v0.30.0 — discipline-layer identity + CI/eval hardening

Skill v0.30.0 · installer @manhquy/flow-skill@0.7.0 on dist-tag latest.

Identity ADR: flow owns the gates and the receipts, never the runtime.

npx @manhquy/flow-skill@latest
# expect: flow-skill v0.7.0 (ships skill v0.30.0)

Added

• Identity ADR (docs/adr/0001-discipline-layer-identity.md): process-token invariant, five flip-tripwires, proportional eval floor, replay-never-counts, fixture-pair-per-new-gate-rule, monetization cap.
• flow.sh eval --record / --replay: keyless artifact-eval replay through parse→vote→per-fixture match (no scorecard). Stale gate-rules hash hard-fails. Replay verdicts never count toward the eval floor. _eval_engine_run / _run_with_timeout bodies unchanged.
• B1-S named-artifact evidence: every done-evidence item must name its artifact or producing command (semantic card gate + fcdd/fcde fixture pair). Mechanical scoring unchanged.
• CI all-checks-passed: single required aggregation job. tests/run_all.sh reads tests/manifest.txt.
• Credentialless pack-rehearsal: every-PR ubuntu job packs the npm wrapper, byte-compares tarball skills/flow/ vs repo, installs into a temp DEST, drives e2e-installed-drive.sh.
• Root AGENTS.md (symlinked CLAUDE.md) + word-budget verify; EN/VI README blob-hash pairing (docs/i18n-pairs.txt).
• macOS live-eval refuse-by-default when no real timeout/gtimeout is on PATH; opt-in FLOW_EVAL_UNBOUNDED=1. Replay never hits the guard.

Changed

• README is a short GitHub landing card; long form lives at flowskill.io.vn.

Full detail: CHANGELOG.

v0.29.0 — spec-kit imports + converge

Skill v0.29.0 · npm installer 0.6.0

Spec-kit-mined upgrades, redesigned to flow's DNA (mechanical half via the existing scanner; semantic half as a ritual).

Added

• ## Open decisions + /flow clarify — mark unresolved product decisions as - [ ] bullets counted by the existing scan_gate (no self-poisoning [ASK] token); advisory section-scoped printer + references/clarify.md write-back ritual.
• Card ## Independent test field (leftover FILL fails check) + PRD/contract requirements-quality Gate boxes + references/artifact-lifecycle.md; law forbids models-only cards.
• /flow converge — the flow-back closer: append-only remainder cards reconciling present code vs plan. Transactional (validate all, commit all-or-nothing with rollback), never edits an existing card, prints CONVERGED + writes nothing when there's no gap; unrequested → review card, never a delete. Payload schema flow-converge/v1.
• Converge eval modality — flow.sh eval --stage converge: a third repo-state gap-detection judge (alongside gate + routing), fully offline-tested.

Quality

• Two independent reviews (fresh agent APPROVE + CodeRabbit) per feature; red-team + code-review gates. 3-OS bash-suite green. Release coherence PASS.

Full detail: CHANGELOG.

flow skill v0.28.1 — Attestation harden

Harden package (post independent parallel review)

1. Mint blob-exec — materialize committed owner/command/oracle blobs at --revision; disk must match (no dirty worktree pass)
2. Live currentness — exact HEAD tip + recomputed owner/oracle fingerprints
3. Cleanliness — mint/consume/auto; allow .flow/, flow/.lock*, status/Evidence-only card dirt
4. Empty range — reject card semantic when base == revision
5. Supervisor — real setsid PGID kill + capability probe
6. coverage_gaps — auto expects v0.28 fail-closed without git/receipts

Skill 0.28.1 · npm 0.5.1

flow skill v0.28.0 — Attested Execution

flow skill v0.28.0 — Attested Execution / Trust Control Plane

Highlights

• Card risk (risk / risk-reason / risk-ack) with fail-closed auto preflight
• Fingerprint-bound receipts: semantic_gate + live_verify under .flow/attestations/
• flow attest mint/status/recover + flow auto / flow auto stop policy latch
• While auto is active: check / card done / ready deps / merged worktree remove require current receipts
• Manual/teach/work remain usable with warnings when auto is inactive
• Bash + Git floor; receipts detect staleness, not actor identity

