v0.21.1 — pumllint on PyPI

pumllint is now on PyPI: pip install pumllint (or pipx / uv tool install pumllint).

• Releases publish automatically from the v* tag via PyPI Trusted Publishing (OIDC, no stored token): build, twine check --strict, and an away-from-source wheel smoke test gate the upload (.github/workflows/publish.yml).
• Packaging metadata modernized: PEP 639 license expression, README as the PyPI page, classifiers for the tested 3.11/3.12 matrix, project URLs incl. the live example report.
• New pumllint --version flag on all commands — the only product-code change; rules, scoring and reports are untouched, golden scores stay frozen.
• Docs lead with pip install pumllint; the setup guide's five stale v0.18.0 pins were fixed and the pin drift guard now covers both README and setup guide, action pins and pre-commit revs alike.

v0.21.0 — syntax gate in CI, governance conventions at home

No product-code changes — this release lands the repository's assurance and dogfood closures, completing the dogfooding audit:

• syntax-gate CI job. Every shipped diagram is checked against real PlantUML (pinned jar, PLANTUML_VERSION in tests.yml) on every push via pumllint score --check-syntax, and a deliberately broken probe must fail -checkonly and be forced to Level 1 by the C2 cap — the DIM-SYN integration is now exercised end to end in both directions. Measured along the way: PlantUML tolerates unclosed alt/while and even a dangling Alice ->, so pumllint's SEQ004/ACT004 are stricter than the grammar itself — grammar checking alone would bless every deliberately broken example. Full findings in "The syntax gate, measured" (docs/dogfooding.md).
• Governance conventions at home. The repository's own pumllint.toml now configures GEN006/GEN007 (an owner: tag; references to the repo's spec documents or ADR-/REQ- ids), and the architecture diagram carries both in its footer. The bundled examples deliberately stay untagged (fictional domain; they feed the frozen calibration corpus), so the published pilot report honestly shows the TRC gap on them — aggregate 88 → 87/100, with no diagram changing level (measured before enabling).

Audit scorecard: two findings shipped as product changes (v0.19.0 suppressed-count disclosure, v0.20.0 SEQ103 tightening), one closed as a CI gate, one closed by configuration.

v0.20.0 — SEQ103 argument-list tightening

SEQ103 (codegen-prose-message) now catches prose hiding inside parentheses. Previously only the outer name(...) shape was checked, so handle(the payment stuff) silenced the blocker — the cheapest evasion of the codegen gate. The rule now validates the argument list with two configurable knobs: max_arg_words (default 2) and an arg_stop_words function-word lexicon, in the same style as the other codegen lexicons. name: Type parameters and quoted literal arguments stay legal, and two-word arguments without a function word (Order order) deliberately pass — precision first. Findings state the reason: 'load_config(explicit path or auto-detect)' hides prose in its arguments ('explicit path or auto-detect' reads as 4 words).

Conforming diagrams are unaffected: zero verdict changes across the bundled examples and the calibration corpus, and golden scores are unchanged. Found by dogfooding (docs/dogfooding.md) — the second finding from that exercise to ship as a product change, after v0.19.0's suppressed-findings disclosure.

v0.19.0 — suppressed-findings disclosure

Score reports now disclose inline-suppressed findings. Inline ' pumllint: disable comments exclude findings from scoring; every report now says so instead of staying silent. Text renders 100/100 (3 suppressed) plus a model-set total, HTML appends "N finding(s) suppressed inline", and the sonar message carries it — all only when non-zero, so clean output is unchanged. JSON always emits maturity.suppressedCount per diagram and for the model set, and the field is required in the score schema — consumers validating score reports should regenerate via pumllint schema score. Composite scores and levels are untouched; suppression semantics are now specified in SCORING.md §3, and --no-suppressions remains the full audit path.

Also in this release:

• The repository's own config moved from pumllint.yaml to pumllint.toml (stdlib-parseable), fixing the dependency-free CI jobs; YAML configs remain fully supported for consumers.
• Dogfooding docs: a sequence diagram of pumllint's own lint pipeline (docs/pumllint-lint-flow.puml) and the sense-vs-nonsense evaluation whose findings became this release (docs/dogfooding.md).

v0.18.1 — public under MIT

First public release. No behavioural changes to the linter or scorer.

• Repository is now public under the MIT licence (LICENSE, license badge, license metadata in packaging).
• Management shelf under docs/: pumllint in the SDLC — a value-stream assessment across the four SAFe Continuous Delivery Pipeline aspects (executive brief, full assessment, 16-practice-domain appendix; every claim tagged measured/mechanism/hypothesis) — plus a plain-language rewrite of the case for pumllint.
• Live pilot example: the tool's own score examples/ run is published via GitHub Pages — example maturity report + badge JSON — and tests/test_pilot_example.py fails the suite if the published bytes ever drift from a fresh run.
• README action pins and the pre-commit rev now point at v0.18.1.

pumllint 0.18.0 — scoring platform complete: ratchet CI, 5 diagram types, measured evidence, schemas

Cumulative release: everything since 0.5.0 (thirteen versions), organized by theme. Zero runtime dependencies throughout; Python ≥ 3.11.

