no local-only files ever leaked into the public repo history.
• beeee02 gnhf 36: Hardened the last unscoped release surface by adding least-privilege permissions: contents: read to ci.yml (release.yml already self-scoped), then re-verified full closure: suite green under -race -count=3, build/vet/gofmt clean, v0.2.0 still latest live release with 0 open issues/PRs and an accurate README.
• fded824 gnhf 32: Landed the public release end to end: pushed the final branch commit, verified PR #10 green with v7 action pins, merged it to master, cut v0.2.0 (goreleaser published brew formula + 4 platform binaries), proved both README install paths and the full documented lifecycle against the released binary, and fixed a discovered README bug where current Homebrew refuses untapped third-party formulas without an explicit trust step.
• 39a0bf0 gnhf 31: Pushed the run's 27 local-only fix commits to origin and opened PR #10 to master (CI green, mergeable), closing the "land on master" prerequisite every prior iteration flagged as the sole remaining release step, plus bumped both workflows off Node-20-deprecated action pins and added the missing README CI badge.
• 1e94659 gnhf 30: Documented writ's two remaining user-facing surfaces for public release — shell completions and script-friendly color behavior — after verifying them end to end, catching that the conventional bash source <() idiom silently fails on macOS's stock bash 3.2 and using a verified-working idiom instead.
• a1ea7f3 gnhf 29: Fixed a real bug where writ's exclude-seeding defense silently did nothing inside linked git worktrees (agents' primary workflow): the rule was written to the per-worktree gitdir that git never reads, so blanket git add -A would track .writ/current.toml and trip the tracked-state breakage decide() guards against.
• 2e8dfa7 gnhf 28: Added the missing conventional --version/-v root flag (previously "unknown flag") printing byte-identical output to writ version, locked it into CI, documented it in the README, and completed the run's first govulncheck scan (clean).
• 509db89 gnhf 27: Audited the last unaudited release surfaces — goreleaser packaging prerequisites (go mod tidy hook cleanliness, full darwin/linux × amd64/arm64 cross-compile matrix, ldflags version stamping), GitHub repo metadata (set 8 discoverability topics on the public repo), and the now-stale AGENTS.md gh-profile claim — finding no code defects requiring changes.
• 15b8107 gnhf 26: Re-proved the complete README-documented lifecycle end-to-end at HEAD after all 25 prior fix iterations and fixed a misleading-doc gap exposed by following the README literally: step 3 never said to create a feature branch off base or commit the work, so a literal reading hits writ's own refusals instead of the documented flow.
• daee5a7 gnhf 25: Closed the tracked-writ-state release gap flagged by iteration 24: committing .writ/current.toml (e.g. blanket git add -A during implement) previously made status render a false "Auto-mergeable" verdict before merge died on raw git checkout errors, or silently left base dirty with a stale tracked copy after merging; writ now prevents tracking at propose time and refuses it with untrack guidance at decision time.
• ea6db44 gnhf 24: Closed iteration 23's flagged polish item by adding strict unknown-key rejection to both author-controlled TOML paths — propose draft intake and approve's $EDITOR round-trip via a new exported writ.Parse — so typo'd keys like "titel" or a renamed [verrify] table are named outright instead of being silently dropped and resurfacing as misleading empty-field validation errors, while writ.Load deliberately stays lenient for Save-written state so version skew cannot strand an open writ.
• 3166b22 gnhf 23: Closed an intake trust hole on the critical path where propose/approve accepted criteria arriving pre-assessed (met/attestation already set), letting an agent self-bless its own acceptance claims through approve --yes in violation of the README's attest-after-approval rule, via a new writ.Writ.ValidateProposal intake validator with tests, docs, and e2e proof.
• f0a6c14 gnhf 22: Fixed the fourth vacuous-drift axis: driving a writ from its own base branch reported "Auto-mergeable" exit 0 (drift blind to commits on base) before merge — even --approve — died on a raw already-on-base refusal; decide() now refuses both commands up front with actionable guidance, with tests, e2e proof, and README documentation.
• 945bee9 gnhf 21: Closed the base axis of writ's vacuous-drift defenses: drift.Compute now refuses a writ whose declared base doesn't resolve to a commit before diffing, turning the raw git plumbing dump users saw for a typo'd base into an actionable message and closing the hole where a blanked base made every committed change silently vanish from drift reports.
• 66d9a03 gnhf 20: Closed the last untested documented workflow state - the proposed-but-unapproved writ between README loop steps 1 and 2 - by proving status/merge behavior end to end with a real binary and locking both the needs-human refusal and the merge --approve override into CI.
