v0.17.0-pre (rolling preview)

Rolling preview — not a release.
Rebuilt on every merge to main. Ships as v0.17.0 when a maintainer cuts the release.
The tag moves, so re-run the install command to pick up the newest build.

0.17.0 - 2026-09-05

Added

• The documentation never pointed to the MCP server or the Copilot CLI plugin. The home page mentioned hve-squad-mcp in passing with a bare GitHub link, and hve-squad-plugin was absent from the site and the README entirely, so a consumer had no path from this repository to either sibling's documentation. Added an Ecosystem page (docs/ecosystem.html, wired into the navigation and pager across the site) covering what each of the three repositories is, which surface to use for which host, the MCP server's two execution modes and its tool set, the plugin's install-as-a-pair rule and its two update rules, and how releases stay aligned. The home page's companion section now covers both siblings with links to their GitHub Pages sites, and README.md gained a Related repositories table (docs/index.html, README.md).

Changed

• hve-core@8692fe3 renamed the entire data-science skill pack and retired the Supply Chain Reviewer agent outright. ds-catalog, ds-analysis-authoring, ds-dataops, ds-evaluation-design, and ds-feasibility moved under .github/skills/data-science-engineering/ as data-catalog, analysis-authoring, dataops, evaluation-design, and feasibility; Squad Data Scientist (squad-src/.github/agents/squad/squad-data-scientist.agent.md) and Squad Prompt Engineer (squad-src/.github/agents/squad/squad-prompt-engineer.agent.md) now route to the renamed skills, and squad-roster.instructions.md's data-scientist/prompt-engineer rows and Deferred Reviewer-Class Agents table were updated to match — Data Workstream Coach is described generically as the non-dispatchable coach orchestrator its successor Data Science and Engineering Coach now ships as, and the removed Supply Chain Reviewer row was dropped in favor of a note that SSSC Planner/Supply Chain Skill Assessor already cover its ground. No squad-owned charter or doc page needed a new agent; apm.yml is regenerated and repinned to 8692fe38cc0415ff8d21aa1b5d8198f008cd4038.

• Updated hve-core dependency pin to c7ee5b9 (c7ee5b9642ab1877a6b5ce5336ebc448b89b2708).

• Updated hve-core dependency pin to b7f8a7e (b7f8a7e8b79694812ea89a46c6517d7ae6050d0b).

• Updated hve-core dependency pin to b972914 (b972914964965b00e40e3a65f42e592fe3885a1a).

• Updated hve-core dependency pin to 48a7bfd (48a7bfd14cea8b5122c1ba3c17eb0a7fdb28809d).

Fixed

• An installed hve-squad-hve-core tree could not be proven to match the commit its marketplace entry pins. config.json records a content digest rather than the git commit SHA-1, and its version comes from upstream hve-core's own plugin.json, so copilot plugin update reports 'already at latest' even when the pin moves. Added scripts/Test-HveCorePin.ps1, which recomputes the git blob SHA-1 of every installed file against the pinned tree, and rewrote the marketplace description in scripts/Build-SquadPlugin.ps1 to say the plugin replaces the official hve-core plugin rather than sitting beside it, and must be refreshed with uninstall-then-install.

Consumer install

Pin to this version:

apm install "Peter-N91/hve-squad#v0.17.0-pre"

v0.16.2

Changed

• Updated hve-core dependency pin to 3050cf5 (3050cf5e609d50ec171cb4d657f0f4bc988e8982).

• Updated hve-core dependency pin to 7cc6dc4 (7cc6dc42caf7f842e1f7aa9f3d41cb4581538f33).

Fixed

• The published plugin marketplace could pair a release with an hve-core commit it was never
  validated against. The generated marketplace.json carried a single hve-squad entry and
  autoUpdate: true, leaving hve-core to be installed separately from its own source — so a
  consumer resolved whatever was current upstream rather than the commit the installed squad
  version's routing tables and role charters were built against.

  Build-SquadPlugin.ps1 now emits a second hve-squad-hve-core entry whose commit SHA is read
  from the built ref's own apm.yml, so each release publishes the exact hve-core pin its
  cast-delta guard validated — v0.16.1 resolves b1cae50, v0.16.2-pre resolves 3050cf5,
  with no manifest hand-editing. autoUpdate is dropped deliberately: the two entries are a
  matched pair, and an unattended update of one without the other reintroduces the same skew.

  publish-plugin.yml gains an optional mcp-version input so a publish can bump the
  @hve-squad/mcp pin in the same run; omitted, the existing .mcp.json pin is reused rather
  than silently advanced.

