v0.7.1 — guard bump --dry-run

Patch release on top of v0.7.0.

• guard bump <tag> --dry-run: resolves the new tag, builds the three-way and section-level plans, prints what would merge, what would conflict and which extends lines would change — and writes nothing. Exit 0 when everything applies cleanly, 1 on conflicts, 2 on errors (incomplete vars, downgrade, or combined with --conflict-markers). This is the preview step the v0.7.0 guide meant: guard sync without --write previews the current tag only and cannot foresee a bump.
• Docs (en/ja) updated accordingly: migration guides, init-project "keeping up with the master", README, CLI README and LAYERING now say guard bump <tag> --dry-run → guard bump <tag>.
• Fixed: --dry-run is accepted by guard bump only — guard sync --write --dry-run used to ignore the flag and write; it now fails with unknown flag. Fixed: a failed tag fetch now exits 2 as documented (it used to abort with a libuv assertion and exit 127).
• Standards reference tag v0.7.1 (only the init-project wording changed). npm: @guardsmith/core / @guardsmith/cli 0.6.1. Self-contained bundle attached for air-gapped use.

📖 日本語: README(日本語版) / CHANGELOG(日本語) / 移行ガイド v0.7.1

v0.7.0 — Absorb standards updates by command (guard bump, three-way sync)

Standards updates are now absorbed by command, without hand-editing project files. Existing projects run guard sync --init-vars once, then guard bump <tag> on every new standards release.

How it works

• guardsmith.vars.yaml (project root, committed) records the values init-project substituted for the template placeholders, plus the standards tag the project was generated from. guard new writes the skeleton; guard sync --init-vars infers it for existing projects (ambiguous keys get candidates in comments, unknown or secret-looking values become TODO).
• guard sync three-way mode: the old master (the recorded tag) and the new master (the extends tag) are normalized (gen comments and the uninitialized banner stripped, placeholders rendered from vars) and their diff is applied to the project files with a line-level three-way merge (node-diff3). Untouched standard sections update automatically; project-specific sections survive; a section the project rewrote that also changed upstream is reported as a conflict — nothing is written unless --conflict-markers is given, and the command exits 1.
• guard bump <tag> rewrites the extends tags, merges files, syncs skills, updates the recorded tag and the CLAUDE.md stamp in one all-or-nothing batch (staged writes, rollback on failure), and writes the policy last.
• New check drift3 (drift/standards-sync in the baseline): warns when standards changes are pending and would apply cleanly, reports conflicts as info, and warns when the recorded tag is newer than the policy tag.

Safety

Writes are contained to the project root (.. in paths is rejected at schema level and at runtime). --write and bump refuse to run while vars contain TODO or unregistered placeholders. References to other repositories (organization overlays) keep their own pinned tags. A recorded tag newer than the policy tag blocks the write (--allow-downgrade to override) so an adopted standard is never rolled back silently.

Breaking

• guard sync exits 1 on conflicts (previously always 0) — check CI jobs that run it.
• baseline v0.7.0 requires @guardsmith/cli 0.6.0 or newer (older CLIs reject the drift3 check).
• guard new now also generates guardsmith.vars.yaml.

Upgrade notes: docs/migration/v0.7.0.md (two steps for existing projects). Full details: CHANGELOG. npm: @guardsmith/core / @guardsmith/cli 0.6.0. Self-contained bundle attached for air-gapped use.

📖 日本語: README(日本語版) / CHANGELOG(日本語) / 移行ガイド

v0.6.0 — Independent QA, resident-context budget, import-budget check

A release about how much context stays resident and who checks quality, driven by field feedback from a 26-PR project run (13 HIGH-severity rejections, 6 bugs found only by independent QA, weekly usage limits exhausted).

