v0.8.1 — the review surface tells the truth

A correctness release for the review surface. Two of the fixes below mean
that on v0.8.0 every design was approved against a picture that was not the whole
picture, and the gate meant to catch a dropped call could report clean without
having judged anything.

Added

• TESTING.md — a value→test map, enforced by a test. Seven properties, each
  stated by its failure, with every file under src/test/java mapped to a
  property or a declared bucket. CoverageGovernanceTest checks it
  both ways: every cited test resolves, is tracked by git and carries no
  @Tag("eval"); every test file is accounted for. Guarding against "a mechanism
  existed and did not run" with a review convention would have been the same kind
  of object as the mechanisms that failed, so the map executes.
• CI, for the first time. .github/workflows/test.yml runs ./gradlew test
  on push and pull request. It installs Node, because FrontendChainTest aborts
  when node is absent and would have skipped 18 tests while reporting green — the
  defect this repo keeps hitting, arriving through the tool meant to catch it. The
  workflow fails when the skip count moves off its expected value.
• The frontend harness can reach a success path. It loads the real
  diagram-svg.js, lets a case stub fetch (the default still refuses the
  network), and records DOM writes so a test can assert what a panel rendered.
  Until now drawModel's success path was unreachable from any test, which is
  why the defect below survived.

Fixed

• The reviewer was never told what derivation could not account for. Stage A
  records a capture gap for a branch, a loop, a chained or static receiver, a
  source that will not parse — and the derive response carried every one of them
  inside slice.captureGaps all along. The wizard read data.sliceModel and
  discarded data.slice, so the Before panel drew a partial flow and said nothing
  about the rest: slice-act1 shows 3 arrows for an 8-call method, and this
  repo's own deriveByPath derives 8+ gaps. The panel now names each gap above
  the diagram, and states complete capture rather than leaving silence to be
  interpreted. Honesty that never reaches the reader is not honesty. No backend
  change was needed. CaptureGapDisclosureTest.
• The dropped-call gate counted calls the design does not make.
  proposedCallSet() resolved the sequence itself and omitted the caller check
  resolveSteps() applies, so a step whose caller did not resolve emitted no
  arrow while the gate still treated the call as proposed — the design lost a
  call silently and the gate reported nothing. A false release, in the gate built
  to catch exactly that. It now reads the shared selection. ReviewGateTest.
• Editing a frontend test driver did not re-run the tests. Four Java tests
  shell out to node src/test/js/*.js, and CoverageGovernanceTest parses
  TESTING.md and WHY.md — none of which Gradle can see, because they are read
  from the project directory rather than the classpath. A content change left
  :test UP-TO-DATE and reused the previous results, so editing a claim switched
  off the check that polices claims. build.gradle now declares all of them as
  task inputs.
• The reviewer could not see the entry interaction or the return type.
  emitPlantUml emitted [*] -> SUT and [*] <-- SUT; renderSequenceDiagram
  had no system-caller branch, so findParticipant('__system_caller__') returned
  undefined and its guard dropped both steps. Step 3's after panel is that
  renderer, so every design was signed off against a picture missing two
  arrows the file carried anyway. A third copy of the resolution indexed fragment
  brackets and had to agree with both. All three now read one resolveSteps() —
  the same shape SliceRenderer already used server-side, where one
  pumlArrows() sits behind renderPuml and renderModel "so the drawn diagram
  and the puml text never disagree". DesignAgreementTest compares the drawn
  labels against the emitted arrows; the emitted text is byte-identical.
• The dropped-call gate failed open, and stuck that way. renderReviewBefore
  cleared the gate before deriving and recomputed only on success, so a derive
  error left it reporting "no dropped calls" after judging nothing. The failure
  was cached, so every later visit to Step 3 replayed the banner and skipped the
  recompute too. A failed derive now blocks sign-off with its own message;
  greenfield, which genuinely has no baseline, still passes. The same gap existed
  while the derive was merely in flight — renderReviewBefore returns
  synchronously and the fetch settles later — so that window blocks too. Failures
  are no longer cached: caching one turned the fix into a trap that locked
  sign-off for the whole session on a single transient error, with nothing able to
  release it. ReviewGateTest.