• The plugin distribution shipped a partial rule set, and the squad dispatched an off-roster
  role because of it. The generator distilled fifteen instruction files into ten reference files
  by hand. Five had no destination at all — squad-routing, the discovery and intake gates,
  notifications, and watch mode — so squad-routing's Tracker-Write Gate ("when the active
  roster does not carry backlog-executor, propose adding it") and the roster's "never
  self-fill an absent role" reached no plugin file. A federation sub-squad asked to write its
  backlog to Azure DevOps dispatched Squad Backlog Executor and wrote its history without ever
  adding the role to team.md, because in the plugin no rule said otherwise.

  Three further reference files (floor.md, mcp-capability.md, notifications-and-watch.md)
  existed only as hand-written files inside hve-squad-plugin, with no source of truth here and
  no generator step authoring them — one of them the target of a citation the generator emitted
  on every build.

  Build-SquadPlugin.ps1 now ports every instruction file verbatim into
  skills/squad/references/rules/, builds the citation index from what it ported rather than
  from a hand-maintained map, and rewrites the directory-level prose that told the coordinator
  its rules live under .github/instructions/squad/ in a distribution that ships no such
  directory. A new instruction file now reaches the plugin without anyone remembering to map it.

  A build-time conformance check fails the build — rather than warning — when a generated file
  cites an instruction path the plugin does not ship, cites a skills/ target no step authored,
  or when anything under agents/ or skills/ was not authored by the run. Every defect it
  catches is invisible at run time: a dangling citation reads as a working reference, and a
  hand-written orphan is indistinguishable from generated content while it drifts.

• squad-researcher.agent.md cited an hve-core instruction under the squad namespace.
  untrusted-content-boundary.instructions.md deploys to .github/instructions/, not
  .github/instructions/squad/, so the citation resolved to nothing in the package as well as in
  the plugin.

Consumer install

Pin to this version:

apm install "Peter-N91/hve-squad#v0.16.2"

v0.16.1

Added

• hve-squad can now build its own GitHub Copilot plugin distribution. There was no repeatable way
  to turn a released hve-squad tag into the tree Peter-N91/hve-squad-plugin ships — every prior
  build was a manual, one-off assembly of plugin.json, marketplace.json, and .mcp.json, with no
  guarantee that a later regeneration wouldn't silently drop hand-authored fields.

  scripts/Build-SquadPlugin.ps1 resolves either an immutable -Ref <tag> or a local -SourceRoot
  dev build, and now owns plugin.json, marketplace.json, and .mcp.json generation end to end,
  including an -McpVersion pin that reuses the existing @hve-squad/mcp version when omitted and
  refuses to guess one when no prior pin exists. .github/workflows/publish-plugin.yml wraps the
  generator in a manual (workflow_dispatch) cross-repo publish step, failing closed when
  HVE_SQUAD_PLUGIN_PUSH_TOKEN is not configured rather than skipping the push silently.

  squad-src/.github/skills/squad/mcp-server.template.json is updated to match: @hve-squad/mcp is
  now published to npm, the template pins an exact version instead of a bare @latest reference, and
  documents why the pin is a deliberate, separate action from a content rebuild.

Changed

• The release gate is Tier 0 only, and now says so. The behaviour contract described Tier 1 as
  the release gate and told the reader the suite would be wired in "once it is green twice in a row".
  It never was, so a reader comparing release.yml against the contract found a gate the workflow
  does not implement — and v0.16.0 was cut on Tier 0 alone with nothing recording why.

  Tier 1 and Tier 2 are operator-invoked by design. The contract now carries the reasoning: they cost
  Copilot requests and about an hour per cut; two of the three dispatched runs before 0.16.0 failed
  because the contract asserted something the source did not say, so a gate on that record blocks
  releases for test defects; and the defect 0.16.0 actually shipped sits behind mode=autopilot,
  which no scenario exercises, so the gate could not have caught it. The conditions that would change
  the decision are written down next to it (tests/squad-behavior-contract.md).

Fixed

• A run reported ten dispatched roles over a history/ holding two files. An autopilot run on a
  live repository produced research, a plan, an architecture, a council verdict, an IaC scaffold, a
  cost model, a security review, a closing review, and a remediation — and left no
  history/<agent>.md for any of the roles that supposedly produced them. The rule it broke is
  stated in six files. Prose was not the missing ingredient, so three mechanisms replace it.

  The ledger's row set is now a function of history/, not of the payload. The Scribe lists the
  directory and writes that listing — one line per file with its block count — into the
  ### Derivation block before any row, then writes a row for each enumerated file and for nothing
  else. A role that left no file gets no row, so the eleven-row ledger that hid the gap is no longer
  writable. A payload naming a role the listing does not comes back as a discrepancy in the Scribe's
  confirmation note (scribe-procedure.md).

