nobrainer-tech-flow 2.12.0

Ask Flow to "find the implicit state machines" in a module and its review now maps them
and says what to fix first. The release also carries the fixes the plugin directories
asked for and four states Flow's own code could reach although nobody designed them. The
portfolio stays at eighteen skills.

• Implicit state machines in review. nobrainer-review gains one practice
  (reference, alias
  nb-auto-fix): find the fields that together mean one state (flags, status strings,
  counters, locks), map who writes and who reads them, and prove each state nobody
  designed with a call sequence. Review reports; nobrainer-build fixes, with a failing
  test first and one explicit state with a single transition function. In the
  eval record it adds no finding to code
  that has none; detection in an ordinary bug hunt is unchanged.
• Claude plugin directory. The copy that the directory tracks ships no script at all.
  The directory now accepts only Markdown, plain text, JSON, YAML and a few image types from
  organizations it has not verified, so it refused a copy that still had Python helpers.
  It had also held v2.10.1 to v2.11.0 on its credential rule for two of them. The new
  scripts/export_native.py builds the copy from the release ZIP, and
  scripts/verify_native_export.py checks it (the copy's CI runs the same check). Where a
  skill names a bundled script, the agent does the same check by hand or with a host tool
  and says so (eval record). Git and npm
  installs keep every script.
• OpenAI plugin directory. The plugin manifests no longer carry an empty
  screenshots list, which the portal rejected.
• Guards. NOBRAINER_GUARD_STRICT reads true, yes and on as well as 1.
  Those values used to leave strict mode off without a word. An unknown value still
  leaves it off, and the guard now says so.
• Optional decisions. A piped TypeSafe key longer than 4096 characters stops with
  INVALID_INPUT. It used to run on as if no key had been given.
• MCP server. A test or command result that went stale after a file change goes
  back for a rerun, also when it failed twice before it passed; get_flow_step used to
  send it to root-cause analysis. Past 255 file changes in one contract, a stale result
  is reported as stale, not as never checked. Token format and old tokens are unchanged.
• MCP Registry. mcp/server.json describes the server for the official MCP Registry
  as io.github.nobrainer-tech/nobrainer-tech-flow. The Publish MCP Registry workflow
  publishes it, and scripts/check_release_channels.py reads the entry back.
• The README links the Can-Do guide.

nobrainer-tech-flow 2.11.0

Ask "give me the DoD for this PR" or "is this PR ready?" and Flow now reports a pull request Definition of Done, in the same eighteen skills.

• Gates: nobrainer-review owns nine gates: requirements coverage, target freshness, local checks, tests executed, evidence, PR description, review, tracker records, and merge and closeout. Each check gets one status, VERIFIED, GAP, UNKNOWN or N/A, and the report ends in one verdict and one next action. A green CI run alone is never Ready, and "mergeable", "ready" and "done" stay three different claims.
• Formats: nobrainer-writing adds four BRIEF shapes: TASK, PR, COMMIT and DELIVERY_COMMENT, with formats for the PR description and for status, review reply, completion, parent and blocked comments.
• Templates: the repository's PR template gains the DoD report, and the spec template, team plan and worker prompt gain a DoD field. A project keeps its profile (target branch, checks, environment) in REVIEW.md or its nearest instructions.

In Claude Code, requests for a PR's DoD loaded nobrainer-review 6 times out of 7, up from 0 of 7, and unrelated requests stayed clean at 5 of 5. That is one run per request in one client. The eval record has the scenarios, scorers and limits.

Full details: RELEASE-NOTES.md. #NoBrainerTechFlow

nobrainer-tech-flow 2.10.2

The MCP done gate now rejects PHPUnit runs with zero assertions when every test is marked risky.

A run that shows Tests: 1, Assertions: 0, Risky: 1. counts as no passed tests, and a valid run with assertions restores DONE. Partly risky runs and intentional tests without assertions still pass (PR #139).

The README now says what the gate can and cannot verify: it checks evidence consistency and does not run your commands.

nobrainer-tech-flow 2.10.1

The MCP done gate now rejects a recognised failed test summary even if a later summary passes.

Submit a clean rerun separately to complete the criterion. Fix for a log that showed FAILED followed by OK being accepted as done (PR #137).

nobrainer-tech-flow 2.10.0

Flow now covers every stage of Anthropic's AI-native SDLC playbook (plan, design,
build, test, deploy, maintain) inside the same eighteen skills; the
gap map records what was
missing and where each play lives.

• Plan and design: an idea becomes a committed intent record (Problem, Proposed
  outcome, Affected users and systems, Constraints, Open questions); the spec
  template carries INTENT_REF and a policy-review table that routes concerns to
  named owners before implementation may start.
• Build: the scope block gains Risks:; the optional guards also watch edits
  (protected paths from .nobrainer/protected-paths, credential-looking content,
  test files while .nobrainer/fix-mode exists) and a strict mode denies
  production deploy patterns; the instruction-file checklist names commands with
  healthy output, conventions, architecture and known agent mistakes.
• Test: a standing scenario set under docs/evals/; every correction freezes one
  scenario; scripts/check_eval_coverage.py fails CI when a changed skill, hook
  or instruction file has no scenario record in the same change.
• Deploy: Review reads a project REVIEW.md, runs bug, security and compliance
  passes, labels findings IMPORTANT or NIT under a nit cap and promotes repeat
  findings into the project's instructions; delivery gains autonomy tiers by
  environment and a headless judgment-step pattern for CI.
• Maintain: closing-the-loop.md runs one baseline metric through a
  deterministic detector with log, diagnose and propose bands, writes findings as
  intent records and an eval per shipped fix, schedules security scans from the
  last scanned SHA, and RCA persists post-mortems under docs/incidents/.
• Sessions: a transport contract and short-lived CLI workers (codex exec,
  muse exec) with preview by default, receipts, timeouts and MAIN verification;
  run_bounded.py --stdin-file feeds a prompt file to such a worker.