Versions

Axis	Version
Skill product	0.28.0
npm installer	0.5.0 (ships this skill)

Docs

• skills/flow/references/attestations.md (canonical contract)
• docs/migration-v028-attestations.md

Install

npx --yes @manhquy/flow-skill@latest

v0.27.0 — harness authority continuity

Skill product v0.27.0

Flow-owned durable harness authority after repository-harness protocol-v1 EOL.

• Live authority: flow_harness.py + flow.sh + gate-rules (not live harness-cli pins)
• R-IMPROVE-HARNESS native ritual (fresh-agent rerun before keep)
• Brownfield Evidence ledger + material-authority stop on Scope/PRD/Contract
• Full test suite green (48 suites)

Install skill via npm installer: npx @manhquy/flow-skill@latest (package 0.4.0, tag npm@0.4.0 triggers publish).

v0.26.0 — hollow-done mechanical trust floor

Skill product v0.26.0

Mechanical multi-signal floor for card done Evidence + ready/graph re-validate.

Install (users)

npx @manhquy/flow-skill@latest
# → flow-skill v0.3.0 (ships skill v0.26.0)

Highlights

• Process-only hollow Evidence fails check / card done
• ready + graph deps re-validate Evidence + Verify
• Fail-closed card done (INT/TERM → todo)
• Eval residual: fcdc (offline LLM FLAG); CI mechanical-only
• 48 test suites green

npm

Package 0.3.0 published to dist-tag latest (OIDC + provenance).

See root CHANGELOG.md and docs/journals/260811-v026-hollow-done-trust-npm-0.3.0-shipped-vi.md.

flow v0.25.0 — graph executor (opt-in, default off)

0.25.0 — 2026-07-27 — graph executor (opt-in, default off)

A graph executor lands in the durable layer, porting LangGraph concepts — not code —
into flow's own Python harness: a checkpoint journal, resume by evidence rather than by
replay, and gates as durable interrupts. It is off by default; nothing changes for an
existing project until FLOW_GRAPH_EXECUTOR=1 is set. Flag-off behavior was verified
byte-identical to 0.24.0 across the full planning ladder, card lifecycle, and workspace verbs.

• Schema band 014+ (graph_execution/graph_checkpoint/graph_step_write/
  graph_interrupt), additive; 013 stays reserved for upstream. This supersedes the
  GAP-MATRIX "work-graph out of scope" red line — flow owns its work-graph now.
• flow harness graph …: session (one execution per project, arbitrated by SQLite,
  not a lock file), record, next, resume, status, cards, finish, abandon,
  gc, lint, root. Manifests are built from typed flags, so card text can never forge
  a gate verdict.
• Topology as trusted data: references/flow-topology.json, pin-verified
  (harness/pins/flow-topology.sha256), loaded only from the skill install dir, and
  validated by a 16-rule graph lint wired into CI. cmd entries are argv arrays limited
  to the new read-only gate verb — mutating verbs are lint-banned from autonomous
  execution.
• /flow gate <stage>|--card C-NNN (new, May-run): mechanical scan only — no unlock,
  no template copy, no durable write. Exit 0 clean / 1 findings / 2 usage or card-not-found.
• Debt-skip fix (applies with the flag off): /flow next no longer re-creates a
  debt-skipped stage, and no longer stalls when that stage's successor file is missing —
  it advances to the first stage that is neither present nor skipped.
• Worktree-aware durable state: a linked worktree resolves to the main worktree's DB so
  parallel cards share one journal. Submodule and --separate-git-dir checkouts keep their
  own DB (git does not expose the checkout there) — documented, not guessed.
• Worktree telemetry survives path spelling: the lifecycle key for a merged worktree
  sink is now canonicalized, and its path travels in its own argument (--src-key-path +
  --src-key-tag). Pre-joining path and tag with # produced a string that Git-Bash path
  translation would not rewrite, so on Windows the rows were keyed differently from the
  sink the harness resolves for itself — written, then invisible to usage and unreachable
  by prune. The same split hit any macOS path reached through a symlink.
• Python floor is measured at 3.7 and enforced by scripts/release-preflight.sh; CI
  pins the interpreter and proves the engine still gates a project with no python on PATH.