Changed

• The claim set is corrected. An adversarial read of WHY.md found seven
  defects. The framing sentence claimed each claim forces the next; it does not —
  claim 5's mechanism belongs to claim 1, claim 7's to claim 3, and claim 6 stands
  alone. Claim 5 said the reviewer understands the code, which contradicts
  "leaf content is sampled"; it now says structure. Claim 6 said "drift cannot
  return" without qualification; design/code drift dies, intent drift moves to the
  PR record and ages there. Claim 7 said "check all of it"; it checks that every
  designed interaction has a test. Claim 1's PRs are self-approved and now say so.
  Claim 3's naive counterfactual is hand-authored and now says so, together with
  the chain-1 run that confirmed it. Claim 4 drops NPath for change cost.
  Two things were missing and are added: a non-claim about the single shape DisC
  imposes, and an answer to the objection the file never faced — why review at
  all, when you can make failure cheap and regenerate?
• Derivation now proves fidelity as well as stability. CallGraphDeriverSoundnessTest
  proves every call in an entry body is captured as an arrow or disclosed as a
  capture gap. Stage A now records a gap for a source that will not parse, a file
  it could not read, two provided types sharing a simple name, and a call Stage E
  cannot emit an arrow for — a static receiver or an unprovided callee type. Each
  one used to pass silently, so a slice built on an incomplete world looked exactly
  as confident as a complete one, and REGEN would have overwritten the orchestrator
  without whatever it missed. captureComplete() had promised this all along.
• Analyze no longer spends a model call on plugin validation. The
  deterministic half of what the plugin's Step 1 would refuse now runs locally
  and instantly as part of the design lint; the plugin's own check runs once,
  at Generate, where a refusal is about to cost a real generation. One fewer
  model call on every Analyze, and the wizard reports most problems immediately
  rather than after a round trip.
• The refusal retry is gone. It fed the plugin's grammar refusal back to
  the sequencer, which only produces the ordered call list — nothing it emits
  could fix a sealed family with one permit or an unpinned decision. It cost a
  model call and could not have worked. (The data-flow retry, which sends
  argument problems to the component that authors arguments, is untouched.)
• Validation asks a capable model, not Haiku. Step 1 is deterministic
  rule-checking written as prose and executed by a model, so the verdict varies
  with the model: the same design was refused by Haiku and accepted by Sonnet on
  the same day. Cheapness mattered when this ran on every Analyze; it runs once
  now, so it can afford to be right.

Fixed

• A refused generation said nothing at all. Moving the plugin's check to the
  Generate button left the panel that displays its verdict back on Step 2, inside
  a section that is display: none while you are on Step 4. Clicking Generate on
  a design the plugin refuses showed "Checking the design…", returned to
  "Generate", and stopped — no message, no generation, no explanation. The panel
  now lives in the step it fires from, and WizardMarkupTest fails if it moves
  again.
• Hand-authored designs were refused for a field the wizard never sets. The
  contract checks require every entity to name an owning participant, a rule
  written for the analyzer's output. Nothing the wizard builds carries it —
  neither the "+ Entity" button nor the entities inferred from method signatures
  — so an ordinary design reported "entity X has no ownedBy", which blocked
  sign-off and wasted a model call on a retry that could not have fixed it. The
  owner is now derived from the participant whose signature introduced the type.
• Grammar problems were being sent to the sequencer. The lint endpoint
  returned data-flow and contract findings in one list, so a "sealed family has
  one permit" reached the retry that exists for data-flow problems, wrapped in a
  prompt about call arguments — the same misrouting removed from the validator
  path, arriving through a different door. The two families are now reported
  separately and only data-flow findings drive the retry.
• The sign-off gate labelled contract problems as data-flow problems. They
  rendered under "this design uses values that nothing in the flow produces",
  behind a checkbox reading "these values arrive some other way — proceed".
  Neither sentence was true of them, and ticking it waved through something the
  plugin would hard-refuse minutes later. Contract findings now get their own
  block, their own wording, and an acknowledgement that says what it does.
• The contract checks ran before the design was assembled. They fired inside
  the sequencer step, which completes before the wizard picks the SUT and adds
  the entry interaction — so they judged a half-built mo...

v0.8.0 — every value has a source, and the front door opens

Generation stops being labelled experimental. It is verified end-to-end on
spring-petclinic — a greenfield feature, then a variance
change over its own generated code, each to a green suite with zero hand
edits (PR #1, PR #2). That is one repository: a real
result, not a general guarantee.

