v2.2.0

2.2.0 (2026-10-22)

Added

• image: v2.2.0 — OpenCode 2.1.2, review before commit, image-only bake (#250) (2bd6e68)

Fixed

• address the last-5-PR review findings (#243) (4ea148f)

Docs

• plan: plan v2.3.0 with Anthropic, AWS AI-DLC and Google lifecycles (#257) (fbab21e)
• plan: record the Codespaces onboarding result (#259) (946bced)
• readme: centre on the Anthropic AI-native SDLC with Superpowers (#258) (6ff374d)

Changed

• ci: publish the ai base as fawkes-space:base-<version> (#247) (395f03e)

Chores

• slim the repo for open source (README, leakage, skills, docs) (#251) (641f4e9)

v2.1.0

2.1.0 (2026-10-19)

Added

• ci: add REVIEW.md and an agent PR-review job (#158) (#232) (eafc523)
• devcontainer: bake hook envs; Claude Code + OpenCode extensions (#202) (f287db4)
• image: kubeconform, kustomize, helm 3, mkdocs in core (#193) (#203) (75ef306)
• image: pin aidlc in the ai variant (AI-DLC R1–R6) (#225) (b53a791)
• image: verify TOFU tools against GitHub's release asset digests (#207) (38a39d9)
• shift-left: type-check with tsc --noEmit and mypy (#192) (#208) (40bccef)

Fixed

• ci: exempt the image lock-bump PR from the plan.md rule (#205) (81f3009)
• ci: test for the Trivy report instead of swallowing cat's errors (#180) (#227) (0189ddd)
• docs: restore CHANGELOG history; repair security form and PR gate hint (#217) (16b71a3)
• image: patch npm security alerts; Codex 0.161, Gemini 0.63 (#206) (25cfb0e)
• release: add missing release-please-config.json; drop dangling labels (#215) (b952e2a)

Docs

• ai-sdlc: add AI-DLC opt-in intent, spec and plan (#218) (#221) (22132ef)
• changelog: add Keep a Changelog header and Unreleased section (#211) (c8cc640)
• governance: add CODE_OF_CONDUCT (#209) (93afc91)
• issue-templates: add security vulnerability template (#213) (f4af6ef)
• pr-template: fix uFawkesAI PR template (#212) (fcc9642)
• readme: cite research basis (paruff/uFawkes.dev#65) (#233) (2d63571)
• remove AI slop and placeholder ambiguity from public docs (#214) (eed2a49)

Chores

• ci: adopt Pipe v1.15.0-beta.1; drop local lint copy (#181) (#228) (94c683b)
• ci: bump uFawkesPipe reusables to v1.16.0-beta.1 (#230) (a49768c)
• image: bump locked toolchain (2026-10-04) (#189) (955dfbc)
• image: bump locked toolchain (2026-10-11) (#224) (d86452a)
• image: bump locked toolchain (2026-10-18) (#242) (24bd70e)
• infra: adopt the OpenCode shift-left plugin (#153) (#229) (b8028f4)

v2.0.0

Devcontainer image

Image	Digest
ghcr.io/paruff/fawkes-space:2.0.0	sha256:def9302d47d242bc11c244271f19c404f37fe922c902cc1941be41004d59ecee

Verify (cosign v3+; v2 reports "no signatures found"):

cosign verify ghcr.io/paruff/fawkes-space@sha256:def9302d47d242bc11c244271f19c404f37fe922c902cc1941be41004d59ecee \
  --certificate-identity-regexp '^https://github.com/paruff/uFawkesAI/' \
  --certificate-oidc-issuer https://token.actions.githubusercontent.com

Acceptance evidence

• Spec / plan: spec.md, plan.md (AC-AI-03)
• "Use this template" run: transcript on #152 (AC-AI-02)
• Benchmark baseline (warm start, ms): core amd64 137 · ai amd64 134 · devcontainer amd64 132 · core arm64 121 · ai arm64 115 · devcontainer arm64 118 (AC-AI-08; images/devsecops/benchmarks/baseline.json)
• Known gap: main branch protection is owner-applied and not yet in place.

v2.0.0-rc.3

Devcontainer image

Image	Digest
ghcr.io/paruff/fawkes-space:2.0.0-rc.3	sha256:491546e9fdef2b473899e152e0631a94b8d68fadb6525d39fb72cdfab08c08e0

Verify:

cosign verify ghcr.io/paruff/fawkes-space@sha256:491546e9fdef2b473899e152e0631a94b8d68fadb6525d39fb72cdfab08c08e0 \
  --certificate-identity-regexp '^https://github.com/paruff/uFawkesAI/' \
  --certificate-oidc-issuer https://token.actions.githubusercontent.com

v1.0.0 — Token-Optimized Launch

What's in v1.0.0

The first production-ready release of uFawkesAI — a DORA-aligned AI agent
starter template, pre-optimized for GitHub Copilot's June 2026 token-based
billing model.

Token cost optimization

• AGENTS.md — 88 lines (down from 226), reducing always-on context cost ~61%
• .github/skills/ — on-demand skill files (architecture, PR contract, metrics, model routing)
• .copilotignore — excludes lock files, build artifacts, and generated code
• scripts/token-audit.sh — measure your token footprint before the bill arrives

Billing guides

• docs/COPILOT_COST_GUIDE.md — billing model explained for developers
• docs/MODEL_ROUTING_GUIDE.md — which mode and model saves the most
• docs/COPILOT_BILLING_HANDOFF_PROMPT_LOCAL.md — retrofit any existing repo using Ollama + Gemma 4 E4B (zero Copilot cost)
• docs/COPILOT_BILLING_HANDOFF_PROMPT_SCRIPTS.md — bash/CI retrofit tasks (~$0.50)

DORA AI Capabilities

• 7 DORA capabilities implemented across AGENTS.md, CI, and docs
• AI Credit Burn Rate added as 7th DORA-adjacent metric in docs/METRICS.md
• scripts/weekly-metrics.sh — rework rate, PR revision rate, CI cycle time

Works with

GitHub Copilot · Claude Code · Cursor · OpenAI Codex · Gemini CLI · Windsurf · Devin

---

Run npm run token-audit after setup to see your baseline cost.