v0.8.0

The [0.7.0] section below was silently rewritten in place by the commit
that produced most of this release (a883cec, #71), attributing this
release's own not-yet-shipped identity completion to the already-tagged
v0.7.0 — whose immutable GitHub Release body still carries the original
wording. Restored verbatim here; the corrected, actually-new text moves to
this section, where an upgrader reading release notes will actually see it.

Changed

• BREAKING: the prd-spec-generator plugin identity and release alias are
  gone. v0.7.0 kept the product and Claude/Codex/Gemini plugins under the
  prd-spec-generator name while only the MCP Registry entry and primary
  bundle moved to ai-architect-mcp-spec; this release finishes the
  migration started there. The product, full-pipeline skill,
  Claude/Codex/Gemini plugins, MCPB asset, and Registry entry are now all
  ai-architect-mcp-spec; no prd-spec-generator plugin or .mcpb release
  alias is retained. Existing callers must replace the
  prd-spec-generator:generate-prd skill qualifier with
  ai-architect-mcp-spec:generate-prd, and anyone depending on the
  prd-spec-generator.mcpb release asset must switch to
  ai-architect-mcp-spec.mcpb — release.yml no longer publishes the legacy
  alias or its checksum. The internal @prd-gen/* workspace packages,
  PRD_GEN_* environment variables, .prd-gen data directory, and prd-gen
  MCP server/tool namespace remain stable protocol and storage identifiers;
  none of them was ever a published plugin or marketplace identity, so none
  of them changes here. (#71)

• BREAKING: the affected-symbols sidecar is now emitted (with empty
  arrays) whenever technical_specification ran and found zero claims,
  instead of being omitted. A docs-only or infra-only PRD that legitimately
  produces no code-level claims was previously indistinguishable, by file
  presence alone, from "extraction never ran." ai-architect-mcp-codebase
stages/stage-6.md keys its regex-fallback decision on the sidecar
  file's absence, not on an empty payload — a consumer relying on the old
  omit-when-empty behavior to detect "extraction didn't run" will now see the
  file present with empty arrays for a zero-claims PRD. The
  technical_specification prompt was also corrected to always emit the
  affected-symbols block, since the previous prompt instructed the model to
  omit it when nothing was touched, masking the zero-claims signal at the
  source. Source: ai-architect-mcp-codebase stages/stage-6.md, "Zero-claims
  case — not the same as absent" (§4.2), pinned at commit
  92216cd90f8f26cb15348675fc6556b8293edfc1. (#80)

• ecosystem-adapters' upstream client is renamed
  AutomatisedPipelineClient → AiArchitectCodebaseClient, matching the
  upstream server's own rename (automatised-pipeline →
  ai-architect-mcp-codebase), with its config type and source file renamed
  to match. The class is exported from @prd-gen/ecosystem-adapters, but
  that workspace package is "private": true and has never been published —
  it has no consumer outside this repo, so the rename is not breaking for any
  external caller. Self-referential doc comments that still called this
  project prd-spec-generator (its own former name) were also corrected.
  (#78, closes #75)

• @modelcontextprotocol/sdk 1.29.0 → 1.30.0; mcp-server/index.js rebuilt
  from source against the updated types. Existing test suites pass
  unmodified. (#79)

Fixed

• The codebase-intelligence tool prefix pointed at a revoked plugin
  spelling. ai-architect-mcp-codebase renamed its server key to
  ai-architect (canonical since its own v0.9.0), so the correct prefix is
  mcp__plugin_ai-architect-mcp-codebase_ai-architect__. This repo still
  named the pre-rename spelling in SKILL.md, EXAMPLES.md, and
  preflight.ts's remediation text; the host silently drops calls to an
  unresolvable tool name rather than raising, so call_pipeline_tool
  returned nothing and the pipeline continued as if the call had succeeded.
  mcp-tool-prefixes.test.ts's hand-copied allowlist carried the same dead
  spelling, so the gate that should have caught this would have rejected the
  fix; the allowlist moved in the same commit as the two call sites it
  guards. A stale cortex@cortex-plugins reference in the same remediation
  text (that plugin renamed to hypermnesia-mcp in v4.15.0) was corrected
  alongside it rather than left as the next silent failure. (#73)

Security

• Raise fast-uri to 3.1.5, the first patched version for
  GHSA-7p8r-x3mc-p8w7, and rebuild the committed MCP bundle.
• Raise hono to 4.12.34, the first patched version for
  GHSA-8j4g-w8fx-2239, and rebuild the committed MCP bundle. A production-tree
  pnpm audit reports zero remaining vulnerabilities after both updates.