  The autopilot run summary now reports the gap itself. ## Stages gains a Dispatch Record
  column filled from history/, and a stage with no file carries — none recorded. Any such cell
  forces Outcome: incomplete (<n> stage(s) without a dispatch record). The Scribe is the only
  writer of history, so it is the only participant that can say which stages actually ran — and the
  coordinator's account of the run is exactly what cannot be trusted to say so
  (entry-schemas.md, scribe-procedure.md).

  The per-stage gate is reachable again. Autopilot now hands off to the Scribe once per stage
  rather than once per pipeline, and state.json advances per stage. The observed run collapsed a
  fan-out, a security review, a closing review, and a remediation into a single turn, which left no
  point at which stage N's missing history entry could block stage N+1
  (squad-autopilot.instructions.md, squad-coordinator.agent.md).

• The contract could not see an invented ledger row. carries no row for a role that was never dispatched only catches rows costed at zero, and every invented row in the observed run carried a
  plausible figure. every ledger row has a history file behind it resolves each row through the
  roster and requires one of its agents to hold a history file, which is the assertion that fails
  that tree (tests/tier1/StateContract.Tests.ps1, tests/tier1/SquadState.psm1).

• Autopilot decided the Implement stage's shape from a list of seven role names. Deliverable
  fan-out engaged only when the roster carried two or more of analyst, product-owner, designer,
  experimenter, presenter, technical-writer, data-scientist — which is product and full,
  and nothing else. Every other profile was classified as a single developer build regardless of
  what its roster actually owned.

  An azure roster owns nine artifact roots. A live run produced a target architecture, an IaC
  scaffold, a cost model, a security review, and a migration sequence — five specialist artifacts —
  under a classification that says its plan is always a single build. It improvised a fan-out the
  pipeline does not define, so none of the per-dispatch recording rules that belong to the fan-out
  path applied: it reported ten stages and left no history/<agent>.md behind any of them.

  Fan-out now engages when the plan's deliverable list names two or more artifact-owning roles —
  a roster row whose Deliverable Root names a real path, counting every one except researcher,
  lead, and tester, which own the Research, Plan, and Review stages instead. The test is read
  off team.md rather than off a profile name, so a consumer who edited a root or hired an extra
  specialist is judged on the roster they actually have. A plan naming one candidate stays the
  unchanged single-developer shape, which is the ordinary case for default
  (squad-roster.instructions.md, squad-autopilot.instructions.md, gates-and-modes.md,
  squad-coordinator.agent.md, squad-lead.agent.md).

  The narrower term deliverable-producing role survives and now names one thing only: the roles
  whose output the Implementation Gate treats as the turn's substantive output alongside developer.
  That gate is unchanged.

Consumer install

Pin to this version:

apm install "Peter-N91/hve-squad#v0.16.1"

v0.16.0

Added

• The squad ran in VS Code and had no entry point anywhere else. /squad-document,
  /squad-governance-report, and /squad-learn existed only as prompt files, which the Copilot CLI
  and the Copilot app never read. All three now ship as agents selectable on any host, with their
  prompts reduced to thin wrappers so VS Code keeps its slash-command ergonomics
  (squad-src/.github/agents/squad/).

• A dispatched agent could run without the squad's non-negotiable rules. Every squad instruction
  file is gated on **/.copilot-tracking/squad/**, so an agent that had not yet touched squad state
  ran without them. A new squad-floor.instructions.md is scoped ** and carries dispatch
  discipline, the single-writer Scribe rule, the state paths, and proof of dispatch on every turn
  (squad-src/.github/instructions/squad/squad-floor.instructions.md).

• Consumers discovered host limits by hitting them. The usage guide now documents per-host
  invocation, the agent-name convention, the four remaining host limits, and why a fixed session model
  beats auto when cost attribution matters (docs/usage.html).

• Nothing checked that the package a consumer installs is internally consistent. A Tier 0
  conformance suite now asserts against the delivered tree: rosters resolve to delivered agents or
  registered opt-in external ones, claimed skill references exist, agent bodies fit the host cap,
  prompts bind to a real agent or a reserved host mode, the always-on floor ships with
  applyTo: '**', and every squad artifact is declared in apm.yml. It invokes no model and reads
  no secret, so it gates pull requests as well as releases
  (tests/tier0/, .github/workflows/tier0-conformance.yml, tests/squad-behavior-contract.md).

• A pull request branch cannot be installed, so it could not be tested. The manifest's
  self-references are bare paths, so APM resolves them against the default branch and reports every
  file a branch adds as missing. Tier 0's source mode installs the manifest, then overlays the
  branch's squad-src/ on top, which is the tree that branch would deliver once merged
  (tests/tier0/Invoke-Tier0Tests.ps1).

