Skip to content

v0.7.0 — Multi-Runtime + Hardening

Choose a tag to compare

View all tags
@MountainUnicorn MountainUnicorn released this 12 Apr 21:58
· 139 commits to main since this release
v0.7.0
1566fda

ADD v0.7.0 is a structural release: the methodology extracts from a Claude-specific plugin into a runtime-neutral core/ source with per-runtime adapters. Claude Code install is unchanged. Codex CLI is now a first-class target.

Architecture

  • core/ — runtime-agnostic source of truth: skills, rules, templates, knowledge, schemas. This is where contributions land.
  • runtimes/claude/ — Claude-specific adapter: .claude-plugin/, hooks, CLAUDE.md, tool-name + frontmatter mappings.
  • runtimes/codex/ — Codex-specific adapter: concat + flatten rules, plain-text fallback for AskUserQuestion.
  • scripts/compile.py — generator: core/ + adapter → plugins/add/ (Claude) + dist/codex/ (Codex).
  • core/VERSION — single file drives every version-bearing surface. Replaces the v0.6.0-era 8-location bump checklist.

Codex CLI support

Install:

curl -fsSL https://raw.githubusercontent.com/MountainUnicorn/add/main/scripts/install-codex.sh | bash

You get 24 custom prompts (/add-spec, /add-tdd-cycle, etc.) and an AGENTS.md with the full ruleset. Known differences from Claude Code: no hooks, plain-text confirmations instead of structured popups, flat autoload. See docs/codex-install.md.

Security hardening

  • JSON Schema validation of SKILL.md + rule frontmatter enforced in CI (.github/workflows/schema-check.yml). Rejects scope creep in allowed-tools.
  • Rule boundary check flags PRs that weaken NEVER/Boundaries:/MUST NOT markers (.github/workflows/rule-boundary-check.yml). Requires explicit CODEOWNER approval.
  • Compile drift check verifies committed plugins/add/ + dist/codex/ match generator output (.github/workflows/compile-drift.yml).
  • SECURITY.md publishes threat model, attack surface analysis, and disclosure process. Release tags GPG-signed from this version onward.

Install reliability

  • TROUBLESHOOTING.md covers stale cache, rules not loading, hook deps, version migration, Codex-specific recovery.
  • Root README install section rewritten: two-step marketplace flow explained, Codex install added, skill count corrected (24 across 4 categories).
  • plugins/add/README.md documents argument-hint, allowed-tools, autoload, maturity as ADD-specific frontmatter extensions (not Anthropic-spec).

Anthropic plugin spec fixes

  • hooks/hooks.json uses the documented jq + stdin pattern instead of non-standard $TOOL_INPUT_* env vars.
  • plugin.json adds license: MIT and a keywords array.
  • Deleted the broken root AGENTS.md (was a sed-mangled copy of CLAUDE.md).

Acknowledgments

This release synthesizes findings from a 5-agent swarm review of plugin installation, Anthropic spec compliance, Codex portability, multi-runtime architecture, and security/trust — the same competing-swarm pattern that was promoted to Tier 1 knowledge in v0.6.0. The architecture design is Swarm 4's; the Codex strategy is Swarm 3's; security hardening is Swarm 5's. None of them saw the others' work until synthesis — each arrived at a perspective the others missed.

Upgrading

Claude Code:

claude plugin update add@add-marketplace

Nothing changes on your end — plugins/add/ is byte-identical to what the compile produces, and is what marketplace install continues to pull.

Codex:

curl -fsSL https://raw.githubusercontent.com/MountainUnicorn/add/main/scripts/install-codex.sh | bash

Deferred to v0.7.1

  • /add:deploy runtime confirmation phrase for production
  • PII heuristic warning before learning-checkpoint writes
  • --force-no-retro abuse detection (N uses in window)
  • /add:init --quick (5-question greenfield fast path)
  • Per-skill Codex overrides for high-leak skills (away, tdd-cycle, implementer) — current v0.7.0 uses the Claude body as-is for Codex
Assets 2
Loading