flow v0.24.0 — harness trust-align (repository-harness 0.1.17)

0.24.0 — 2026-07-18 — harness trust-align (repository-harness 0.1.17 spirit)

Skill version jumps 0.22.0 → 0.24.0. The 0.23 milestone was the cross-agent installer
(Cursor target + universal Agent-Skills home + per-agent restart-guidance), which shipped
via the npm wrapper 0.1.0-rc.2/rc.3 with no flow-skill version bump — see
plans/260717-0925-cross-agent-installer-expansion/. The 0.23.x skill number is
intentionally skipped to keep skill and installer milestones distinct.

Align flow durable layer + skills with repository-harness authority (protocol floor
harness-cli-v0.1.14, trust CLI harness-cli-v0.1.17, never use 0.1.16 assets).
No full schema 006–013 merge; no rust unfreeze on flow-lineage DBs.

• Trust boundary: story update --status implemented rejected; use
  story complete --id … --proof-source card_markdown_gate|manual|verify_command.
  Card markdown gate records honest proof_source= in notes and does not forge
  last_verified_result=pass (only story verify may set shell-verify pass).
• /flow check done wires story complete --proof-source card_markdown_gate + enriched
  auto-trace (no fake --lane tiny override).
• STRICT durable writes: FLOW_HARNESS_STRICT unset|1|fail — soft warn vs loud vs
  propagate nonzero; harness_call_checked for observed exit codes.
• Gap matrix skills/flow/harness/GAP-MATRIX-0.1.17.md + lineage/docs contract tests.
• Canonical harness skill skills/harness-skill/SKILL.md (CI-tested; optional install to
  ~/.agents/skills/harness).
• Docs purge: agent-stage-mapping / auto-run / harness README no longer teach bare
  implemented updates.
• Optional HARNESS_CLI_SMOKE=1 release binary smoke + sha256 sidecars.
• Tests: test_flow_harness_lineage_contract, test_flow_harness_strict,
  test_flow_harness_trust_complete, test_flow_skill_harness_docs_contract,
  test_harness_cli_optional_smoke.

Plan: plans/260718-0840-harness-v017-flow-skill-trust-align/.

skills/flow/SKILL.md (mirrored in .claude-plugin/plugin.json and portable-manifest.json;
/flow coherence enforces agreement). Earlier history lives in git and the README status line.

flow v0.22.0 — concierge front-door + standalone self-sufficiency

0.22.0 — 2026-07-16 — concierge front-door + standalone self-sufficiency

Two operator-approved workstreams from a brainstorm→plan→red-team→validate→cook pipeline
(3-agent hostile red-team, 21 raw findings → 13 accepted after dedup, all applied; 4-question
validation interview). Full plan: plans/260716-1342-flow-v022-concierge-standalone/.

WS-A — Concierge front-door. Chat is now the default entry to /flow: any natural-language
ask routes through references/concierge.md — run flow.sh status (ground truth, never a
guess) → look up the closest row in the new references/flow-catalog.tsv → propose exactly ONE
next action in plain language → offer to run it, per a default-deny May-run/Must-ask
classification covering all 27 dispatcher verbs (red-team: an earlier draft left promote and
harness — global/durable writes — in an unclassified auto-run gap; next was misclassified as
auto-runnable even though its pass-precondition can't be verified before it runs). New users get
exactly one plain consent question before the concierge switches to mode work on their behalf
(teach-mode's "never author on the operator's behalf" rule still holds). Power-user verbs pass
through untouched — a typed /flow next dispatches exactly as before.