• That workaround still aborted on the branches most worth testing. A branch that adds a
  squad artifact makes apm install exit non-zero, and source mode threw before a single case
  ran — so any additive branch reported nothing rather than a result. Source mode now tolerates
  an install failure only when every unresolved reference names a file present in the working
  copy, which is precisely the file the overlay is about to supply. A failure naming anything
  else still aborts (tests/lib/SquadInstall.psm1).

• Nothing verified the state a squad run leaves behind. A Tier 1 state contract now asserts the
  files Init seeds, the shape of state.json, dispatch history as proof a stage ran, and the
  consumption ledger's arithmetic — that every cost follows from its tokens and rates, that rates
  match consumption-rates.md, and that the run total is the sum of every recorded block rather than
  of the latest turn alone. The runs are nondeterministic; the assertions are not, because they read
  files. A self-check generates a schema-correct fixture and then mutates it once per rule, requiring
  the contract to catch each break — a suite that cannot fail is not evidence
  (tests/tier1/).

• Nothing exercised a real run. A Tier 1 live harness now provisions a scratch repository
  per scenario, installs the package into it, copies a small fixture over it, and drives real
  headless turns before the state contract reads what was left behind. The model is pinned
  because a headless run ignores the model: frontmatter the editor honors, every turn is
  bounded, and a failed scenario is retried once with both attempts kept so a flake is
  separable from a regression (tests/tier1/Invoke-Tier1LiveRun.ps1,
  tests/tier1/scenarios/, .github/workflows/tier1-behavior.yml).

• A squad can write a valid tree while quietly routing to a different cast. Tier 2 scores
  each run against a golden baseline on four facts read from disk: the roles dispatched, the
  deliverable roots and types produced, the gate verdicts recorded, and — only when asked —
  whether the answer is materially equivalent. Deliverables compare as root and type rather
  than filename, because the topic slug is the model's to choose while the root is the
  roster's promise. Advisory until the noise floor across repeat runs is measured
  (tests/tier2/, .github/workflows/tier2-semantic.yml).

• A release could be cut over a broken package. The release workflow now runs Tier 0 twice:
  once against the ref being released, and once against the tag it just pushed. Only the second
  can assert that the tag pinned its own self-references, because that check needs a ref to
  install — and a tag that freezes the dependency list but not its contents is the defect that
  made earlier tags non-reproducible. A failure there leaves a tag but no Release
  (.github/workflows/release.yml).

• The state contract had no live run to assert against. A Tier 1 harness now provisions a
  scratch repository per scenario, installs the package into it, copies a tiny fixture on top, and
  drives real headless Copilot CLI turns before handing the resulting tree to the state contract.
  Scenarios cover Init, an ordinary routing turn, and promotion from a single squad to a federation
  with a cross-sub-squad handoff. The model is pinned because a headless run does not read the
  model: frontmatter the editor honors and results are otherwise incomparable; every turn carries a
  timeout, and a failed scenario is retried once with both attempts kept, so a flake is
  distinguishable from a regression
  (tests/tier1/Invoke-Tier1LiveRun.ps1, tests/tier1/scenarios/, tests/fixtures/,
  .github/workflows/tier1-behavior.yml).

• A squad can write a valid tree while quietly routing to a different cast. Neither Tier 0 nor
  Tier 1 can see that. Tier 2 now reduces each run to four deterministic facts — which roles ran,
  which deliverable types landed at which roots, which gates fired with which verdict, and what the
  run answered — and scores them against a golden baseline captured from a known-good release. Only
  the answer is prose, and it is judged only when asked for. The tier is advisory until the noise
  floor across repeat runs is measured, because a gate that blocks on unmeasured variance gets turned
  off. Its comparator carries its own drift controls
  (tests/tier2/, .github/workflows/tier2-semantic.yml).

Changed

• Three squad agents exceeded the 30,000-character host limit and fifteen declared model: as a
  YAML array the Copilot CLI rejects outright. An over-cap profile is why a selected coordinator
  could answer as a plain model, and a model: array makes an agent fail to load entirely. The
  coordinator, federation coordinator, and Scribe now bind to the squad skill through a named Skill
  Reference Contract and fit the cap; squad SKILL.md was split into ten topic reference files so
  each agent loads only its own role's procedure, and the Scribe reads the seeding, consumption, and
  federation files only when the turn's payload writes them; and every model: is now a single string
  (squad-src/.github/agents/squad/, squad-src/.github/skills/squad/references/).

