v1.7.0 — Hardening by evidence: a full-kit test campaign, 12 fixes with retest proof

This release adds no new command. Every change came from one thing: a real test campaign — 58 test cases across 9 independent sandboxes (greenfield C#/Next.js, brownfield Node/Express, a 2-repo workspace, a graduated repo, 4 purpose-built fixtures), with every result re-checked on disk instead of trusted from a sub-agent's report. The campaign found 12 defects in the kit; 11 were patched with a retest proving the patch works, 1 was documented as a known limitation rather than patched with prose that cannot be verified. The three heaviest defects share one shape: a rule that exists where it is described, but is missing where it is executed.

🎯 1 · Coverage gate changed shape — no more false red

• Method-percentage is no longer a gate. In .NET the method count is dominated by auto-properties, record constructors and design-time factories, so a percentage fires false alarms while hiding the real thing — a few untested business methods behind dozens of covered auto-properties.
• Replaced by the zero-coverage-methods rule — every method measured at 0% is listed in TEST_REPORT §Coverage with a test or a one-line reason; a business-logic method at 0% without a reason fails the gate; structural members only need their kind named.
• A method shipping code already references needs a test, not a reason — "its caller does not exist yet" only stands when nothing references it.
• Synced across all 5 representations: rules/testing.md, commands/test.md, agents/test-engineer.md, templates/TEST_REPORT_TEMPLATE.md, CLAUDE.md Quality Gates.

🔒 2 · A security fix must not open a new hole

• New-call precondition check (/fix-issue) — when a fix replaces an expression with a library call on request-derived input, it must name the new call's preconditions, enforce them at the boundary, and add a test sending a type-violating value through the real route. Enforcing them is part of the fix, not out of scope.
• Found the hard way: a bcrypt fix swapped a total operation (!==, never throws) for a partial one (bcrypt.compare, throws on non-string) — one unauthenticated request crashed the API. Verified end-to-end, then closed.
• Wrong-type input is now its own test class — "edge case" read as boundary values misses input of the wrong shape entirely (rules/testing.md + Node/PHP test overrides).
• A comment asserting third-party behavior is a claim, not a fact (rules/code-style.md) — back it with a test that exercises that exact case, or delete the claim and write the defensive code.

📌 3 · Findings and commits stop leaking

• §Commit ownership (rules/git-workflow.md + Agent Behavior Guideline #14) — every command either commits its own artifacts or names exactly what it left uncommitted; never fold another flow's uncommitted work into your commit. Before this, only 6 of 20 commands mentioned committing at all — which is why /deploy had to block on a dirty tree whose git tag no longer described the image.
• Out-of-scope findings now have an address (principles-and-practices.md §2.5) — three rules said "record it in the backlog" while the kit never defined where the backlog was. Findings now route by kind: AC ambiguity → SPEC Open Questions · tech debt → plans/BACKLOG.md · security → a carry-forward row. A finding stated only in chat is not recorded.

🎓 4 · Greenfield graduates to brownfield

• §Mode lifecycle — greenfield is a birth phase, not a permanent identity: once a kit-built project ships its first staged release, backward-compat and ADR-to-change start applying.
• /discover §Graduation run — inventory-only: mints docs/CODEBASE_MAP.md, never REVERSEs over the forward spec, and flips Mode: only with your consent.

📄 5 · Specs that read for their audience

• specs/EVIDENCE.md — the engineer-facing US-ID → file:line evidence map moves out of SPEC.md, so the spec stays readable prose for stakeholders.
• Living-state rule for scoped REVERSE — a partial baseline must say so: header Version stays in sync with Revision History, and "not reversed yet" is never filed under "Won't".
• rules/output-style.md §10 — non-specialist floor — five checkable rules for stakeholder-facing artifacts: one word one meaning · name the actor and the physical action · countable criteria instead of adjectives · state the safety net and the red branch · a kind-noun before every identifier.

⚠️ Known limitation

• Occasional language drift — a command may reply in English even though the Profile declares another language. Measured at 1 run in 9; both occurrences happened on runs that stopped at pre-flight before writing any artifact, 0 of 6 on runs that completed. Not patched: at that rate a prose fix cannot be verified. Tell Claude "reply in " and it rewrites immediately.

🧭 Also in this release

• MIT license; README1.txt → examples/linkvault-brief.txt
• User-facing docs rewritten to the §10 floor — README (EN/VN), quick-start (90 → 59 lines), both getting-started guides: every gate condition is now countable, and each one says what to do when it goes red

Full detail per change: CHANGELOG.md § [1.7.0].