refactor-chain v4.7.0

refactor-chain v4.7.0

The Conductor. The method that produced the v4.6.6 hardening wave was run by hand: a chain-of-skills
per task, spec-kit commands per phase, and a multi-pass adversarial review until nothing new turned
up. This release ports that method natively, generalizes it to the whole plugin, makes it async by
construction, and proves it does not regress any existing behavior.

The Conductor

Given any task, the Conductor resolves the chain-of-skills (internal skills plus external installed
ones), maps the spec-kit (SDD) commands for the phase, and runs the generalized review loop. It is
both an always-on layer inside every run and a standalone /refactor-orchestrate command. Four new
engines carry it, all synchronous, deterministic, and zero-dependency:

• skill-registry assigns skills by capability, with a total tie-break and open-set discovery that
  matches a skill the catalog never listed by reading its own description.
• spec-kit maps the four real pipeline phases plus the prose phases onto the eight SDD commands,
  and gates auto-run behind mode and the .specify signal.
• conductor composes those two plus the standard spine, then partitions the work into what the
  host runs in parallel versus in order. It never mutates the run's steps.
• review-loop keeps the review going until a round adds nothing new, with a floor of at least
  three passes for a review-class target and a budget ceiling, then shapes a SPEC and a sprint plan
  from the findings.

Durability and safety

• The concurrency blocker is fixed. Recording a review lens was a read-modify-write on
  board.json that could silently drop a finding under parallel records. Each lens now writes its own
  round file, so parallel records never lose data. Old boards still aggregate.
• Records preserve unknown fields; every engine's command-line entry is space-safe and no longer
  crashes when invoked without a script path.
• The stop gate now also blocks a premature "done" while a review loop is still running, and session
  start surfaces a paused loop so it resumes cleanly.

Async, by construction

The engines stay synchronous and deterministic. All parallelism is the host dispatching the emitted
plan, so the same run reproduces byte-for-byte and a Codex-style runtime executes it sequentially
without a code change. A test asserts no engine contains fan-out primitives.

Non-regression and migration

A run that does not invoke the Conductor produces byte-identical state transitions to v4.6.6. The
change is additive: board.json keeps its version, state stays schema v3, and the loop metadata plus
per-lens files are optional with safe defaults. A run in flight when v4.7.0 installs resumes cleanly;
reset clears a run if you want a clean slate, and history is kept.

—
Ahmed "Ben" Zayed · Head of Products & Ventures at ZAT.VC [Venture Partner]

refactor-chain v4.6.6

refactor-chain v4.6.6

A final-version hardening wave. A four-pass adversarial self-review (the plugin's own Review
Board, run on itself) found that the pipeline's two load-bearing gates did not actually gate, plus
a long tail of correctness, installer, and detection defects. This release fixes all of them, each
with a test that fails against the old code.

Fixed — the gates now actually gate

• The "done" gate was unwired. The Stop hook meant to block a premature "done" checked
  phase === "done", a value the harness never sets (the real terminal phase is docs), so it
  approved the moment the last step advanced. It now gates on the review-gate step's verified
  status, so "done" is unreachable until the gate step passes.
• The mandatory 100% guidelines gate was bypassable. eval trusted a cached (or hand-written)
  guidelines.json, and an "exception" was any bare id in a self-written array. Now it always
  re-extracts the observed facts, and an exception counts only as a recorded
  {id, reason, approvedAt} object. A fabricated manifest or a bare-id array can no longer pass.
• The plan-phase decision window ran on wrong data. The principle recommendation dropped each
  language's family, so JS/Python/Go/Elixir got an empty or truncated set. Family is now resolved
  from the registry, so the correct per-stack principles surface.
• scope-fence was documentation, not a fence. The scope field it keyed on was never
  populated and its guard only recorded (PostToolUse). The matcher is now path-segment and
  separator-normalized (a node_modules/src path no longer counts as src/, and Windows
  backslash paths compare correctly), and the docs are corrected to describe it honestly.

Fixed — aggregation, harness, durability

• Review findings with a string confidence ("0.9") or behaviorChanged ("false") now aggregate
  identically to native types (string confidence was collapsing to 0.5 and flipping decisions).
• The dedupe merge reconciles verdicts, so a CONFIRMED duplicate is never masked by a SUSPECTED one.
• readState is guarded and state.json/board.json are written atomically (temp file + rename),
  so a corrupt or half-written file can no longer crash status/advance/doctor or the read-only
  Action. doctor reports corruption instead of hiding it.
• checkpoint no longer leaves the git index fully staged; baseline refuses to re-run mid-chain;
  init refuses to overwrite an active run; the board refuses to aggregate a partial round.
• risk-guard now catches the genuinely destructive commands it was missing (rm -r,
  find -delete, curl | sh, git checkout -- .) and stops nagging the safe --force-with-lease;
  the ship-file matcher no longer fires on .env.example or doc files.
• intake uses whole-word triggers, so "solidify" and "the refactoring book" no longer arm it.

