v2.0.12

What's changed

Audit convergence (G-1 / G-2, #106)

• New .scrum/audit-ledger.json (schema + update-audit-ledger.sh): one entry per defect class keyed by audit_identity, with structured occurrences, dec_id-verified exclusions, linked PBIs, and a detector with its own verification stamp. Status machine open → sweeping → guarded/accepted → closed is enforced by the wrapper.
• codebase-audit reads the ledger, reuses identities byte-for-byte, transcribes every class and occurrence into the ledger before writing the report, files a detector PBI + sweep PBI for machine-checkable classes, and every AC carries a mandatory Not closed by this check: line.
• Guard-first detectors run as merge-gate errors: run-detectors.sh executes every guarded class's detector on the merged tree before the project regression command; violations or a broken detector record merge_failure.kind=detector_regression, roll main back, and escalate at three strikes as merge_detector_regression. smoke-test records a detectors category. A class can only become guarded through a wrapper check that proves the gate is actually wired.
• Migration 008 seeds the ledger from existing audit PBIs.

Retrospective-filed defects (#104)

• #96: the design reviewer reads the PBI's acceptance criteria from .scrum/backlog.json itself and every missing_ac_mapping finding carries the criterion text, the searched string, and the matching row.
• #97: guard-type deliverables must demonstrate the failing direction (negative: / positive: steps in demo_plan); Sprint Review and PO acceptance execute both; update-backlog-status.sh warns when a guard-shaped plan lacks one.
• #93 (1): the three PreToolUse guards anchor on the project root ($CLAUDE_PROJECT_DIR, else a marker walk) instead of the working directory, and fail closed when the root cannot be resolved. Decision A on #93 (2): the Bash text scan is a guardrail; its pattern set is frozen and pinned by a lint (#105).

Reliability and CI (#103)

• The documented sh …/scrum-start.sh launch now works on Linux (dash): the three entry points re-exec under bash, and internal launches use bash.
• CI runs every integration suite and pytest, lints workflows with actionlint, and pins shellcheck v0.11.0 to match local runs.
• sign-and-notarize.sh retries notary polling on transient network errors and never retries a definitive Apple verdict; a keychain-profile run no longer exits 1 on success.
• Instruction text that would write .scrum/*.json without a wrapper is caught by a lint.

Documentation (#105)

• Public pages and READMEs state the current audit flow (severity-graded findings put to the PO; whole-repo audit every third Sprint). The requirements diary is folded into the requirements themselves. All 19 skills point at the canonical output discipline. pbi-merge forbids SM inspection actions during merge.

Upgrade notes

• Redeploy targets with setup-user.sh; migrate-state.sh runs migration 008 at launch and creates .scrum/audit-ledger.json. From then on add-backlog-item.sh --audit-identity must name a class present in the ledger (the error message names the upsert-class command to run).
• New merge-failure kind detector_regression (3 strikes → merge_detector_regression). Projects that never promote a class to guarded see no behaviour change.
• A target already in sprint_review when it redeploys still needs a sprint_acceptance decision recorded (unchanged from v2.0.11).

Verification

• bats -r tests/unit/ tests/lint/ tests/integration/: 1376 passed
• pytest tests/dashboard/: 41 passed
• ShellCheck, Ruff, actionlint: passed
• tests/integration/detector-merge-gate.bats: fake detector → merge rolled back → detector_regression → third strike escalates

Full changes: v2.0.11...v2.0.12

v2.0.11

What's changed

• Slim the Scrum Master into a thin orchestrator (agents/scrum-master.md 528 → 170 lines) and add two SM-spawned bounded agents: scrum-explorer (read-only evidence for one question) and ceremony-operator (runs exactly one ceremony skill). Liveness nudges are now self-describing (scripts/stall-watchdog.sh) with an autonomous-mode handoff (autonomous_liveness_handoff()); the in-agent cron self-poll is gone by design.
• Show phase-aware agent progress in the status line (scripts/statusline.sh).
• Run the whole-repo codebase-audit every third Sprint; cross-review still closes PBIs every Sprint.
• Classify Integrity divergence deterministically: source-scoped Critical/High findings count as increment, spec/doc lag as sync_lag, so documentation catching up with a same-round design amendment loops the round instead of escalating (#92). New resolve-integrity-fail.sh + lib/integrity-gates.sh own the transition.
• Raise the default stall thresholds to 30 minutes (stall_watchdog.idle_threshold_minutes / pbi_idle_threshold_minutes) and document the external liveness-nudge contract in docs/contracts/agent-interfaces.md § System: External liveness nudge (#95).
• Accept blocked PBIs at the review-phase Stop gate; the Sprint Review names each parked PBI with its blocker and decides carry-over vs. return-to-backlog (#94).
• Add the sprint_acceptance PO decision kind and the po_acceptance_missing Stop gate in sprint_review; migration 007 strips blank evidence entries from .scrum/po/decisions.json alongside the schema tightening.
• Register the two new agents in CLAUDE.md, docs/contracts/sub-agents.md, docs/architecture.md, rules/scrum-context.md; dedupe the Integrity resolver snippet.

