Skip to content

v0.3.0

Choose a tag to compare

View all tags
@stdin stdin released this 19 Jun 11:03
· 11 commits to main since this release
v0.3.0
bde954f

Buy vs Build 0.3.0 closes the loop from advice → enforcement → evidence → memory. Five new features, plus a behavioral nudge — all zero-runtime-dependency.

Highlights

  • PR check now posts evidence, across ecosystems. The dependency check diffs package.json, requirements.txt, pyproject.toml, go.mod, Cargo.toml, and Gemfile — not just npm — and for each newly added dependency posts deps.dev / OSV / OpenSSF Scorecard signals and a license-compatibility check, alongside the decision-note nudge.
  • Right-tool reference skill ($buy-vs-build-right-tool). On-demand decision tables for the traps the benchmark targets — SSE vs WebSockets, SQL vs NoSQL, cron vs queue, REST vs GraphQL, webhook vs polling, and more — organized around the distinguishing requirement (directionality, volume, latency, consistency, failure mode). Kept out of the always-injected rule so the rule stays lean.
  • Whole-repo dependency audit (npm run audit:deps). Ranks every direct dependency by ownership risk and names the lower rung you could drop to — the left-pad story, run against what you already own.
  • Revisit tracker (npm run revisit). Surfaces ADRs whose date- or dependency-version-based revisit trigger has fired, and flags free-text triggers for a human or LLM to judge. The back half of the ADR loop.
  • License-compatibility guard. A coarse copyleft-into-permissive/proprietary check (it surfaces, it doesn't adjudicate), wired into the dependency report, the audit, and the PR check.
  • Verify the choice paid off. The rule and the main/review skills now nudge a post-implementation check: did the choice actually cut code, failure modes, and operating burden — not just name the right option? A sound choice can still be integrated badly, and the decision note is the artifact that makes the tradeoff reviewable. (Thanks to the Reddit feedback that prompted this.)

Under the hood

New shared, dependency-free modules scripts/manifests.js (name-only manifest extractors) and scripts/license-compat.js. Tests added for every feature; the suite stays at zero runtime dependencies.

Full changelog: v0.2.0...v0.3.0

Assets 2
Loading