⚠️ If you already have the DisC plugin, upgrade with update

claude plugin update design-is-code@mossgreen-design-is-code

marketplace update followed by plugin install does not upgrade it —
install reports "already installed" and leaves the old version in place.
Earlier releases documented that sequence, so if you followed it you are still
on the plugin you had. v0.8.0 requires plugin v0.11.2+.

Every value has a source

The substance of this release is one defect class. A call arrow used to echo the
callee's declared parameter names instead of binding the caller's actual
values, so a design could fetch something and hand it to nobody — severed
variance that compiles, passes its tests, and does nothing. It was not merely
unnoticed: with no name on a produced value, it was unrepresentable.

• data_pipe restored — arrows carry value bindings, and the sequencer is
  required to name every result.
• Data-flow gate (DataflowLinter + POST /api/design/lint) runs right
  after composition and hands violations back to the sequencer to fix, so the
  model corrects itself before a reviewer sees the design. Rules: an argument
  nothing produces, a value produced and never used, and a method invoked on a
  reused type that the codebase scan says does not exist.
• Decision-table sidecars are linted against the flow — a table targeting a
  call the design never makes, or mapping the same inputs to two outputs, is now
  refused.
• Resolvers emit the real discriminator instead of a placeholder key that
  nothing in the flow produced.
• Sign-off lists the decision-table defaults nobody chose — nulls, rounding,
  the exception type. Informational, never a gate.

Fixed: the front door

Two silent defects on the exact path a new user walks, both present since
v0.7.0:

• The README's install command named a repo that does not exist
  (mossgreen/design-is-code, missing the -plugin suffix), so every fresh
  install failed at the plugin step.
• The app suggested plugin install to upgrade an outdated plugin — a command
  that succeeds and changes nothing. It now suggests plugin update.

Tests

app.js was 6.4k lines with no test coverage, which is exactly where the
data_pipe defect lived. It now has tests that load the real file in a Node
vm — a copy would prove nothing. Plus SequencerEvalTest, which judges the raw
step JSON the prompt actually controls.

141 tests, 0 failures.

---

Install: download disc-studio-0.8.0.jar below and run java -jar disc-studio-0.8.0.jar, then open http://localhost:8080. Java 17+. Full changelog in CHANGELOG.md.

v0.7.0 — DisC Studio becomes a design-review tool

DisC Studio becomes a design-review tool: point it at an existing
Java/Spring project and it derives the current design from your code, shows a
before/after diff of the change under review, and blocks sign-off if the
proposed design would silently drop calls that exist today. Handing the design
to the DisC plugin to generate tests + code is included but experimental —
the design-review path is the verified one.

Added

• Code→design derivation. A deterministic projection of a Java entry
  method's call flow into a sequence diagram (POST /api/code-derive,
  /api/code-derive-by-path): same code in, same diagram out; a small edit
  makes a small diagram change. Resolves through an interface to its
  implementing class, so the derived flow is the real one, not an empty stub.
• Step 3 is a design diff. Sign-off shows before (your code's current
  flow, or a greenfield banner) beside after (the proposed design), plus a
  plain-language "why this design" from the analyzer's variance plan.
• Dropped-call gate. If the proposed design removes a call that exists in
  the current code, Step 3 lists it and blocks team sign-off until the removal
  is explicitly acknowledged — catching silent behaviour regressions before
  any generation.
• Update-mode grounding. When the story names an existing class
  ("Update X"), that class's current flow is injected into analysis so the
  design preserves calls the acceptance criteria never mention; a chip under
  the story box shows whether the name matched (and hints on near-misses).
• Code→design diff pipeline (dev harness at code-diff.html): a ticket +
  code → minimal design delta (new variant behind a resolver / rule-table),
  with a before/after view and a deterministic test-cost rationale.
• Abort a running analysis — the Analyze banner gains an Abort action that
  stops the in-flight LLM chain and kills the subprocess.

