v1.18.0

Registry examples now compile against the real MAF packages. Every example from MAF
1.10 to 1.23 was compiled against the packages it describes: 28 entries were wrong and
are fixed, and their compiler-error codes now match what a build reports, so
MafRunCs0618Hunt links your build errors to the right entry. The 1.10.0 and cumulative
migration guides are corrected too. New maintainer command verify-examples (used by
the release pipeline). Still covers MAF 1.23.

Added

• Product fixes release on their own when MAF is quiet. auto-release only fired when a
  MAF train merged, so fixes on main waited for Microsoft (v1.17.0 needed a manual tag).
  The weekly maf-freshness run now also checks for a product release: when the latest
  release is at least 30 days old and main has commits touching files that ship in the
  packages, it dispatches auto-release in product mode (same canary, same
  AUTO_RELEASE kill switch). No new schedule.
• Registry examples are compiled against the real MAF packages. maf-doctor verify-examples compiles each entry's example_before against the old release's
  packages and example_after against the new one's (the exact versions in the train
  lock), and checks that a cs_warning naming a compiler diagnostic is the one old code
  actually gets on the new packages. Snippets are compiled as written: undeclared
  variables are typed from how they are used, and anything that only involves the
  reader's own types is reported as unchecked, not as an error. --show <id> prints
  the generated source and every diagnostic. Watcher PRs run it in verify (report-only
  for now), restoring only Microsoft.Agents.AI* package ids.

Fixed

• 28 registry entries corrected against the real packages (found by the new
  compiler check across MAF 1.10–1.23):
  • 1.13.0 file store: the entries described Stream content and FileListEntry
    results. The real API reads and writes string content, DeleteFileAsync returns
    bool, the list methods returned names and ListChildrenAsync returns
    FileStoreEntry items (compare Type with FileStoreEntry.File/Directory;
    there is no FileStoreEntryType), and SearchFilesAsync → SearchAsync also
    renamed filePattern to globPattern.
  • 1.10.0 ToolApprovalAgentOptions has JsonSerializerOptions and
    AutoApprovalRules; EnableNonApprovalRequiredFunctionBypassing belongs to
    ChatClientAgentOptions. Fixed in the registry and in the 1.10.0 and cumulative
    guides.
  • Examples that did not compile: AgentSkill.Frontmatter.Name (1.12.0), the
    AzureBlobAgentSessionStore constructor's required agentNamespace (1.22.0), and
    six Foundry tool options without a parameterless constructor (1.23.0).
  • 27 cs_warning codes now name the diagnostic a build actually reports, so
    MafRunCs0618Hunt can link it to the entry: removed members are CS1061/CS0117,
    not CS0246; added optional parameters are BINARY_BREAK, not CS0618; the 1.23.0
    Foundry namespace move is CS0246.

v1.17.0 — complete MAF 1.1–1.23 knowledge, --baseline, C# 14, MCP SDK 2.2

Better knowledge of MAF 1.1 to 1.23, no change in coverage. Registry entries are now
checked against the real packages: about 40 entries were added, re-attributed or
rewritten. doctor --baseline gates CI on new findings only, C# 14 code parses, and
the MCP SDK moves to 2.2 (stateless spec 2026-07-28). The release pipeline now merges
additive MAF releases, retries a failed fill and releases on its own; MAF 1.24 will be
its first real run. Still covers MAF 1.23.

