v1.5.1 — Upstream Adoption & Quality-Compactness

The upstream-adoption & quality-compactness release. Three upstream kits were mined by multi-agent recon — samber/cc-skills-golang v1.7/1.8, everything-claude-code v2.0, and ponytail v4.8.4 — with every adopted claim re-verified against real files and a real Go 1.26.4 toolchain before landing. Every change was applied by Opus and independently verified by Claude Fable 5, card by card. Headline component counts are unchanged (56 agents / 16 commands / 42 hooks / 22 skills / 19 rules); no breaking changes.

🐛 Shipped-defect fixes (things the kit taught or did wrong)

• synctest.Run → synctest.Test — two Go references taught the superseded Go 1.24 experimental API; migrated to the 1.25+ stable signature (Test(t, func(t *testing.T)), go-doc-verified) with an experimental/stable caveat in both files.
• fx blocking-OnStart — our own di-frameworks.md example modeled the exact anti-pattern fx warns against; the accept loop now runs in a goroutine, OnStop honors ctx/StopTimeout. google/wire's Aug 2025 archival is now flagged in the section, the recommendation table, and stay-updated.md.
• --force-with-lease finally usable — block-dangerous-git.sh blocked the exact safe command its own message recommends. The force-push guard is now token-aware; refspec-force (git push origin +main) is now caught; a new working-tree-discard gate covers git checkout ./--/-f, git clean -f*, git switch --discard-changes/-C — all backed by a 26-case regression suite.
• Tool-directive contradiction — module-management.md taught only go install ...@latest while go-modernizer already ran go tool; it now teaches Go 1.24 tool directives with a pinned govulncheck default.

🚀 Go 1.25/1.26 currency + security stream

• stay-updated.md / modernize-guide.md no longer stop at 1.24: wg.Go, errors.AsType[E error] (the real constraint per go doc — not the rumored [E any]), reflect.TypeAssert, container-aware GOMAXPROCS (automaxprocs now redundant), Green Tea GC (1.25 experimental → 1.26 default), ReverseProxy.Rewrite, stdlib crypto/pbkdf2/hkdf/sha3 (pbkdf2.Key returns an error — examples show it), one cautious json/v2 line.
• security-checklist.md: path-traversal defense now leads with os.Root confinement (with the honest negatives: Clean+HasPrefix is NOT confinement; os.Root is NOT a full sandbox), filepath.IsLocal+Rel lexical fallback for <1.24, stdlib CSRF via http.CrossOriginProtection (1.25+), and bcrypt's 72-byte ErrPasswordTooLong handling.

📚 Five new Go references (29 → 34)

• refactoring-mechanics.md — the behavior-preserving transform ladder: gopls code actions → gofmt -r → eg → gopatch → go/analysis+SuggestedFixes → go fix///go:fix inline (1.26+) → dave/dst → deadcode -whylive, each with exact commands and gotchas, plus the never-sed rule and rename→struct-tag/reflect/template desync check. testing-patterns.md gained the companion coverage-adaptive safety net (≥80/40-80/<40 tiers, characterization tests, object seams).
• cli-cobra-viper.md — the missing Go CLI surface: Run* hook order, child-PersistentPreRunE-replaces-parent trap, RunE-over-Run, Args validators, and the viper env-trio silent failure with a WRONG/CORRECT pair.
• gopls-driving.md — opt-in gopls MCP semantic navigation (8 tools, blast-radius-before-edit workflow, static-dispatch caveats); inert unless you register the server.
• rest-openapi-patterns.md — swag v1 code-first (v2 marked RC/preview) vs oapi-codegen spec-first, the three lying-spec traps, swaggerignore on secrets, and a graded review checklist (Swagger UI ungated in prod = CRITICAL).
• troubleshooting.md — live runtime triage: symptom→first-move table, Delve, GODEBUG traces, goroutine dumps, safe production pprof, the -race -count=100 flaky recipe.

🔍 Evidence Gate now covers external symbols — all six stack reviewers

A finding that hinges on a stdlib/third-party API's contract must be verified against the installed artifact — go doc (Go), node_modules type declarations (TS), inspect.signature/pydoc (Python), the local cargo registry (Rust) — or labeled ASSUMED. Never asserted from memory. Applied to go/go-error/go-concurrency/ts/py/rs reviewers and all six Codex mirrors; the upstream godig binary/MCP dependency was deliberately rejected (stdlib-only, offline-safe).

🪜 Solution Ladder (adopted from ponytail — after a 4-agent audit: craftsmanship A−, supply chain CLEAN)

The always-on coding-style.md rule now carries the 5-rung ladder — YAGNI → reuse-in-codebase → stdlib → native platform feature → installed dependency; a NEW dependency is the last resort — plus a canonical YAGNI anti-pattern list, an evidence-shaped Search First (name the precedent file:line), the deliberate-simplification comment convention, and the safety counterweight in the same breath: validation, error handling, security, accessibility, and anything explicitly requested are never simplified away. /dev Phase 7 walks the ladder; minimal-change-engineer gained stdlib:/native: creep categories; Codex AGENTS.md mirrors it all.

🔧 Workflow discipline & templates

• /workflow bugfix is red-first (Triage writes the failing repro test; Fix must turn it green) and refactor gained a Baseline step (green suite — or characterization tests — before any change).
• Lean ADR template (docs-templates/adr-template.md) with an opt-in /dev Phase 2 nudge — the rejected alternatives the Architect already produces stop being thrown away.
• docs/recommendations.md reframes MCP servers as an add-sparingly hygiene note (two-part test, per-turn schema-token cost, pin-your-versions), mirrored into Codex INSTALL.
• code-style.md gained a doc-comment quality rubric (6 anti-patterns: paraphrase, marketing vocabulary, invented rationale…); go-safety.md gained //nolint discipline (suppressed security linter = CRITICAL); reality-checker demands demonstrated side effects for background-job claims.

📟 Statusline: context fallback

statusline.cjs no longer renders a blank or mis-scaled ctx% on CLIs without native context_window — it reconstructs usage from the transcript's latest usage record and resolves the window via CLAUDE_CONTEXT_TOKENS_MAX → [1m] model marker → >200k heuristic → 200k default. Fully fail-open; native path byte-identical.

🧪 Test infrastructure

• block-dangerous-git_test.sh — 26-case pass/block matrix for the hardened git guard.
• mirror-invariants_test.sh — 79 assertions pinning invariant substrings on both sides of the six Claude↔Codex reviewer pairs, severity enums, the Solution-Ladder mirror, and the Go-reference count vs CLAUDE.md. Claude↔Codex drift now fails CI instead of waiting for a human checklist. 13 suites total, all green.

🧹 Verification before tagging

The release was gated by a two-auditor documentation sweep + full test matrix (28/28 npm tests incl. fresh-install smoke, 13/13 hook suites, 210-file frontmatter scan): it corrected the fast hook-profile description in five docs to match profile.sh reality, a phantom "47 checks" in Codex INSTALL, guide-07's rule inventory (all seven rules, real line counts), and two YAML-breaking SKILL.md descriptions.

---

Full changelog: CHANGELOG.md · Previous: v1.5.0