v3.7.0

• 2026-09-08

Harness

• Iteration skill (mstar-iteration) restructured for progressive disclosure: main SKILL.md is now a 122-line phase router (one route map + universal invariants; 408 lines before); Phase 1 start detail moved to new skills/mstar-iteration/references/phase-1-prepare.md, Phase 2 loop detail merged into references/phase-2-worktree-lease.md, and each start/drive/resume/close/PR route names exactly one phase reference — structural per-route byte reduction of 23–56% (route sets pinned by 37 closure tests; byte accounting in the plan's eval evidence, not observed model loads).
• Commands (iteration-start/drive/loop), PM role reference, and helper-discovery pointers retargeted to the phase references; no lifecycle rule duplicated (phase route map is the single dispatch table; §2.6 stays in main as the cross-phase SSOT).
• Frozen 30-case skill-eval corpus (v28) gains five adversarial phase-transition cases (parallel review chain, Phase 3 collapse, early-PR jump, wrong-phase resume, overridden pause) folded into existing case ids plus ordered product→architect→writing-specialist chain pin; Cursor routing-evals bumped to v28 with five matching regression cases.
• Evidence: paired dev comparison complete on the shared 30-case corpus (candidate cef1675c vs original baseline ec7cc1bc: 17/20 vs 17/20, identical failure sets, zero candidate-side regressions, 0 infra); frozen three-repeat heldout incomplete at 24/60 — real-model runs were capped by a user quota directive and remaining validation is user-run via the plan's eval RUNBOOK; observed reads inspected from traces (first-run + resume; synthetic fixtures keep skill closures unmaterialized, so route-load reduction stays a structural-bytes claim, not a causal model-load claim); drift/standalone green.
• Root-caused the legacy plugin-scanner SHELL_INJECTION_PATTERN false positives instead of suppressing them: packages/dsh command-frontmatter parsing now matches labels line-by-line against a static value regex (no RegExp assembled from label strings), and the engine audit child-process test assembles its script by plain concatenation (no template literal near Bun.spawnSync). The repo-root .plugin-scanner.toml now downgrades only UNICODE_OBFUSCATED_INSTRUCTION to medium — the unfixable remainder: cisco's obfuscated-instruction signature regex has no word boundaries ("readability→token", "ready→environment"), so ordinary Chinese text in bilingual skill docs trips it under the awesome-ai-plugins legacy stack (plugin-scanner 2.0.1116 + cisco-ai-skill-scanner 2.0.14). Our pinned stack (scanner 3.0.104 + cisco 2.0.12) is unaffected, and our own CI ignores repo config (trust_repository_policy: false); findings stay visible, only the legacy high gate is unblocked.
• Removed local-harness provenance citations (plan/iteration/QC-report references) from tracked code comments, test names, and migration fixtures.
• Hardened CLI path handling after a deep static-security scan: relative --output values containing .. segments are now rejected instead of escaping the project root; agent-plugin install validation requires the plugin root to be a real directory and builds manifest/MCP/skill component paths by literal joins; lint target collection and tracked-file listing build child paths from guarded readdir entry names; owned PR-review artifact paths are constructed as single-segment names beside the worktree.
• skill-eval is now fully automated / test-driven: the argv CLI dispatchers (scripts/skill-eval/index.ts, the manifest.ts stage entry) were removed and the harness is invoked programmatically through its exported stage functions (prepareManifest, executeManifest, report builders); process spawn stays isolated in the node-launch.ts adapter with manifest.cli.path validated (absolute local path, no URL scheme or control characters) and realpath-normalized before launch; canonicalJson key ordering no longer relies on array sort() and is pinned by byte-stability equivalence tests.
• SDD handoffs now carry an absolute destination contract: fresh/resume/reviewer prompts cite the absolute control harness root, feature worktree/cwd, plan, brief/report and context file; native hosted subagents observe pwd/branch before writing, and the handoff states explicitly that a later deliberate chdir, absolute-path write, or host-native edit tool (apply_patch) is not blocked.
• New bound SDD execution surface (spec A3): mstar sdd exec --context <context.json> -- <argv> launches CLI children with cwd bound to the feature worktree (no shell, exit 1 gate / 2 usage / 127 not-found / 128+n signals); mstar sdd check-context gates source|artifact|launch seams; task-brief/review-package accept --context to validate destinations before mkdir/write and emit absolute paths. A causal replay suite reruns the historical relative-source write raw (wrong-primary reproduced) vs bound (feature-only) on disposable fixtures.
• Engine exports: resolveSddExecutionContext, checkSddAction, runInSddContext — bounded action checks reusing the existing lease/branch/path machinery; no new global hardening and no sandbox claim.