• The Model Attribution ladder described host behavior that measurement contradicted. A valid
  frontmatter pin beats --model, an unentitled pin is substituted silently on the dispatch path with
  no warning, and auto overrides a subagent's pin entirely. The ladder now leads with the
  host-reported dispatch model, so the consumption ledger records what actually ran rather than what
  was requested (squad-src/.github/instructions/squad/squad-state.instructions.md).

• Updated hve-core dependency pin to 8d21777 (8d21777065f2f32fab4260c1366931e66f7bc51f).

• Updated hve-core dependency pin to 5b2119e (5b2119e3c924738b200ef31baaf4672a0e6938d8).

• The consumption block stored the same fact a dozen times and could store it wrong each
  time. Every per-dispatch block carried the four token rates and a derived est_cost_usd and
  est_credits alongside its own token counts — so a rate that belongs to a model was restated once
  per dispatch, and a cost fully determined by its own inputs was stored next to them where the two
  could disagree. A live Copilot CLI run showed both failure modes in one turn: a block carrying
  Claude Sonnet 5's rate fields whose cost had been derived at Claude Sonnet 4.6's rates, and an
  orchestration block whose recorded cost was 2.2× what its own numbers produced.

  The block is now ten fields and records consumption only — model, model_source, priced_as,
  model_tier, internal_turns, the four token counts, and basis. input_rate, cached_rate,
  cache_write_rate, output_rate, est_cost_usd, and est_credits are gone from history/
  entirely. Cost is derived once per role in consumption.md, from that row's summed token columns
  and the rates of the row priced_as names in consumption-rates.md, which remains the single
  source of rates. priced_as is what carries the pricing decision from the dispatch to the ledger.

  Four of the run's five consumption defect classes cease to exist rather than being caught later:
  there is no rate field to copy wrongly, no rate to contradict a tier, no per-block divide to slip a
  decimal on, and no second copy of a cost to disagree with the first. The arithmetic that remains
  happens once per row in one table a reader can check at a glance. Nothing is lost — every role
  still has its own cost row in consumption.md; it simply stops being written twice.

  The Tier 1 contract moves with the shape: per-block assertions for rates, cost, and credits are
  replaced by a p...

v0.15.3

Changed

• SQL migration guidance duplicated an upstream questionnaire and could drift from its policy. Squad SQL Migration Advisor now prefers the recommend-migration-path and generate-migration-prerequisite-plan skills installed through the upstream sql-migration-advisor plugin, preserves the bundled advisor as a recommendation-only compatibility fallback, and routes prerequisite/readiness requests explicitly (squad-src/.github/agents/squad/squad-sql-migration-advisor.agent.md, squad-src/.github/skills/sql-migration-advisor/SKILL.md, and the squad roster and routing instructions).

Fixed

• The Squad Coordinator could activate a specialist skill before dispatching its owning agent.
  Dispatch discipline now keeps classification metadata-only and leaves project, plugin, and bundled
  specialist skills inactive until the resolved specialist runs
  (squad-src/.github/agents/squad/squad-coordinator.agent.md).

Consumer install

Pin to this version:

apm install "Peter-N91/hve-squad#v0.15.3"

v0.15.2

Changed

• Updated hve-core dependency pin to 594ee84 (594ee8480c9e65ad7eaee30f6cab8f0aa6cce814).

Fixed

• Every release tag served squad files from main instead of from the tag. The 47
  Peter-N91/hve-squad entries in apm.yml ship as bare paths, and APM resolves a bare path against
  the default branch — so a tag froze the dependency list but not its contents. Measured by installing
  #v0.14.0 and getting main's coordinator back, while the hve-core entries in the same manifest
  resolved correctly because they carry #<sha>. release.yml now pins the self-references to the tag
  it is cutting and pushes that commit straight to refs/tags/, so a release installs the files it was
  built from (.github/workflows/release.yml, scripts/Set-SquadSelfRefPin.ps1). main keeps the
  unpinned manifest, so development installs still track main. Tags before v0.15.2 remain unpinned.

Consumer install

Pin to this version:

apm install "Peter-N91/hve-squad#v0.15.2"

v0.15.1

Changed

• The discovery gate shipped with no consumer documentation. The usage guide now covers it as a
  sibling of the intake gate — the inverse triggers that chain a brainstorm into a validation, why it
  is offered rather than automatic, the four trigger conditions, the quick/standard/deep/skip
  depth tiers, and why it stays silent outside the product and full profiles while the intake gate
  escalates. The discovery= and owner= inputs are documented for the first time (docs/usage.html,
  docs/index.html).