Docs

• Add CLAUDE.md wiring this repo into the global zetetic agent rules
  (~/.claude/rules/model-behavior.md, coding-standards.md). (#76)

Canonical .mcpb bundle

Artifact: ai-architect-mcp-spec.mcpb
SHA-256: 1e21c45f00b4eb3874ebf5290e52bf593aa38226b197d0c4a3dc261e54362b6a

v0.7.0

Added

• Canonical distribution identity. The product and Claude/Codex/Gemini
  plugins remain prd-spec-generator, while the official MCP Registry entry
  and primary portable bundle become ai-architect-mcp-spec at version 0.7.0.
  Repository-facing branding and URLs move to AI Architect MCP Spec at
  cdeust/ai-architect-mcp-spec.
  Releases retain prd-spec-generator.mcpb as a byte-identical compatibility
  asset, and the existing prd-gen server/tool namespace remains unchanged.
  The release procedure deprecates all versions of the former Registry entry
  only after the new canonical entry is active.

• Portable Spec Verifier for Codex and Gemini CLI. Both host manifests now
  launch the same opt-in verifier profile, which advertises and accepts only
  validate_prd_section and validate_prd_document. The shared audit-prd
  and validate-spec skills preserve the boundary between deterministic
  structural conformance and semantic or factual correctness. The existing
  Claude manifest still selects no profile, so its default 17-tool full
  surface is unchanged. Distribution tests pin manifest versions, launch
  arguments, supported skill frontmatter, and that Claude compatibility
  invariant.

Fixed

• Registry checksum guard now validates the field consumers actually read.
  Release automation and verification use the schema-defined fileSha256
  property rather than agreeing circularly on an unused file_sha256 field.
  The checksum is omitted until the artifact exists, and both identity and
  digest guards explicitly reject the former all-zero placeholder.

• Codex and Gemini verifier startup from immutable plugin installs. Their
  host manifests now execute the bundled server directly instead of running a
  first-launch npm ci inside the installed plugin directory, which Codex
  mounts read-only. Ajv is statically imported so esbuild carries it in the
  bundle, and the portable-host smoke test makes the staged plugin root
  read-only before exercising MCP initialize, tool discovery, and validation.
  Claude Code remains the primary full-profile interface: its .mcp.json
  launch path and 17-tool surface are unchanged and covered by regression
  tests. The obsolete verifier-only dependency branch was removed from the
  remaining Claude launcher after the portable hosts stopped invoking it.

• The server advertised the wrong version to every host that connected.
  serverInfo.version was the literal 0.4.0 in packages/mcp-server/src/index.ts
  while package.json, .claude-plugin/plugin.json, manifest.json and server.json
  all carried 0.6.1 — three releases of drift, read by every MCP client at
  handshake and by the registry entry built from it. The number is no longer
  written down twice: server-version.ts resolves it at startup from the
  package.json that ships beside the running bundle (the plugin tree and the
  staged .mcpb both carry mcp-server/package.json), falling back to the root
  package.json for workspace runs, and returning an obviously-unresolved
  sentinel rather than a plausible-looking number if neither can be read.
  pnpm bundle stamps mcp-server/package.json from the root version
  (scripts/stamp-bundle-version.mjs), and CI's bundle-freshness check now
  diffs all of mcp-server/, so an unstamped commit fails.

  The gate that should have caught this is fixed too: smoke-mcpb.sh printed
  serverInfo.version in its OK line while asserting only that a serverInfo
  existed, so the wrong version passed CI in green for three releases. It now
  asserts the advertised version equals the one manifest.json declares — two
  independent mirrors of the release, so the check can actually fail.