Upgrade notes

• Redeploy targets with setup-user.sh; migrate-state.sh runs migration 007 at launch and warns (by decision id) about approval records whose evidence was blank.
• A target already in sprint_review will hit the new po_acceptance_missing gate until a sprint_acceptance decision is recorded via append-po-decision.sh.
• Explicit stall_watchdog.* values in .scrum/config.json still win; only the defaults moved from 10/15 to 30 minutes.

Verification

• Unit + lint tests (bats -r tests/unit/ tests/lint/): 1052 passed
• Integration tests (all 9 suites): 70 passed
• ShellCheck, Ruff: passed
• pytest (tests/dashboard/): 40 passed, 1 pre-existing failure unrelated to this release (fixed in the CI follow-up)

Full changes: #101

v2.0.10

What's changed

• Add reliable per-PBI pipeline health measurement using shared activity signals and the new pbi-idle.sh helper.
• Wire Scrum Master health checks to consistent idle-time reporting.
• Validate stat output before lock-staleness arithmetic to avoid false signals across BSD/GNU environments.
• Report never-observed activity honestly instead of fabricating elapsed time.
• Exclude paths inherited from merged main when calculating PBI diffs.

Verification

• Unit tests: 878 passed
• Lint contract tests: 106 passed
• Integration tests: 19 passed
• ShellCheck: passed

Full changes: #89

v2.0.9

Sprint-end audit: graded findings, full PO adjudication, suppression that persists

• Findings are now rated on a canonical 3-level scale — critical (a bug that prevents the spec from being met), high (spec met, but future harm), low (need-not-fix) — stored in a machine-readable audit_severity field on backlog items instead of only the PBI title. Migration 006 back-fills existing audit PBIs (legacy Medium maps to high, which can newly block Integration-Sprint entry).
• Every finding goes before the Product Owner with a plain-language, decision-ready brief; nothing is filed behind the PO's back and nothing mandatory-tiers past them. defer/reject verdicts are persisted per finding; a reject suppresses re-filing across Sprints and lapses only when a later audit rates the class strictly higher. Suppressed criticals are named out loud at the Integration gate.
• In human-PO mode the Scrum Master records the human's verdicts on their behalf, so suppression works identically in both modes.

Specs describe the present

• New catalog Governance Rule 8: spec bodies are current-state-only; history lives in frontmatter revision_history, D-001 ADRs, and the decision log. Live backward-compat paths and migration version ranges are explicitly not history.
• The audit detects history contamination repo-wide (new Axis A class 5) and routes it through spec adjudication → change-process; the docs-consistency reviewer blocks new contamination at merge time.
• New audit Step 4c backfills every answered spec clarification into the clause at Sprint end, so an ambiguous spec is fixed once instead of re-asked every Sprint.

Retrospectives can improve the framework itself

• New draft-framework-issue.sh drafts a sanitized GitHub issue for this repo when a retrospective finds a framework-attributable bug or improvement: postable body and local metadata are separate files, four mechanical sanitizer checks reject target-project identifiers/paths/tokens (no --force), and repeat findings bump an occurrence count instead of drafting twice.
• Posting always requires an explicit human "yes" after reading the full draft; autonomous runs queue drafts in the attention file and never post.
• The deploy stamp now records framework_origin so target projects can address this repo without network access.

Fixes

• Every documented bats invocation is now recursive (bats -r); the non-recursive form silently skipped 658 of 930 tests locally. The CI ShellCheck glob and the schema-pairing gate were missing the same class of subdirectory coverage and are aligned.
• Cross-Sprint audit dedup keys on the audit_identity field instead of description text; PBI worktrees can fork from an explicit base; the changelog page's v2.0.8 "Fixed" badge class now matches the CSS.

🤖 Generated with Claude Code

v2.0.8

Maul Team for Mac v2.0.8

Reliability release. No Mac app UI changes — everything here is in the
bundled framework.