Added

• doctor --baseline <file>: gate only on new findings. Pass the output of an earlier
  maf-doctor doctor --all --json; matching findings (by drift-stable fingerprint) are
  dropped before grading, so --fail-on fails only when something new appears. The
  report and JSON (baseline_suppressed) say how many matched. The PR audit now uses the
  base branch as its baseline, so its comment shows what the PR introduced.
• Signature oracle for registry entries (report-only in verify for watcher PRs).
  Every new entry's API claims are checked against the real packages in the train lock:
  the obsolete member must exist in the old package and the replacement member in the
  new one. Across MAF 1.10–1.23 its only findings were real mis-attributions, now fixed.
• The watcher runs within about four days of a MAF release. The weekly (Monday) freshness job dispatches
  it as soon as main is behind and no watcher PR is open (was: Thursdays only).
• The fill agent repairs its own failed fill once. When the required verify check
  fails on the agent's commit, maf-fill-repair re-runs the agent (bounded by
  MAF_FILL_MAX_REPAIRS, default 1), then labels the PR needs-human with a runbook
  link.
• MCP spec 2026-07-28 (stateless) is served. With the 2.2.0 SDK, hosts can skip the
  initialize handshake: server/discover, tools/list and tools/call work with
  per-request _meta. The classic handshake still negotiates up to 2025-11-25.
• An MCP round trip runs on every PR (build-test): every tool, prompt, resource
  and template is listed, every resource read, the argument-free prompts rendered, a
  real tool call made, and the stateless 2026-07-28 flow exercised.
• Automatic releases. When a watcher PR merges (.maf-version changes on main),
  auto-release tags the next minor version, so each MAF train ships as a maf-doctor
  release with no human step. Switched by the AUTO_RELEASE repository variable.
• Release canary. Before anything is pushed to NuGet, release.yml installs the
  packed tool from the local .nupkg, checks --version, runs an MCP stdio smoke test
  (handshake, capability lists, a real tool call) and verify-registry against the
  registry embedded in the package.
• New MAF packages can no longer go unnoticed. The weekly maf-freshness job lists
  every verified Microsoft.Agents.AI* package on nuget.org and keeps a rolling issue
  open for any that is neither a watcher surface, a lifecycle-event package, nor
  ignored with a reason in .github/maf-package-discovery.json. 24 of 35 packages had
  gone undiffed for months.
• Freshness badge. The README shows the maf-freshness status; the run now turns red
  while the SLO is breached or a package is untracked.
• CLAUDE.md with the repository's working notes (it was referenced but missing).

Changed

• MAF-AP-SEC-001 (DefaultAzureCredential in AI code) is a warning, not an error. It is
  hardening advice (Azure Identity: prefer a deterministic credential in production), not
  a defect; as an error it graded an official Azure OpenAI sample "F" (now "B"). The
  bundled samples move one finding from errors to warnings (6/4, still "F").
• The tool rolls forward to newer .NET runtimes (RollForward=Major). .NET 8 and 9
  reach end of support on 2026-11-10; the net8/net9/net10 builds keep shipping while MAF
  supports them, and a machine with only a newer runtime (e.g. .NET 11) can still run it.
• CI budget: maf-freshness runs weekly (Mondays; with the watcher's Thursday run a new
  MAF release is picked up within about four days), and the Copilot semantic review runs
  automatically only on release-watcher PRs (any PR can still be reviewed on demand with
  workflow_dispatch).
• C# 14 code is parsed correctly. The scanners and rewriters moved to Roslyn 5.6
  (was 4.14) and parse at the latest language version through one helper, so extension
  blocks, null-conditional assignment and the field keyword no longer produce syntax
  errors around the MAF calls being checked. The shipped analyzer stays on Roslyn 4.14
  (it loads in the user's compiler); a test guards that pin.
• MCP C# SDK 2.2.0 (ModelContextProtocol, was 1.4.1). A drop-in for MAF Doctor:
  same protocol version, tools, prompts, resources and templates (verified over stdio).
• xunit.runner.visualstudio 4.0.0 (test-only).

