v1.48.0

Package Changelog

Minor Changes

• 60b7b5a: Adds a CLI writer for a milestone's operator-authored pre-mortem fields (closes rec-20260714-001): cadence milestone premortem <id> now accepts repeatable --add-out-of-scope <text...>, --add-likely-failure-mode <text...>, and --add-hidden-dependency <text...> options that append operator-authored text without hand-editing .cadence/intelligence/milestones.json. Each value is refused (non-zero exit, clear stderr, nothing written) if empty or whitespace-only after trimming. Operator-authored likelyFailureModes/hiddenDependencies entries now survive a later plain cadence milestone premortem <id> refresh alongside the freshly-derived deterministic entries, mirroring the guarantee outOfScope already had. All operator-supplied text is newline-collapsed to a single line before being stored, matching how every other pre-mortem entry in the ledger is normalized (a raw embedded newline would otherwise break MILESTONES.md's one-bullet-per-entry rendering).
• 7cc606d: Adds cadence recommendation evidence add <recId> --note <text>, a tied-record writer that appends a new evidence note to an existing recommendation and links it into the recommendation's evidenceIds. Previously the only way to attach evidence after a recommendation's creation was a manual hand-edit of evidence.json and recommendations.json in lockstep — cadence intelligence reconcile does not help here, since deriveRecommendationLinks only re-derives assumptionIds/decisionIds from the assumption/decision ledgers, never evidenceIds from the evidence ledger, so a hand-added evidence entry silently would not show up in cadence recommendation show until evidenceIds was also hand-edited. The new command writes both ledger files atomically in one call, redacts secret-shaped substrings in the note the same way recommendation add --evidence does, and refuses cleanly (no ledger mutation) on an unknown recommendation id.
• ac6722c: Fixes .cadence/state.json/STATE.md tracked-file cross-worktree merge conflicts (#177): cadence init now gitignores the four CADENCE-owned ephemeral paths (state.json, STATE.md, mcp-trust.json, intelligence/context/) by default, and cadence doctor/cadence doctor --fix gain a state-tracked check + untrack-state auto-repair to migrate existing repos (this repo included). The audit-trail value a tracked state.json used to carry incidentally now lives in a new stateAtSettle field on SUMMARY.json/SUMMARY.md, captured immediately before each settle resets the loop to IDLE. cadence doctor also diagnoses an unresolved git conflict in state.json with a field-by-field local/incoming diff instead of a bare JSON-parse error, and cadence doctor --fix --resolve-state-conflict=local|incoming writes the chosen side through the normal state-commit path. Any command that hits a corrupted state.json now prints a pointer to cadence doctor --fix instead of a bare error. docs/concepts.md, CLAUDE.md, and docs/reference/commands.md are updated to describe the new convention.

Patch Changes

• 7a9098a: Fixes a ReDoS-shaped regex-injection risk (#249, CodeQL) in cadence assumption list, cadence decision list, and cadence recommendation list: --filter-regex values were compiled directly with new RegExp(...) with no bound on pattern length, so a pathologically long attacker- or script-supplied pattern could hang the process. Each command now rejects patterns longer than 200 characters with a clear <command> list failed: --filter-regex pattern is too long: ... stderr message and non-zero exit, before new RegExp is ever called — legitimate, previously-accepted patterns (well under the cap) are unaffected. The guard is duplicated per-command rather than factored into a shared helper, matching this codebase's existing parseRegexFlags precedent. --filter-regex's --help text and docs/reference/commands.md are updated to document the length limit.
• 9dd68f8: Fixes cadence onboard silently no-op'ing on a .cadence/ dir with a missing state.json (#177 fallout from phase 196's state.json/STATE.md gitignoring): a fresh git worktree or a fresh clone of a repo with .cadence/ already committed has no state.json yet, but onboard — the command built exactly for "a repo that already has .cadence/ committed" — previously read it for the project name, fell back to "unnamed" on the missing file, and never wrote one, leaving every subsequent state-reading command (cadence progress, etc.) throw NotInitializedError right after onboard reported success. onboard now bootstraps a fresh state.json (loopPosition: IDLE, no active phase/draft/task, revision: 0) whenever one is missing, deriving the project name from .cadence/PROJECT.md's header rather than package.json (which can disagree with the recorded project name in a monorepo), and prints a loud stderr notice when it does. An existing state.json is left completely untouched. cadence doctor's missing-state.json diagnostic now names cadence onboard as the fix instead of advice that no longer worked (cadence init correctly refuses on an already-.cadence/-committed repo). docs/reference/commands.md's onboard behavior section is updated to describe both the bootstrap and pass-through paths.
• 2acd4c0: Fixes a bug (#248) where cadence recommendation add could reuse an already-issued recommendation ID once every recommendation created on a given day had been archived (e.g. shipped). nextRecommendationId only scanned the active recommendations array for the highest existing same-day sequence number, never the archived bucket — once the active array had no same-day entries left, the counter reset to 001 and collided with the first ID issued that day, even though that ID remained in permanent use elsewhere (evidence, assumptions, decisions, milestone links, commit messages, DRAFT files). New recommendation IDs are now guaranteed unique across a project's full history, not just among currently-active entries.
• 14c7336: Adds a task-verify-required settle gate that refuses cadence settle run when a task is marked DONE but its DRAFT - verify: line was empty or omitted — previously draft-parser.ts silently defaulted a missing line to '' and SUMMARY.md recorded a bare TN: DONE with zero evidence (#206). The gate fires in standard/complex tiers across strict/standard/auto profiles; quick-fix is deliberately exempt. The refusal names every offending task id and points at the missing verify line, following this repo's refuse-and-suggest house style — it never mutates the DRAFT or task status. docs/concepts.md and cadence explain gates are updated for the new 14-gate total.

Published Packages

All public packages are published on npm as 1.48.0:

• @manehorizons/cadence-core
• @manehorizons/cadence-host-claude-code
• @manehorizons/cadence-host-codex
• @manehorizons/cadence-types

Verification

• npm publish completed with provenance in the Release workflow.
• Remote tag v1.48.0 is verified before the GitHub Release is created.
• npm package versions and GitHub Release metadata are verified after publish.
• Workflow run: https://github.com/manehorizons/cadence/actions/runs/29710894999