A whole-codebase audit (8 read-only axes, 81 raw findings, ~71 distinct)
turned up 12 real bugs. Six of them were invisible from inside the
framework repo: they only fire in deployed target projects, which is why
the test suite stayed green throughout and CI never caught them. The
framework repo is immune to each for a structural reason — files are
git-tracked here, and the guards under discussion are deliberately not
registered here — so the masking was systematic rather than incidental.

The phase/path guard was inert in every deployed project (#85)

hooks/status-gate.sh emitted a top-level {"decision":"allow"|"deny"}.
Claude Code's top-level decision enum is ["approve","block"] —
allow/deny belong to the nested
hookSpecificOutput.permissionDecision. The object failed schema
validation, no permission decision was applied, and with no exit 2 path
the tool call proceeded.

Unenforced as a result: "only pbi-designer may write
docs/design/specs/", phase-based source-write gating, catalog.md
read-only, and catalog-config enablement.

The tell was in-repo: hooks/lib/validate.sh calls exit 2 "the Claude
Code hook deny convention", all five other guards use it, and
status-gate.sh's own header comment described the contract it did not
implement. Verified against the shipped binary (2.1.220).

The allow path deliberately stays a bare exit 0 rather than
{"decision":"approve"} — an explicit approve would bypass the user's
normal permission prompt for every Write/Edit.

Also: Claude Code matchers built only from [A-Za-z0-9_|, -] take the
exact-name membership branch, not a regex branch, so "Write|Edit" never
substring-matched NotebookEdit. All three PreToolUse guards now name the
notebook tools explicitly, in both settings surfaces.

Two breaking schema changes shipped with no migration (#85)

Both affected files sit in migrate-state.sh's blocking STRICT_MAP,
so an affected project hard-failed launch at exit 65 and the team never
spawned — with no documented repair.

• 003-drop-improvement-category.sh — e1958ec removed category from
  improvements.schema.json under additionalProperties: false. Its own
  commit message said "Existing state files must be migrated (strip the
  key)"; none was written.
• 004-drop-pbi-state-phase.sh — 001-legacy-to-ssot.sh skipped per-PBI
  files on the stated grounds that "projects in flight legitimately carry
  richer fields", which contradicts additionalProperties: false. A v1
  file still carrying phase blocked the launch gate.

Each migration's first test asserts the pre-migration file is genuinely
rejected, so the launch-block is proven, not assumed.

Cross-model review was unreachable from PBI worktrees (#85)

Reviewers cd into .scrum/worktrees/<pbi-id> before sourcing
codex-invoke.sh, and a worktree checked out at sprint.base_sha cannot
see untracked files from the main working tree. In any project set up by
setup-user.sh, the source failed and every codex second opinion reported
itself "unavailable" — for an entire Sprint at a time.

The helper now deploys to .scrum/scripts/lib/, which is symlinked into
every worktree. This also stops setup-user.sh scattering four
framework-repo-only helpers into the target's scripts/ tree, where a
plain cp could clobber a same-named file.

Gates that passed vacuously (#85)

• Pragma audit. jq -r '.pragma_pattern' yields JSON text for the
  schema-sanctioned object form and the literal null when the key is
  absent. Either matches nothing, and all over an empty array is true —
  so the pragma leg of Definition of Done was a silent no-op. All three
  shapes are now handled explicitly and an unresolvable one fails loudly.
  Narrowing the schema instead was rejected: config.json is in
  STRICT_MAP, so that would have created a third launch-brick.
• c0_threshold / c1_threshold were mandated by four documents but
  declared in no schema and in no example config — a typo silently
  reinstated the 100% requirement.

Stalls, duplicate work, and dropped events (#85)

• A dead Developer teammate stranded its PBI at escalated with a null
  reason, so the handler never wrote escalation-resolution.md and
  completion-gate.sh blocked every subsequent SM Stop. Adds the
  teammate_unrecoverable escalation reason end to end.
• session-context.sh reported merge-queued PBIs as active pipelines (the
  in_progress_merge exclusion its two sibling copies carry was missing),
  triggering duplicate Developer re-spawn.
• session-context.sh echoed hookEventName:"PostCompact", which is not a
  member of the hook output union, so post-compaction context was silently
  discarded.
• json_update_atomic took no lock on a read-modify-write that
  dashboard-event.sh runs on every PostToolUse from every concurrent
  agent; a dropped subagent_stop inflated count_in_flight_subagents
  into a spurious "N subagent(s) still running — do NOT re-spawn".
• pbi-merge collapsed preflight refusals (64/65/67) with real conflicts
  (exit 1), so the SM told a Developer to resolve conflicts in a worktree
  that had none while the actual remedy sat in discarded stderr.

