v2.4.0 advances photo provenance, expands OKF secret detection, records the
isolated okf-wiki runtime boundary, and completes attribution-hook parser
hardening with required CI coverage.
What shipped
- journalism-core 1.3.0: photo-metadata now covers current IPTC digital
source types, C2PA and Content Credentials, GPS stripping, Google Images
licensing fields, extended descriptions, and XMP-first metadata workflows. - okf-wiki 0.7.0: default high-signal detectors now cover Anthropic,
GitLab, npm, OpenAI, SendGrid, and Stripe secrets while preserving valid
human-readable vault paths. - okf-wiki runtime evidence: a repeatable isolated Codex pilot verifies the
installed skill and spec, exact generated output, immutable inputs, and the
boundary between the portable OKF bundle and inert Claude adapter files. - Document design update path: a fail-closed migration, verifier, fixture,
and live canary cover the historical project-lock key that blocked updates in
Skills CLI 1.5.20. - Attribution hook: inherited Git identity and measured Bash directory,
quoting, and commit-message-file behavior are now covered by the parser and a
required hook-test workflow.
Compatibility evidence
The checked-in Codex compatibility matrix remains an evidence record for the
versions that were actually tested. Its 2.3.3-era package results are not
silently relabeled as 2.4.0 support. The release and README state that gap and
identify new pilot runs as the step that can advance the evidence.
Published versions
| Package | Previous | v2.4.0 |
|---|---|---|
| Marketplace | 2.3.3 | 2.4.0 |
| journalism-core | 1.2.0 | 1.3.0 |
| okf-wiki | 0.6.1 | 0.7.0 |
Verification
- Exact-tag client compatibility canary: five jobs passed at
adf8398 - Node regression suite: 160 passed
- Pinned Agent Skills validator: 60/60 passed
- Docs CSS: 49/49 stylesheets current
- Editorial hooks: 253 passed
- okf-wiki: 214 passed
- Ruff and
git diff --check: passed - Public documentation deployment: passed and smoke-tested
See the full changelog or compare v2.3.3...v2.4.0.