v0.18.0 — Explicit deep audits and task-fit judgment

0.18.0 — Explicit deep audits and task-fit judgment

Publication status: GitHub source and the three attached, CI-verified
tarballs are available. npm publication of all three 0.18.0 packages is
currently blocked: the registry rejected publishing with HTTP 404. The
official npm latest versions remain 0.16.0. Do not treat this GitHub release
as proof that npm install ...@0.18.0 is available. Maintainer publishing
credentials/package permissions must be resolved before retrying npm delivery.

• Add do-it-audit for explicitly requested repository-wide or scoped audits, with substantive per-file coverage and a fresh independent causal synthesis before repair recommendations.
• Distinguish undefined semantics, dropped contracts, independent defects, and refuted findings. Missing coverage or synthesis remains incomplete; ordinary review stays bounded.
• Ship the simplified Core and advisory runtime: no mandatory workflow classification, lexical router/grill, completion-language gates, automatic task takeover, or custom adaptive personalization. Preserve existing user configuration and project documents; evidence collection is opt-in diagnostics.
• Remove obsolete merge-completion, candidate-count, confirmation, handbook-template, and reference requirements.
• Add audit regression fixtures; fix Node 18 compatibility and the Windows smoke check for the current runtime.
• Refresh the locked transitive TOML dependency to 4.3.0; the OpenCode runtime dependency audit reports zero vulnerabilities.

Inventory: 12 runnable skills (including the router compatibility alias), one generated discovery entry, and 10 specialist definitions. Existing Codex, Claude Code, Cursor, OpenCode, Pi, and Kimi delivery surfaces remain supported; this release does not introduce an OMP or Grok-specific adapter.

Upgrade

See the migration guide and installation instructions.

The historical v0.17.0 tag remains unchanged; its npm publication failed. This release supersedes the published 0.16.0 line.

Verification

Local full suite, Node 18 compatibility tests, native Windows Git Bash smoke, and exact root/OpenCode/Pi tarball smoke passed. Known remaining dependency advisories concern the Pi development-only dependency tree, which is excluded from the published Pi tarball. Hosted CI and CodeQL passed for release commit a7462bc879d2aea21648610d9e53ba489706bab0. The release workflow passed full verification and all three exact-tarball smoke checks; only its npm publish jobs failed. Attached packages are those exact verified workflow artifacts, with SHA256SUMS.txt for download verification. Skill guidance and package discovery do not prove behavior across every model or host configuration.