Standards v0.6.0

• Independent QA owns code review and acceptance verification. qa-engineer becomes the single quality gate (concurrency / idempotency / data integrity / permissions / input bounds / performance / design review + acceptance, regression, a11y). Reports must include the target commit, commands and results, skipped checks, open findings and a verdict; "we ran out of budget" is not a pass. The PM checks evidence instead of repeating the review.
• Model policy: PM on Claude Fable 5.1 only; qa-engineer / backend-engineer / db-engineer on opus; frontend-engineer on sonnet. Backend/DB engineers must answer a "secondary correctness" checklist (locks, partial failure, external rules, input limits, N+1, API-contract follow-through).
• @ imports are resident context. Moving text into docs/ and referencing it with @ does not reduce context. CLAUDE.md keeps only @docs/CODING_STANDARDS.md behind @; everything else is a plain path plus "when to read it". First-time setup moves to docs/SETUP.md.
• Context management: rules for continue / compact / new session, trial parallelism (1 implementer + 1 QA, max 3), and a per-issue state file under .guardsmith/state/.
• Line-count rules (50 / 800 / 4) become guidelines; splitting or rejecting on line count alone is prohibited.

CLI 0.5.0

• New check import-budget (claude-md/import-budget, warn at 32,000 chars — a trial value): measures a CLAUDE.md plus everything its @ imports pull in, following the Claude Code memory docs (imports anywhere in the file, relative to the importing file, 4 hops, code spans and fences skipped). Always reports the resident total with a per-file breakdown. References outside the scan root are never read.
• Breaking: the policy schema is strict again — unknown keys under with or on a rule are parse errors (they were silently dropped before). baseline v0.6.0 requires CLI 0.5.0+ (older CLIs reject the new check). Bare @scope/pkg in CLAUDE.md is read as an import — wrap package names in backticks.

Upgrade notes: docs/migration/v0.6.0.md (includes the patch for user-level ~/.claude/rules/common/ files and post-adoption metrics). Full details: CHANGELOG. npm: @guardsmith/core / @guardsmith/cli 0.5.0. Self-contained bundle attached for air-gapped use.

📖 日本語: README(日本語版) / CHANGELOG(日本語)

v0.5.2 — guard lint: ignore / .gitignore support

Patch release on top of v0.5.1. Fixes the scan-scope problem reported from a project whose repository root contains Claude Code agent worktrees (.claude/worktrees/** with .venv / node_modules): guard lint took over 100 seconds and security/no-secrets-in-context flagged files inside them.

• New policy key ignore: string[] (glob). Concatenated across extends (like exemptions), not overridden.
• .gitignore is honoured by default by guard lint / guard sync (root and nested files; negations, directory-only and anchored patterns follow git semantics — verified against git ls-files as the oracle). Opt out with --no-gitignore. **/.git/** is always excluded. Secret scanning is now defined as "files that could be committed"; see the README table for which checks follow .gitignore (json-path does not).
• Traversal is pruned, not just filtered: 10,022-file fixture went from 1,759 ms to 38 ms.
• baseline security/no-secrets-in-context now excludes .claude/worktrees/** explicitly, so the fix also applies to older CLIs.
• Standards reference tag: v0.5.2. Upgrade notes: docs/migration/v0.5.2.md.
• npm: @guardsmith/core / @guardsmith/cli 0.4.0 in the changelog; note that 0.5.0 (v0.6.0, released the same day) supersedes it and reads the v0.5.2 baseline as well. Self-contained bundle attached for air-gapped use.

📖 日本語: README(日本語版) / CHANGELOG

v0.5.1 — Runtime artifact hygiene

Patch release on top of v0.5.0.

• New baseline rule hygiene/guardsmith-artifacts-ignored (warn): verifies .gitignore excludes GuardSmith runtime artifacts — .guardsmith/ (local CI result JSON contains repo name / branch / commit SHA) and .claude/settings.local.json (hook URLs / tokens). These are per-machine files and must never be pushed to the project repository.
• finish-task now checks the staging area for these files before committing; docs/CI_CD.md states the prohibition explicitly.
• Standards reference tag: v0.5.1. Upgrade notes: docs/migration/v0.5.1.md (projects coming from v0.2.x should follow the v0.5.0 guide first).
• npm: @guardsmith/core / @guardsmith/cli 0.3.0 (first publish of the 0.3 line includes this rule). Self-contained bundle attached for air-gapped use.

