Goodfellow 0.6.0

Added

• Four seed principles: P-097 safety nets cover partial failure, P-098 exercise destructive code only against fakes or isolated namespaces, P-099 untrusted text never rides inline in an agent-run command string, P-100 gate actions on who bears the cost, not on reversibility.

• Custom fail-first test runners. Configure red_check.command and optional per-run
  red_check.reset in .goodfellow/config.json, or use --command / --reset (CLI wins;
  --test-cmd still works). {workdir} supports container mounts with writable, temporary JUnit
  reports inside each run directory. Custom runners skip bubblewrap, explicitly reported in text
  and JSON; reset or configuration errors fail closed.

• Standalone /goodfellow:grill interview. “Grill me on X” and “interview me about X” run a
  bounded scout, then one question at a time with a decision ledger before writing a reviewed spec.

Changed

• Short skill cores. Ten skills now keep step order, hard gates and conditional reading
  pointers in short SKILL.md files; detailed commands and rules live alongside them and load
  only when their step or situation is reached.

• BREAKING: one-word skill names, with no aliases. Update saved invocations, prompts and
  integrations to the new names below. Replace brainstorm --grill with /goodfellow:grill;
  brainstorm no longer accepts the interview flag. Other skill names and risk tiers are unchanged.

  Old invocation	New invocation
  /goodfellow:review-doc	/goodfellow:review
  /goodfellow:codex-review	/goodfellow:codex
  /goodfellow:public-pr	/goodfellow:publish
  /goodfellow:prune-stale	/goodfellow:prune
  /goodfellow:snap-compact	/goodfellow:snapshot
  /goodfellow:brainstorm --grill	/goodfellow:grill

Goodfellow 0.5.0

Research drops its optional Tavily backend and runs through Claude's own web search only, which
clears the plugin directory's credential review hold. The listing also gets the light-background
mark and a fuller description.

Removed

• The Tavily research adapter and its GOODFELLOW_TAVILY_KEY variable (breaking). Research now
  runs through Claude's web search only, the path Tavily users already fell back to. If you set
  GOODFELLOW_TAVILY_KEY, you can drop it; research still runs, now via web search. Removing the only
  code that read an installer-supplied credential clears the directory's "uses a credential from the
  user's machine" review hold. scripts/research_tavily.py and its test are gone; scripts/research.sh
  now takes --claims-file and reads the claim list from a file (no credentials, no environment keys,
  and no claim text interpolated into a shell command).

Changed

• Listing icon switched to the light-background mark (assets/logo/mark-light.svg). It keeps a
  visible rounded-tile edge on every background; the previous dark-tile mark blended into dark-mode
  surfaces and lost its shape.
• Fuller listing description, naming what the plugin does: a tiered process, tests that must fail
  first, cross-model adversarial review looped to convergence, and knowledge that compounds across runs.

Goodfellow 0.4.1

The red and mutation checks now run your tests in a sandbox, the mutation check stops counting a
slow machine as a kill, and the final review survives a rebase. The stop list now asks instead of
blocking. Heads up: the old skill aliases are gone (see Removed).

Removed

• The spec-review, plan-review and grill skills (breaking). Use review-doc --spec,
  review-doc --plan and brainstorm --grill. 0.4.0 announced their removal for 0.5.0; it moves
  up because people rarely type multi-word commands: Claude picks a skill from what you say. The
  phrases the aliases answered to ("review my spec", "stress test this plan", "grill me on X") are
  now in the canonical skills' descriptions, so asking in words works as before (#35).
• Stop-list rules that blocked reviewable or reversible work. Opening or merging a pull
  request, pushes to repositories outside an owner list, and migration commands no longer stop
  anything, so stop-foreign-remote, stop-public-repo (and its gh repo view visibility
  lookup) and stop-migration are gone, with the stop_list.owners and
  stop_list.migration_commands settings. Old configs that name them still load (#35).
• The git add -A and protected-branch force-push guards. Staging is reversible, and every
  force-push now asks through stop-force-push. GOODFELLOW_GUARDS is gone too:
  GOODFELLOW_STOP_LIST=0 is the one switch (#35).