Changed

• Story and acceptance criteria are entered together in one Step-2 box;
  Gherkin lines parse into criteria automatically.
• disc.claude.effort defaults to medium; subprocess timeout raised to 600s.
• A one-variant "family" is refused with a question instead of generating an
  abstraction with nothing to choose.

Requires

• The DisC plugin v0.11.1+ (validate no longer false-refuses correct
  designs). Install/update: /plugin marketplace update mossgreen-design-is-code.

v0.6.1 — single-source analyzer rules

Analyzer design rules are now single-sourced: each rule is authored once and
rendered into both the prompt's full guidance and its one-line self-check, so
the two can no longer drift apart. No change to the design judgment itself —
eval holds at 6/6 on vanilla petclinic with no regression versus v0.6.0.

Changed

• Rule-as-object model in the analyzer prompt. analyzer.md defines a Rule
  concept (id / title / guidance / why / appliesWhen / severity /
  assertion); the rules/*.md files carry normalized frontmatter plus an
  assertion: line, and the prompt gains an explicit "Apply the rules" step.
• AnalyzeService loads rules once and renders them twice. Rules are read
  into a single Rule record and rendered into both {RULES} (full guidance)
  and {SELF_CHECK_RULES} (one assertion line each) from the same objects;
  the separate dev/jar loaders collapse into one loadRules().

v0.6.0 — analyzer invariants, safer Claude invocation, Optional<X> fix

The analyzer prompt is rebuilt around two explicit invariants — "shape, not
content" and "one declared pattern per variance axis" — giving its design
judgment a principled, self-auditing foundation. The Claude subprocess no
longer uses --dangerously-skip-permissions; both the analyzer and sequencer
now run as pure prompt→JSON transforms via --strict-mcp-config --tools "".
The model picker offers Opus 4.8 (replaces 4.7). Optional<X> return types
in resolver/rule-table matching are now unwrapped correctly, fixing a silent
variance-gap false alarm.

Added

• disc.claude.timeout and disc.claude.effort config properties. Override the subprocess timeout (default 300 s, was 120 s) and Claude's reasoning effort (default low; raise to medium/high for deeper designs) in application.yml or via -D flags.
• ./gradlew eval task. Runs the analyzer eval suite against the real Claude CLI in isolation from unit tests. Streams per-run summaries; artifacts land in build/eval/. Tune with -Ddisc.eval.runs=N and -Ddisc.eval.passRate=0.N.
• DesignContractValidator — a structured contract-level assertion harness for eval, replacing DesignModelAssertions. Validates participants, entities, variancePlan, and cases[] against contract rules rather than raw field equality.

Changed

• Analyzer prompt rebuilt around two invariants. "Shape, not content" and "one declared pattern per variance axis" are now declared up front with worked examples, so every rule in the prompt derives from one of these invariants rather than appearing ad-hoc.
• Safer Claude invocation. Both AnalyzeService and SequenceService now run --strict-mcp-config --tools "" instead of --dangerously-skip-permissions. Single-completion prompt→JSON transforms never needed agent tools or MCP servers; disabling both removes the permission footprint and prevents stalled tool calls.
• Timeout raised to 300 s and made configurable. The 120 s limit was too tight for Opus on complex designs; 300 s is the new default.
• Background stdout reader. Stdout is now drained on a daemon thread before waitFor(), preventing a potential deadlock on outputs larger than the ~64 KB pipe buffer.
• Opus 4.8 replaces Opus 4.7 in both model pickers (Analyze step and Generate step).
• Rule prompt refinements. invariance, composition-over-inheritance, and R2-purpose-specificity updated with tighter worked examples.

Fixed

• Optional<X> return types in resolver/rule-table matching. A resolver whose method returns Optional<StrategyInterface> (correct Java for a map-lookup miss) was silently dropped from variance-gap checks and resolver sidecar generation. The new unwrapOptional() strips the wrapper before matching.

v0.5.0 — design-intelligence upgrade

v0.5.0 - 2026-05-30

The Design step gets a design-intelligence upgrade: the analyzer commits to a
variance-handling pattern up front, auto-emits the matching decision-table
sidecars, validates each design against the DisC plugin before you save, and
surfaces AC-coverage gaps inline — so under-specified designs are caught at
authoring time, not at codegen. Also lowers the minimum JDK to 17.