Consumer install

Pin to this version:

apm install "Peter-N91/hve-squad#v0.15.1"

v0.15.0

Added

• The squad had a front door for weak inputs and none for absent ones. The intake gate validates requirement artifacts when they exist; a request with nothing written down went straight into research on framing nobody examined. The new opt-in discovery gate (squad-src/.github/instructions/squad/squad-discovery-gate.instructions.md) fires on the inverse trigger — no input artifact, a goal rather than a settled task — and produces a brief the intake gate then validates. The two gates chain rather than loop.
• It is offered, never automatic, and never unattended. Validation can be automatic because assessing a document is something an agent does alone; ideation cannot, because the value of a brainstorm is the human's ideas. The coordinator asks once per topic and honours a discovery=quick|standard|deep|skip input on /squad and /squad-federation. On a Watch Mode or headless run no offer is made, a discovery= argument is ignored, and the triggering payload becomes the intake gate's input instead.
• The offer is scoped to the product and full profiles, the only rosters carrying the roles the gate dispatches — analyst writes the brief at every depth and no other profile seeds it. Elsewhere the gate is silent rather than escalating, which is the deliberate difference from intake-validator: an input that exists and goes unvalidated is a skipped check worth interrupting for, while an unrequested brainstorm is not. An explicit discovery= is still honoured on any roster, with one combined escalation naming the roles it must add.
• The dispatched roles interview the user rather than answering for them. Each puts its questions through the question tool one at a time and waits, the same discipline Squad SQL Migration Advisor already follows here. A role that cannot reach the user returns its outstanding questions instead of inventing the answers, and the session stops — a brief built from an agent's assumptions is the failure the gate exists to prevent.
• Depth tiers scale the session to the decision and introduce no new role: quick dispatches analyst; standard adds designer (resolved to DT Coach) for How-Might-We framing and divergent ideation; deep adds challenger and experimenter. Only analyst writes a file — the brief, in the existing analyst Deliverable Root — so one session leaves one artifact.
• The discarded options are recorded with their reasons. The Squad Scribe writes a ## Discovery Verdict to decisions.md (including on a decline, which is what stops the gate re-offering), carrying the framing, every option considered with why it was chosen or discarded, objections, the riskiest assumption, and the open questions research inherits.
• Federation asks the question once and applies it per qualifying sub-squad, the same ask-once contract that already governs member naming and the approval channel. Each product or full sub-squad still runs its own session and writes its own brief and verdict under its own root; sub-squads on other profiles run unchanged, and the federation plan meta-stage never brainstorms on a sub-squad's behalf.

Changed

• The published docs did not describe how a fix ships without shipping everything else. Added the hotfix procedure, the ref release input, and the release-merge-back label to the contributing and maintaining pages, and documented the rolling pre-release channel on getting started and troubleshooting.

• Every merge cut a release. A fragment landing on main assembled the CHANGELOG, bumped apm.yml, and tagged immediately, and the daily hve-core sync cut a release of its own on top, so a quiet week still produced several versions and nothing was ever installed before it shipped. Releasing is now a deliberate act: .github/workflows/release-prep.yml runs on manual dispatch only, ships everything pending as one version at the highest bump any fragment asked for, and nothing goes out on a timer.

• Merged work is now installable before it ships. .github/workflows/preview.yml keeps a single GitHub pre-release in sync with main, tagged with the version the pending fragments resolve to (v0.15.0-pre) and force-moved on every merge, so a change can be installed and tested the moment it lands. It only reads: no fragment is consumed, no version is bumped, and CHANGELOG.md is untouched. A quick fix can ship as soon as it is verified there, while a larger change sits in preview until it is ready.

• The hve-core sync queues instead of releasing. .github/workflows/sync-hve-core.yml now records a pin move as a change fragment and pushes it, leaving the release to a maintainer. The cast-delta guard and the Watch Mode handoff are unchanged.

• A fix can ship without shipping what is not ready. A release carries a commit, so a tag cut from the default branch contains everything merged into it. release-prep.yml and release.yml accept a ref input, which lets a hotfix be cut off the last release tag and released on its own, leaving the pending batch and its preview untouched. release.yml also declines the Latest badge when the version it is cutting is lower than the current latest, and pr-validation.yml accepts a release-merge-back label so the hotfix can be merged back with the release state Release Prep already wrote.

• Invoke-ReleasePrep.ps1 gained -SectionOutFile and -InstallRef so the preview can render the pending release notes and point the install snippet at the preview tag without consuming anything.

• Updated hve-core dependency pin to 2a333df (2a333df05cc5aa85d2dc9db834958b717c888bf9).

• Updated hve-core dependency pin to c91c782 (c91c7823188fef4d1ca7558c1c868b05be3aa3c2).

• Updated hve-core dependency pin to 26b9712 (26b97122e19d6ff271b0b6f0401c92bb12eda03b).

