v3.5.0

Added

• Added a model-independent semantic context gateway for Codex and Claude.
  Cross-version host configs deliver stable, bounded, integrity-checked context
  from case-sensitive exact focuses and shared policy, with complete internal
  edges and atomic receipts. Emission is verifiable; comprehension is not.
• Added a repository-only semantic project graph for maintainers and coding
  agents. An Espree-backed compiler maps capabilities to commands, hooks,
  modules, exports, configuration, tests, canonical docs, and package files;
  every relationship carries evidence and an explicit certainty. Deterministic
  tree/impact JSON queries report bounded retrieval bytes, while source
  fingerprints and drift checks reject stale caches and invalid claims. The
  graph remains local, does not run in normal hooks, and is excluded from the
  published npm package.
• Added the beginner-friendly panic command: one deterministic, read-only
  view of the current Git state with explained inspection steps and narrowly
  gated, content-preserving unstage or previous-branch options. It covers
  detached HEAD, active merge/rebase/cherry-pick conflicts, staged and deleted
  changes, untracked files, and recent branch switches without executing a
  recovery operation or displaying commands that discard work or force
  history changes.
• Added an opt-in, advisory-only staged debug-artifact check with curated
  language-scoped rules for common JavaScript, Python, Ruby, and explicit
  temporary-comment markers. It scans only added lines through the existing
  structurally validated Git patch parser, excludes documentation, fixtures,
  snapshots, and effective generated paths by default, supports deterministic
  path-glob exemptions, aggregates human output, and publishes stable JSON
  check, subtype, and rule identifiers without changing the strict schema-v1
  finding shape. Unavailable or malformed diffs warn and still allow the
  commit.
• Added non-destructive init/doctor --integration[=<manager>]
  coexistence for Husky, Lefthook, and the Python pre-commit framework. Setup
  prints exact project-local snippets, automatic detection refuses ambiguous
  ownership, install-time verification requires the manager's executable Git
  dispatcher without rewriting it, and uninstall preserves every
  project-owned manager entry. lint-staged remains an explicitly separate
  command in the existing hook flow.
• Added a tested, fail-closed pull-request change classifier. Pure
  documentation and metadata changes retain DCO, static quality, formatting,
  dependency audit, and focused documentation, schema, link, asset, release,
  and workflow-policy tests while skipping the irrelevant compatibility
  matrix; every deletion, rename, copy, other category, mixed change, unknown
  path, ambiguous Git status, shallow history, diff failure, or classifier
  failure runs the full required graph. The focused path also derives the
  canonical 100% badge directly, so a README edit cannot falsify or stale it.
  Pull requests execute the classifier from the immutable base commit rather
  than trusting fork code. CI Success accepts skips only for the classifier's
  exact, internally consistent documentation-only result.
• Added a reusable before/after workflow graphic and social-ready 16:9 export,
  pairing the existing 26-second terminal demo with consistent README, package
  metadata, rationale, and launch messaging: catch mistakes while they are
  still cheap to fix, get the exact safe command, and keep CI authoritative.
• Added an upload-ready Product Hunt media pack with a square thumbnail and
  four deterministic gallery cards showing the before/after story, two-command
  setup, advisory warning, and safe fix flow.

Changed

• Replaced direct npm publishing with stage-only OIDC and human 2FA approval.
  The exact candidate, source, toolchain, draft, provenance, and four recovery
  states are verified before an npm-incapable GitHub finalizer runs.
• Refactored the packed package-manager lifecycle from one monolithic smoke
  script into named node:test phases over one shared disposable fixture.
  Exact-tarball inspection, real Git hooks, workspace and worktree behavior,
  clone repair, uninstall ownership, and the npm/pnpm/Yarn/Bun CI matrices
  remain intact, while failures now identify the lifecycle phase directly.
• Simplified the before/after graphic into a picture-first, jargon-free story:
  send, wait, find a mistake, and redo versus spot it, fix it, and send once.
• Redesigned CLI help around described setup, check, and fix actions, with the
  installed version, examples, safe command-specific help, and a separate
  integration section for commit-msg, normally invoked automatically by Git.
  The low-level fix-staged-js package compatibility command remains callable
  but no longer competes with the safer developer-facing fix action in primary
  help.