Added

• MCP prompts capability (#28): prompts/list + prompts/get publish the
  pipeline ordering as enumerable protocol — run_prd_pipeline(context, request)
  (coordinate_context_budget → start_pipeline → get_pipeline_state →
  submit_action_result → plan_document_verification → conclude_verification) and
  verify_prd_document(run_id). Each step's one-line summary is pulled from the
  live registered-tool description (the same schema tools/list advertises), so
  the ordering is not hand-copied a third time — packages/mcp-server/src/mcp-prompts.ts.
• MCP tool profiles (#28): full/agent profiles (tool-profiles.ts)
  selected by --profile / PRD_GEN_PROFILE. agent advertises the 12
  agent-facing generation/verification tools; full exposes all 17 including the
  internal diagnostics (get_config, read_skill_config, check_health,
  get_quality_history, get_strategy_effectiveness). Per-profile initialize
  instructions.
• resources/list interop shim (#28): the server now answers resources/list
  and resources/templates/list with empty arrays and declares the resources
  capability, so clients that probe resources regardless of declared capabilities
  do not surface -32601 as a failed connection (CBM upstream #958). Rationale
  recorded at the use site in index.ts per §8.

Security

• Every known-vulnerable dependency is gone, and the audit ignore list is now
  empty (#36, Scorecard VulnerabilitiesID). The tree carried 39 advisories
  (1 critical, 12 high) and pnpm.auditConfig.ignoreGhsas suppressed 8 of them.
  Both are now zero: pnpm audit reports {critical:0, high:0, moderate:0, low:0} with nothing suppressed. Floors come from each advisory's
  first_patched_version, not from guesswork — vitest (critical
  GHSA-5xrq-8626-4rwp, packages/benchmark was pinned at ^2.0.0 while the
  rest of the repo ran ^4), vite 8.1.5, postcss 8.5.23, hono 4.12.32,
  @hono/node-server 2.0.5, fast-uri 3.1.4, ip-address 10.3.1, qs 6.15.3,
  body-parser 2.3.0, js-yaml 4.3.0, esbuild 0.28.1, mathjs 15.2.0.
  Transitive floors are pinned via pnpm.overrides, each satisfying its
  declaring parent's own range (@modelcontextprotocol/sdk is already at its
  latest 1.29.0, so there was no upstream release to wait for).
  The previous deferral said mathjs was "absent from the shipped .mcpb"; that
  was false — grep -c mathjs mcp-server/index.js returns 730 on the bundle it
  described — so the two-major bump was owed rather than optional.

• The plugin's runtime provisioning now verifies integrity hashes
  (#36, Scorecard PinnedDependenciesID). bin/ensure-deps.sh ran npm install --no-package-lock on the user's machine at first launch, so the shipped
  plugin re-resolved ^8.17.1 to whatever it meant that day, unverified. It now
  runs npm ci against a committed mcp-server/package-lock.json (44 of 45
  entries carry an integrity hash). Scorecard's shell checker accepts exactly
  this one form: isNpmUnpinnedDownload treats a command as pinned only when it
  contains ci, so pinning versions inside npm install pkg@1.2.3 satisfies
  neither the checker nor the actual threat.

• Least-privilege GITHUB_TOKEN across CI (#36, Scorecard
  TokenPermissionsID): ci.yml declared no top-level permissions: block.
  Per Scorecard's own checks/evaluation/permissions.go, that undeclared
  top-level is what zeroed the check; release.yml's job-level contents: write — which creating a GitHub Release genuinely requires — costs nothing
  because that file already declares contents: read at top level.

Added

• Property-based tests for validateSection (#36, Scorecard FuzzingID):
  six contract invariants under fast-check — never throws, score stays in
  [0,1], rulesPassed/violations partition rulesChecked,
  hasCriticalViolations agrees with the violation set, determinism, and
  section-type echo. The function is fed LLM output, so its input space is "any
  string a model might emit"; the two defects regex-hardening.test.ts records
  ([:<≤<=] never matching <=, and test_foo matching inside mytest_foo)
  were both reachable by ordinary inputs nobody had written down.

• Dependabot (#36, Scorecard DependencyUpdateToolID) for npm and
  github-actions. The second ecosystem matters as much as the first: every
  uses: is pinned by commit SHA, and a SHA pin never ages out on its own, so
  without it the repo trades a supply-chain risk for an unpatched-action risk.

Fixed

• The .mcpb bundle could not start. manifest.json declares
  server.mcp_config = node ${__dirname}/mcp-server/index.js, and the staged
  tree carried no node_modules: launching it exited immediately with
  Cannot find module 'ajv'. bin/ensure-deps.sh shipped inside the bundle but
  nothing in the .mcpb ever invoked it — that launcher belongs to the plugin
  path (.mcp.json), which passes it explicitly. The .mcpb now ships with its
  runtime dependencies already provisioned from the committed lockfile
  (--omit=optional leaves out the platform-specific better-sqlite3, whose
  absence is the already-declared Beta(7,3) prior fallback).