Gap map: docs/evals/ai-native-sdlc-gap-map-2026-11-02.md. Scenario record: docs/evals/v2.10.0-ai-native-sdlc-2026-11-02.md.

SHA-256

• nobrainer-tech-flow-2.10.0-plugin.zip: 4b15127aa3fc1fca7f2d54aa29f1cbcd91120c057c0c89b4cb775bfd80656959
• nobrainer-tech-flow-2.10.0.tgz: 5ebdcac40d3d2a7738557258349db0f418a97ef7b5bd07c15d680ccabd2c7e55

nobrainer-tech-flow 2.9.3

The MCP done gate no longer counts Python unittest expected failures as passing tests.

• Fix: check_flow_evidence subtracts expected failures from the passed count in unittest OK (...) and FAILED (...) summaries. A test item whose only "passing" test is marked @unittest.expectedFailure now gets NO_TESTS_RAN, stays open, and check_flow_done returns NOT_DONE. A run that also has a real pass still counts.
• Fix: in FAILED (...) summaries the key failures= no longer matches inside expected failures=N, so FAILED (errors=1, expected failures=2) reads as one failure, not two.
• No schema, rejection code or tool contract changes.
• Pull request: #133

The public MCP server at mcp.nobrainer.tech picks this up after its next deploy.

nobrainer-tech-flow 2.9.2

The MCP done gate no longer accepts shared-network IP addresses or reserved .invalid, .test and .example names as production evidence.

• Fix: for a production item, check_flow_evidence now returns LEVEL_TOO_LOW for url evidence on 100.64.0.0/10 (CGNAT), including its IPv4-mapped IPv6 forms, and on hosts ending in .invalid, .test or .example, in any case and with or without a trailing dot. The item stays open and check_flow_done returns NOT_DONE. Public hosts such as test.com and example.org still pass.
• No schema, rejection code or tool contract changes.
• Pull request: #130

The public MCP server at mcp.nobrainer.tech picks this up after its next deploy.

nobrainer-tech-flow 2.9.1

A failed test re-run without output could leave an earlier pass marked done. The MCP done gate now reopens the item until a later test passes.

• Fix: check_flow_evidence counts a test or command record with a non-empty cmd, a non-zero exit and no out as a failed run, not as MISSING_FIELD. The item reopens and check_flow_done returns NOT_DONE until a later run passes.
• No schema, rejection code or tool contract changes.
• Pull request: #128

The public MCP server at mcp.nobrainer.tech picks this up after its next deploy.

nobrainer-tech-flow 2.9.0

The entry skill gains a short Work to done section and a finish check before the
handoff block.

• A request to act is carried out; a question, review or brainstorm gets an answer and no
  unrequested changes.
• The full scope stays in force, including requirements added mid-task; the easier part is
  never delivered as the whole.
• Known, authorized next steps are taken without check-ins, routine reversible details are
  decided in scope, and permission already given is reused.
• Ambiguity is not a blocker: a safe assumption is named and work continues; only
  dependent work pauses. Silence is never consent.
• Before an unavoidable approval, everything already allowed is prepared. After a failure
  the cause comes first and an identical attempt is never repeated.
• Finish check: any requested, possible and allowed action the reply would only promise is
  done first; a partial result is never called done and no background work is promised
  that nothing started.

No approval gate changes. A behavior evaluation compared 2.8.0 and 2.9.0 on five frozen
scenarios across three models (26 runs, separate judge): no regression and no scored
difference on these short tasks, recorded as a null result. See the
2.9.0 record.

SHA-256:

• nobrainer-tech-flow-2.9.0-plugin.zip: 7809b2110351603ec67a1f9b951cd08234330fc9ae0318c5872200563f6db42a
• nobrainer-tech-flow-2.9.0.tgz: 766d96bb79ca440e7fe8c3fc1b71fdffbcb9add1f4d4457e54c629b51f7d6ddc

nobrainer-tech-flow 2.8.0

Every finished task now ends with one fixed handoff block: Delivered, Checked (each
command or check with its observed result) and Not checked (each gap with its reason).
A listed gap means done with gaps, not done, the same meaning as the MCP server's
DONE_WITH_GAPS verdict. scripts/validate_skills.py --suite now fails when the entry
skill loses that block. The verify gate also asks the agent to list each place the task
touched where docs and code disagree.

Seventeen module descriptions now start with the situation they handle instead of a
command alias; the nb-* aliases move to the end and still trigger. The entry skill and
the README top section use plain language: "the user" instead of "owner", "main agent"
instead of MAIN in prose, and shorter sentences. Stage tokens such as
OWNER_DECISION_REQUIRED do not change. Maintainer-only planning files (tasks/ and
docs/reports/paid-run-plan.md) are no longer tracked, the README chart no longer shows
the optional Jev and Laya profiles, and docs/COMPATIBILITY.md now states the real
distribution state. See the 2.8.0 record.