Consumer install

Pin to this version:

apm install "Peter-N91/hve-squad#v0.15.0"

v0.14.0

Changed

• HVE Core retired its entire dispatchable data-science agent cast (DS Gen Data Spec, DS Gen Jupyter Notebook, DS Gen Streamlit Dashboard, DS Test Streamlit Dashboard) and its Evaluation Dataset Creator, replacing them with reference-pack skills and a disable-model-invocation: true orchestrator (Data Workstream Coach) that runSubagent cannot reach. A new squad-owned charter, Squad Data Scientist (squad-src/.github/agents/squad/squad-data-scientist.agent.md), now serves the data-scientist role's Primary, running the ds-catalog, ds-analysis-authoring, ds-dataops, ds-feasibility, and ml-experimentation skills, and reaches the existing Power BI/Fabric skills explicitly instead of ambiently. Squad Prompt Engineer now also runs ds-evaluation-design for the prompt-engineer role's eval-dataset alternate, replacing the retired Evaluation Dataset Creator. apm.yml moves to hve-core@2be87b7.

Consumer install

Pin to this version:

apm install "Peter-N91/hve-squad#v0.14.0"

v0.13.2

Fixed

• A federated sub-squad's artifacts could still be created outside the member. The Deliverable
  Roots table is now explicitly squadRoot-relative, and the Scribe resolves each root against the
  squadRoot it was handed at seed time before writing it into the roster — so a sub-squad's
  team.md reads .copilot-tracking/squad/members/product/plans/ rather than the bare
  .copilot-tracking/plans/, and its research, plans, PRDs, changes, and reviews are created inside
  the member. Federation Init and Expansion verify the seeded roster before moving on, and a
  promotion rebases the relocated roster's cells so every role keeps pointing at its own relocated
  artifacts. docs/ and outputs/ remain the two exceptions and stay at the repository root
  (squad-src/.github/instructions/squad/squad-roster.instructions.md,
  squad-src/.github/agents/squad/squad-scribe.agent.md,
  squad-src/.github/agents/squad/squad-federation-coordinator.agent.md).

• Editing a role's Deliverable Root in team.md had no defined effect. The roster cell is now
  the running value and the table is only the seed-time default: the coordinator states each
  dispatch's write path from the row it just resolved, the Artifact Gate looks for the artifact at
  that same cell, and a roster refresh preserves an edited cell instead of normalizing it back. A
  consumer pointing a role at their own directory therefore takes effect on the very next dispatch
  with no reseed (squad-src/.github/instructions/squad/squad-roster.instructions.md,
  squad-src/.github/agents/squad/squad-coordinator.agent.md,
  squad-src/.github/agents/squad/squad-researcher.agent.md).

• /squad-document is unaffected by the rebasing and now reads the squad's deliverables. Its
  default output stays at the repository-root docs/, which the rebasing rule already exempts, and
  that exemption is stated where the path is derived so a future change does not rebase it under a
  sub-squad. Its search step also resolves the Deliverable Root paths from team.md rather than
  assuming the repository-root tracking paths, so a federated run grounds on the sub-squad's own
  artifacts (squad-src/.github/prompts/squad/squad-document.prompt.md).

• Promoting a single squad to a federation left the squad's own work behind and could delete it.
  Promotion moved only the state tree, so every artifact produced before the promotion —
  brd-sessions/, plans/, details/, research/, changes/ — stayed at the repository-root
  tracking paths while the roster's deliverable roots had already rebased under members/<name>/.
  Promotion now relocates those directories too, enumerated from disk rather than from the
  Deliverable Roots lookup table (which names the roots the cast writes today, not every directory
  a session produced) and confirmed with the user in Phase 1; docs/ and outputs/ stay at the
  repository root, and a Watch Mode promotion moves everything under .copilot-tracking/ except
  squad/ and records the list in its decision entry
  (squad-src/.github/instructions/squad/squad-federation.instructions.md,
  squad-src/.github/agents/squad/squad-federation-coordinator.agent.md,
  squad-src/.github/agents/squad/squad-scribe.agent.md).

• A promotion could clear the source before writing the destination, then report it could not find
  the files to move. Every move is now an explicit copy → verify → delete-source sequence, per
  file: write the destination, read it back, and only then remove the source. Nothing at the source
  is removed, cleared, or truncated before its verified destination copy exists, and a failed
  destination write stops the promotion with the source intact — a partially relocated tree is
  recoverable and a deleted source is not
  (squad-src/.github/instructions/squad/squad-federation.instructions.md Copy, Verify, Then
  Delete, squad-src/.github/agents/squad/squad-scribe.agent.md Step 10).