Fixed

• maf_compatibility knew only 22 of the 27 MAF releases. 1.6.0, 1.6.2, 1.7.0, 1.8.0 and
  1.9.0 answered "unknown version" and were missing from the regression-plan ladder,
  although the registry has their changes. They now have rows (dependency floors from
  the packages, notes from the registry), the 1.10.0 note no longer lists changes that
  shipped in 1.6.2 to 1.9.0, and the 1.0 to 1.2 rows use the same row format as the rest. A new
  cross-file check fails when the registry has entries for a release that the matrix
  (doc or MCP tool) does not list.
• The 20 re-attributed 1.6.2–1.9.0 entries now give real migration steps. Their old
  text was vague and partly wrong: WithName/WithDescription did not disappear in 1.9.0,
  they moved to the new OrchestrationBuilderBase<TBuilder> (calls compile; rebuild). The
  entries now name the actual replacements from the packages: SubAgents* →
  BackgroundAgents*/BackgroundTask* (1.6.2), skill Content/Resources/Scripts →
  GetContentAsync/GetResourceAsync/GetScriptAsync (1.7.0), and
  ScriptDirectories/ResourceDirectories → ScriptFilter/ResourceFilter +
  SearchDepth (1.8.0).
• DefaultAzureCredential no longer flags non-AI code. MAF-AP-SEC-001 now applies only
  to files that use an agent/AI stack (MAF, Microsoft.Extensions.AI, Azure AI, OpenAI,
  Semantic Kernel). A false-positive sweep of non-MAF repos graded CleanArchitecture "C"
  (and offered an autofix) for a Key Vault configuration credential; it is now "A".
  eShop and aspire-samples were already clean.
• Twenty 1.10.0 entries carried the wrong release. They were drafted from one lumped
  1.6.1 → 1.10.0 diff; a per-release diff (and the new signature oracle) shows they
  shipped in 1.6.2, 1.7.0, 1.8.0 and 1.9.0. Their version_introduced and
  applies_to_codebases now match the real release.
• Regression plans dropped changes from releases the matrix skips. A step lists the
  entries introduced after its source version up to its target. Before, it listed only
  entries introduced exactly at the target, so a 1.7.0 → 1.10.0 plan (one step: the
  matrix had no 1.8.0/1.9.0 rows) left out the 1.8.0 and 1.9.0 changes.
• The first public releases (MAF 1.1–1.3) gain registry coverage. A per-release diff
  from 1.0.0 found 10 breaking changes with no entry: skill APIs (1.1.0), Foundry
  AsAIAgent (1.2.0), and the 1.3.0 A2A client and hosting redesign (IA2AClient,
  AddA2AServer + MapA2AJsonRpc/MapA2AHttpJson, RequestContext). The historical
  MAF130-A2A-001/002 notes are corrected: MapA2A did ship in the 1.2.0 hosting
  previews, and A2AServerRegistrationOptions has no AgentCard property.
• Sixteen breaking changes in MAF 1.6–1.10 had no registry entry. The watcher
  used to jump from 1.6.1 to 1.10.0, so those releases were never diffed one by one. A
  per-release diff of all 35 packages found them: Foundry toolbox removal and client
  options (1.6.0), the AIProjectClientExtensions move and FoundryAgent.GetService
  (1.6.2), session isolation on by default in Hosting stores and the removal of
  declarative-workflow code generation (1.8.0), Harness constructor changes (1.9.0,
  1.10.0), and the GitHub Copilot SDK namespace move (1.10.0). Noted in the 1.6.1 and
  1.10.0 guides.
• Nine breaking changes in MAF 1.18 and 1.21 were missing. Those releases were
  processed while the watcher diffed only 8–9 packages. A backfill diff of the other
  packages found them: Foundry.Hosting session stores return AgentSession? and
  AddFoundryResponses gained configure (1.18), the AspNetCore claims-isolation types
  and UseClaimsBasedSessionIsolation were renamed (1.18), and the A2A AgentRunMode
  members were renamed to ReturnMessage/ReturnTask/ReturnTaskWhen (1.21). Added as
  registry entries with exact signatures and noted in the 1.18 and 1.21 guides.
• The fill agent was told to follow MAF 1.3.0 rules. .github/copilot-instructions.md
  was a stale init output ("NEVER introduce patterns not present in MAF 1.3.0") that
  Copilot loads as repository instructions, including in the agentic fill. It now
  describes this repository and points to the version-scoped constraints.
• Docs describe the current self-update loop (agentic fill, required gates, freshness,
  lock-file repair) instead of the retired Copilot-coding-agent issue flow:
  TROUBLESHOOTING.md, docs/setup.md, the maf-release-watcher skill, the watcher's
  commit message and notices.

