v5.0.0-rc.2

Release Candidate 2

Security skills red-team tone, runtime fixes, TOML hardening.

Changes

• Security skills streamlined to red-team-first tone — removed repeated authorization disclaimers from securing-systems, defending-applications, and their references/; the kernel scope.md remains the single authorization gate, so exec skills no longer re-trigger it. Output constraints now focus on technical accuracy (RFC 5737, placeholder credentials, detection/mitigation pairing) rather than conservative framing.
• Codex TOML editor hardened — array-of-table headers ([[...]]), multi-line strings, and hook/MCP headers with trailing whitespace are now parsed correctly; duplicate ABYSS_HOOK_MARKER constant unified with bin/lib/abyss-integration.js.
• doctor / compose runtime fixes — doctor no longer reports missing inject plane for Gemini/OpenClaw; compose rejects unsupported targets and refuses to write guidance over the 8000-char budget cap.
• Skill script path safety — doc_generator, persona_forge, and scanner skills now resolve user-supplied paths through resolveSafePath to prevent symlink/traversal surprises.
• run_skill.js lock hardened — lock directory moved from world-writable os.tmpdir() to ~/.code-abyss/locks/, uses atomic directory creation, and includes the skill name in the lock hash to avoid cross-skill contention.

Validation

• npm test: 43 suites / 489 passed / 2 skipped
• npm run verify:skills: 39 skills + 7 personas
• CI: 15 jobs green (3 Node versions × 4 targets × 3 OS)

Install

npx code-abyss@5.0.0-rc.2 -t claude -y

Migration

See docs/MIGRATION-v5.md.