v0.4.2

Patch release. See CHANGELOG.md#042---2026-08-06.

If you copied docs/vault-ci/guard.yml before this release, bump its ENGINE_REF. It shipped pinned to v0.2.0, which predates the commit-author check — so the push-time guard, the one tier --no-verify cannot skip, ran green while never looking at authorship. Both templates now track the current release, and a test ties VERSION, the changelog and both ENGINE_REFs together so it can't drift again.

If your vault predates v0.4.0, it has no identity block and the author check is not running on it. There is no automatic upgrade — --adopt fills scaffold files and never edits a manifest — so it's a hand edit, now documented at Upgrading an existing vault. make doctor now names the exact key to add instead of reporting a bland optional ok.

Also fixes sync-skills.sh printing link targets shortened to the checkout while writing absolute ones.

v0.4.1

Patch release — test-only. No shipped script changes behaviour.

See CHANGELOG.md#041---2026-08-06.

Two tests in v0.4.0 were environment-dependent and made make test / make check fail on Linux, and on any machine with no git identity configured yet — so a fresh checkout could go red for reasons unrelated to the code. Fixed by giving the Makefile an overridable SHELLCHECK variable instead of testing shellcheck's absence by stripping PATH (which removes make and python3 too when they share /usr/bin), and by pinning GIT_AUTHOR_* where an assertion needed an identity to resolve.

If you pulled v0.4.0, take this one instead.

v0.4.0

Minor release — additive and machine-side, nothing here requires action in an already-onboarded repo.

See CHANGELOG.md#040---2026-08-06 for the full list.

Everything in this release came from one real first-time setup on a fresh machine, where the docs were followed verbatim and every place they failed became a finding.

Highlights: commit authorship checking — an opt-in identity block in vault.json so the guard also checks who a commit claims to be from, not just which vault it goes to; make uninstall, which removes only links it can account for and recovers links left dangling by a checkout you already deleted; init-vault.sh writing this machine's config so the vault id and SBW_EXPECTED_VAULT_ID cannot be made to disagree by hand; make doctor telling apart a vault path that points nowhere from one that is merely unfinished, with documented exit codes; make check degrading instead of dying when shellcheck is absent; every shell snippet in the docs made safe to copy-paste into zsh; and docs/NEW-MACHINE.md rebuilt around verification checkpoints with a troubleshooting table that a test keeps in step with the messages the tools actually print.

v0.3.0

Minor release — new-but-additive, nothing here requires action in an already-onboarded repo.

See CHANGELOG.md#030---2026-08-04 for the full list.

Highlights: check-followups.py, the long-range counterpart to check-follow-ups for stale open commitments; docs/GUARD.md and docs/AUDIT.md split out of the README; and four rounds of external-review polish — the Quickstart's clone-and-checkout example is now self-resolving, paste-and-run, and filtered to real semver tags, and the follow-up-ownership and enforcement-tier stories are stated once and consistently.

v0.2.0

Minor release — new-but-additive, nothing here requires action in an already-onboarded repo.

See CHANGELOG.md#020---2026-08-03 for the full list.

Highlights: a vault-repo CI template for both the weekly audit and a push-time commit guard (docs/vault-ci/), guard-vault-commit.sh --range/--rev for checking a pushed commit range instead of a staged index, and check-lineage.py now fails loudly instead of silently skipping a check it can't parse.

v0.1.0 — first tagged release

First tagged release of the public engine.

What's in it

• Rendering: one canonical rule set (rules/*.md + AGENTS.md) into Cursor's .mdc, Claude Code's .claude/rules/*.md + CLAUDE.md, and a portable AGENTS.md — render.py, with drift checking (--check) and rendered files now stamped with both the source commit and this engine version.
• Skills: update-second-brain (the only write path into the vault), obsidian-knowledge-base (read-only), check-follow-ups (daily-note follow-up tracking that survives a vacation-length gap, not just a weekend), onboard-repo, mcp-per-project.
• Vault safety: guard-vault-commit.sh, installed as a pre-commit hook by default (init-vault.sh), so committing to a vault is guarded regardless of whether a skill remembered to invoke it. The expected vault id resolves from machine config (SBW_EXPECTED_VAULT_ID), never from the vault being checked.
• Audits (make audit): check-lineage.py cross-references rules against the practice notes they were distilled from (unpromoted notes, orphaned rules, stale claims, thin evidence); rule-budget.py estimates the always-on rule set's per-turn token cost against a configurable ceiling.
• make doctor: reports a vault whose commit-guard hook is missing or isn't ours.

Versioning

See the README's Versioning section for the bump policy and rollback (git checkout <tag>, re-render).

Compatibility

No known breaking changes for adopters — this is the first tagged baseline.