Changed

• The stop list asks, it never blocks (behaviour change). Before a force-push, a push to the
  default branch, a tag push or gh release write, a package publish, or a command carrying
  --dangerously-skip-permissions, the hook returns permissionDecision: "ask" with a one-line
  reason: Claude Code shows its normal confirmation and your yes goes through. The default branch
  comes from protected_branches (default main, master) and the remote's HEAD; no network
  lookup remains. Your own block rules in .goodfellow/guards.json still deny (#35).
• Test sandbox: convenient by default, strict where it matters. Where
  bubblewrap is installed, the red and mutation checks
  run your tests with a private PID namespace and a filesystem allowlist: the only writable host
  directory is the check's own throwaway copy, your home directory, checkout and credentials are
  not mounted, and tokens in your environment are dropped (GOODFELLOW_SANDBOX_ENV keeps named
  variables). Without bubblewrap (macOS, say), the red check still runs, with one warning line and
  an install hint, and its report says unsandboxed. The mutation check runs deliberately broken
  code, so without bubblewrap it asks for --fakes or GOODFELLOW_SANDBOX=off (behaviour change).
  Once bubblewrap is installed, a sandbox that does not fully isolate makes either check refuse:
  it never degrades silently. GOODFELLOW_SANDBOX=bwrap requires the sandbox everywhere;
  GOODFELLOW_SANDBOX_RO adds read-only paths. See docs/configuration.md (#35).
• Mutation timeouts are calibrated to the load (behaviour change). Each mutant gets at least
  three times the suite's runtime measured in every parallel sandbox at once (never under 30 s;
  --timeout still overrides), and is capped at what is left of --budget. A timeout counts as a
  kill only when its limit was at least three times that loaded runtime; otherwise it is
  timeout_unverified and the result is incomplete (exit 3) instead of a pass (#35).

Added

• Sampling for large new files in the mutation check. A file that is new on the branch, longer
  than 400 lines and with more than 150 mutants is reduced to a fixed, seeded sample of 150, and
  the verdict says (SAMPLED: file k/N). Edits to existing files are never sampled. --sample,
  --sample-min-lines and --no-sample tune it (#35).
• Rebase-aware final review. ship's final-HEAD check maps the last reviewed commit to its
  rebased counterpart by patch-id and file content (scripts/review_delta.py), so after a rebase it
  reviews only the commits that came after the reviewed ones. A dropped, reordered or rewritten
  reviewed commit, a merge commit, or any git failure reviews the whole branch (#35).

Goodfellow 0.4.0

goodfellow now sizes the process to the change. A classify step puts each change in one of four
risk tiers, from a one-line fix to a live migration, and runs only the design work that tier needs;
the code checks run at every tier. Autopilot is now the default, with a hook-enforced stop list for
the actions it must hand back to you. Heads up: two behaviour changes below need a look before
you upgrade.

Changed

• Autopilot is on by default (behaviour change). The chain no longer pauses for approval
  between steps, and ship merges your own-repo PR once review converges and CI is green. Set
  GOODFELLOW_AUTOPILOT=0 to approve each step as before. dry-run is unchanged (#34).
• A stop list is enforced in every mode (behaviour change). The PreToolUse hook now
  stops pushes and PRs to repositories outside your owner list (default: the owner of origin),
  default-branch pushes, tag pushes and PR-opens on public repositories, gh release writes,
  package publishes, deploy-style migrations and plain force-pushes. Add owners with
  stop_list.owners in .goodfellow/guards.json, or turn off one stop with its id in
  disable_builtins. GOODFELLOW_AUTOPILOT=0 keeps it on; GOODFELLOW_STOP_LIST=0 is the
  dedicated opt-out (#34).
• ship --quick is now an alias for --tier T0. It is refused when the diff touches a
  high-stakes or live-state path, instead of running a single review round (#34).
• ship reviews to convergence at every tier, with a round cap of 3 at T0 and T1 and 6 at T2
  and T3, and reviews the final commit before the PR opens or merges (#34).
• New short description, README, logo and social preview; "adversarial" no longer leads the
  description (#34).