Added

• Variance-handling pattern selection. The analyzer picks one of four patterns
  (rule-table / resolver / sealed-polymorphism / pattern-matching) per variance
  axis and records it in a top-level variancePlan, with an exhaustive mapping[]
  for rule-table and resolver axes.
• Auto-emitted decision-table sidecars. Pure-function leaves and rule-table
  appliers get their .decision.md sidecars generated from per-AC-row examples —
  one row per acceptance criterion — feeding the plugin's filled-mode codegen.
• Plugin validate-and-retry. Step 2 runs the design through the DisC plugin's
  --validate-only mode and shows refusals inline, so contract problems are fixed
  before saving.
• AC coverage on Step 2. AC ↔ participant coverage plus a per-participant
  variance-axis-count chip, so under-specified or overloaded participants are
  visible while you design.
• Model picker for the Claude CLI calls.
• Polymorphic-entity callees — interface/sealed-interface entities with
  behaviors can be called directly in the sequence, plus a resolver mapping[] schema.
• OS-native folder browser on Step 1 for connecting a project.

Changed

• Wizard reflow into Connect / Design / Sign-off / Generate, with AC rows,
  per-card purpose, auto-compose, and "Connect project" moved into Step 1.
• Codebase-grounded analyzer — fed the connected project's packages, glossary,
  and most-relevant existing types so it reuses them (existingFqn) instead of
  re-proposing.
• Abstraction discipline baked into the analyzer prompt (invariance,
  purpose-specificity, leaf freestandingness, feature-envy, composition-over-
  inheritance) plus interface/sealed-interface entity kinds.
• Callee-anchored @package recommendation on Step 4; plugin integration
  refactored behind a CodeGenerator abstraction.
• Minimum JDK lowered to 17 (was 21). DisC Studio now builds and runs on Java 17 LTS.

Removed

• Multi-level design recursion parked for MVP (single-level compose;
  defer-design trees documented but not auto-walked).
• The two "Load demo" buttons and their seeded data.

v0.4.2 — honest demo + starter project

Hotfix on top of v0.4.1's downloadable jar: the demo no longer pretends a
project is connected (a hardcoded path that only existed on the author's
machine), and the Release ships a starter Spring Boot project so anyone
evaluating DisC Studio can complete the flow end-to-end without bringing
their own codebase.

Added

• disc-studio-starter.zip attached to the Release — a minimal Spring
  Boot scaffold (Spring Initializr export, ~55KB) with one com.example.demo
  package and an empty design/ folder. Unzip and point the Studio at it to
  evaluate the full save → run flow without an existing Java project.

Changed

• README leads with "What you need" before Quick start. Three numbered
  requirements (Java 21+ · required; a Java/Spring project · required, with
  the starter as fallback; Claude CLI + plugin · optional) replace the
  parenthetical version note from v0.4.1. The reader knows what they're
  signing up for before downloading.

Fixed

• Demo no longer fakes a connected project. "Load simple demo" /
  "Load complex demo" used to set state.projectPath to a hardcoded
  /Users/mossgu/Downloads/demo and run /api/scan against it, producing
  a red error banner for every user except the author. The demos now seed
  story + participants + sequence only; the header chip stays in "Connect
  project" mode until the user pastes a real path.

v0.4.1 — downloadable jar

DisC Studio is now downloadable. Grab disc-studio-0.4.1.jar from the
Release page, java -jar, open localhost:8080 — no clone or Gradle
required.

Added

• Downloadable jar. ./gradlew bootJar produces a single fat jar
  (disc-studio-0.4.1.jar, ~30MB) attached to the GitHub Release. Run
  with java -jar disc-studio-0.4.1.jar on any machine with Java 21+.

Changed

• README restructured around "download-and-run" first. New Quick
  start section leads with the jar path. Running from source demoted
  into a Development section for contributors.

Fixed

• Composer step number off-by-N. The "Add step N" composer was
  counting fragment markers (loop, else, end) and SUT boundary
  edges ([*] -> SUT, [*] <-- SUT) as steps, so "Step 9" would
  appear above a list whose last CALL badge read "7". Now counts CALL
  rows only, matching the badges.

