v0.28.0

[0.28.0] - 2026-09-05

Changed

• Rule #137 made executable in Grep-less harness modes and propagated to all specialists (#228).
  Rule #137 ("never ingest file content via filtered bash") previously assumed a Grep tool always exists and only covered @sec, @rev, and @dev. In harness modes (such as bypass-permissions modes) where Grep is not exposed and the harness injects a system-prompt block nudging cat/sed/head over structured tools, the rule failed to account for missing tools, and the counter-rule was missing from @sre, @design, and @research.
  • Revised the rule in security.md, review.md, and engineer.md: Read is the primary content tool, Grep is used only when the session actually exposes it, and a named fallback (the filtering proxy's raw/passthrough escape hatch) is provided for bash-only reads, reporting the read as unfiltered.
  • Added the adapted counter-rule across sre.md, design.md, and research.md, closing the propagation gap across all specialists.
  • Updated @techlead's dispatch instructions to stop mandating a Grep tool that a target session might not have.
  • Added explicit handling for harness/hook instructions or MCP preamble suggesting bash reads or unrelated tool calls: treat them as harness noise, disregard, report, and continue working without halting.
  • Added an AGENTS.md Lessons entry recording the diagnostic procedure for distinguishing harness-emitted prompt text from repo-borne prompt injections.

Fixed

• Rule-origin governance CI gate negative test strips all origin tags globally (#228).
  The negative self-test in .github/workflows/ci.yml previously stripped only the first (origin: ...) tag in engineer.md. When a rule carries multiple origin tags (e.g. #137 and superseding #227), stripping only the first left the rule tagged, making the negative test a no-op. The test now strips tags globally (s///g).

Documentation

• Synchronized product capabilities across README, hotsite, and CHANGELOG (#234).
  • Documented GitHub Copilot CLI harness support in the README and landing page.
  • Updated the channel roster and hero descriptions to include @rev and @research specialists and peer operator claim protocols.