Fixed — installers and CI

• No secret leak. Installing from a working clone no longer copies a token-bearing .env or
  the .git directory into ~/.codex (all four installers).
• Every installer verifies the harness scripts actually landed before printing success, so a
  partial copy fails loudly instead of registering hooks that point at missing files.
• The Windows Go binary uses npx.cmd; rcx --help no longer crashes; install.sh's Node-less
  uninstall warns instead of stranding hooks.
• CI now behaviorally exercises all four installers (shell, Node, Go, and PowerShell on a real
  Windows runner), the checklist scripts of all 56 skills, and the installer download path for real
  (the previous download-path test silently ran the local path instead).

Detection, registry, docs

• The secret scan now covers .go; the auth signal no longer false-fires on AUTHORS.md;
  Delphi/Pascal is one correctly-classified entry instead of two mis-mapped duplicates; the memory
  file is bounded; a committed or stale state.json no longer shows every teammate a phantom
  paused-run banner. STATE-SCHEMA.md was rewritten to match the actual state object.

—
Ahmed "Ben" Zayed · Head of Products & Ventures at ZAT.VC [Venture Partner]

refactor-chain v4.6.5

refactor-chain v4.6.5

Fixes a silent, serious bug: the curl | sh install installed almost nothing.

Fixed — curl … install.sh | sh installed ~1 skill instead of 57

When install.sh runs from a pipe (the advertised one-liner) it downloads and extracts the
GitHub tarball, then has to locate the plugin root inside it. Two bugs in that one line made it
resolve the source directory to the literal string -1:

1. head was shadowed. The script defines its own head() helper for printing section
   headers, so find … | head -1 piped the found path into that function, which ignores stdin
   and printed -1. (v4.6.3 fixed this exact shadowing on the version line but missed this one.)
2. -maxdepth 2 was too shallow. GitHub nests the tarball as
   refactor-chain-main/.claude-plugin/plugin.json (depth 3), so even without the head bug the
   find matched nothing.

With SRC set to -1, every copy read from -1/skills, -1/commands, etc., so the install
laid down almost nothing while still printing ✓ … installed. A classic silent failure.

The fix reaches the right depth and drops the head dependency:

SRC=$(find "$TMP" -maxdepth 4 -name plugin.json -path '*/.claude-plugin/*' 2>/dev/null \
      | sed -n '1s#/.claude-plugin/plugin.json##p')

Why CI didn't catch it (and now does)

The installer smoke test installed from the local checkout, where the source is found directly,
so the download path was never exercised. v4.6.5 adds a download-path smoke test: it packs the
checkout into GitHub's <repo>-<ref>/… tarball layout, points install.sh at it through a new
RCX_TARBALL_URL override (a file:// URL, offline), runs the real download path, and asserts at
least 57 skills land with a non-empty version stamp. That test fails against the old code.

Scope

Only install.sh was affected. The Node (bin/rcx.mjs), Go (installer/go/main.go), and
PowerShell (install.ps1) installers resolve the tarball root correctly (JSON parsing / adequate
recursion depth) and were verified during this fix.

—
Ahmed "Ben" Zayed · Head of Products & Ventures at ZAT.VC [Venture Partner]

refactor-chain v4.6.4

refactor-chain v4.6.4

Fixes the Go installer build that shipped red in v4.6.3.

Fixed — the Go installer wouldn't compile

The --update code added in v4.6.3 called skip(...) where the helper is actually named
skipMsg(...). Go only errors on unused imports and locals, but a call to a function that
was never declared is a hard undefined: skip compile error, so installer/go/main.go failed
to build. Because every release binary is compiled from that file, all five release.yml
cross-builds (linux/darwin/windows × amd64/arm64) and the CI gobuild job went red on v4.6.3.

This was mirrored code written without a local Go toolchain, which is exactly why the gobuild
CI job exists. It did its job and caught the typo; v4.6.4 is the fix.

• installer/go/main.go: skip(...) → skipMsg(...).
• ci.yml + release.yml: point actions/setup-go at cache-dependency-path: installer/go/go.mod.
  Our module lives under installer/go/, not the repo root, so this silences the "Dependencies
  file is not found" warning and enables the Go module cache.

Honesty about testing

The Node (install.sh, bin/rcx.mjs) --update paths remain verified end-to-end locally
(fresh-install stamp → --update reports the transition → planted orphan removed → scripts intact).
The Go fix is a single unambiguous identifier correction; with no Go toolchain in the dev
environment it is validated by the gobuild + release.yml cross-builds on this tag, which are
now expected to go green. The PowerShell path is still mirror-implemented, exercised on a real
Windows install.

—
Ahmed "Ben" Zayed · Head of Products & Ventures at ZAT.VC [Venture Partner]

refactor-chain v4.6.3

refactor-chain v4.6.3

The installer can now update itself: check the installed version, then reinstall cleanly.

Added — --update

curl -fsSL https://raw.githubusercontent.com/ahmedbenaw/refactor-chain/main/install.sh | sh -s -- --update

It reads the currently-installed version, reports current → new, then reinstalls cleanly:
old refactor-* skills and commands are cleared first, so a skill renamed between versions can't
leave an orphan behind, and the harness scripts + hooks are laid down fresh. Install now writes a
.rcx-version stamp so the update knows where you're coming from (a pre-4.6.3 install has no
stamp — --update says so and installs fresh).

