string-audit v0.7.0

What's Changed

• scan: promote to a verb (CLI + MCP) + shared Zod type contracts (types.mjs) by @bdelanghe in #41
• chore: bump version to 0.6.1 (reconcile manifest with release tags) by @bdelanghe in #42
• types: compile-time checking via tsc --checkJs, no build step by @bdelanghe in #44
• concept-drift: promote to a verb (CLI + MCP); type-check test.mjs too by @bdelanghe in #45
• string-audit v0.7.0 — concept-drift verb + full-tree typecheck by @bdelanghe in #46

Full Changelog: v0.6.1...v0.7.0

string-audit v0.5.1

What's Changed

• catalog: audit the real brand registry (vendor/brand), drop the photo-frame demo by @bdelanghe in #31
• Spike: registry-drift vocab from the projected MCP schema (#27) by @bdelanghe in #30
• Harden registry-drift vocab: projected MCP schema, not Zod internals (v0.5.1, closes #27) by @bdelanghe in #33

Full Changelog: v0.5.0...v0.5.1

string-audit v0.5.0

What's Changed

• Spike: registry-aware prose drift check (issue #22) by @bdelanghe in #24
• Provider seam + registry-aware drift check (issue #22) by @bdelanghe in #23
• string-audit v0.5.0 — provider seam + registry-aware drift check by @bdelanghe in #25

Full Changelog: v0.4.0...v0.5.0

string-audit v0.4.0

What's Changed

• verbspec: single-source the Anthropic report tool from a VerbSpec (Thread 2 Step 1) by @bdelanghe in #18
• verbspec: audit + extract as VerbSpecs → CLI + MCP surfaces (Thread 2 Step 2) by @bdelanghe in #19
• string-audit v0.4.0 — verbspec surfaces (CLI + MCP) by @bdelanghe in #21

Full Changelog: v0.3.1...v0.4.0

string-audit v0.3.1

What's Changed

• Reconcile #15: restore v0.3.1 identity, CAS backends as optional deps, fix daemon gating (unbreak main CI) by @bdelanghe in #17

Full Changelog: v0.0.1...v0.3.1

string-audit v0.3.0 — copy-hygiene suite + data-driven AI-tells

string-audit v0.3.0 — copy-hygiene suite + data-driven AI-tells

Adds a deterministic copy-hygiene layer to the auditor — the cold-read editorial
rules, run on every symbol, free and offline — and makes severity first-class.

New prose checks (zero-API, uncached, every symbol)

• ai-isms — formulaic machine-written tells: it isn't X — it's Y antithesis,
  the easy part … the hard part, rule-of-three triads + gerund tricolons, em-dash
  cadence, rhetorical teaser fragments, chatbot artifacts/placeholders, and buzzword
  filler. Patterns + lexicon are data in ai-tells.json (seeded from the
  vale-signs-of-ai-writing corpus), so they track upstream instead of living in code.
• overclaims — absolute, unprovable language bound to a coverage term (every privileged effect, always enforced); the prose analogue of the grounding check.
• proofread — mechanical slips spell/grammar miss: doubled words, stray/missing
  spaces, space-before-punctuation, repeated punctuation, mixed straight + curly quotes.
• readability — over-long sentences and (for body/meta) dense prose by Flesch
  reading-ease — a proxy for "why am I reading this?".

First-class severity

Every finding now carries { level, msg } — error ✗ (correctness/honesty) ·
warn ⚠ (ai-ism/proofread) · suggestion ·. audit.mjs renders the glyph from
level (à la Vale severities). The keyed Anthropic auditor is told the same rules.

Quality

• spellCheck no longer flags English contractions (isn't, we're) as misspellings.

Prior art (issue #6)

Vale + vale-signs-of-ai-writing cover AI-tell linting at scale; our lexicon is seeded
from it. spikes/ holds the data-driven port (now promoted) and an optional vale
shell-out provider. The differentiator stays: typed-symbol catalog, content-hash cache,
and grounding/overclaim checking.

Changelog: #5 · #7 · #8 · #9

string-audit v0.2.1 — signed provenance (DSSE ed25519)

Each cached audit result's in-toto derivation is now a DSSE-signed envelope (ed25519): assembleEnvelope + ed25519Signer sign the PAE, the signature (keyid + sig) is attached and stored with the record. The signing identity is generated once and persisted in the room (gitignored). Closes the last provenance follow-up from #1 — derivations are signed, not just canonical.

string-audit v0.2.0 — real cas/anchored-chain + keyed Anthropic

Wires up the real published bounded-systems packages and a live keyed CI path.

cas + anchored-chain are real now (from JSR)

• @bounded-systems/cas — content addressing (sha256Hex/sha256BareHex); blobs by digest, get re-hashes + rejects corrupt.
• @bounded-systems/anchored-chain — each cached result records a real in-toto derivation (digestManifest → derivationId, manifestToStatement → an in-toto.io/Statement/v1), serialized with canonicalJson.
• STORE=cas (and STORE=socket, the room daemon) now produce canonical, in-toto provenance — verified in CI (the room step audits through the socket-mounted cas store).
• (DSSE ed25519 signing — assembleEnvelope + ed25519Signer — is the small remaining follow-up.)

Live keyed Anthropic — in Actions

• .github/workflows/anthropic.yml: manual + weekly live audit gated on the ANTHROPIC_API_KEY repo secret (real LLM only on cache-miss). Add the secret to enable.

Unchanged & green

fs / cas / socket-in-a-room stores · typed audits · grounding guard · spell + custom dictionary · grammar · overlap · extract+coverage · Anthropic path test. CI pipeline green.

string-audit v0.1.0 — cost-aware, grounded content auditor

A content auditor that audits typed string symbols, scopes checks by type, and
content-hash caches so only changed copy pays for the (expensive) LLM call — and
whose rewrites can't invent facts.

Audits

• Type-scoped — headline / cta / meta / claim / body, each with its own checks.
• Grounding guard — claims may only assert facts in the grounding source; ungrounded stats are flagged, never fabricated.
• Spell-check — portable modern wordlist + a custom dictionary.txt.
• Grammar/style — write-good.
• Overlap — duplicate / near-duplicate copy across symbols.
• Extract + coverage — scan a surface → propose typed symbols; covered / uncovered / unused.

Cost & provenance

• CAS-memoized — key = sha256(version:type:value); warm run = 0 calls; identical audits dedupe to shared blobs.
• Pluggable store (same get/put/has port): fs · cas (content-addressed + anchored-chain input→output lineage) · socket (a store daemon mounted on a Unix socket, in a room).
• Anthropic provider — structured output via tool-use, cost-aware model, grounding enforced; request/parse path test-verified (live run is keyed).

Reuses the bounded-systems stack

cas (content addressing) · anchored-chain (lineage) · brand/content (typed symbols) · prx (budget). CI pipeline green.