• A promotion produced no consumption accounting, so the new federation reported a zero-cost first
  turn over a sub-squad carrying a populated ledger. The Scribe now runs its consumption step for a
  promotion payload scoped to the relocated sub-squad root, rewrites members/<name>/consumption.md
  from the relocated history, and seeds the federation state.json currentRun totals from that
  ledger's total row. The Federation Coordinator verifies the relocation by reading
  members/<name>/ back before confirming, rather than asserting success
  (squad-src/.github/agents/squad/squad-scribe.agent.md,
  squad-src/.github/agents/squad/squad-federation-coordinator.agent.md).

• state.json was seeded at Init and then never advanced. No Scribe step touched updated,
  turn, mode, activeRoles, or openEscalations, so a squad appended decisions and history
  every turn beside a status document still reading turn: 0 — and in a federation, a routed turn
  left the federation's own state.json untouched entirely. A new Scribe Step 12 advances the
  file on every turn that writes anything, as a read-modify-write that carries schemaVersion,
  notify, trigger, currentRun.sessionModel, and currentRun.modelOverrides forward instead of
  resetting them, and leaves the cost totals to the consumption step. Both coordinators now hand the
  advance on the same call that appends the logs, and both verify it before reporting the turn done
  (squad-src/.github/agents/squad/squad-scribe.agent.md,
  squad-src/.github/agents/squad/squad-coordinator.agent.md,
  squad-src/.github/agents/squad/squad-federation-coordinator.agent.md,
  squad-src/.github/instructions/squad/squad-state.instructions.md).

• A federation root never got its history/ directory. The Scribe's history step defines the
  file as history/<agent>.md for a dispatched agent and requires a paired consumption block, so a
  federation-level entry — which names a sub-squad, not an agent, and whose cost is already recorded
  in that sub-squad's own ledger — fell outside the step and was silently dropped. The step now
  covers it explicitly as the one history append that stands alone, the federation coordinator's
  completion checklist catches a root that only grows its decision log, and the federation
  conventions state exactly which files a healthy federation root holds and which are legitimately
  absent (squad-src/.github/agents/squad/squad-scribe.agent.md,
  squad-src/.github/agents/squad/squad-federation-coordinator.agent.md,
  squad-src/.github/instructions/squad/squad-federation.instructions.md).

• A federated sub-squad could not reach another's work, and nothing said how it should. A run
  scoped to members/azure/ resolves every path under its own root, so a product sub-squad's PRD
  at members/product/plans/ was invisible to it — and a sub-squad's inner run never reads
  federation-level state, so the federation decisions.md was not a discovery mechanism either. The
  only prior mention of a handoff was one line in the federation autopilot instructions, with no
  mechanism and nothing for an interactive turn. A new Cross-Sub-Squad Handoff contract makes the
  Squad Federation Coordinator — the only component that sees both roots — resolve the producer's
  artifacts from its team.md deliverable roots, verify each file on disk rather than infer it,
  and hand them to the consumer as explicit read-only inputs= paths. The producer runs to
  completion first, the pair is not parallel-eligible for that turn, the consumer never writes across
  the boundary, and the handoff is recorded in the federation decisions.md so a two-sub-squad
  outcome stays reconstructable (squad-src/.github/instructions/squad/squad-federation.instructions.md,
  squad-src/.github/agents/squad/squad-federation-coordinator.agent.md,
  squad-src/.github/agents/squad/squad-coordinator.agent.md,
  squad-src/.github/instructions/squad/squad-federation-autopilot.instructions.md).

• A missing upstream artifact had no defined recovery. Stopping is the safety property, not the
  outcome, and a consumer left to work the requirements out for itself returns a complete-looking
  deliverable built on requirements the producer never agreed — a divergence nothing in the output
  reveals. A new recovery ladder mirrors the bounded auto-remediation loop of the intake gate rather
  than inventing a second vocabulary: run the registered producer and resume the consumer in the
  same turn, or re-dispatch only the producing stage when the artifact is partial or stale, or
  offer Federation Expansion when no sub-squad owns the artifact, or take a user-supplied path or a
  user's explicit decision to proceed with the gap recorded as an assumption. Interactive turns state
  what will run and wait; autopilot and Watch Mode proceed unasked, because dependency-first ordering
  was already settled at the plan meta-stage. The loop is capped at one producer run per handoff per
  turn, and every recovery dispatch is a Scribe-recorded stage with its own consumption block
  (squad-src/.github/instructions/squad/squad-federation.instructions.md,
  squad-src/.github/agents/squad/squad-federation-coordinator.agent.md).

Consumer install

Pin to this version:

apm install "Peter-N91/hve-squad#v0.13.2"