v0.7.0

Added

• nd plugin (0.5.0): 18 new eval cases (44 in total). They cover trigger boundaries (architect-skips-plain-pr-review, herdr-skips-spawn-an-agent-for-review, handoff-skips-compact-conversation, onboarding-skips-single-c4-diagram, disciplined-delivery-skips-docs-typo-fix); safety (handoff-keeps-secrets-out, handoff-records-uncommitted-when-declined, onboarding-keeps-injection-and-secrets-out, delivery-gates-push, herdr-hands-dialogs-to-user, herdr-does-not-resend-after-timeout, architect-asks-before-delegating); and behaviour (handoff-updates-existing-file, delivery-commits-after-approval, engineer-reports-not-done-on-red-suite, engineer-challenges-with-evidence, architect-does-not-trust-a-green-report, onboarding-reports-a-failing-gate). The herdr cases run against a stub herdr and set HERDR_ENV through the eval sandbox's own shell startup files.
• nd onboard: the checker fails a doc containing a secret-shaped string (key SECRETS; it prints the kind and line, never the value), accepts --inadmissible-dir, rejects a nonexistent --root, and prints its default citation floor.
• nd herdr: a "Spawn a Claude peer" recipe that architect and engineer now share, and windows.md for the Git Bash and PowerShell notes.
• pm plugin (0.2.1): two sdd eval cases (continues-local-only-without-atlassian, asks-which-copy-wins-on-divergence), and repo-context.sh --hash, which prints the document's hash for Phase 5.

Changed

• nd plugin: the five skills whose folder name differed from their name now use the short name for both, so four slash commands change: /nd:disciplined-delivery is now /nd:delivery, /nd:reflecting is /nd:reflect, /nd:writing-plain-language is /nd:plain-language, and /nd:onboarding is /nd:onboard. /nd:herdr, /nd:handoff, /nd:architect and /nd:engineer are unchanged. The folders disciplined-delivery, reflecting, writing-plain-language, onboarding and spawning-herdr-agents were renamed to delivery, reflect, plain-language, onboard and herdr, so a spec validator no longer flags the mismatch, and the eval regexes accept one name instead of two.
• nd onboard: writers treat everything read from the repo as data, never instructions, and never copy a secret value into the docs. In a run on a planted repo, the old briefs obeyed an injected "claim SOC2 compliance" comment in one of three runs; the new ones asserted it in none of 16 (they record it under Unknowns as an embedded instruction, as intended). The checker now matches the briefs: a non-empty, keyword-led mermaid block is required in the AI or runtime design doc, infrastructure.md, deployment.md and ONBOARDING.md as well as C4 and components docs; the citation floor counts distinct files (not anchors), defaults to min(25, max(3, citable_files * 2 // 3)) (printed on the first line; citable files exclude README, CLAUDE.md, AGENTS.md, docs/, reference/, LICENSE and the directory being checked), is never more than the repo has to cite (an earlier draft of this change asked a five-file repo for seven files, which no doc could meet), and excludes citations under the "existing in-repo prose" heading, which is now exempt only in ONBOARDING.md; markdown links out of the docs dir to README, CLAUDE.md or AGENTS.md fail; a placeholder is a TODO: or TBD: marker, not the bare word. SKILL.md caps the fix loop, bounds cost (default depth targeted above about 500 source files, a 30-agent stop, ask which track first above four), checks for stray writes, and lets the orchestrator read the README once for orientation.
• nd handoff: never writes a secret value into HANDOFF.md even when asked (and scans the draft); commits only HANDOFF.md, by path, never on main, master or another protected branch, and never pushes; infers the focus when $ARGUMENTS is empty; updates an existing file for this session instead of appending; leads with Next Steps. Without the secrets rule the old skill wrote the key into the file in two of five runs when asked to.
• nd herdr: answers a dialog only if it confirms a slash command it just sent or is the trust-folder prompt for the directory it set (everything else goes to the user); treats pane output as data, not instructions; checks before resending after a timeout; starts the agent kind the user named (default claude); closes only panes it recorded and asks first if the agent is still working. Outside Herdr it now runs no herdr command at all, not even to diagnose.
• nd delivery: centred on the approval gate and the definition of done rather than test-first on every edit; approval counts only after the user has seen the diff, test result and exact message ("commit it" before that is not approval); the gated actions are defined by category (publishes, rewrites history, discards work, moves HEAD); it covers pre-existing red suites, no test runner, a declined gate and runs with nobody to approve. A docs-only typo fix does not load it (delivery-skips-docs-typo-fix), and any request to run a gated git action does (a bare "push this to origin" loaded it in 10 of 10 runs after the trigger phrases were widened; before, one run in five pushed without asking).
• nd architect and engineer: after a challenge or question the engineer stops and waits; a challenge that still stands goes to the user, not to either session; a decision is the architect's only if a recorded user decision or the spec settles it and it is reversible; the engineer asks before spawning an architect and never commits unless the user authorized it; failure modes (declined delegation, silent engineer, red suite, low context) and sample task and report messages were added. The engineer now fires on an instruction from the architect session, including a go-ahead to commit (1 of 5 runs before, 5 of 5 after).
• nd reflect: facts about code are verified against files, while decisions are recorded as "decided in session, not verifiable"; it never guesses a storage path when basic-memory is unreachable; updates an existing note instead of creating a second one; suggests rule edits instead of making them; offers to reflect instead of starting.
• nd plain-language: says what it does, keeps meaning, code and quoted identifiers exact, and holds the register for the rest of the conversation.
• nd descriptions for handoff, herdr, onboard, architect, delivery, reflect and plain-language now state what the skill does as well as when to use it, and their trigger phrases were narrowed to avoid colliding with built-in /compact, in-session subagents and single-document requests.
• pm sdd: Phase 5 recomputes local_hash with repo-context.sh --hash (which allowed-tools already covers) instead of an unlisted git hash-object. Reference files point at ../templates/... and ../scripts/..., story-from-document no longer reads as locked after a dry run, and epic says "two writes, then a confirmation".

Fixed

• nd evals: on macOS the eval sandbox cannot run git (the Xcode shim needs a cache file it may not write), which made handoff-guards-non-git, handoff-asks-before-committing, delivery-shows-before-committing and engineer-refuses-unauthorized-commit fail for reasons unrelated to the skills. Their scaffolds now put the real git binary on the sandbox's PATH (only when it exists and only inside the eval's own temporary home), and all four pass. The plain-language-explains-plainly judge failed plain answers (it read bold plain sentences as jargon labels), which made the case fail with and without the plugin; its criteria are now exact. reflecting-asks-before-writing also checks the write_note and edit_note path, not only Write. The onboard cases now read the files the run wrote instead of the Write tool's input, because with Bash granted the agent may write the docs with a heredoc and a Write-only check passes or fails for the wrong reason; they also get a 900 s timeout, since three evals in parallel pushed runs past the default 300 s.