0.2.1

Upgrade from 0.2.0. If you installed the skill into a project with npx skills add, 0.2.0 gave you wrong results: it read its own code as yours.

Found by following the README in a clean session on a fresh create-next-app project, and by running the probe on 34 local repositories.

Wrong results in 0.2.0, fixed

• The probe read itself. A skill installed in .agents/skills, .claude/skills or any other agent's skills/ folder counted as the app's code. Gates 6, 9 and 12 passed on it, and fix then skipped the health route. Installed skills are now left out.
• fix did nothing through a link. Started through .claude/skills, which links to .agents/skills, fix.mjs printed nothing, wrote nothing and exited 0. It now runs.
• Gate 7 refused rehearsed drills. It knew four English labels. Any label in any language now counts, unless it names a plan (Next, Planned, Due).
• Gate 4 refused a real date. (due: 2027-01-24, earlier if convenient) was reported as invalid. An impossible date still is.
• A readable pyproject.toml was reported as unread. Plain Python libraries got "stage not detected".

Faster

Following imports now visits each file once, and each file is read once. One repository went from 40 s to 0.3 s, another from 53 s to 2.5 s.

New check

Gate 3 fails when .gitignore hides .env.example, as create-next-app's .env* does, because nobody who clones the repo gets it. It names the line to add, !.env.example, and you add it yourself: fix does not edit .gitignore.

Expect this on a fresh project

A new create-next-app has no test script, so fix does not write the CI workflow and the project stops at 3 of 4 required gates until you add one. That is on purpose: CI with no tests in it would be a green light that means nothing.

Checked, and not checked

• 223 tests on Ubuntu and Windows with Node 20, 22 and 24.
• The README in a clean Claude Code session and in Codex, then a typecheck and a production build of the generated project on Next.js 16.4.5.
• Not checked: the generated workflows on GitHub Actions, the rollback and restore guides on a real Supabase project, macOS.

Full list: CHANGELOG.md

0.2.0

A reliability round. No new gates, no new adapters. The probe claims less than it did, and what it claims holds up better.

Your score may drop after upgrading. That is the point of this release: checks that used to pass on weak evidence no longer do.

Behaviour changes

• The probe no longer runs code from the repository it reads. Before this release, pip-audit -r requirements.txt could run a package's build backend. Python audits now accept exact pins only, with resolution and builds off. An unpinned requirements.txt gives gate 2 UNKNOWN, with the reason, instead of being resolved.
• The stage grows with the app. fix used to write stage: 1 into HUMAN-GATES.md, which froze the requirements. New registers leave detection on. If an older fix wrote that line for you, remove it: a declared stage below the detected one is kept, and the report now flags the conflict.
• --url measures more strictly. Health needs JSON with a real version. Strict-Transport-Security: max-age=0 and frame-ancestors * count as missing. Security headers need HTTPS.
• --csrf-post no longer gives a PASS. A POST to the health route says nothing about the routes that write, so gate 10 reads it as inconclusive. Your Origin check still counts as static evidence. Test the routes that write yourself.
• What was not checked is said. Monorepo apps, skipped packages, nested manifests and source the probe cannot read (Vue, Svelte, Go and others) are listed, in the Markdown and in --json. They give UNKNOWN, not PASS.
• Fewer false passes: impossible and future dates, a CI job or step with if: false, retention-days on a workflow artifact read as log cleanup, a helper imported only by a file nothing loads, Django settings that switch a header off, and comments as evidence.

Generated files

• Next.js src/app layouts are handled, and a Pages Router project gets a manual step. The CI workflow is written only when it can work.
• The backup workflow commits nothing unless you opt in, and refuses to run in a public repository.
• The rollback and restore guides were followed step by step and corrected: supabase migration repair before db push on a restored database, a compensating migration instead of a down file, and rows copied between databases by \copy into a staging table.

Checked, and not checked

• 205 tests on Ubuntu and Windows with Node 20, 22 and 24.
• fix --write, then a production build, on fresh Next.js apps.
• Both guides on a throwaway Postgres 17 with Supabase CLI 3.0.0 and 2.122.1. auth was a stub table.
• Not checked: the generated workflows on GitHub Actions, either guide on a real Supabase project, macOS.

Static checks are pattern matching, not proof a control works: read the evidence column. --no-audit still passes gate 2 on config alone, and the probe still exits 0 on a failing scorecard.

Full list: CHANGELOG.md