okf v0.8.0

What's Changed

• feat(mcp): read-only MCP server over a bundle (#41) by @scaccogatto in #45

Full Changelog: okf--v0.7.4...okf--v0.8.0

okf v0.7.4

What's Changed

• chore: arm the plugin's own upkeep hook, unfreeze v1, and make the docs true again by @scaccogatto in #46

Full Changelog: okf--v0.7.3...okf--v0.7.4

okf v0.7.3

What's Changed

• fix(validate): name the fix in the §11.1 frontmatter error by @scaccogatto in #43

Full Changelog: okf--v0.7.2...okf--v0.7.3

okf v0.7.2

What's Changed

• ci: auto-release on version bump by @scaccogatto in #35
• ci: require a version bump when shipped code changes by @scaccogatto in #36
• ci: make the version-bump gate safe to require by @scaccogatto in #37

Full Changelog: okf--v0.7.1...okf--v0.7.2

okf v0.7.1 — opt-in enforced upkeep, refocused on the standard

Everything since v0.6.0.

Enforced upkeep (opt-in). The plugin now ships a Stop hook (hooks/okf-stop-check.sh), dormant by default. A bundle arms it with upkeep: enforced in .okf/index.md frontmatter; it then blocks finishing when tracked files changed but .okf/log.md was not updated. A user overrides any bundle with OKF_HOOK=off. Soft-mode (the CLAUDE-okf.md snippet) is unchanged. (#27, #29, #31)

Refocused on the standard. Removed the benchmark/ tree: the canonical OKF spec makes no claim about tokens, cost, or answer quality, so measuring those measured the ecosystem's adoption pitch, not the standard this toolkit implements. (#32)

Docs. README cleaned up and made example-first. (#34)

Fixes: the Stop hook counts only modified tracked files, so untracked tooling dirs (.claude/, .venv/) no longer false-fire it. (#29)

okf v0.6.0 — derived trust signals, tighter validator, GitHub Action

Added

• visualize derives the §5.3 trust tier and staleness. The panel showed the
  raw fields; it now shows what they mean — unverified / machine-confirmed /
  human-reviewed, and a stale badge once stale_after is past. Both are
  computed at render time: OKF deliberately stores neither, because a stored tier
  is a stored opinion and it goes stale. Advisory badges, never a gate (§5.3).
• validate checks the §7 actor convention on generated.by,
  verified[].by and sources[].author. Not a whitelist — the spec's own §5.1
  example uses author: team:ga4-docs, so the <prefix>:<id> family is open.
  What it catches is the near-miss of human:: Human:dana satisfies the generic
  shape and looks well-formed while §5.3 reads it as an agent, silently demoting a
  concept a person did review.
• usage_window is validated (a usage_count with nothing framing it warns;
  bounds must be absolute dates) and rendered next to the count it frames — a
  count without its window is a number without units (§5.1).
• Attested Computation path-valued fields — computation,
  executor.resource, attester.resource — are resolved when they point inside
  the bundle (§6.2). They are exactly the pointer that rots: the concept keeps
  validating while the script it names moves away.
• generated.at / verified[].at are checked as RFC 3339, date-only
  tolerated, with the same quoted/unquoted equivalence as stale_after.
• A composite GitHub Action (action.yml): gate a bundle in any repo's CI
  without Claude Code. Exercised in CI on both the passing and the failing path,
  since an action that never fails looks green for the wrong reason.

okf v0.5.0 — OKF v0.2, --migrate, --max-warnings

Changed

• The toolkit now targets OKF v0.2. skills/okf/reference/SPEC.md is
  re-vendored verbatim from upstream 3fcbb9f, and the okf, validate, and
  visualize skills apply its rules. Conformance is unchanged in substance
  (parseable frontmatter with a non-empty type) but has moved from §9 to §11;
  validator messages cite v0.2 section numbers throughout.
• okf_init.py scaffolds v0.2 frontmatter — okf_version: "0.2" in the root
  index, status and generated: {by, at} (actor process:okf_init) on the
  starter concept.
• examples/sample-bundle and this repo's own .okf bundle are migrated to
  v0.2; the two GitHub Pages demos are regenerated from them. The sample bundle's
  checkout conversion metric now records the orders database in sources, so the
  live demo shows a derivation edge.

