Release v6.0.3

[obra]

Release PR: dev → main for v6.0.3. This is the release-mechanism PR (not a feature contribution), so it intentionally bundles the staged 6.0.3 work and the version bump.

Release notes (v6.0.3)

Subagent-Driven Development

• SDD scratch files moved out of .git/. Claude Code treats .git/ as a protected path and denies agent writes there, so an implementer subagent writing its report into .git/sdd/ got blocked mid-run. Task briefs, implementer reports, review diffs, and the progress ledger now live in a self-ignoring .superpowers/sdd/ directory in the working tree — kept out of git status and out of commits, and resolved per worktree by a shared sdd-workspace helper. One caveat: because the workspace is git-ignored working-tree scratch, git clean -fdx will delete the progress ledger; recover from git log if that happens. (Use a working-tree SDD directory (.superpowers/sdd) to avoid .git write approvals and improve SDD UX #1780)

Commits in this release

972399d Release v6.0.3: SDD artifacts move out of the .git/ protected path
81f860a test(deps): bump ws to ^8.21.0 in brainstorm-server tests
80f810a docs: add v6.0.3 release notes for the SDD .git/ workspace fix
528be9f test(sdd): wire test-sdd-workspace.sh into the runner; note git clean -fdx
ce8fd59 test(sdd): lock in per-worktree workspace isolation (#1780)
f660e9e fix(sdd): write artifacts to working-tree .superpowers/sdd, not .git/ (#1780)
78ec255 feat(sdd): add sdd-workspace helper for a self-ignoring artifact dir

Version bump

All 7 declared manifests bumped 6.0.2 → 6.0.3 and verified in sync via scripts/bump-version.sh --check:
package.json, .claude-plugin/plugin.json, .cursor-plugin/plugin.json, .codex-plugin/plugin.json, .kimi-plugin/plugin.json, .claude-plugin/marketplace.json (in-repo registry), gemini-extension.json. The audit's only "undeclared" hits were coincidental 6.0.3 strings in cached evals/results/ dependency manifests — not version declarations.

Pre-merge validation (macOS, Claude Code 2.1.181)

• tests/claude-code/test-sdd-workspace.sh — PASS (8/8)
• tests/shell-lint — PASS
• tests/brainstorm-server (npm test, post-ws bump) — PASS (134/134 across all suites)

Post-merge steps (NOT done — out of scope for this PR)

Per the release scope, this PR stops at "open the PR against main." After merge, the remaining release-engineering steps are:

• Tag v6.0.3 (annotated) on main and push the tag
• gh release create v6.0.3 with the notes above
• Update ../superpowers-marketplace/.claude-plugin/marketplace.json to 6.0.3 and push (marketplace is the install source of truth)
• Verify /plugin install superpowers@superpowers-marketplace

---

Produced by Claude Opus 4.8 (claude-opus-4-8[1m]) in Claude Code 2.1.181; reviewed by Jesse Vincent (maintainer).

[arittr]

LGTM