Removed

• Dead /api/disc-steps endpoint. The Java controller, the
  loadDiscSteps() JS indirection, and the on-disk skill bundle were
  serving a path that no longer had a frontend consumer. The run
  checklist now reads from a hardcoded DISC_STEPS constant in
  app.js (the run-event regex matches step numbers only, so a title
  mismatch couldn't break event mapping anyway). Net –80 lines.

v0.4.0 — DisC Studio launch

The wizard grew up. It's now DisC Studio — the companion editor for
DisC. Designs are first-class authoring objects with decision tables,
explicit system-under-test marking, and a step composer you can actually
live in: one-line rows, click-to-edit pills, insert-anywhere wedges,
duplicate, hover-only delete, drag-reorder with a visible grip. Two demo
seeds (a 4-participant loop example and the full 10-participant order
flow) cover both ends of the complexity gradient.

Added

• Decision tables, first-class. Any CALL step can be marked
  decision-table-backed via a + DT chip on the step row. Click opens a
  modal editor with the method signature as a read-only header, a config
  form (nullHandling, exceptionType/defaultValue, rounding,
  scale, locale — the keys java_spring.md enumerates), and a
  freeform rows table. "Save to project" writes the .puml plus one
  <Participant>.decision.md sidecar per DT-backed call into the same
  design/ folder.
• System-under-test mark + entry interaction. Each participant card
  shows a + SUT chip. Marking auto-adds the entry interaction
  ([*] -> SUT : method(...)) and final return ([*] <-- SUT : Type).
  Single-method SUTs get the boundary steps instantly; multi-method SUTs
  prompt via an inline "pick entry method" banner on Step 2. Required
  for DisC v0.5.x — Step 1 refuses any .puml without exactly one
  system_caller.
• Step composer overhaul for read, write, and modify:
  • Each CALL renders on one line instead of two — the trailing
    return type is a muted inline suffix, halving vertical space. The
    13-step complex demo fits on a single screen.
  • Caller, callee, and method are click-to-edit pills. Click opens
    a small popover scoped to valid choices; Esc / outside-click
    dismisses. Method-edit is one click, not "delete + re-pick three
    dropdowns."
  • Insert-anywhere wedges between adjacent rows. Hover the gap
    between steps, click + insert here, the composer relocates inline.
  • Per-row duplicate (⎘) button deep-copies the step including any
    attached decision table. Delete (×) and duplicate now hover-only to
    reduce idle noise.
  • Visible 6-dot grip glyph advertises the drag-reorder affordance
    that was already there but invisible.
  • Composer's caller dropdown prefills from the last CALL's caller
    (the common "same orchestrator throughout" case).
• Two demo seeds, side by side. "Load simple demo" seeds a
  4-participant loop example (matches the 03_loop.puml corpus).
  "Load complex demo" seeds the 10-participant order flow with three
  pre-populated decision tables (matches 06_order/PlaceOrder.puml).
  First-timers can climb from one to the other.
• Target-package autocomplete on Step 4. Suggestions come from the
  unique packageNames in the scanned project. Free typing still works.
  The list is persisted to localStorage so it survives a page reload
  before reconnecting.
• Plugin pre-flight gets an Update flow. When the installed
  design-is-code plugin is older than the latest GitHub release, an
  "Update plugin" banner appears next to "Run it for me" with the new
  version + changelog link + a one-click installer. Skip-for-session
  also available.
• Boundary box auto-fit. Participant boxes in the live SVG measure
  their rendered text width (getBBox()) instead of guessing 8px/char,
  so long names like LineSubtotalCalculator never clip.