📖 日本語: README(日本語版) / CHANGELOG

v0.5.0 — UI/CI/agents standards overhaul

Standards release v0.5.0 — UI, CI, and agent policy overhaul

A major refresh of the distributed standards. Existing projects are tag-pinned and keep
working untouched — upgrading is optional and can be done step by step:
migration checklist.

Highlights

• Frontend UI standard — shadcn/ui + Tailwind + TanStack as the default dashboard stack,
  a new presets/frontend.yaml (added to extends only by projects with a UI), and a
  minimal reference skeleton
• New CI/CD model — day-to-day CI runs locally in Docker (make ci, results written as
  JSON to .guardsmith/ci-results/ for external tools). GitHub Actions is reserved for
  deploy on push to main — zero Actions minutes consumed by routine CI
• ponytail built in — over-engineering prevention wired into the scaffolded settings and
  the finish-task skill (tests, input validation, security and a11y are never reduced)
• DESIGN.md workflow — a design-spec template (based on awesome-design-md-jp, incl.
  Japanese typography rules), concretized per project by init-project
• Agent model/effort policy — qa: fable / effort: high, implementation agents: sonnet;
  date-pinned model IDs are flagged by the new agents/no-pinned-model rule
• Issue & branch contracts for external tools — feature/bug/chore templates with fixed
  headings, <type>/<issue>-<slug> branch naming, and an HTTP hooks sample
  (.claude/settings.local.json.example)
• New baseline rules (both start as warnings): agents/no-pinned-model,
  ci/no-remote-test-workflows

Packages

npm: @guardsmith/core / @guardsmith/cli 0.3.0. The attached
guardsmith-cli-v0.5.0.tar.gz is a self-contained bundle for air-gapped environments —
only GitHub access and Node.js 20+ required (node guardsmith-cli/guard.mjs).

---

📖 日本語: README(日本語版) /
変更履歴(CHANGELOG) /
既存プロジェクトの移行ガイド

v0.4.0 — Offline bundle & npm READMEs

What's new

• Self-contained CLI bundle on GitHub Releases (guardsmith-cli-v0.4.0.tar.gz) — run GuardSmith without any npm registry access (air-gapped / restricted egress environments). Only GitHub + Node.js 20+ required:

  gh release download v0.4.0 --repo novexar/Guardsmith --pattern 'guardsmith-cli-*.tar.gz'
  tar -xzf guardsmith-cli-*.tar.gz
  node guardsmith-cli/guard.mjs lint

• Action source input — source: release runs the action from the Releases bundle instead of npx (npm registry not required). Default remains npm.

• npm READMEs (JA/EN) — @guardsmith/core / @guardsmith/cli 0.2.2 now ship bilingual READMEs (the npm pages previously showed no description).

• guard version command; guard new reference tag decoupled from the npm version (standards remain at v0.2.1).

---

npm レジストリへ到達できない環境向けの依存同梱バンドルを添付しました(GitHub と Node.js 20+ のみで動作)。Action は source: release で npm 不要になります。npm パッケージ 0.2.2 には日英併記の README を同梱しています。

v0.3.0 — GuardSmith Lint Action

What's new

• GitHub Action moved to the repository root — use it with a single line:
  uses: novexar/Guardsmith@v0.3.0 (the old packages/action path is removed)
• npx-based execution — the action now runs the published CLI via
  npx @guardsmith/cli (pinned with the cli-version input) instead of
  checking out this repository and installing dependencies. Setup steps are gone
  and runs are faster. The guardsmith-ref input is replaced by cli-version.
• npm packages (@guardsmith/core / @guardsmith/cli) remain at 0.2.1 — the CLI itself is unchanged.

Usage

name: GuardSmith
on: [pull_request]
permissions:
  contents: read
  pull-requests: write
jobs:
  guard:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: novexar/Guardsmith@v0.3.0

On violations the job fails, the console report lands in the Job Summary, a SARIF
report is uploaded (Code Scanning / artifact), and a summary comment is posted on the PR.