Install or upgrade: dotnet tool update -g maf-doctor · Full history: CHANGELOG.md

v1.16.0

What's Changed

• Self-healing loop, phase 1: unstick the watcher, diagnose failures, agentic fill by @joslat in #185
• chore: MAF 1.18.0 registry/matrix/guide update (breaking) by @joslat in #186
• Agentic fill: make the push work end to end (proven on MAF 1.18.0) by @joslat in #189
• Track Microsoft.Agents.AI.Mcp; let REVIEW sentinels resolve in untracked packages by @joslat in #191
• chore: MAF 1.19.0 registry/matrix/guide update (breaking) by @joslat in #190
• chore: MAF 1.20.0 registry/matrix/guide update (additive) by @joslat in #192
• chore: MAF 1.21.0 registry/matrix/guide update (breaking) by @joslat in #193
• deps(actions)(deps): bump marocchino/sticky-pull-request-comment from 3.0.4 to 3.0.5 by @dependabot[bot] in #132
• deps(actions)(deps): bump docker/metadata-action from 6.1.0 to 6.2.0 by @dependabot[bot] in #133
• deps(actions)(deps): bump docker/login-action from 4.2.0 to 4.4.0 by @dependabot[bot] in #134
• deps(actions)(deps): bump docker/build-push-action from 7.2.0 to 7.3.0 by @dependabot[bot] in #135
• deps(actions)(deps): bump docker/setup-buildx-action from 4.1.0 to 4.2.0 by @dependabot[bot] in #136
• deps(docker)(deps): bump dotnet/sdk from ed034a8 to 72dd743 by @dependabot[bot] in #168
• deps(docker)(deps): bump dotnet/runtime from ed5d539 to 68d3501 by @dependabot[bot] in #169
• Diff all 35 MAF packages; never say SAFE past the registry (coverage horizon) by @joslat in #194
• deps: patch CVE-2026-62900 (SourceLink 10.0.303); group Dependabot updates by @joslat in #195
• Autonomy: auto-merge additive trains, envelope gate, freshness SLO, stalled-PR clock by @joslat in #197
• verify: autonomy envelope diffs from the merge-base by @joslat in #202
• fill agent: run the obligations gate; REVIEW sentinels need new entries by @joslat in #205
• MafDoctorStatus: report MAF knowledge freshness (U-02) by @joslat in #199
• deps(docker)(deps): bump the docker-base-images group with 2 updates by @dependabot[bot] in #198
• chore: MAF 1.22.0 registry/matrix/guide update (breaking) by @joslat in #196
• deps: repair Dependabot's single-framework lock files; keep gh-aw out of Dependabot by @joslat in #206
• deps(actions)(deps): bump the github-actions group with 10 updates by @dependabot[bot] in #208
• Registry hygiene (Q-03), regression-plan fix, verify merge-base fix, replay test by @joslat in #209
• Prepare v1.16.0 (MAF 1.18-1.23) + unblock PRs cut before #209 by @joslat in #210
• chore: MAF 1.23.0 registry/matrix/guide update (breaking) by @joslat in #207
• deps(nuget): Bump the nuget-minor-patch group with 6 updates by @dependabot[bot] in #201

Full Changelog: v1.15.0...v1.16.0

v1.15.0 — MAF 1.14–1.17 migration intelligence + CI reliability

maf-doctor v1.15.0

This release completes the repaired, sequential Microsoft Agent Framework update chain from MAF 1.13 → 1.14 → 1.15 → 1.16 → 1.17. Each MAF step was generated, audited against official assemblies/source, filled, independently reviewed, tested, and merged in order.

Migration intelligence

• MAF 1.14: agent-mode/session API changes, async message injection, approval-rule contexts and defaults, Harness file/shell composition, AG-UI package split, GitHub Copilot collection narrowing, and ShellPolicy binary/deny-first behavior.
• MAF 1.15: preview Hosting named-argument changes, abstract DeleteSessionAsync, session/checkpoint isolation, streaming correlation, and declarative autoSend behavior.
• MAF 1.16: VectorData 9.7→10.7 source/provider migrations, connector transitions, chat-history ownership, ToolApproval sessions, FileMemory scope, Foundry port binding, and A2A configuration boundaries.
• MAF 1.17: public APIs remain structurally clean; declarative/Foundry failures now terminate and respect redaction policy; Durable Task and Azure Functions retain package IDs under an independent extension-repository cadence.

maf://guide now ships the complete cumulative guide through MAF 1.17. MafMigrationPath understands both legacy and current guide metadata and returns every intervening release while excluding the already-applied source step.

