v0.7.4

Fixed

• Verify no longer fails when the success command is a non-idempotent
  scaffolder (X init / create-next-app / terraform init): the command
  ran as both the last setup step and the assertion, so the assertion's
  re-run failed on the state setup created. It now runs exactly once, in the
  assertion, against a clean state — grounding unchanged (#224, closes #222).

Changed

• CITATION.cff credits the current 15 contributors instead of a placeholder
  author (#226, closes #225).

v0.7.3

Fixed

• A stage that pays for LLM calls and then fails is now billed for that
  spend: stage_fail accumulates cost_usd like stage_complete, and
  DistillError carries the distiller's grounding-retry cost across the
  raise. Previously a failed distill — the one run you most want a spend
  figure for — reported $0.00 (#209, closes #103).

Changed

• Docs: howto.jsonld added to the README's generated-outputs list and
  llm_backend to its config example (#119, thanks @BenjaminAyivoh1);
  the architecture diagram, module map, and the debug-run skill now show
  the real verify → tutorial → render stage order (#211, thanks
  @professor314).

v0.7.2

Fixed

• extract_json no longer truncates JSON whose string values contain } —
  the brace counter is replaced with raw_decode, so plan commands like
  awk '{...}' parse correctly (#146, closes #49, thanks @Sanjays2402).
• Unknown TOML configuration keys fail fast with a concise CLI error
  instead of being silently ignored; the retired vhs_image key is
  accepted as a deprecated, warned, ignored compatibility field (#174,
  closes #84, thanks @cen-zp).
• SEO descriptions collapse embedded whitespace, keeping generated YAML
  front matter single-line (#125, closes #91, thanks @pollychen-lab).
• The README contributors section pointed at a fork — badge, graph link,
  and avatar mosaic now show this repository's contributors, on GitHub
  and PyPI (#180, closes #179, thanks @BenjaminAyivoh1).

Changed

• CI: bump actions/upload-artifact to 7 in release.yml, aligning with
  the pin the composite action already ships (#177).

v0.7.1

readme2demo is on PyPI: pip install readme2demo.

Added

• The release workflow publishes to PyPI on every tag via Trusted
  Publishing (OIDC) — no tokens or stored secrets anywhere (#176,
  closes #175).

Fixed

• README renders correctly on the PyPI project page: all 14 relative
  links/images converted to absolute URLs, and the dead
  IMPLEMENTATION_PLAN.md link (file removed in v0.6.0) repointed to
  architecture/README.md (#176).

v0.7.0

The GitHub Action release: readme2demo can now sit in CI and turn "the
README quietly broke" into a red X. Runnable walkthrough of everything
below: docs/whats-new-0.7.0.md.

Added

• GitHub Action (#157): a repo-root composite action — install, build the
  sandbox image, run the pipeline, fail the check when the fresh-container
  replay doesn't pass. Artifacts and a job summary included; url mode until
  local-path ingestion (#74) unlocks PR-head verification. Self-test via
  workflow_dispatch.
• report exit codes signal the verdict (#158): 0 verified, 1 completed but
  unverified, 2 stage failed — CI can gate on the exit code alone.
• report --markdown (#159): a GitHub-flavored job summary (verified badge
  line, stage table with per-stage cost, artifact list) for
  $GITHUB_STEP_SUMMARY.
• Every run mints badge.json (#156): a shields.io endpoint file, written
  before the tutorial LLM pass so nothing can suppress an unverified run's
  red badge. Hosting tracked in #63.

Fixed

• The suite is portable on Windows: the POSIX executable-bit test skips on
  NTFS (assertions untouched on POSIX) and artifact reads pin UTF-8 instead
  of trusting the locale (#154, thanks @innovationty).
• A docker-socket test reached the real docker run probe and stalled the
  suite 60s per run whenever Docker Desktop was half-up; the probe is now
  monkeypatched and the suite stays under a second (#155).

v0.7.0 — verify your README in CI

readme2demo can now sit in your GitHub Actions workflow and fail the build when your README breaks.

The Action

~15 lines of YAML: the pipeline runs your README inside a hardened Docker sandbox, replays the distilled steps in a fresh container, and the check goes red only when that clean-room replay fails — a red X means a real container tried your README and it didn't survive.

name: readme-check
on:
  push:
    branches: [main]
    paths: ["README.md"]
  schedule:
    - cron: "0 6 * * 1"   # weekly: catch the world changing under an unchanged README
jobs:
  verify:
    runs-on: ubuntu-latest
    steps:
      - uses: alphacrack/readme2demo@v0.7.0
        with:
          anthropic-api-key: ${{ secrets.ANTHROPIC_API_KEY }}

v0.6.4

Internal quality release: no user-facing behavior changes.

Added

• Trust-boundary test suite (#151): 70 tests covering the modules that are
  the security/verification story. Every sandbox hardening flag now has a
  named test — the "never weaken hardening flags" rule is executable — and
  the clean-room replay is pinned as the only source of "verified"
  (fresh sandbox per attempt, no agent state, marker + exit code both
  required, no marker leakage across attempts).
• CI: coverage ratchet at 80% (measured floor) on the 3.12 leg and a mypy
  type-check job gating at zero errors (#152). The handful of src touches
  required are annotation-only or provably behavior-identical; grounding
  paths audited.

v0.6.3

See CHANGELOG.md

v0.6.2

Fixed

• scp-style repository URLs (git@github.com:owner/repo.git) normalize
  correctly in SEO titles instead of leaking the git@host: prefix
  (#121, thanks @hkJerryLeung).
• step_by_step.md now carries a distinct SEO title from tutorial.md, so
  the two published pages no longer compete for the same search snippet
  (#134, thanks @cnYui).
• Installer-URL phase tagging is word-anchored: URLs merely containing the
  substring "install" (installer.tar.gz, reinstall-notes.txt) no longer
  classify as setup steps (#122, thanks @hkJerryLeung).

Removed

• Dead Sandbox.commit() method — zero call sites, no behavior change
  (#82, thanks @professor314).

Changed

• Docs: the documented pipeline stage order matches manifest.STAGES
  (verify → tutorial → render) across README, CONTRIBUTING, ROADMAP, and the
  bug-report template (#120, thanks @cnYui); README gained an auto-updating
  contributors section (#136).
• CI: bump actions/setup-python to 6 (#34) and actions/download-artifact
  to 8 (#35) — the v4-upload/v8-download artifact pairing in release.yml is
  cross-compatible (verified against the v8 compatibility matrix before
  merge).

v0.6.1

See CHANGELOG.md