Coverage and honesty about testing

• install.sh and bin/rcx.mjs are verified end-to-end — fresh install writes the stamp,
  then --update reports the transition, removes a planted orphan, and keeps the scripts.
• installer/go/main.go and install.ps1 carry the same logic, mirrored. I couldn't run Go or
  PowerShell in the dev environment, so CI now builds + vets the Go installer on every push
  (a new gobuild job) to validate main.go; the PowerShell path is mirror-implemented and will
  be exercised on a Windows install.
• The CI installer smoke test now also runs --update.

Fixed along the way

The version read piped through head -1, but this script defines its own head() helper for
printing headers — which shadowed the command and corrupted the stamp. Switched to awk.

—
Ahmed "Ben" Zayed · Head of Products & Ventures at ZAT.VC [Venture Partner]

refactor-chain v4.6.2

refactor-chain v4.6.2

A ship-blocker fix, caught by actually testing the installer end-to-end instead of trusting
--dry-run.

Fixed — the curl | sh installer produced a broken install

A fresh install copied all 57 skills and registered all 6 hooks, but installed none of the
harness scripts — so every hook pointed at an orchestrate.mjs / boot.mjs that didn't
exist, leaving the pipeline non-functional.

• Root cause: install.sh created the scripts dir, then the skills-copy loop rm -rf'd
  skills/refactor-chain and re-copied it (the orchestrator skill, which has no scripts/)
  — wiping the dir — and the later cp … scripts/ silently failed because cp won't create a
  missing destination. install.ps1 had the same defect via Remove-Item. Both fixed by
  copying skills first, then creating and filling scripts/.
• The Node (rcx.mjs) and Go (main.go) installers were not affected — their copy helpers
  recreate the destination — but rcx.mjs was reordered to match for clarity.

Prevention

CI now runs an installer smoke test: it installs into a throwaway HOME and asserts the
harness scripts are present and every registered hook resolves to a real file. The gap that let
this ship — no install-and-verify test — is closed.

If you installed v4.6.0 or v4.6.1 via curl | sh, re-run the installer to get the scripts.

—
Ahmed "Ben" Zayed · Head of Products & Ventures at ZAT.VC [Venture Partner]

refactor-chain v4.6.1

refactor-chain v4.6.1

A CI-hygiene patch. v4.6.0's gate was run as tests + audit + doctor but not eslint — which CI
runs — so three no-unused-vars errors in the new board code turned the ci workflow red on
main, even though every test passed and the release binaries built fine.

Fixed

• scripts/lib/board.mjs — the unused selectLenses parameter is now _diagnosis (it's a
  future hook).
• tests/board.test.mjs — dropped two imports that weren't used directly.

No functional change. This release was validated by running every CI step locally —
syntax-check, the test suite, audit --provenance-strict, eslint, shellcheck, and JSON
validation — rather than a subset, so the gate matches what CI actually enforces.

—
Ahmed "Ben" Zayed · Head of Products & Ventures at ZAT.VC [Venture Partner]

refactor-chain v4.6.0

refactor-chain v4.6.0

The Review Board: a native, portable multi-agent review capability — and the story of it
catching nine real bugs in its own code the first time it was pointed at itself.

Added — /refactor-board

Convene a panel of named engineer personas to review a codebase from several independent
angles at once, keeping only what survives an adversary. A deterministic Node conductor picks
the role-lenses (architecture, harness, correctness, security, docs-truth), binds each to a
veteran whose grumpy, zero-BS profile is an enforced rubric — every finding anchored to
file:line, tagged CONFIRMED or SUSPECTED, over-flagging penalized. Each lens is a Lead
(finder) plus a Coordinator (adversarial verifier); a finding counts only if the
Coordinator can't refute it. The prompts are emitted as data, so the identical reviewer
runs on Claude Code, Cowork, and Codex — the personality and standards don't vary by host.

The board reuses what already exists — the review gate's dedupe/rank/decide logic (now
extracted into a shared library so the two can't drift), the discipline pack's
adversarial-verify as the Coordinator mechanism, and the guidelines gate over any fix a board
run proposes. It adds a capability; it reinvents nothing.

The dogfood

Pointed at its own ~600 lines of new code, the board raised nine real defects — two of which
defeated its own "REFUTED is dropped" promise (a whitespace-padded verdict and a string-typed
index both let refuted findings survive), and one of which was the exact unguarded-JSON.parse
crash class fixed elsewhere in 4.5.0 but missed on the new reader. Every one is fixed with a
regression that fails without the fix. That is the point of the capability, proven on the
author's own work.

Known limitation

board.json reads/writes are not atomic — two orchestrate processes running a board on the
same project simultaneously could clobber a round. This mirrors the pre-existing state.json
behavior and isn't board-specific; single-session use is unaffected. A future pass may make all
harness writes atomic.

Full gate green: 9 suites, audit clean, doctor ok.

—
Ahmed "Ben" Zayed · Head of Products & Ventures at ZAT.VC [Venture Partner]

v4.4.0

refactor-chain v4.4.0

v4.3.2

refactor-chain v4.3.2