CI and self-update repairs

• Replaced corrupt dotnet-inspect 0.7.8 evidence with exact-pinned 0.9.1 plus strict structural validation.
• Added release-aware, per-package evidence planning and extraction ledgers; targeted Core, Workflows, Hosting, Harness, AG-UI, Copilot, Shell, and lifecycle transitions fail closed.
• Prevented skipped stable releases, retained historical-branch collisions, partial extraction, deleted scaffold obligations, and untrusted verifier/semantic-review execution.
• Restored semantic review after GitHub Models retirement.
• Fixed the Windows valid-path smoke test so it scans an isolated empty directory instead of the shared temp root, eliminating parallel 30-second timeouts.

Release integrity

• Both packages are versioned 1.15.0 in lockstep.
• The release validates exactly two NuGet packages and two symbol packages, including IDs, versions, TFMs, tool settings, analyzer layout, README/icon, and symbols before publication.
• All four artifacts receive provenance attestations and GitHub Release assets.
• Tag-triggered NuGet and GHCR publication both reject commits outside reviewed main history.

Validation

• 326 Python CI/helper tests passed.
• 3,861 .NET tests passed across net8.0, net9.0, and net10.0.
• Registry, cross-file, semantic-review, security-scan, audit, and workflow-invariant gates passed.
• Local release rehearsal produced and inspected all four artifacts; isolated install reported maf-doctor 1.15.0, returned grade A on an empty directory, and embedded the cumulative MAF 1.17 guide.

Install / upgrade

dotnet tool install -g maf-doctor
dotnet tool update -g maf-doctor

Migration data PRs: #176, #180, #181, #182. Release prep: #183.

v1.14.0 — Fable-5 residual remediation + report readability

maf-doctor v1.14.0

The Fable-5 residual-review remediation — a deep second-pass review of v1.13.0 turned up 115 findings, and this release closes 113 of them across the autofix engine, the CLI, the scan core, every reporting surface, and the entire CI / release / AI-automation pipeline. It shipped as nine independently-reviewed phases (PRs #154–163), plus a security-documentation refresh (#164) and a report-readability fix (#165).

CI green across net8/9/10 and Linux.

🙏 Thanks to Jesse Liberty for the feedback that prompted the report-readability improvement — scoring an app now produces a report that's genuinely easy to scan.

---

✨ Highlights

The scored report is now scannable. maf-doctor doctor spaces each finding out and separates them with a horizontal rule (the --all grouped view too). Machine surfaces — --json, --plan, --plan-json, SARIF — are byte-for-byte unchanged. (Suggested by Jesse Liberty.)

Before → after:

BEFORE                                  AFTER
1. **[…]** finding one                  **1. [Source]** finding one
   - Why: …
   - Fix: …                             - **Why:** …
2. **[…]** finding two                  - **Fix:** …
   - Why: …                             - `file:line` → `code`

                                        ---

                                        **2. [Source]** finding two

Verifiable release provenance. Starting with this release, every published .nupkg carries a signed build-provenance attestation, and the publish pipeline refuses to release from any tag that isn't an ancestor of the reviewed main branch.

---

🔒 Security

• Fence-label injection closed (SEC-01) — the LLM data-fence label is sanitized ([A-Za-z0-9._-], ≤64 chars) in both the C# and Python fencers, so an attacker-influenced registry id can't inject text outside the fence a downstream model reads.
• Subprocess secrets no longer inherited (SEC-09) — credential-like env vars are stripped from every dotnet / dotnet-inspect / git child, so a run on an untrusted repo can't read the host's secrets.
• Hostile .git/config neutralized (SEC-22) — git runs with fsmonitor/hooksPath/pager/protocol.ext locked down + GIT_CONFIG_NOSYSTEM.
• Build-provenance attestation + tag-on-main publish guard (SEC-13).
• NuGet vulnerability audit with teeth (SEC-15) — NuGetAuditMode=all, HIGH/CRITICAL advisories fail restore.
• Fork-safe PR automation (SEC-11) — jobs that build fork code no longer hold write scope; a trusted companion posts comments.
• Fail-closed release classification (WM-11) — a garbled/truncated upstream diff classifies as breaking, never silently additive.
• Non-vacuous mcp-scanner gate (SEC-12 / WM-13) and a widened CI templating-injection gate (WM-14).
• Container capability boundary (SEC-10).

