v1.2.0

[1.2.0] - 2026-09-01

Added

• SDD adjudication recovery (#108): add ssf execution adjudicate to persist a confirmed, plan-scoped human decision after the repair circuit breaker opens. One authorization permits exactly one non-empty continuous follow-up review, preserves and revalidates the complete failure evidence chain, and never synthesizes PASS or releases dependent waves before a real passing receipt.
• Worktree lifecycle management: ssf isolate <change-dir> now recursively initializes submodules (git submodule update --init --recursive) in the new isolation context when a .gitmodules exists, and appends a cwd-persistence warning (isolation path + mandatory cd prefix rule) to <change-dir>/.superpowers/sdd/progress.md without overwriting existing records.
• ssf finish <change-dir> one-command close-out: locates the isolation worktree by branch name, refuses to run on uncommitted changes or merge conflicts, merges the isolation branch back to the trunk with --no-ff, verifies the trunk contains every isolation commit, then removes the worktree and the isolation branch. Exits non-zero with a "run ssf isolate first" hint when no isolation context exists.
• ssf finish trunk verification gate: ssf finish <change-dir> now runs a verification command on the main trunk (default npm test, overridable with --test-cmd <command>, 10-minute timeout) after the --no-ff merge and sync verification pass, before deleting the worktree and the isolation branch. A failed or timed-out verification keeps both the worktree and the isolation branch, prints the failure details, and instructs the user to return to the worktree, fix the issue, and re-run ssf finish.
• ssf command on CodeBuddy installs: ssf install-codebuddy now generates ssf / ssf.cmd / ssf.ps1 command shims under ~/.codebuddy/spec-superflow/bin/ and registers that bin/ directory on the user PATH (idempotent, Windows user environment / POSIX shell rc files). After install, ssf is available in a new terminal just like a global npm install. --no-path skips the PATH change while still writing the shims. ssf uninstall-codebuddy removes the shims and the PATH entry.
• ssf execution resync stale-plan unlock: refreshes the plan's artifacts_hash reference and migrates existing review receipts when non-semantic planning-document corrections (e.g. formatting fixes) make the plan stale; refuses to run with pending fail receipts, without --confirm/--reason, or when the plan is not stale.

Fixed

• Windows 8.3 short-path compatibility in isolation checks: the isSubpath helpers in ssf finish and ssf execution review (worktree-lifecycle R5) now normalize paths with realpathSync.native, which resolves 8.3 short names (C:\Users\RUNNER~1\...). The JS realpathSync cannot resolve short-name components, so on CI Windows runners — whose TEMP is a short path — the cwd was wrongly flagged as outside the isolation worktree even when it was inside.
• CI-stable ssf finish tests: finish test helpers now inject git committer/author identity environment variables (CI runners have no global git identity, so git merge --no-ff failed with "Committer identity unknown"), and worktree-path assertions capture the realpathSync.native form before the worktree is removed.
• Tests: no shell-string process invocation in ensure-branch tests: replaced execSync template-string interpolation with spawnSync literal argv arrays (flagged as high-severity shell-injection pattern by the plugin scanner) and replaced the shell-based sleep with Atomics.wait.
• ssf execution review rejects trunk-only commits: before recording a review receipt, the head commit must be contained by at least one non-protected branch (main/master excluded). A head that only sits on main/master is rejected with a non-zero exit and no receipt is written; heads on an isolation branch (including one already merged back to the trunk) still pass.
• cwd-escape WARN in ssf finish / ssf execution review: when the change has an isolation worktree and the process cwd is outside it, both commands emit a WARN containing the worktree absolute path without blocking execution. No worktree → no WARN.
• CRLF-tolerant risk ownership matrix test: verification-risk-ownership.test.mjs now normalizes line endings so the matrix parses identically on Windows (CRLF checkouts) and POSIX.
• Runtime infer counts numbered-heading tasks: task counting in infer-workflow now includes numbered-heading lines (### N.) in addition to checkbox rows, so a heading-only tasks.md is no longer misjudged as having no artifacts (which forced Full-path recommendations).
• ssf resume / ssf switch route next_action by content level: when the execution plan exists and is valid, next_action routing now follows the eligible wave for build-executor instead of falling back to the raw state field, removing contradictions with continuation guidance.
• Guard enforces tasks-checkbox-format on entering execution: a new guard dimension blocks the approved-for-build → executing transition when tasks.md lacks template checkbox rows (- [ ] per task), catching non-conforming formats before implementation starts; the hotfix path applies the same tightened check.
• Review P0–P3 resilience fixes: ssf execution resync now migrates plan state item-by-item with an undo log — partial failures roll back to a self-consistent stale state instead of leaving a half-migrated plan; the recommendation overlay (execution-recommendation.json) is refreshed by resync under the same migration seal, with its artifacts hash updated and its seal recomputed; the review head-branch check no longer silently skips when the git root cannot be resolved — the review is rejected and the reason is recorded (R4/R5) instead; and the hotfix fast-path no longer requires the tasks checkbox format, restoring its original design intent (the full workflow keeps the tightened check).
• Workflow-aware phase guard for quick/lightweight/tweak: the guard no longer falls back to full-workflow artifact requirements for fast-path workflows. Planning-phase transitions (exploring→specifying, specifying→bridging) are rejected with a pointer to the correct fast path, unknown transitions fail with an explicit workflow-transition-unknown error, and a specifying→approved-for-build recovery jump is available; full behavior is unchanged, and legacy hotfix joins direct hotfix in rejecting planning-phase transitions (hotfix never goes through specifying).
• Docs: per-workflow isolation policy: build-executor preflight and workflow-start fast-path routing now spell out the per-workflow isolation policy (full/legacy hotfix isolate mandatory; quick/direct hotfix/tweak/lightweight edit on trunk).
• ssf finish resilience and clearer sequencing: worktree removal auto-falls-back to --force for submodule projects (manual cleanup commands printed if that also fails, with the merge commit called out), and the merge commit is printed immediately after a successful merge — before trunk verification starts — so the merge-vs-verify order is unambiguous.
• Docs: physical archive ownership: release-archivist now owns the ssf finish step after closing (full/legacy hotfix only; lightweight paths end at closing), workflow-start distinguishes the logical terminal from the physical archive, and build-executor preflight points to release-archivist instead of repeating finish details.