AICAM v1.3.2 Release

AICAM v1.3.2 Release Notes

Release Date: 2026-04-25
Since: v1.2.1
Assessment: 5 rounds of independent review, scoring 3.6 → 4.0 (L4 maturity)

---

🏗️ Architecture

Gate Adapter Layer

• New .claude/gates/ directory with 6 independent gate definition files:
  • tdd.gate.md — TDD red-green-refactor gate with exemption/non-exemption checklist
  • smoke.gate.md — Smoke test gate with runtime health checks
  • security.gate.md — Security scanning gate (gitleaks + semgrep + dependency audit)
  • contract.gate.md — API contract/naming consistency gate
  • destructive-op.gate.md — Destructive operation detection (CRITICAL/HIGH/MEDIUM)
  • coverage.gate.md — Coverage gate with per-project-type thresholds
• Gates are decoupled from command scripts — reusable, independently maintainable

Eco-Adaptive CI Pipeline

• New .github/workflows/aicam-gates.yml — fully automated quality gates
• Preflight job auto-detects ecosystem (npm/python/go/cargo) and project type (web/rest-api/cli/worker/mobile/tauri)
• Conditional steps adapt to detected ecosystem — no manual configuration needed
• Security jobs: secrets-scan (gitleaks), sast-scan (semgrep), dependency-audit (ecosystem-specific)
• Test jobs: unit-tests + coverage per ecosystem, smoke-test with per-type branching
• oasdiff breaking change detection step in unit-tests job
• Mobile smoke generates actionable warning (requires device/emulator — not available in standard CI)

---

🔐 Security

Three-Layer Security Scanning

• Local (pre-commit): .githooks/pre-commit runs gitleaks + Spec-Lite existence check + large file detection
• CI (PR gate): gitleaks (secrets) + semgrep (SAST) + ecosystem-specific dependency audit (npm/cargo/pip/govulncheck)
• Config files: .gitleaks.toml (45 lines, 3 custom rules: generic-api-key, private-key, jwt-token), .commitlintrc.yaml

Git Hooks

• pre-commit — gitleaks secrets detection + CLAUDE.md size check + Spec-Lite existence + large file warning
• commit-msg — enforces Conventional Commits via commitlint, blocks malformed messages
• Both installed via /onboard L3: ln -sf ../../.githooks/{hook} .git/hooks/{hook}

Gitleaks License Documentation

• CI gitleaks-action@v2 configured with continue-on-error: true — private repo without license degrades to warning
• /onboard L3 documents the license requirement and trufflesecurity/trufflehog@main as free alternative

---

🚀 New Commands

/diagnose — One-Click Health Check

• Section 1-7: file existence, gate integrity, security tools, skills inventory, reference docs, template health
• Section 5: commit-msg hook symlink check (added v1.3.2)
• Section 6.5: Gate Execution Completeness — cross-references TDD/Smoke Log entries vs expected counts (anti-truncation)

/onboard — Interactive Setup

• Progressive 4-level enablement: L0 (zero-config, <5min) → L1 (minimal, <15min) → L2 (standard, <1hr) → L3 (advanced, <2hr)
• Each level has concrete steps with copy-paste commands
• L3 includes gitleaks/semgrep install, git hooks symlink, CI config, commitlint, MCP setup

/backend-test Skill

• New .claude/skills/backend-test/SKILL.md
• Covers REST API integration tests, database tests, and mock strategies
• Auto-triggers on backend test file creation, API integration test writing, DB fixture setup

---

📊 Metrics & Quality

M1-M5 Five-Dimensional Metrics

• M1 Phase周期 (cycle time) — git log auto-calculation with cross-platform fallback
• M2 一次通过率 (first-pass rate) — formula defined
• M3 测试密度 (test density) — per-AC coverage calculation
• M4 上下文压缩效率 (context compression efficiency) — pre/post archive line ratio
• M5 门禁绕过率 (gate bypass rate) — ⏸️ status tracking

Anti-Truncation & Anti-Bypass

• /diagnose §6.5: compares non-exempt task count vs TDD Log entries, Smoke Test checklist vs log entries
• /verify-phase: mandatory TDD/Smoke entry count vs gate comparison — mismatch blocks phase completion
• CLAUDE-template: Known Issues persistent section (excluded from 150-line limit, auto-maintained by /close-phase)

---

🐛 Bug Fixes

Python Rest-API Smoke Fallback (v1.3.2)

• Replaced dead [ -n "$SERVER_PID" ] check with python -c "import uvicorn" availability detection
• Flask/Django projects now correctly fallback to python app.py instead of silently failing
• uvicorn absent → falls back to Flask/Django; uvicorn present → uses python -m uvicorn

CI Needs Chain Completeness (v1.3.1)

• Fixed missing preflight in job needs arrays — eco-adaptive detection was silently returning empty strings
• All needs.preflight.outputs.* references now resolve correctly

Output Key Consistency (v1.3.1)

• Unified project-type (hyphen) → project_type (underscore) across outputs declaration and all references

Coverage Gate Heading (v1.3.1)

• Fixed corrupted ##地回答Hard Rules → ## Hard Rules

---

🗑️ Removals

agent-browser Skill Directory Cleaned Up

• .claude/skills/agent-browser/ removed — had been deprecated and merged into e2e-test since v1.3.0
• Skills directory now matches WORKFLOW.md declaration exactly (4 skills)

---

📝 Documentation

WORKFLOW.md

• Version history extended through v1.3.2 (3 new entries)
• Progressive enablement L0-L3 section added
• System components table: 15 commands, 6 gates, updated skills list
• Full MCP installation guide (serena + typescript-lsp) with hooks config

README.md (Root)

• Rewritten from minimal placeholder to comprehensive project landing page
• Version badge, key features table, quick start, directory structure overview, version history

README.en.md & README.zh.md

• Synced from v1.2.1 to v1.3.2
• Version history updated with v1.3.0 / v1.3.1 / v1.3.2 entries
• System components table: commands 13→15, skills list updated, gates row added
• Progressive enablement L0-L3 section added

CLAUDE-template.md

• Security scanning guidance section added
• Known Issues & Deferred Risks persistent section added
• Skill activation rules: backend-test added
• Reference docs: coverage.gate + security.gate loading triggers added

Coverage Gate — Ecosystem Tool Table

• 5 rows covering npm (Vitest/Jest), cargo (tarpaulin/llvm-cov), python (pytest-cov/coverage.py), go (built-in)

Contract Gate — oasdiff Protocol

• Spec archival protocol: cp openapi-current.yaml archive/openapi-phase-{N-1}.yaml
• Breaking change detection: oasdiff breaking <prev> <current>

---

🧪 Test Strategies

• 6 type-specific strategy documents in .claude/reference/test-strategies/: cli, mobile, rest-api, tauri, web, worker
• Web strategy: Environment Variable Isolation with Vitest vi.stubEnv pattern
• Per-project-type coverage thresholds in coverage.gate.md

---

📊 Commit History (since v1.2.1)

Commit	Message
e784374	feat(workflow): upgrade AICAM from v1.2.1 to v1.3.2 — 5 rounds of independent assessment

---

Quick Start

git clone https://github.com/cham-space/AICAM.git
cd AICAM
cp -r .claude/ /path/to/your/project/
cp .githooks/ .commitlintrc.yaml .gitleaks.toml /path/to/your/project/
cp -r .github/workflows/ /path/to/your/project/.github/

Then in Claude Code, run /onboard for interactive guided setup.