🛠 Fixed & Changed

• Autofix engine — source-corruption / pipeline / encoding / preview / file-lock fixes; rewriter output is compile-verified.
• CLI & MCP lifecycle — strict args, honest exit codes, correct stdout/stderr separation.
• Scan core — parse-once + parallel scanning with honest caps.
• Reporting accuracy — single-source health grade, additive-diff contract, full SARIF fidelity, and prose-to-data fixes so the numbers reconcile across every surface.

📚 Documentation

• Security docs federated + refreshed (#164) — four documents, one job each: a navigation map, a single canonical scan-result home, and accuracy fixes (tool count corrected to 28, closed gaps updated, new attack classes documented).

---

📦 Install / upgrade

dotnet tool install -g maf-doctor            # first time
dotnet tool update  -g maf-doctor            # upgrade to 1.14.0

Full commit-by-commit detail is in CHANGELOG.md. Deferred, honestly-disclosed residual items live in docs/security/threat-model.md §5.

v1.13.0

What's Changed

• fix: security remediation — all 30 findings from 2026-07-19 assessment, verified across 4 review rounds by @joslat in #152

Full Changelog: v1.12.0...v1.13.0

v1.12.0

A second, more thorough steering-completeness pass — following v1.11.0's dead-reference fix, audited the full live tool/prompt catalogue against what the steering docs actually tell Copilot, Claude Code, and Cursor to do, and closed the real gaps found.

Added

• Self-update awareness in steering. Nothing in the four steering docs (or the @maf agent) ever mentioned MafDoctorStatus — the tool that reports whether the installed package or a workspace's init is stale. Added: check occasionally, surface the dotnet tool update -g maf-doctor + maf-doctor init flow when needed, confirming with the user before the global tool update (repo-scoped init is always safe to just run).
• maf://constraints awareness in steering. Every MCP prompt (maf-audit, maf-migrate, maf-remediate, maf-migrate-from, maf-review, maf-debug) reads maf://constraints — the non-negotiable hard rules — as its first step. The baseline steering never told the assistant to do the same for anything answered outside a prompt. Added as its own item, early in the list.
• "Scan incomplete" awareness. v1.10.0 added scan_truncated / files_scanned reporting when a repo scan hits a size cap, but steering never told the assistant to check for or surface it — a capped scan could silently present an incomplete grade as definitive.
• maf-onboarding now referenced in steering, not just in maf-help's routing table.
• MafAuditPullRequest now referenced in steering — previously only mentioned inside the maf-migrate prompt's own text.
• Discovery fallback in steering. Added a closing pointer to MafTour() (full capability catalogue) and the maf-help prompt (guided triage) — previously only reachable via the @maf agent (Mode 2 only), leaving Claude Code / Cursor / plain-init Copilot users with no discovery mechanism at all.

Notes

• Deliberately NOT added to steering (to avoid turning it into a full tool index — that's what MafTour / maf-help are for): MafScanAntiPatterns, MafValidateFanOut, MafScoreMigrationRisk, MafGenerateRegressionPlan, MafExplain, and similar — already reachable via maf-review / maf-debug / the @maf agent's own decision tree.

Full Changelog: v1.11.0...v1.12.0

v1.11.0

Steering-wiring review: dead agent references fixed, a real onboarding-prompt gap closed, and a sweep of stale docs.

A review of how init steers GitHub Copilot, Claude Code, and Cursor found that all four shipped steering files (and two of the MCP prompts) told the assistant to hand off to @maf-* specialist-agent personas that init's default install path never actually installs — dead references for anyone who just ran maf-doctor init rather than manually copying this repo's .github/.