Scoring & CI trust

• Model-set aggregate score (0.6.0) — every report ends with the set verdict: worst per-diagram level (the set is only as trustworthy as its weakest diagram) plus an element-weighted composite. --min-level gates on it.
• Baseline / ratchet mode (0.6.0) — record today's per-diagram levels once, then fail CI only on regression; --update-baseline accepts the status quo. Trend/delta annotations in the text and json reports (0.7.0).
• Maturity badge (0.7.0) — score -f badge emits shields.io endpoint JSON for the model-set level.
• GitHub Action + pre-commit hooks (0.8.0) — composite action mirroring the CLI (uses: fdurieux/pumllint@v0.18.0), plus pumllint / pumllint-score hooks; both dogfooded in this repo's CI.
• HTML architect report (0.15.0) — score -f html: a single self-contained page (no scripts, no external requests, deterministic), model-set verdict first, per-diagram cards worst-first with dimension bars, gap report and baseline trends.

Coverage: 42-rule catalog across five diagram types

• Class diagrams (0.9.0) — parser + CLS001–005 (empty classes, orphans, missing multiplicities/types, generalization cycles).
• State machines (0.10.0) — parser + STA001–003 (unreachable states, no initial/final, unlabelled transitions).
• Use-case direction (0.11.0) — UC003 catches <<include>>/<<extend>> arrows pointing the wrong way.
• Traceability & readability (0.12.0) — GEN006 owner-tag and GEN007 requirement-link (convention-gated: dormant until you configure your project's pattern), GEN008 note-density, GEN009 max-elements, SEQ011 max-messages.
• Cross-type entity identity (0.13.0) — XD004/XD005 catch the same entity named or stereotyped inconsistently across sequence, use-case, class and activity diagrams.
• Calibration everywhere (0.14.0, 0.17.0) — the mutation-ladder corpus and the frozen golden-score contract now cover every diagram type (97 scored units).

Evidence

• Deepened codegen experiment (0.17.0) — 243 generation runs across two generator models and two independent LLM judges (EVIDENCE.md): controlling for scenario difficulty, per-diagram correlation between the composite score and generated-code fidelity is r ≈ 0.65–0.70, stable across models. The below-Level-2 cliff reproduces — and steepens under a smaller generator model. Judges agree on ranking (r = 0.715).

Auto-fix & contract

• pumllint fix (0.16.0) — auto-remediation for exactly the mechanical findings where nothing has to be invented: diagram names, humanized titles, implicit participant declarations. --dry-run prints the diff and exits 1 when fixes are pending (CI check mode); the Action accepts command: fix. Labels, guards and multiplicities stay human decisions.
• JSON report schemas (0.18.0) — the -f json shapes for lint and score are now a pinned public contract: JSON Schemas (draft 2020-12) ship inside the package, pumllint schema {lint,score} prints them, and the test suite validates every emittable report shape against them.

Documentation

• Audience-split guides (post-release) — docs/ now carries role-specific guides: the management case (with the measured evidence), setup & CI integration, understanding findings & scores, and a step-by-step rule-writing guide walked through a real shipped rule.

---

Level 5 means method-convention complete — the diagram-side preconditions for faithful code generation, bound to the codegen profile. Full details: README, SCORING.md, RULES.md, ROADMAP.md.

pumllint 0.5.0 — maturity scoring

Maturity scoring (pumllint score)

pumllint now aggregates its rule findings into a 360° maturity level per diagram — from 1 (Sketchy) to 5 (Generation-ready) — with a prescriptive gap report listing exactly which findings block promotion to the next level.

python -m pumllint score diagrams/ --min-level 4      # CI gate: exit 1 below Level 4
python -m pumllint score diagrams/ --profile codegen  # Level 5 requires this profile
python -m pumllint score diagrams/ --check-syntax     # also run plantuml -checkonly

• Seven scoring dimensions (semantic, completeness, consistency, traceability, readability, ambiguity + an external syntax gate), every rule annotated in the catalog.
• Integrity caps C1–C7 — blocker cap, syntax gate, sacrificed-dimension cap, vacuity guards (an empty diagram cannot score), and Level-5 binding to the codegen profile so the claim can't be made without those rules running.
• Gap reports in text/JSON/SonarQube output: the minimal set of fixes to reach the next level.
• XD cross-diagram pack: participant identity checked across the whole lint batch (kind/stereotype conflicts, case collisions), majority-wins attribution.

Calibrated and evidence-backed

• Defaults (K=50, signal-proportional dimension weights, severity ladder) validated against a generated mutation/synthetic/wild corpus — zero monotonicity violations in every configuration tested — and frozen behind golden-score regression tests (SCORING.md §9).
• The maturity→codegen relationship is measured, not asserted (EVIDENCE.md): across 75 generation runs with an independent LLM judge, maturity scores correlated with generated-code fidelity (r ≈ 0.49), and diagrams below Level 2 degraded sharply — fidelity down by roughly a third, invented business logic doubled. The --min-level gate keeps those diagrams out.

Also in this release

• Executable spec extended: SCORING.md's Gherkin runs in the test suite alongside RULES.md.
• Parser tolerates a UTF-8 BOM before @startuml (found by wild-corpus harvesting).
• Hardened by a 57-agent max-effort review: 15 findings fixed, including cross-diagram attribution for unterminated blocks, a vacuous-pass hole in the CI gate, and shell-splitting for syntax_command strings.
• Zero-dependency promise preserved: the scorer is stdlib-only; 249 pytest + 178 zero-dep-runner tests green.

Full scoring model: SCORING.md · Rules: RULES.md · Experiment record: EVIDENCE.md