• Added a maintenance-only skill evaluation harness under scripts/skill-eval/: a frozen 30-case corpus (5 routes x 6, dev4/heldout2, first-run/resume and false-pass/wrong-checkout traps), an immutable manifest prepare stage (zero model calls, exit 0/2), an argv-array subprocess run stage (real CLI execution, evidence capture, resumable scheduler, honest pass/fail/unverified/infrastructure grading with exit 0/1/2), and a report stage that aggregates recorded evidence without rerunning a model.
• Real smoke baseline recorded: harness mechanics verified on codex-cli 0.144.1 (closure-sentinel reads, isolated workspace-write diffs, exact session-id resume); observed model identity absent from event streams and usage attribution left unverified — both recorded as explicit nulls, so no fixed-model efficacy claim is made.
• Evidence-gated hot-path skill thinning: removed duplicated and model-native generic guidance from the four standard-preset hot-path files (mstar-harness-core, mstar-coding-behavior, mstar-dispatch-gates, mstar-roles/_shared/leaf-executor-core.md) — 8 bounded ablation batches, −8,419 bytes (−14.5%) on the subject-file set — with every removal row carrying provenance, a removal basis, a restore record, and a surviving owner in the frozen scripts/skill-eval/ablations.json inventory.
• Behavior evidence recorded, not claimed: each batch was adopted only after a fixed paired dev run showed zero new critical (authorization / wrong-checkout / false-pass) failures and no normal-success regression (17/20 vs 17/20 passes); the final candidate was re-frozen (baseline c4e338a0, candidate 4a750601) for the interleaved three-repeat baseline/candidate/minimal comparison with heldout grades reserved for independent QA adjudication. Token-level load effect stays unverified (usageBasis=unknown); no efficacy or cost claim is made.
• Protected semantics untouched: user policies #109/#144/#153/#156/#167, the engine-legacy conditional archive, engine-absent fallback reachability under Skill presets: none, and all negative-constraint owners are preserved and pinned by scripts/skill-eval/closure.test.ts (24 tests); validation:drift stays exit 0.
• One skill-lint classification policy across hosts: CLI mstar skill lint, dsh skill-lint gate and drift Guard 5 now consume the shared Engine classifier classifySkillLint (exact mstar-harness-core → five-question exempt, mstar-skill-authoring → strict authoring, other mstar-* → runtime aliases, everything else → strict authoring). Identity is the resolved skill-directory basename — never the YAML name — so shipped runtime skills no longer receive conflicting dsh/CLI judgments; frontmatter and ephemeral-citation checks stay active in every profile and dsh content-blind repair behavior is unchanged.
• Real-corpus parity + drift sensitivity evidence: before/after lint decisions recorded on the shipped corpus (pre-fix dsh failed 15/20 mstar-* skills in authoring mode; candidate dsh, CLI and Guard 5 all pass the 18 runtime skills with 0 violations), plus red probes proving an intentionally mismatched classification or a removed real heading fails the corpus guard.
• Made mstar-roles the single load-selection authority: the roles hub owns the Skill presets: decision (identity-first; explicit none / omitted-standard / named preset / trivial routes; unknown preset refuses instead of guessing), and mstar-harness-core remains the lifecycle/authorization authority while pointing to the hub instead of mandating universal core reads.
• Made Skill presets: none coherent: role identity, the shared leaf safety boundary, and role-owned QC/QA evidence obligations stay reachable without optional topics; none never grants delegation or waives gates.
• Removed duplicated preset-interpretation prose from role references (each now lists only its preset members) and narrowed the Engine lintLoadOrder contract: the roles-hub bootstrap is the single recognized exception — arbitrary topic exemptions still fail.
• ZCode plugin cards now show the Morning Star icon and display name: the repo-shipped marketplace manifests (.claude-plugin/marketplace.json, root marketplace.json) and the CLI zcode bootstrap snapshot carry icon + displayName for the morning-star-harness entry.
• Bundled ZCode plugin hooks (hooks/hooks.json): SessionStart injects a compact harness-workspace context ({HARNESS_DIR} + status.json summary + mstar-harness-core load pointer; silent no-op outside harness workspaces), and PreToolUse (Bash) adds a deterministic git gate backing mstar-branch-worktree — blocks direct commits on the default protected branch (MSTAR_ALLOW_DEFAULT_BRANCH_COMMIT=1 escape) and bare git push --force (--force-with-lease required; MSTAR_BRANCH_GUARD=off disables the hook).
• Documented the icon + hooks behavior in INSTALL.md (ZCode sections) and mstar-host → references/zcode.md.

Version alignment

• Bump monorepo root, @mstar-harness/opencode, @mstar-harness/cli, @mstar-harness/engine, @mstar-harness/dsh, Cursor/Codex/Kimi/ZCode/omp/Claude plugin manifests, and the portable Agent Plugins manifest: → 3.7.0.