v0.80.0

What's Changed

• Release 0.80.0: a README that leads with what the skill finds by @rlx in #85

Full Changelog: v0.79.0...v0.80.0

v0.79.0

What's Changed

• Date the checklist to this pass, and name what the loop depends on by @rlx in #79
• The checklist's claims about GitHub, checked against GitHub by @rlx in #82
• Make the skill installable as a plugin by @rlx in #83
• Release 0.79.0: the plugin install, and the update command the README prints by @rlx in #84

Full Changelog: v0.78.0...v0.79.0

v0.78.0

What's Changed

• A support range that nothing tests by @rlx in #78

Full Changelog: v0.77.0...v0.78.0

v0.69.0

What's Changed

• Say each thing once, and make the counts match the lists by @rlx in #69

Full Changelog: v0.68.0...v0.69.0

v0.60.0

Three findings from broadening the validation corpus by shape — monorepos, reusable-workflow
fan-out, merge queues, a non-GitHub forge, a repository with no history.

• A repository that teaches CI contains CI files that are not its CI. A self-hosted-runner search
  matched three workflow files that turned out to be teaching material under course/content/. Scans
  now exclude testdata, fixtures and examples — and say the list is never complete, so the
  durable habit is to read the path of a match rather than only its count.
• No history has two causes with opposite remedies. A shallow clone is fixed by fetching; a
  repository that publishes squashed snapshots is a finding, because nobody can mine its incidents.
  They are indistinguishable until you check is-shallow-repository.
• A GitLab map. "Audit their equivalent" was the whole of the guidance for a non-GitHub host, and
  nothing had ever tested it. The questions that transfer are now mapped to their GitLab names,
  grounded in a real .gitlab-ci.yml: rules: on CI_PIPELINE_SOURCE == "merge_request_event",
  include: for fan-out, and component: pinned to a version string rather than a SHA.

v0.59.0

• Hazard discovery no longer names four languages. The find and the DDL grep both hard-coded
  .sql .go .py .rb, and returned zero on a repository with thirty-two Elixir migrations holding
  forty-eight ALTER TABLE and thirty DROP CONSTRAINT statements. Zero destructive DDL reads as
  no data hazard here, on the hazard class this skill treats as the most serious there is.
• Destructive schema change is not spelled in SQL: Ecto writes remove(, Rails remove_column,
  Django RemoveField and DeleteModel, Knex dropColumn. SQL keywords find the raw-SQL minority.

v0.58.0

Five practices this project has followed all along and the skill never taught. Found by diffing what
the repository does against what the skill says — a pass now written into CONTRIBUTING.md,
because the mechanism is worth more than this batch.

• A committed hook is inert. Git does not populate .git/hooks/ from a tracked directory. The
  ladder proposed commit hooks without saying so, which produces a control that exists in the tree,
  fires on nobody's machine, and that everyone believes is running.
• --no-verify needs a stated convention rather than a pretence it will not happen.
• Local-only checks must skip when CI is set, or they teach people the gate is noise.
• A gate script runs on more than one machine's tooling; a portability failure looks like a broken
  check.
• permissions: {} is the floor worth proposing, not contents: read — a job added later starts
  closed rather than inheriting a token nobody re-examined.

v0.57.0

• Check the clone is not shallow before reading its history. git clone --depth 1 — the default for
  CI checkouts and quick clones of large repositories — answers every history question with zero:
  zero reverts, zero hotfixes, no contributor count. That reads exactly like a healthy repository, and
  it is the highest-consequence measurement error available here, because what has already gone wrong
  is one of the three questions the whole audit is aimed by.

v0.56.0

• The three orienting questions — who is exposed when this changes, what has already gone wrong here,
  and what would have to be true for this repository to be fine — are now asked in SKILL.md before
  the mode file is opened. They were being asked after the decision to run a full audit and after four
  thousand tokens of procedure, which is the wrong order: by then the expensive decision is made.

v0.55.0

• The SKILL.md budget is 6000 rather than 4000, and the reasoning is written where the rule lives:
  the ceiling is a visibility mechanism, not a quality cap. It exists because the file loads on
  every trigger for every user, so growth is a cost borne by someone else and should be deliberate.
  When something belongs in the always-loaded file it goes there and the number moves in the same
  change. Never cut something worth saying to fit a figure.