Fixed

• Made Husky, Lefthook, and pre-commit coexistence entries select only the
  first regular executable project-local launcher from the exact extensionless,
  .exe, .cmd, and .bat candidates. Missing, pruned, wrong-kind, or
  non-executable launchers now fail open silently without a PATH/global
  fallback, while literal hook argv and real blocking exits still propagate.
• Hardened hook-manager coexistence verification: Lefthook snippets are static
  and resolve the active commit-message path inside Commitment Issues,
  effective Lefthook wrappers must forward hook arguments, pre-commit wrappers
  must contain a real dispatch, and linked Husky roots/runtime directories are
  rejected without reading through them. Custom executable Husky v8 hooks
  remain valid unless they explicitly source an invalid _/husky.sh runtime.
  Active older direct, duplicate, and cross-stage Commitment Issues calls are
  reported for targeted replacement, removal, or relocation instead of being
  hidden by a healthy guarded entry. A cross-stage-only hook also retains its
  missing own-stage snippet so relocation alone is not presented as complete.
  Init and doctor now print remediation snippets only for inactive hook
  entries, so fully wired integrations are not told to add duplicates.
  Uninstall cleanup guidance also recognizes exact current and pre-dispatch
  manager entries even after custom commands, without treating them as healthy
  or changing manager-owned files.
  Lefthook's fixed package-owned file producer keeps empty commits and pushes
  inside the policy path, while canonical POSIX/Windows and workspace-root
  wrappers are inspected without executing repository-controlled manager code.
• The staged large-file guard now gives its fixed-argv, NUL-safe whole-index
  probe an explicit bounded output buffer instead of inheriting Node's roughly
  1 MiB default. Large indexes no longer silently disable oversized-file
  findings, and genuine Git or buffer failures remain advisory but visible.
• Pre-push now accepts the documented complete PRE_COMMIT_* range environment
  when the pre-commit framework has consumed Git's stdin. Manager-composed hook
  entrypoints honor COMMITMENT_ISSUES=0 and legacy HUSKY=0, and Husky
  snippets preserve nonzero blocking exits before later custom commands.
• Pre-commit lint, format, and staged-test checks plus configured pre-push tests
  now partition path arguments by one shared platform-aware byte/unit budget
  instead of passing an unbounded argv. Non-zero batches continue so every
  finding and test summary is aggregated, while one overall timeout still
  stops interrupted work and cleans up its process tree. The staged large-file
  guard now reads Git's NUL-delimited whole-index stage data and filters exact
  staged paths locally, removing its unbounded pathspec argv without weakening
  hostile-path handling.
• Contributor onboarding now distinguishes first-time locked dependency setup
  (npm ci) from the lighter hook verification and repair command
  (npm run doctor). The once-per-clone welcome names that repair task
  directly while retaining its detected package-manager command.
• Release evidence now treats the hosted workflow's single accepted tarball as
  the authoritative byte-level candidate and records each run's SHA-256,
  source, tag, runner OS/image, and exact Node/npm versions together without
  blessing a rejected rebuild. Local pre-release packs remain content and
  behavior evidence without promising identical compressed bytes across
  environments; Audit 9 now records both v3.4.0 artifacts accurately without
  changing the immutable release.
• Trusted npm publication now tolerates the registry's short metadata and
  attestation propagation delay. Only exact-version and exact-attestation HTTP
  404 responses receive bounded backoff inside a hard 60-second deadline;
  malformed data, unexpected statuses, and any package, tarball, provenance,
  source, or latest mismatch still fail immediately without republishing.
• Corrected the once-per-clone welcome so it accurately describes Commitment
  Issues in ordinary consumer repositories instead of claiming every project
  uses its own product.
• init --dry-run no longer tells an already-configured project to rerun and
  apply changes when there are no changes to apply. Dry runs that preview real
  setup work retain the apply instruction.