Added

• maf-onboarding MCP prompt. The maf-help triage prompt routed "I just joined the team" to @maf-onboarding — an agent persona with no MCP-prompt equivalent, unlike every other route. Added a real, always-available prompt mirroring the agent's guided first-day tour (codebase summary, agent topology via MafSimulateWorkflow, hot-path files, current grade + top fixes via MafDoctor). (Prompts 10 → 11.)

Fixed

• Dead @maf-* agent references in all four steering files and two MCP prompts. init never copies .github/agents/*.agent.md into a consumer repo (only manually copying this repo's whole .github/ in — "Mode 2" — does, and only for GitHub Copilot); there is no Claude Code subagent or Cursor custom-mode equivalent anywhere. So .github/instructions/maf-doctor.instructions.md, .claude/maf-doctor.md, the AGENTS.md block, .cursor/rules/maf-doctor.mdc, and the maf-debug / maf-help prompts were all routing to personas that don't exist for the common case — while the identical workflows were already sitting there, wired up by every init run, as MCP prompts (maf-review, maf-audit, maf-migrate, maf-debug, maf-migrate-from). Steering now leads with the prompts and mentions the @-mention personas only as a Mode-2, Copilot-only enhancement.
• Sidecar files carried no "don't hand-edit me" warning. .github/instructions/maf-doctor.instructions.md, .claude/maf-doctor.md, and .cursor/rules/maf-doctor.mdc are fully overwritten on every re-init, but the only comment that said so lived in the source snippet's header — which is stripped before the file is written to a consumer's repo. Each now carries an accurate, undeleted note pointing at where durable customizations actually belong.
• Stale header comments in the four docs/steering/*.md source snippets — left over from a prior refactor, describing appending into the user's own copilot-instructions.md / CLAUDE.md with merge semantics; the shipped design has been overwrite-on-reinit sidecars for a while. Rewritten to match, and to name Copilot's/Cursor's native AGENTS.md support.
• Stale docs/steering/README.md — said "these three files" (there are four) and claimed cursor-rules.md lands at ./.cursorrules; the real destination is .cursor/rules/maf-doctor.mdc.
• --with-cursor's console output named the wrong file (.cursorrules instead of the actual .cursor/rules/maf-doctor.mdc).
• Stale tool / prompt / skill counts drifted independently across README.md, NUGET_README.md, and several docs pages — reconciled to the live, drift-tested values: 28 tools, 11 prompts, 15 skills.
• No drift guard on the three duplicated steering bodies — added a test pinning that copilot-instructions.md / claude-instructions.md / agents.md stay identical.

Full Changelog: v1.10.0...v1.11.0

v1.10.0

MCP server memory leak fix + repo-scan hardening — and our first outside contribution 🎉

The MCP server no longer leaks memory while idle — a stray config-reload file watcher was recursively monitoring the MCP host's entire working directory (typically the user's home folder), ballooning to multiple GB within minutes under normal machine activity. Reviewing that fix surfaced a related class of issues, now also closed: repoPath must be a genuinely absolute path, every repo scan is bounded, and the MAF PR Audit CI check no longer fails on outside contributions. Full details in CHANGELOG.md.

A special thank you to @ANcpLua (Alexander Nachtmann) — maf-doctor's first outside contributor. He diagnosed this memory leak with a precise root-cause writeup (down to the exact sample stack trace) and shipped a minimal, well-verified fix in #147. Really appreciate the sharp catch and the quality of the report — this is exactly the kind of contribution that makes an open-source project better. 🙏

What's Changed

• fix: stop config-reload file watcher from ballooning memory in MCP mode by @ANcpLua in #147
• fix: harden PathGuard, cap repo scans, fix fork-PR audit comments (#148) by @joslat in #149

New Contributors

• @ANcpLua made their first contribution in #147

Full Changelog: v1.9.0...v1.10.0

v1.9.0

What's Changed

• Add MCP update and init freshness checks by @joslat in #142
• Document update freshness status in quickstart by @joslat in #143

Full Changelog: v1.8.0...v1.9.0