• a8f98e7 gnhf 19: Closed the scope-axis vacuous-drift hole: status and merge now refuse an approved-but-tampered writ whose declared scope covers the whole repo, instead of reporting zero drift and rendering "Auto-mergeable" for arbitrary unreviewed changes.
• a5b2a15 gnhf 18: Closed a validation gap on the propose critical path where criteria with empty or whitespace-only ids/text passed Validate — producing writs addressable only via attest "" with anonymous status rows — by requiring every criterion to have a non-empty id and text, with tests and end-to-end proof.
• 6e91ac2 gnhf 17: Fixed a vacuous-truth auto-merge bug where a writ whose acceptance criteria were deleted (reachable via approve's documented invalid-edit path that leaves the broken file on disk) passed status as "all criteria met" exit 0 and could merge unchecked; gate.Decide now requires at least one criterion, so such a writ needs-human with an explicit reason.
• 9b48675 gnhf 16: Fixed a config-sensitivity bug where writ's dirty-tree merge guard silently weakened for users with git's status.showUntrackedFiles=no set, and hardened the test suite against contributor machines with global signing configs.
• 8540ce5 gnhf 15: Locked the last user-visible rendering surfaces into CI — the singular drift line, mixed/pure-deletion change summaries, and the previously untestable ANSI color verdict paths — via a small injectable-color seam in render.Status, then proved all of them end to end against real git data and a real pty terminal.
• d85108d gnhf 14: Closed the corrupt-state escape-hatch gap across all six writ-reading commands and locked the last documented-but-untested merge refusal paths into CI, then validated the whole repo under -race for the first time since iteration 7.
• cad8ff4 gnhf 13: Closed the last undocumented user-facing surface: the WRIT_VERIFY_TIMEOUT knob (10-min default) that governs verification on the critical auto-merge path is now documented in the README, named in the timeout message users actually see in status output, and hardened against the WRIT_VERIFY_TIMEOUT=0s footgun that would previously have killed every verification instantly.
• 5c032be gnhf 12: Closed the last untested surface - the cobra command tree itself - by adding cmd/writ/root_test.go integration tests that drive the real dispatch path (SetArgs -> Execute), locking registration of all 8 documented subcommands, all 5 documented flags' wiring, bare-invocation help, unknown-command failure, exit-code-2 propagation, and the full documented propose --file -> approve --yes -> attest --note -> status -> merge lifecycle into CI.
• 1175b66 gnhf 11: Fixed a real documentation bug in the freshly added Exit codes section - the README claimed exit code 2 ("no writ is open") comes only from status/merge/discard, but approve, attest, and unattest also return 2 on that exact condition - corrected it to name all six commands, and locked the two never-tested attest/unattest exit-2 paths into the Go test suite.
• b057c78 gnhf 10: Fixed the last first-run UX trap - bare writ propose in an interactive terminal no longer hangs silently forever but refuses up front with an actionable message naming both remedies - and documented writ's designed 0/1/2 exit-code contract in the README so agents can script it.
• 86ed36c gnhf 8: Closed the last critical-path UX gap — propose over a corrupt .writ/current.toml now points at writ discard instead of a raw TOML error — and locked four previously untested documented behaviors into the Go test suite: gitMerge's already-on-base and detached-HEAD refusals, runMerge's full happy path through RunE (merge + state-file clear), and runStatus's exit-0/exit-1 codes through the real drift+evidence+gate pipeline.
• a122ab3 gnhf 5: Fixed a user-facing bug on the documented human-approval path where editors configured with arguments (EDITOR="code -w") died with a confusing fork/exec error, and added the first-ever test coverage of the README-documented $EDITOR approve flow, proving it end to end with a real binary.
• 7ff9671 gnhf 4: Fixed the last flagged first-run UX bug: repoRoot() no longer silently falls back to the current directory when not inside a git repository - every command except version now fails loudly with an actionable message instead of scattering .writ/ state into ordinary directories or reporting a misleading "no writ is open".
• 4fadb48 gnhf 3: Added the previously missing writ discard command so a rejected, abandoned, or corrupt open writ can be thrown away without hand-deleting internal state, closing the last user-facing workflow deadlock flagged by prior iterations and documenting it in README and AGENTS.md.
• 724f81c gnhf 2: Fixed a critical-path user-facing bug where writ status/merge failed with a confusing raw git error on brand-new repos with zero commits, by teaching drift.Compute to handle an unborn HEAD via git's empty-tree diff, and corrected the stale AGENTS.md/CLAUDE.md claim that drift.Compute is still a stub.
• 8dd8329 gnhf 1: Audited all README-documented commands against the code and proved the documented propose→approve→attest→status→merge loop end-to-end, finding and fixing a critical-path bug where writ's own untracked .writ/current.toml state file made gitMerge refuse every merge ("working tree is dirty") unless the user manually gitignored it.