Hardening and hygiene (#85)

• All 23 scrum-state wrappers now resolve schemas through
  lib/atomic.sh::resolve_schema_dir instead of an inline probe that used
  only its first candidate, with no $PWD fallback and no diagnostic.
• The four top-level contract schemas under docs/contracts/, which
  nothing validated, gain fixtures and 13 tests — valid fixtures must
  pass and invalid ones must be rejected. A drift guard asserts every
  criterion_key a reviewer declares is in the envelope enum, the exact
  defect 1b2d9aa fixed by hand. Both guards were mutation-tested.
• Stale references, flock-vs-mkdir lock drift in four places (the
  difference is load-bearing: a mkdir lock does not auto-release on process
  death), undocumented StopFailure/PostCompact hooks, the missing
  retrospective → complete phase edge, and ~158 lines of duplicated prose
  collapsed to pointers. Deliberate duplication was left intact and
  documented as such.
• Target-project Sprint identifiers removed from three files, per this
  repo's own no-private-project-references rule.

Upgrading

Existing projects pick all of this up on the next scrum-start.sh launch:
the two new migrations run automatically and idempotently before the team
spawns. No manual step.

Verified: shellcheck clean · ruff clean · 715 tests green
(unit+lint 225, scrum-state 445, integration 45).

Full diff: #85

v2.0.7

Maul Team for Mac v2.0.7

Feature release: the Mac app gets browser-style project tabs and now
taps you on the shoulder when Claude is waiting for your answer, and
the bundled framework starts big projects in seconds instead of
minutes and no longer stalls overnight.

Mac app: tabs for every running project (#83)

• The workspace toolbar now shows a folder-style tab strip with
  every project that has a live session, including ones running in
  the background. Click a tab to switch; the × stops that session
  (after a confirmation). The Projects button just takes you back to
  the picker — sessions keep running, no more leave dialog.
• Switching directly between two projects rebuilds the dashboard and
  file tree for the one you land on, so you never see stale state.

Mac app: know when Claude needs you (#83)

• When Claude asks a question or waits on a permission prompt in any
  tab, that tab shows an orange badge — and if the tab isn't the
  one you're looking at, a macOS notification banner appears with
  what Claude actually asked, not a generic "waiting" message.
  Clicking the banner jumps straight to that tab. One banner per
  question — no repeat nagging.
• Under the hood, the bundled framework records "waiting for the
  human" state to .scrum/attention.json via a new Notification
  hook, so any external UI can consume the same signal.

Bundled framework: fast launches on big backlogs (#83)

• Projects that have accumulated hundreds of PBIs no longer wait
  minutes at launch: per-PBI state validation now runs as one
  batch instead of one process per file — measured 233s → 5s on
  a 260-PBI project. When something is actually invalid, the
  launch still names every offending file exactly as before.

Bundled framework: no more silent overnight stalls (#83)

• Two real unmanned stalls (63 minutes and 8.6 hours) traced to a
  deadlock where a Developer waited forever on a notification from a
  finished sub-agent. The pipeline now always re-spawns sub-agents
  fresh instead of resuming them, and the Scrum Master runs a
  10-minute health check that probes a quiet pipeline and
  re-spawns confirmed-dead work instead of watching and waiting.
• All Scrum agents also adopt Opus 5 output discipline: tighter
  reports and decisions everywhere, with an explicit guard so
  reviewers stay concise without ever dropping findings.

Site

• The landing-page hero mockup catches up with the shipped app (tab
  strip, detached editor windows) and no longer jitters vertically
  while its animation loops.

Update channels

Sparkle in-app auto-update, Homebrew tap, and direct DMG download —
existing v2.0.6 installs should be offered this update automatically.

v2.0.6

Maul Team for Mac v2.0.6

Feature release: the bundled Scrum framework's Sprint-end audit now
converges instead of refilling the backlog forever, and the landing
page speaks Portuguese.