  The reason this survived a green suite is that the suite exercises the
  workspace sources; nothing ever started the artifact users install. So
  staging moved out of release.yml into scripts/release/stage-mcpb.sh, and
  scripts/release/smoke-mcpb.sh stages the bundle and speaks MCP to it over
  stdio, asserting initialize returns a serverInfo and tools/list returns
  17 tools. It runs as the mcpb smoke CI job on every push and as a gate
  in release.yml before packing. Verified to fail on the defect it exists to
  catch: with provisioning removed it reports SMOKE FAIL: no response to initialize — the server did not start.

  Both channels are now verified end-to-end from a clean tree: the plugin path
  (ensure-deps.sh → npm ci → 44 packages) and the .mcpb path both reach
  initialize OK → prd-gen 0.4.0, 17 tools.

• The ReDoS growth-ratio assertion no longer fails on an unchanged tree.
  expectSubQuadratic timed every small s...

v0.6.1

Added

• README "Use with other MCP hosts" section (Gemini CLI, Codex, Cursor,
  Windsurf, VS Code) — explicitly scoped to the standalone deterministic
  spec-linter surface (validate_prd_section, validate_prd_document,
  plus the direct-consumption planning/diagnostics tools). The full
  action-driven pipeline remains host-dependent and is only supported on
  Claude Code; the docs say so rather than overclaiming.

Fixed

• Docs aligned with measured reality (#25): test-count badges and prose
  628/629 → 877 (vitest workspace count), pipeline step count 9 → 20
  (11 PRD-generation steps + 9 opt-in implementation steps behind the
  implementation_gate human gate), SKILL.md version refs (stale
  3.2.0/3.1.0 → package version), and the "does not write code" claim
  rewritten honestly: the server never edits source or pushes, but the
  opt-in steps 12–20 do drive host subagents that write, test, and review
  an implementation, gated by implementation_gate and pr_gate.
• De-flaked real-tsc oracle tests (#25 + this release): the subprocess
  tests measure 0.3–3.9s solo (2026-07-22, darwin arm64) but exceeded
  vitest's 5000ms default under full-suite parallel load, failing as
  timeouts rather than code failures. vi.setConfig({ testTimeout: 30_000 }) applied to code-oracle.test.ts (#25) and
  external-oracle.test.ts, with the measurement recorded at the use
  site. findTscBinary's tsc --version probe timeout also raised
  3s → 10s (TSC_PROBE_TIMEOUT_MS): the probe measures 1.6s wall solo,
  so 3s left <2× headroom and made isTscAvailable() flip
  load-dependently — throwing OracleUnavailableError with tsc
  installed.
• LICENSE is now the verbatim MIT text (#26): GitHub licensee reported
  NOASSERTION because of the custom preamble and trailing citations note,
  breaking license bots and the marketplace's validate-licenses CI. The
  preamble, independence statement, and citations note moved verbatim to
  the README license section.
• server.json migrated from the 2025-07-09 snake_case schema to the
  current 2025-12-11 camelCase registry schema
  (registryType/fileSha256/websiteUrl) required by mcp-publisher
  for official MCP registry publication (#26).

Note: no privacy-policy change in this release — PRIVACY.md has
shipped since 8decec5 and is staged into the .mcpb by release.yml.