Added

• validate: checks for the new families, all soft — generated.by present,
  every verified entry has an actor (a bare mapping counts as a one-element
  list, §5.2), status is one of draft/stable/deprecated, stale_after and
  sources[].last_modified are absolute YYYY-MM-DD dates, every sources
  entry has a resource, every [^label] footnote names a sources[].id, and
  an Attested Computation declares a runtime.
• visualize: the detail panel renders status, generated, verified,
  stale_after, and a Sources list with each source's credibility signals; a
  sources entry pointing at another concept in the bundle also becomes a graph
  edge.
• validate --migrate: rewrites a v0.1 bundle to v0.2 in place — timestamp to
  generated: { by: process:okf-migrate, at }, a # Citations list up into
  sources, okf_version to 0.2. Textual, so comments, key order and quoting
  survive a migration; idempotent, so a half-migrated bundle converges. It does
  not invent generated.by for pre-v0.2 content (the process: actor leaves the
  concept correctly unverified under §5.3) and cannot recover per-claim
  [^id] attribution, which v0.1 never encoded — the command says so.
• validate --max-warnings N: the gate between a default that fails on nothing
  and a --strict that demands zero, so a bundle with known warnings can still
  be gated in CI. --strict is the N=0 case.
• make docs pins the exact invocation behind the two GitHub Pages demos, and CI
  fails on a stale docs/. They had silently drifted: both live pages were
  serving a build from before the DOMPurify sanitize fix.

Compatibility

• v0.1 bundles still validate and render. The two superseded constructs are
  read, not rejected: a legacy timestamp is used as generated.at, and a body
  # Citations list is recognized. Both are reported as warnings naming their
  v0.2 replacement (§13.1).
• --strict fails an unmigrated v0.1 bundle. That is the migration nudge and
  it is deliberate — templates/CLAUDE-okf.md tells every user to run --strict
  before committing, so --migrate ships in the same release to make it a door
  rather than a wall. Note that §11 conformance itself never mentioned
  timestamp or # Citations: a v0.1 bundle is conformant under v0.2 either way.

okf v0.4.0 — okf init scaffold

Added

• okf_init.py — one-command scaffold for a conformant OKF v0.1 bundle (root index.md, log.md, starter concept with full recommended frontmatter). Refuses non-empty targets without --force; a fresh scaffold passes --strict validation with zero warnings, enforced in CI.

Full Changelog: okf--v0.3.6...okf--v0.4.0

okf v0.3.6 — security: visualizer XSS fix

Security

• visualize: concept-body markdown is now sanitized with DOMPurify (SRI-pinned) before innerHTML — a shared viz.html could previously execute script from a malicious concept body (stored XSS).

Fixed

• validate/visualize: a binary or non-UTF-8 .md file now yields a per-file error/warning instead of crashing the whole run.

Added

• CI: windows-latest job (real cp1252 console coverage) + XSS regression self-test.

Full Changelog: okf--v0.3.5...okf--v0.3.6

okf v0.3.5 — scale guardrails, Windows fix, validator tests

Fixed

• validate/visualize: no longer crash with UnicodeEncodeError on default Windows consoles (cp1252) — stdout/stderr are reconfigured to UTF-8. Thanks @crackcode09 (#3). A cp1252 regression step now runs in CI.
• visualize: large bundles no longer freeze the browser — the force (cose) layout applies only up to 1,000 concepts (measured ~32 s of blocked main thread at ~2k), larger bundles default to the linear concentric layout; explicit --layout cose still wins. Thanks @td-bl (#4, #5).
• visualize: filter passes wrapped in cy.batch(), search box debounced (150 ms).

Added

• Unit tests for okf_validate.py internals — 25 cases, stdlib unittest, in CI (#1).
• visualize: warning above 5,000 concepts + --max-nodes N to refuse oversized bundles in CI.
• Decision record: scale guardrails.

Full Changelog: okf--v0.3.3...okf--v0.3.5