Added

• Risk tiers. brainstorm and ship classify each change as T0 fix, T1 feature, T2 design or
  T3 live state, announce it, and only ever raise it. A fix gets a failing test and the fix; a
  feature gets a short plan in the PR; a design gets a reviewed spec and plan; a live-state change
  also needs a rehearsal against a sandbox you supply, and its live step is handed to you only after
  review and CI pass (#34).
• --tier T0..T3 on brainstorm and ship, with hard floors: a high-stakes path forces at
  least T1, and a live-state path (built-in: migrations, service and timer units, crontabs,
  Terraform; extend with .goodfellow/live_state_paths.txt) forces T3. A tier below the floor is
  refused with the reason (scripts/tier.py) (#34).
• review-doc --spec | --plan, one review skill for specs and plans (#34).
• brainstorm --grill for the one-question-at-a-time interview (#34).
• docs/configuration.md, the full configuration reference (#34).

Deprecated

• spec-review, plan-review and grill still work as aliases for review-doc --spec,
  review-doc --plan and brainstorm --grill through 0.4.x, and are removed in 0.5.0 (#34).

Removed

• The old hero, icon and pipeline graphics (#34).

Goodfellow 0.3.0

Added

• Tests that can fail. plan names each behaviour task's expected red (an assertion message,
  never "function not defined") and, on high-stakes paths, the fail-closed branches, boundaries and
  one deliberate break per rule. execute is test-first with a right-reason red and never edits an
  expected value to match output. The Codex diff reviewer gained a test-quality block, and the plan
  reviewer flags high-stakes tasks with no expected red. New principles P-094 to P-096
  (#30).
• scripts/red_check.py. Replays a branch's new tests against the base in a temporary worktree
  and requires an assertion failure there and a pass on the branch (OK, WRONG_REASON, NOT_RED,
  NOT_GREEN, NEW_SYMBOL). Runner-agnostic via JUnit XML; runs in ship by default
  (#30).
• scripts/mutation_check.py. Opt-in, diff-scoped mutation testing of the Python lines a branch
  changed in files listed in .goodfellow/high_stakes_paths.txt, in throwaway copies and under a
  time budget. Running out of budget is reported as incomplete, never as a pass. Code that sends
  signals, spawns processes, or deletes or writes files is only mutated inside a PID namespace
  (--isolated) or with fakes (--fakes). Every test run gets its own process group, killed on
  timeout, exit and termination signals (#30).
• Tool-layer guards. A PreToolUse hook (scripts/guard_engine.py) blocks git add -A/./
  --all, --dangerously-skip-permissions, and force-pushes to main/master by default, plus
  any BLOCK rules a project declares in .goodfellow/guards.json. --validate for CI and
  --selfcheck to print the enforced set; snap-compact re-asserts the set after compaction
  (#26).
• Tiered principle index. The always-loaded index carries the vital-few principles plus a
  category routing table; --category NAME and --show P-NNN load more on demand. The core index
  dropped from about 2,800 to about 720 tokens. 14 new seed principles, P-080 to P-093
  (#28).
• Progressive disclosure for seeded principles and a CI density ratchet
  (measure_principle_density.py, docs/instruction-density-budget.md) that caps what is injected
  on every run (#24).
• Parallel implementers in execute. A phase's independent tasks can fan out to parallel
  implementer agents, each in its own runtime-isolated git worktree, reconciled by merge. Serial
  remains the default (#13,
  #23).
• Two-stage generator and judge review. On the Codex path a generator emits structured findings
  and a judge grounds or drops each one; judge failures fail open to the unjudged findings with a
  banner. Optional static-analysis pre-pass (ruff, shellcheck, gitleaks, semgrep,
  auto-detected) (#16).
• Judge lens tag. Each judged finding can carry a reviewer lens, threaded through loops.json
  (--lens) and lens-tuning attribution (#25).
• public-pr skill and scripts/public_pr_scrub.py: a pre-open gate for PRs to public or
  upstream repositories, with a configurable internal-reference scrub and correct cross-fork
  gh pr create flags (#16).
• grill skill. An opt-in, one-question-at-a-time interview for fuzzy or high-stakes design
  intent that stops when its open-decision ledger is empty
  (#9,
  #10).
• Reviewer lenses. spec-review and plan-review give their two reviewers different lenses,
  batch the verifier pass, and run research in an isolated subagent
  (#14).
• Lens-tuning report (scripts/lens_tuning.py): a read-only pointer to reviewer sources whose
  findings mostly triage as not-a-defect (#18).
• Rollback journal and evidence provenance for the rich memory backend, completed as a
  two-phase (intent, commit) write-ahead log with byte-bound crash recovery
  (#19,
  #22).
• Durable per-loop uuid so loop references do not alias after loops.json is reset
  (#21).
• P-079, "Reaching a limit is not success". A cap, budget or timeout halt is reported as a halt
  in prose and in control flow across the chain (#17).
• Recommended defaults for each brainstorm clarifying question
  (#11).
• Parallel triage reviewers, dispatched in one batch per backlog
  (#12).
• Marketplace manifest (.claude-plugin/marketplace.json), so the plugin installs directly with
  /plugin marketplace add easelyte/goodfellow, and a CI version-consistency check
  (#6).
• Seed principles P-059, P-061, P-063 to P-070 and sub-entries P-017a/P-017b.
• Brand assets: README hero banner, pipeline diagram and a square plugin icon
  (#8,
  #29).
• Release process: Keep a Changelog format, a tag-triggered release workflow that publishes the
  matching CHANGELOG section as the GitHub Release notes, RELEASING.md, CONTRIBUTING.md,
  SECURITY.md, and issue and pull request templates.