.mcpb bundle

SHA-256: d6f0ce83456f65ffd7663966362612fa2224c7670dbc419d72db7cfccfc10815

v0.6.0

Added

• Claim tiering + model-diversity judge slots (@prd-gen/verification).
  A claim whose own text names a deterministically executable verification
  method (grep/diff/time/kcov/exit-status/named gate) skips the judge panel
  and gets a synthesized rule-tier verdict instead
  ({kind:"rule",name:"rule-tier"}); architecture-typed claims get one
  judge per model in VerifyBudgetConfig.diversity_models (default
  ["haiku","sonnet"]) instead of N persona-prompted judges on one
  underlying model. JudgeVerdict.model records which model judged each
  claim; 10-verification-report.md renders a cross-model-agreement
  summary. Measured on the calibration fixture: 30 → 23 judge invocations
  (-23%).
• Explicit verification acceptance policy at implementation_gate.
  VerificationPolicyConfig (block_on, min_subjective_sampled_ratio,
  on_unsampled_below_ratio, on_cross_model_disagreement —
  composition-root-injectable, default null uses
  DEFAULT_VERIFICATION_POLICY) and evaluatePolicy(), a pure function
  turning verification results into pass / needs_attention / blocked.
  implementation_gate now shapes its "Implement / PRD only" question from
  that verdict — a bare "Implement" is never offered while blocked — and
  records any human derogation on post_specs.policy_derogation.
• Host-side external-judge executor (scripts/external-judge/). A
  zero-dependency Node CLI (judge.mjs) that posts a judge prompt to an
  OpenAI-compatible endpoint (Gemini via AI Studio, Mistral via La
  Plateforme) when a spawn_subagents invocation names a non-Anthropic
  model, plus a calibration harness (calibrate.mjs) gated on agreement
  ≥ 0.7. No API key configured produces an explicit skipped result, never
  a fabricated verdict.
• Bilingual (FR/EN) hard-output-rule detection: opt-out markers and
  per-rule topic/keyword signal lists now recognize French phrasing via a
  shared lexicon (rules/lexicon.ts); 12 previously English-only rule
  checks (crypto, input validation, output encoding, structured logging,
  alerting thresholds, API contract docs, deprecation strategy, etc.) gain
  an explicit opt-out path, audited by
  packages/validation/src/__tests__/opt-out-coverage.test.ts.
• Budget-gated haiku judge panel for self_check verification
  (PipelineState.verify_budget, composition-root-injected): default
  panel reduced to 1 judge/claim (2 for architecture claims); a budget
  gate asks the user (reduced sample / full fleet / skip verification)
  when the invocation count exceeds a configurable cap (default 20).
• submit_action_result / start_pipeline response-size bound
  (boundEnvelopeResponse): an oversized spawn_subagents action has
  every invocation's prompt replaced by an observable OmittedStub; the
  full unbounded action is recoverable via
  get_pipeline_state(run_id, format:"action").
• 10-verification-report.md now written by implementation_gate before
  the implementation decision is asked, carrying per-claim judge verdicts
  when available.
• Root pnpm lint typechecks every workspace package via tsc --noEmit
  (lint script added to all 9 TS packages) and runs in CI.

Fixed

• Root lint script was structurally broken: tsc --noEmit at the repo
  root found no tsconfig.json (only tsconfig.base.json exists), so it
  printed CLI help and exited non-zero — invisible because CI never ran
  it. Fixed by delegating to each package's own lint script via
  pnpm -r run lint; CI now runs the step so it cannot rot silently again.
• Hard-output-rule false positives on French-language PRD sections
  (technical_specification, cryptographic_standards, rate_limiting,
  secure_communication, GDPR consent, distributed_tracing) that had
  explicit, justified "non applicable" prose the English-only detector
  could not recognize.
• test_traceability_integrity's test-function pattern only matched
  Swift-style func test_xxx(, so bash-defined tests (test_xxx() { },
  function test_xxx() { }) were reported missing even when present.
• claim-extractor.ts's evidence-snippet window used a fixed ±N-line
  radius that ignored claim boundaries, letting an adjacent claim's
  wording bleed into the current claim's evidence and mis-tier it;
  snippet() now stops at the neighboring claim's own start line.
• file-export.ts wrote placeholder text for companion files whose
  source section(s) produced no content; such files are now omitted
  entirely, with the omission and its reason recorded in
  00-run-notes.md (numbering stays stable).
• renderJudgeVerdicts stringified the structured AgentIdentity judge
  field as "[object Object]" instead of "kind:name".

Fixed (release workflow)

• release.yml never wrote the real .mcpb SHA-256 back into
  server.json#/packages/0/file_sha256, leaving a permanent
  000...000 placeholder in every published release's manifest. The
  workflow now patches the checksum after packing the .mcpb and
  pushes the single-file update back to main as part of the same
  release job, so this fix is already in effect for the v0.6.0 tag
  itself. Fixes #23.

.mcpb bundle

SHA-256: c4897edab70e8a4db79dfc22167087891e3b62131dce1fe40280e9ed0f95d5e3

v0.5.0

No CHANGELOG entry found for 0.5.0; using tag message

.mcpb bundle

SHA-256: f7084782abbe8d1aa7cdb17150ce8cef9d7f86e7583e5c6d74f68151ef8547e7