Changed

• Renamed to "DisC Studio" (user-facing). <title>, <h1>,
  README all reframed: DisC owns codegen; the Studio owns design
  authoring. The Java package, Gradle artifact name, plugin slug, and
  repo URL are unchanged — this is a Tier-1 brand rename.
• PlantUML emitter uses the SUT-anchored arrow style from the
  canonical .puml corpus: returns emit <-- (dashed) instead of
  <- (solid), and the boundary marker [*] always anchors the left
  side of every line — both for entry ([*] -> SUT) and final return
  ([*] <-- SUT). Visually distinguishes returns from forward calls.
• DisC step-name display synced to the v0.5.1 SKILL: Validate Inputs → Validate Design, Classify → Classify Participants,
  Discover Context → Resolve Targets, Generate → Generate Tests, Quality Gate → Check Tests, Implement → Generate Implementation. Step numbers unchanged. The run-event regex is
  number-only so live event mapping was unaffected; this is display
  only.
• Participant cards drop the noisy CALLER/IMPL header badges —
  premature surface for half-shipped affordances. Grid minmax raised
  from 13rem to 18rem so cards have room for typical method signatures;
  method line wraps within the card instead of ellipsizing.
• Plugin-update flash simplified. The post-update pill no longer
  says "restart Claude Code" (nothing needs restarting — each "Run it
  for me" spawns a fresh claude process that picks up the new
  plugin). Reads DisC plugin updated to v<X> ✓ then settles to the
  normal status pill.
• Story textarea placeholder changed from a concrete example to
  the canonical three-part template As a <role>, I want to <action>, so that <outcome>. Teaches the shape, not just the tone.
• Step 2 terminology cleanup: + new class → + new participant;
  N classes counter → N participants. Matches the participant data
  model.
• Modal copy: "generate a stub class alongside the interface" →
  "also generate the implementation class alongside the interface."
  Stub was misleading — DisC emits a real implementation.

Breaking

• Hand-built designs need a SUT. DisC v0.5.x refuses any .puml
  without exactly one system_caller. Loading either demo handles
  this automatically. For hand-built designs, click + SUT on the
  participant that is your entry point — Studio adds the boundary
  steps for you. Pre-v0.4.0 designs saved before this release will
  need the SUT marked before they can be re-run.
• The CALLER and IMPL badges on participant cards are gone. No
  behavior change beyond visual — the underlying implByDefault flag
  is still stored on each participant.

v0.3.0 — blank-by-default wizard, live run console, model picker, plugin pre-flight

Public-ready polish: the wizard no longer auto-fills with demo data, you
can pick which Claude model runs DisC, and the "Run it for me" pipeline
streams progress live with an 8-step checklist and a working Cancel
button. Plus a Claude Code plugin pre-flight that catches "DisC isn't
installed" before you hit run, and surfaces updates when they're available.

Added

• Live DisC run console. "Run it for me" now streams the subprocess's
  stream-json output back into the wizard as it happens: an 8-step
  checklist (init → tests → green → impl → coverage …) ticks through in
  real time, the elapsed timer updates each second, and a Cancel button
  cleanly tears down the spawned claude process.
• Model picker on Step 4. Pick Sonnet 4.6 (default), Opus 4.7, or
  Haiku 4.5 next to the "Run it for me" button. The selection is passed
  to the spawned subprocess as --model <id> against a server-side
  allowlist; no other models are accepted. Doesn't affect the slash
  command you copy for interactive use.
• DisC plugin pre-flight. Before the wizard offers "Run it for me"
  it checks whether design-is-code is installed in your Claude Code
  config and which version. If missing, an inline "Install plugin"
  banner runs claude plugin install … for you. If outdated, an
  "Update plugin" banner shows the new version + changelog link and
  installs the upgrade with one click.
• "Load demo data" button in the header (next to the Connect-project
  chip). Click it to seed the same end-to-end "generate invoice"
  example that used to load automatically.
• Multi-modal input affordances on Step 2's Participants and Steps
  section heads — greyed-out text/image/voice/video icons signaling the
  natural-language / multi-modal input paths planned for a later release.
• Release runbook (RELEASE.md) — a checklist the
  AI agent follows when you say "release it."

Changed

• Wizard starts blank. Story textarea, participants list, sequence
  steps, target package, and project chip all start empty on page load.
  This makes the app usable for someone other than the author. Use the
  new "Load demo data" button to get the previous behavior.
• Step 4 layout tightened around the run-result panel — model picker,
  copy-command button, plugin pill, and run controls now sit on a single
  wrapping row instead of stacking.

Breaking

• The page no longer auto-prefills with the invoice example or
  auto-connects to /Users/mossgu/Downloads/demo. If you relied on a
  full-screen demo on page load (e.g. screencasts, screenshots), click
  "Load demo data" first or revert to v0.2.0.