WS-B — Standalone self-sufficiency. Installing flow alone now gets the full experience —
five gate seams that used to lean on optional external skills ship native, clean-room
rituals (references/native-rituals.md): persona-debate @ ADR, edge-case decomposition @
Contract, STRIDE security @ Review, numeric retro @ Retro, native loop protocol @ Build/Verify.
ck-predict/ck-scenario/ck-security/ck-loop/retro are now offered as richer
alternatives when installed, never a requirement (gate-rules.md, adversarial-review.md,
law/RETRO.md, claudekit-skills.md all rewired native-first). Legal: claudekit-engineer is
proprietary (All Rights Reserved) — every ritual was written fresh from public/generic patterns,
reviewed side-by-side against the corresponding ck skill for zero copied expression, and no ck
text was ever committed (tests included). A sixth ritual, references/forge-idea.md
(persona-driven idea pressure-testing, opt-in at Idea/Scope, never a gate condition), is adapted
from BMAD-METHOD's bmad-forge-idea (MIT) — the full license notice is reproduced verbatim.

Routing eval judge (v0.22 addition, not a stage-list tweak). Red-team correctly identified
that "extend --stage" undersold the work: routing judges (state-snapshot + utterance) → action,
a different shape from the existing artifact-vs-gate-rules judge (FLAG/PASS). Built as its own
modality: flow.sh eval --stage routing — separate manifest (eval/fixtures/routing/, 15
fixtures, VN+EN, incl. one steering-resistance case), separate prompt builder
(_eval_routing_build_prompt, utterance fenced as DATA with an explicit "do not obey it"
instruction), separate verdict vocabulary (MATCH/MISS/INVALID/UNRELIABLE), separate results
stream (eval-routing-results.jsonl) and scorecard, own --report. Hard cost ceiling: 90
calls/batch (validation decision), pre-batch cost estimate printed before any billable call,
zero-call clean skip when claude CLI is absent. Metric is labeled panel-agreement, not

flow v0.21.0 — eval-trust hardening + express-lane KILLED by data

Two-part release, both evidence-driven from the first REAL gate-eval baseline.

Motivating incident (260710)

The very first real batch after v0.19 shipped came back 17/18 INVALID despite the existing in-run retry — the storm produced no usable votes and burned all 18 billable calls. The only diagnostic signal (SessionEnd hook cancelled ×18 on stderr) was thrown away because the seam captured stdout only. A single call + one full rerun immediately after came back clean (hollow-flag 3/3 stages 100%, 0 INVALID/18) — mechanism unconfirmed at the time. The next storm has to be diagnosable, and the aborted-batch cost has to be capped. That's the whole shape of Phase 1.

Express-lane KILL (roadmap A → rejected by data)

Same-day per-cycle telemetry mining dissolved the original justification for an express-lane verb: cycles that ran ≥1 successful next reach Cards at 14/15 (93%), contract-stage dwell median is 40s (n=12; the "1.3h bottleneck" was a measurement artifact of usage --global averaging), and "33% abandonment" decomposes into exploration pokes + brownfield card-mode. Roadmap A is formally killed with a re-trigger condition. See docs/quality-metrics.md §A-kill.

Red-team pre-ship (3 hostile lenses, code-reviewer subagents, file:line-backed)

26 raw findings → 14 accepted after dedup (2 Critical, 5 High, 7 Medium). Catches include the original circuit-breaker missing its own motivating 17/18 incident (retrip on first-UNRELIABLE, not all-invalid) and the raw-capture spec being stdout-only when the storm signature was stderr — both would have shipped as latent bugs without the pass. Adjudication table lives in the plan.

