Skip to content

v0.7.0

Choose a tag to compare

View all tags
@robcsaszar robcsaszar released this 15 Aug 05:31
· 5 commits to main since this release
v0.7.0
6fc1368

Upstreamed from working use of the skill in a real codebase.

Added

  • Phase 5 (Remediate FAILs) and Phase 6 (Work through MANUAL-REVIEWs) — the skill now acts on its own report instead of ending at it. FAILs are fixed one at a time under per-item approval; MANUAL-REVIEW items are expanded from a one-line action into followable instructions with a disposition captured for each. Phase 4 ends by asking whether to proceed, so an audit-only run stays a first-class outcome.
  • references/remediation-workflow.md — interaction protocols for both phases, loaded only once remediation begins.
  • Phase 3 capability probe — check for credentials, an authenticated vendor CLI, and config-as-code before declaring anything user-only, then state the agent boundary explicitly in the finding. Handing back work the agent could have done costs a round trip.
  • Phase 1 now captures the project's verification command, which Phase 5 runs after every fix.
  • Runtime-verification table for fixes that change request-time behavior. A type-check and build both pass on a CSP that blanks every page in production, so headers, auth, middleware, rate limits, and schema changes must be exercised with a real request before being marked fixed. Written after exactly that regression shipped — a hand-written policy that blocked SvelteKit's own inline hydration script. Fixes that can't be exercised locally are marked verified-by-build-only rather than passing as verified.
  • Three NEVER rules covering the capability probe, the verification command, and the green-build trap.

Fixed

  • Phase 5 committed each fix before asking for approval, so (r)evise and (s)kip implied unwinding a commit that should not have existed. The commit now follows the answer, and the diff is shown before the question. Verification still precedes the question, since it informs the decision.
  • The quit key was (q)uit in four prompts while remediation-workflow.md required uppercase Q — lowercase q sits next to a and would otherwise fall through to approve.

Removed

  • NEVER write a finding block for a category you haven't read the source file for — redundant with the PASS-requires-reading and FAIL-requires-a-snippet rules, whose rationale it restated almost verbatim.

Full Changelog: v0.6.0...v0.7.0

Assets 2
Loading