v0.18.0 — Explicit deep audits and task-fit judgment

0.18.0 — Explicit deep audits and task-fit judgment

Publication status: GitHub source and the three attached, CI-verified
tarballs are available. npm publication of all three 0.18.0 packages is
currently blocked: the registry rejected publishing with HTTP 404. The
official npm latest versions remain 0.16.0. Do not treat this GitHub release
as proof that npm install ...@0.18.0 is available. Maintainer publishing
credentials/package permissions must be resolved before retrying npm delivery.

• Add do-it-audit for explicitly requested repository-wide or scoped audits, with substantive per-file coverage and a fresh independent causal synthesis before repair recommendations.
• Distinguish undefined semantics, dropped contracts, independent defects, and refuted findings. Missing coverage or synthesis remains incomplete; ordinary review stays bounded.
• Ship the simplified Core and advisory runtime: no mandatory workflow classification, lexical router/grill, completion-language gates, automatic task takeover, or custom adaptive personalization. Preserve existing user configuration and project documents; evidence collection is opt-in diagnostics.
• Remove obsolete merge-completion, candidate-count, confirmation, handbook-template, and reference requirements.
• Add audit regression fixtures; fix Node 18 compatibility and the Windows smoke check for the current runtime.
• Refresh the locked transitive TOML dependency to 4.3.0; the OpenCode runtime dependency audit reports zero vulnerabilities.

Inventory: 12 runnable skills (including the router compatibility alias), one generated discovery entry, and 10 specialist definitions. Existing Codex, Claude Code, Cursor, OpenCode, Pi, and Kimi delivery surfaces remain supported; this release does not introduce an OMP or Grok-specific adapter.

Upgrade

See the migration guide and installation instructions.

The historical v0.17.0 tag remains unchanged; its npm publication failed. This release supersedes the published 0.16.0 line.

Verification

Local full suite, Node 18 compatibility tests, native Windows Git Bash smoke, and exact root/OpenCode/Pi tarball smoke passed. Known remaining dependency advisories concern the Pi development-only dependency tree, which is excluded from the published Pi tarball. Hosted CI and CodeQL passed for release commit a7462bc879d2aea21648610d9e53ba489706bab0. The release workflow passed full verification and all three exact-tarball smoke checks; only its npm publish jobs failed. Attached packages are those exact verified workflow artifacts, with SHA256SUMS.txt for download verification. Skill guidance and package discovery do not prove behavior across every model or host configuration.

v0.16.0

0.16.0 — Core protocol and architecture routing

Core protocol and architecture routing

• do-it-core: added a single protocol voice for eight execution rules,
  backed by the closed-set execution-failure-modes.tsv registry and a
  consistency validator that rejects missing, mutated, duplicated, or restated
  rule bullets across the core skill, hooks, bridges, and satellite skills.
• do-it-architecture: added load-bearing architecture guidance for
  authority and ownership, public or persisted contracts, dependency
  boundaries, migration and cutover, guards, deletion, recovery, and drift.
• Model-adaptive Standard advisory: strong-model hosts receive one compact
  do-it-core pointer; weak, unknown, or undetected models receive the
  canonical rule text inline.
• Architecture routing: action-shaped Heavy interface/schema,
  migration/cutover, and security-boundary changes point to
  do-it-architecture; explanation questions remain Light, and ordinary Heavy
  release work stays free of an architecture pointer.
• Prompt-state ordering: Claude, Codex, Cursor, OpenCode, Pi, and Kimi now
  invoke router then Heavy grill through one serialized prompt-submit hook,
  preventing concurrent hook scheduling from reading a stale tier; the
  entrypoint stays fail-open (router guidance is always emitted, grill is
  gated on state persistence), and state writes use a portable mkdir lock
  fallback with a bounded wait when flock is unavailable.
• Architecture routing precision: strong Heavy detection now uses bounded,
  clause-local action/surface pairs for interface, migration, and security
  work, avoiding substring joins such as token + relationship while still
  recognizing explicit security-boundary creation.

Install

npm install -g @tdwhere/do-it@0.16.0
# adapters (after registry has them)
# npm install -g @tdwhere/do-it-opencode@0.16.0
# pi install npm:@tdwhere/do-it-pi@0.16.0

Published packages: @tdwhere/do-it, @tdwhere/do-it-opencode, @tdwhere/do-it-pi.

v0.15.0

0.15.0 — Code-quality rules move into skills and hooks

• New file-size advisory family in write-quality-lint: whole-file line
  count against warn (>500) and split (≥800) thresholds, nudging phase-based
  splits before behavior is added to oversized files. Project override via the
  data-only .do-it/write-quality.local.tsv (git root of the edited file) or
  the DO_IT_FILE_SIZE_WARN_LINES / DO_IT_FILE_SIZE_SPLIT_LINES env vars;
  each level falls back independently, CRLF/no-EOL files tolerated.
• do-it-code-quality: new "Phases, Not Piles" section — compute → apply →
  audit separation, reuse before repeat, a three-question post-edit re-check,
  and function-length judgment guidance; scope chain gains a targeted-reads
  step (no whole-file reads on large files).
• do-it-skill-authoring: new "Where a Rule Lives" — judgment rules in
  skills, deterministic numbers in hooks, drift contracts in validators; the
  family reference table is the single prose home for hook-owned numbers.
• Repo root gains AGENTS.md with repo-local contributor facts (source of
  truth vs build artifacts, closed-set contracts, verification bar).

Full changelog: CHANGELOG.md

v0.14.2

Summary

• Post-0.14.1 release hygiene: bump all host package/manifest versions to 0.14.2
• Correct README/release truth planes for tagged npm publication
• Stabilize Pi bridge timeout diagnostic race in CI
• Portable Pi smoke npm path formatting

Packages

• @tdwhere/do-it@0.14.2
• @tdwhere/do-it-opencode@0.14.2
• @tdwhere/do-it-pi@0.14.2

v0.14.1

Highlights

• Adds the Pi host adapter with advisory lifecycle hooks, Windows/Git Bash support, bounded hook execution, real Pi loader smoke coverage, and optional namespaced do-it.* agents through pi-subagents.
• Publishes three independently verified npm packages: @tdwhere/do-it, @tdwhere/do-it-opencode, and @tdwhere/do-it-pi.
• Adds the Kimi Code adapter, default-off retrospective feedback, and opt-in strict external-action controls.
• Hardens Scout + bounded deep code-mapper routing, package generation, Windows installation, and release truth-plane documentation.

Verification

• CI and CodeQL passed on commit 2d9d511, including native Windows Pi install/tests/package smoke.
• Release workflow verified exact root/OpenCode/Pi tarballs before publishing: https://github.com/tdwhere123/do-it/actions/runs/30066324711
• Full details: https://github.com/tdwhere123/do-it/blob/v0.14.1/CHANGELOG.md