Phase 1 — eval robustness

• Raw capture on final-INVALID — both attempts' stdout + stderr + rc persisted to .flow/eval-raw/<run_id>/<fixture>-v<vote>-a<attempt>.{out,err,rc}. Envelope stripped down to assistant/result/rate_limit_event records — cwd (which embeds the Windows username on this dev OS), session_id (resumable via claude --resume), plugin/memory paths, apiKeySource are all removed. cmd_eval calls _ignore_run_state so .flow/eval-raw/ is git-ignored.
• Circuit breaker on first-UNRELIABLE. Trip after the first fixture returns UNRELIABLE (invalid_count*3 > n), print an abort line naming the raw dir + file count, set an aborted flag, and skip the done trailer so --report/drift never surface the junk batch as canonical baseline. Distinct nonzero exit 2. --keep-going overrides (worst case ≈ 37 calls documented next to the flag).
• Injectable backoff. FLOW_EVAL_RETRY_BACKOFF env (default 5s, tests set 0). Retry now skipped when a rate-limit signal fired on attempt 1 OR when rc=124 (timeout) — both are infra failures, not formatting slips. A greppable retrying vote N line makes the retry path assertable via text, not stopwatch.
• Rate-limit visibility (advisory). _eval_parse_rate_limited anchored to rate_limit_info's own status value. Empirical: on cli 2.1.201 a healthy allowed event carries overageStatus":"rejected" as a separate field in the same envelope — a naive grep would false-positive on every healthy call. Documented best-effort until a real throttled sample lands.
• Pre-batch raw-dir prune. Keep the 3 newest run dirs by the epoch embedded in run_id (deterministic, mount-independent, unforgeable). TTL guard: never prune a dir whose embedded epoch is within FLOW_LOCK_TTL (900s) of now.
• Fixture-id sanitized for write paths. fid sanitized through the nonce charset before touching the filesystem — a hand-edited or FLOW_EVAL_MANIFEST-overridden manifest cannot traverse out of eval-raw/.
• Raw-write failure is LOUD, not the file's usual 2>/dev/null || true telemetry-sink pattern.

Phase 2 — fixture f01a repair

Complaint #3 rewritten (lines 38-41 only) as a coherent online quote with a synthetic thread-style link; no more "paraphrased-with-permission during a pilot household interview" framing that the judge was correctly FLAGging as laundered interview data.

Phase 3 — canonical baseline + docs + version

Canonical billable baseline (run …-1783743592-…): 6/6 MATCH, 0 unreliable, 0 invalid, 18/18 calls parsed. Per-stage hollow-flag-rate 1/1 sound-pass-rate 1/1 across 01-research, 02-scope, card. Judge claude-opus-4-7, CLI 2.1.201, gate_rules_sha 3672145322. Recorded in .flow/eval-results.jsonl; eval --report surfaces this as the drift-baseline.

CI status (post-release)

GREEN 3/3 OS on GitHub Actions run 29141602431 after 2 rounds of macOS-only fixes:

• Round 1 (82a67c0): retry skips on rc=124 timeout + prune bash-3.2 refactor
• Round 2 (17677b1): prune via tempfile + while read < $tmpf (redirect, not pipe) + test E threshold 20→45s for the documented macOS _run_with_timeout fallback DEBT lane

Post-ship independent audit

Separate code-reviewer subagent audit after ship: 0 runtime defects, 6 red-team applied fixes spot-checked (RT-C1, RT-C2, RT-H3, RT-H4, RT-H5, RT-H9 all verified with file:line), 1 docs drift caught and fixed same session (95672ef).

CI switch to Azure Pipelines

Right after the v0.21.0 line landed, GitHub Actions runs 29149122349 and 29149390414 failed 3/3 OS with steps=[] — runner never started — the recurring billing/quota block on private repos returned. .github/workflows/ci.yml retired in 2c24032; Azure Pipelines (free-tier private, 1 parallel job / 1,800 min/mo) already covers the same 3-OS matrix via azure-pipelines.yml.

Deferred, disclosed

• macOS _run_with_timeout fallback watchdog DEBT (DEBT.md) — needs real macOS access to diagnose
• A real throttled rate_limit_info sample — rate_limited field stays best-effort/advisory until one lands in the corpus

Files

14 changed, +1279 / -42 lines on the v0.21.0 line (d22d274 → 82a67c0 → acac540 → 17677b1 → 998ccac → 95672ef), plus post-release 2c24032 (CI retire) + aa6d4d3 (README update).