Changed

• With no Codex CLI, the fallback reviewer now defaults to opus instead of sonnet, so the only
  reviewer is not weaker than the model that wrote the code. GOODFELLOW_REVIEW_MODEL still
  overrides it (#25).
• ship routes review findings by three tiers: blockers stop the PR, majors are filed as loops,
  minors become knowledge gotchas (#20).
• pyproject.toml version aligned with plugin.json at 0.2.0
  (#6).

Fixed

• Guard engine fail-open gaps. Mutation testing found git add forms the guard let through; it
  now also blocks -A bundled into other short flags (-fA), the whole-tree pathspecs ./, *,
  :/ and :(top), pathspecs that are all exclusions (git add ':!secrets.env' adds everything
  else) and --pathspec-from-file. Git run through a relative path without a leading ./
  (usr/bin/git) is recognised, and Windows drive paths with forward slashes compare
  case-insensitively (#32).
• public_pr_scrub.py could scan an empty diff. Without --base it used the branch's upstream,
  which for a pushed feature branch is itself, so the whole PR went unscanned. It now scans against
  every likely PR target that exists (upstream/HEAD, upstream/main, upstream/master,
  origin/HEAD, origin/main, origin/master, main, master), skipping any that already contain
  HEAD. With no base left it fails closed (exit 2) instead of diffing against the tip's parent;
  a missing git or an uncomputable merge-base (a shallow clone) is also exit 2. Pass --base to
  scan against the exact target (#32).
• The scrub's added-line parser tracks diff hunks, so a content line starting ++ is scanned instead
  of being mistaken for a file header, and it reads a plain diff (--no-color --no-ext-diff), so
  color.diff=always can no longer hide every added line
  (#32).
• Major review findings were silently dropped at ship time; they now reach loops.json
  (#20).
• The review bridge exits with a REVIEW_FAILED sentinel on any nonzero exit, so a review that dies
  mid-run can no longer read as a clean pass (#15).
• Codex was invoked with a Claude model name; the Codex path now takes its model only from
  GOODFELLOW_CODEX_MODEL (#7).
• Spec and plan review saw an empty context for a freshly written, untracked file; the bridge now
  embeds the file body (#7).
• spec-review ignored next_action: halt-after-spec-review in the spec frontmatter
  (#7).
• grill validated its topic slug before using it in a path, closing a path traversal
  (#10).