Bundled framework: audit sweep-to-zero (#80)

• The Sprint-end codebase-audit now files one PBI per defect
  class, swept to zero: auditors must search the whole repo for
  every instance of a defect class before reporting, and the filed
  PBI's acceptance criteria carry the full occurrence list plus a
  re-runnable zero-check — fixing one site of a repo-wide pattern no
  longer counts as done, and the same class can no longer resurface
  Sprint after Sprint as "new" findings.
• All documentation-drift findings (stale docstrings/comments,
  spec-text drift) collapse into a single per-audit DOCS batch PBI
  instead of a spread of fine-grained doc-fix PBIs that drag Sprint
  velocity.
• A class recurring after being swept to zero is flagged by the
  existing [REGRESSION] mechanism; the integration-entry
  Critical/High gate is unchanged.

Site & licensing

• Landing page adds Portuguese (pt-BR) — now eight languages.
• License wording reserves room for a future paid Enterprise tier
  (no change to current terms: framework MIT, app commercial).

Update channels

Sparkle in-app auto-update, Homebrew tap, and direct DMG download —
existing v2.0.5 installs should be offered this update automatically.

v2.0.5

Maul Team for Mac v2.0.5

Maintenance release: the bundled Scrum framework picks up the
2026-07-19 cleanup-audit fixes, and the app docs catch up with the
current editor.

Bundled framework fixes

• Status line no longer counts cancelled PBIs in Sprint totals — a
  Sprint with a descoped PBI now reaches N/N.
• The escalation handler gains the missing kind_mismatch response
  (reclassify / strip / park), and escalation writes are
  reason-first everywhere, so escalated is never observable
  without a recorded reason.
• Contract docs (Stop hook, TaskCompleted gate, state writers)
  re-synced with the implementation; duplicated shell helpers
  consolidated and mirror drift is now pinned by lint.

App & docs

• macapp README rewritten for the CodeEditSourceEditor +
  detached-window editor (macOS 14+, Xcode 16+, Swift 6).
• New hero screenshot from the current build; site copy updated in
  all seven languages.

Update channels

Sparkle in-app auto-update, Homebrew tap, and direct DMG download —
existing v2.0.4 installs should be offered this update automatically.

v2.0.4

Mac App

• In-app auto-update (Sparkle 2) — the app now checks for updates itself (with your consent on first launch) and installs them in place; a "Check for Updates…" menu item is also available. Updates are verified with an EdDSA-signed appcast. Note: auto-update delivers future releases — existing installs pick this version up via the dmg or brew upgrade one last time.
• Editor overhaul — the file editor is rebuilt on CodeEditSourceEditor with tree-sitter syntax highlighting; detached windows are now the sole editor surface.
• Editor view options — a view-options popover with custom indent guides.

Requirements

• Minimum macOS is 14 (Sonoma) — now stated correctly in the README and landing page (the app has required it since the previous release; the Homebrew cask already enforced it).
• Building from source now needs Xcode 16+ (Swift 6 toolchain).

Licensing

macapp/THIRD-PARTY-NOTICES.md lists all bundled components. CodeEditLanguages / CodeEditSymbols currently publish no upstream license grant; they are flagged UNRESOLVED there while clarification is pursued upstream.

🤖 Generated with Claude Code

v2.0.3

Highlights

This release fixes a silent deploy failure that let targets run current skills against stale .scrum/scripts/ wrappers, plus the framework-upgrade safety net that keeps it from ever recurring.

Fixed

• Space-safe deploys (#70): setup-user.sh's copy_tree word-split its glob, so a framework under a path containing a space — exactly the Mac app's extracted bundle in ~/Library/Application Support/MaulTeam/ — silently deployed nothing for agents, hooks, rules, and .scrum/scripts wrappers while skills kept updating. All deploy classes now copy correctly from any path.
• Content-keyed framework extraction (#71): the Mac app keys its extracted framework on the bundled commit (framework-<version>-<rev>), so a rebuild at the same version can no longer serve a stale extraction; older caches are swept automatically.

Added

• Upgrade safety (#70): every launch now clean-slate redeploys the wrappers, runs all idempotent state migrations with a hard launch gate (migrate-state.sh), and stamps the deployed framework revision into .scrum/deploy-stamp.json for staleness diagnosis. The status enum is derived from the deployed schema instead of being hardcoded.
• Regression tests deploying end-to-end from a spaced, git-less framework copy; CI now runs the full recursive bats suite and the macapp Swift tests.

Upgrading

Install this build and reopen your project — the next launch fully syncs the deployed wrappers. PBIs already refined before the upgrade are not retroactively gated: if a kind=code PBI is missing demo_plan, set it via .scrum/scripts/set-backlog-item-field.sh <pbi> demo_plan '<how to demo locally>'.

🤖 Generated with Claude Code