v0.12.0

• security-audit: narrow scope to change review. The description now declines whole-codebase and posture audits, and a new 'When this is the wrong skill' section routes them to wstg-security-testing mode 2, naming the three precedents that break on a repo-wide ask.
• wstg-security-testing: add reference/CODEBASE-AUDIT.md, a systematic whole-codebase audit protocol for mode 2 (stack detection and category mapping, route-handler enumeration, tenant-isolation and secret sweeps, frontend-gate cross-referencing, evidence-backed strengths). Mode 2 now owns repo-wide security asks.
• Add audit-report: render audit findings as an A4 PDF with severity donut, category bars, severity chips, evidence-backed strengths, and copy-ready GitHub issue blocks. English default, pt-BR label pack, self-verifying render.

v0.11.0

• pr-craft: report which automated reviewers the repo runs when the PR is opened
• testing-philosophy: correct the sibling-skill list in the description (/verify no longer exists)
• implementation-review: repoint the pre-commit live check from the removed /verify to /run; fall back to docs/intent for plan-gap checks
• babysit-prs: add PROVENANCE-FLAG triage row and bot identification by user.type; flag silent or paused automated reviewers
• commit-report: add --metrics (review coverage, rework depth, artifact lag, spec churn, recurring fix classes)
• to-prd: read docs/intent as a Glossary source when the conversation does not carry the grill-me block
• grill-me: persist Design Notes, Glossary and edge cases to docs/intent/NNNN-.md instead of leaving them in conversation
• review-pass: harvest existing automated review before running its own stages; add the automated-reviewers reference
• dev-flow: add sentinel as the scheduled Maintain stage, make the on-disk artifact chain explicit, repoint the review tail's live check to /run
• Add sentinel: scheduled post-ship detector that files recurring fix classes, reverts, and prod threshold breaches as docs/intent files

v0.10.4

• exclusion rule states the principle (employer- and client-owned skills stay out) instead of naming one private skill

v0.10.3

• Flutter audio guidance no longer names a specific app; the technical anchors (SF2 SoundFont, MIDI, FFI) carry the specificity

v0.10.2

• folder-matching examples genericized (no client or personal project names); each example now states which matching case it illustrates

v0.10.1

• drop third-party ponytail marker from the scope note; rationale kept verbatim
• reads the periscope contribution log as a first-class evidence source in draft and compile, so influence work with no commit behind it reaches the promo packet

v0.10.0

• new skill: role-driven opportunity scan across tech / product / org lenses, kind-based surfaces with a hard tool allowlist, per-lens credibility, evidence trail for brag-doc
• drop third-party ponytail attribution; the rule keeps the idea as its own stated floor
• review tail delegated to review-pass as one stage (was verify + code-review + implementation-review restated inline); removes the duplicated gate specs that had drifted, and the chain now ends in one merged go/no-go verdict
• adds quick depth (verify + code-review only) and an orchestrator-driven mode that skips the confirm step; now the single owner of the review gate policy
• stdout/stderr forced to UTF-8: publishing a NEW skill whose description contains an arrow or dash no longer dies with UnicodeEncodeError on a cp1252 console
• new skill: review-only entry point over verify -> code-review -> implementation-review, merged into one go/no-go verdict
• new skill: LLM-maintained interlinked Markdown wiki with ingest / query / lint operations
• employer-internal exclusion note is employer-agnostic
• client tier is employer-agnostic (no employer name)
• employer-agnostic: target al renamed to work, employment doc path generalized to .md with multi-employer resolution
• employer-agnostic: agency-specific sections reframed as client-services context (applies whenever a paying stakeholder sits between team and end user); employer name removed
• copytree now ignores pycache, *.pyc, .DS_Store, .pytest_cache and *.egg-info so build droppings are never vendored into the public repo
• new skill: cross-store ASO from one per-locale Markdown source, free live-store keyword probing, listing linter
• sync mode gains standalone-rewrite sub-flow, DOCX export, three-tier metric markers and data-integrity rules; example persona genericized (no real PII or client names)
• scripts 33 -> 88 (crawl audit, schema tooling, a11y, LCP subparts, repo SEO, log analysis) + reference and sub-skill updates
• Check 3 now reconciles the shipped diff against the plan Blind Spots ledger
• new "## The Blind Spots" section: pre-code edge-case ledger with a decision per case
• new "## Edge cases" output block: lens 6-7 findings survive the session with a handle/defer/wont decision
• edge-case ledger now flows grill-me -> heist -> implementation-review
• dev-flow 0.4.1 — updated
• parallel-worktrees 0.1.1 — updated

v0.9.0

• dev-flow 0.4.0 — add observability rule (name outcome metric + add telemetry before pr-craft, risk-scaled) alongside the test-sequencing rule
• dev-flow 0.3.0 — add "test the sharp edge as you cut it" rule (risk-driven early tests) + cross-ref testing-philosophy

v0.8.0

• dev-flow 0.2.1 — updated
• pr-craft 0.2.0 — updated
• publish-skill 0.1.2 — fix: git clean -fd in ensure_repo so a stray dry-run skill dir cannot be swept into the next publish

v0.7.0

• commit-report 0.1.3 — updated
• babysit-prs 0.1.0 — new skill
• commit-report 0.1.2 — updated