Repository navigation
v3.15.0
What's new
This release closes the loop on the Claude Code review-artifact validator: it now ships as a real, executable command inside the plugin bundle instead of prose describing one that couldn't run, and the contract that names it has been corrected to describe how the parent actually reaches it.
Features
The Claude Code bundle had shipped prose naming a validate-review-artifact command with nothing able to run it, so validation there recorded an absence rather than a result (#871). It now carries a real executable — bin/systematic-validate-review-artifact, built in memory at bundle time and reachable as a bare command. Containment helpers moved out of the CLI into their own module: the CLI's import graph reaches the JSONC config loader, and a bundle that pulls that in builds cleanly but dies at runtime looking for a module its own wrapper requires by name. Exporting from the CLI would have reintroduced exactly that defect. The entry imports only the schema and the extracted helpers, keeping it at 0.28 MB with nothing resolved at runtime, and reproduces the subcommand's behavior exactly — including the projection that reports only field paths and error codes so artifact contents never reach the output. A companion refactor consolidated three functions and a type that had been duplicated byte-for-byte between the CLI and the bundled validator, closing the risk that one copy could quietly regain a legacy-artifact classification bug already caught once in review. Verified by running the built artifact from outside the repository against valid, invalid, legacy, malformed, and missing inputs, and confirming a planted marker in every string field of an invalid artifact never leaked into the output.
The bundle writer had been creating every file with a default mode, so the validator shipped without an executable bit and could only run via an interpreter named in front of it — defeating the point of living in a bin directory (#872). Entries under bin are now written executable; nothing else changes mode, since restoring source modes across the whole bundle would be a broader change with no demand behind it. The pre-publish guard also gained this check, now asserting the entry is executable rather than merely present — presence alone wouldn't catch a file that exists, passes every other check, and still can't run. Verified by copying the built entry outside the repository with its mode preserved and running it directly with no interpreter: valid, invalid, legacy, malformed, and missing inputs all returned their documented codes, and removing then restoring the bit confirmed the guard catches both directions.
Documentation
skills/ce-review/references/synthesis-artifact-contract.md told the parent to look for one command on PATH and warned that a harness installing only bundled markdown wouldn't have it — true when written, false now that the Claude Code bundle ships its own validator beside the prose naming it (#873). The revised passage states the resolution order explicitly: the bundled command first, then the packaged subcommand. It also directs callers to run the command rather than test for its presence, since a name on PATH can be a shim that fails on every invocation — a documented failure elsewhere in this repository — so resolving a name proves nothing that running it doesn't prove better. Absent and present-but-broken stay distinct: both record the run as unavailable, but neither is ever a failed validation, since that value means an artifact was read and did not conform. Two learnings that had asserted the bundle carries no executable were corrected; the recommendations they made survive untouched. A companion change marked the bundled-validator plan complete, since all five units had shipped across three pull requests but the plan still read as though none had.