v3.2.2

Changed

• Profile examples trimmed back to worked-example scope: version notes, licence advice and dated citations removed from the .NET, Next.js, Astro and avoid files (#19).
• Plugin README notes that evals/ ships with the plugin on purpose (#19).

v3.2.1

Added

• evals/stale-state: fails when a session corrects a stale state file before the user approves it (#17).

v3.2.0

Added

• profile/macos-swift.md: defaults and known traps for macOS-only native tools, indexed in the
  profile README (#14).
• evals/: six claude plugin eval cases covering detection, refusing early code, re-entry,
  phase announcement, skill triggering and staying out of unrelated requests (#15).

Changed

• A project whose MVP or round has closed now routes to a re-entry step that checks the record and
  sends new work to an increment, a new round or maintenance (#14).
• 00-state.md and 02-decisions.md templates carry size limits; history moves to archive/,
  and a large decision record splits by topic (#14).
• A compact project that outgrows its two files is promoted to the five-file layout (#14).
• The tool never proposes waiving its own gates; a standing approval is recorded verbatim with its
  scope and expiry (#14).
• Routing announces the project's phase on every invocation, including when it opens with a
  concrete task (#14).
• The active phase reference is re-read after a context compaction (#14).
• /project pre-approves only the Skill tool (#14).
• Phase 5 lists increment steps in the reply when the task tools are unavailable (#14).
• Phase 4 notes that git worktrees lack local-only tooling and suggests a .worktreeinclude (#14).
• A state file that disagrees with the documents or the code is reported and corrected only on
  approval; a conflict with what the user said is still fixed at once (#15).
• A compact project's Belge düzeni line carries where decisions and the roadmap live (#15).
• Profile defaults updated: React Router 8, .NET application-part discovery, CSS-in-JS nonces,
  AutoMapper's licence, Next.js private folders and Astro hosting, each with source and date (#15).
• READMEs say the AI tooling can stay local and list docs/README.md in the produced tree (#15).

v3.1.1

Changed

• /project is a skill now, not a command file. commands/project.md moved to
  skills/project/SKILL.md; Claude Code documents command files as the older form and skills as the
  one to use. The command name, arguments and tool grants are unchanged. It also carries
  disable-model-invocation: true: the model reaches the phases through the project-flow skill,
  so the entry point only needs to answer the user typing /project. The same field keeps it out
  of subagent preloads and scheduled tasks.
• READMEs lead with the one-step install, /plugin install project-flow --marketplace voyvodka/claude-plugins (Claude Code 2.1.275 or later), and keep the two-step form for older
  versions.
• CI: actions/setup-node pinned to v7.1.0.

Fixed

• Phase 4 said a rule file with broken frontmatter is dropped. It is the opposite: Claude Code
  ignores frontmatter that does not parse and loads the rule into every session as if it had no
  paths:. A malformed area rule becomes always-on context rather than a gap, which is the cost the
  CLAUDE.md budget exists to avoid. Path-scoped rules also load when a matching file is written or
  edited, not only read.

v3.1.0

Added

• Phase 4 wires verification into hooks instead of prose. Where a verification command was
  settled, the fast part becomes a Stop hook in .claude/settings.json that checks the changed
  files and blocks the turn on failure, and the slow suite a git pre-push hook that skips pushes
  carrying no code. CLAUDE.md gains an optional Verification section naming what the hooks run.
  Three projects arrived at this independently after a written "run the checks" instruction; the
  phase had no place for it.
• CLAUDE.md has a budget of roughly 150 lines, and area rules go to .claude/rules/. A rule
  that applies to one part of the code is written with a paths: list and loads only when a
  matching file is read. Two large projects had to cut 300–480-line files by half or more to get
  there after the fact. Phase 5 points new area rules the same way.
• The publication decision now covers the AI tooling. Phase 3 asks whether CLAUDE.md,
  AGENTS.md and .claude/ ship; when they do not, Phase 4 keeps them out through
  .git/info/exclude rather than .gitignore, which is committed and would publish the list.

Changed

• Proposed subagents are read-only, on the cheapest model that does the job. The main session
  is the only writer; an advisory agent gets Read, Grep, Glob and Bash only when it must
  run a check.

v3.0.3

Added

• CI checks the changelog's link footer: [Unreleased] compares from the newest version, every
  tagged version has a ref, and no ref points at a tag that does not exist. The newest version may
  be untagged, because a release PR adds its heading before the tag. The checkout now fetches full
  history so the check can see the tags.
• The CI routing check also resolves every profile/*.md path a phase reference or SKILL.md
  names, not only the templates.

Fixed

• The cache check could not fire. self-improvement.md told the reader to stop if
  ${CLAUDE_PLUGIN_ROOT} pointed into plugins/cache/, but Claude Code substitutes that variable
  only into skill, command and agent bodies as they load. It is not in the Bash environment and not
  substituted into a reference file read later, so the reader saw the literal string. The check
  now lives in SKILL.md, where the path is substituted, with the skill's base directory as the
  fallback, and self-improvement.md points at it.
• The decision record had six lines in the template and "five fields" in the reference.
  templates/02-decisions.md carries a Kaynak line that phase-3-decide.md never mentioned, and
  told the reader to leave Bağlı olduğu varsayım blank where the reference required all five.
  Phase 3 now says five required fields plus an optional Source, gives the English label for it,
  and says an entry resting on no assumption writes "—".
• Phase 1 counted six blocking items in a table of seven. Item 6b, existing skill, is blocking,
  and a reader counting to six could close the gate without it. The count now says seven, 1–6
  and 6b.
• Turkish template literals leaked into English projects. Only the decision labels had a
  translation rule; Ek bilgiler, yok / uygulanmaz, Belge düzeni and the rest did not, and
  the English-only CLAUDE.md template quoted the Turkish Elenenler label. SKILL.md now carries
  one rule — headings and literals follow the document's language, the section set is what is
  fixed — and the CLAUDE.md template names the line by what it holds.
• phase-4-scaffold.md and the AGENTS.md template still described CLAUDE.md as holding a map
  of docs/, which 2.6.0 moved into docs/README.md. Both now say pointer, and Phase 4's table
  lists docs/README.md among the files it produces.
• The profile's safety rails called themselves absolute while profile/README.md called
  everything in the profile a default, and Phase 5 said "run it" against a rail forbidding tests
  unasked. The rails are now the named exception, and Phase 5 asks before running tests when they
  forbid it, reporting the increment as unverified if the answer is no.
• 00-state.md had nowhere for the records the phases tell it to keep — dispatched research
  branches, the compact layout, a merge-or-replace choice, tooling built on request — while
  SKILL.md forbids new headings. The template gains a Belge düzeni line and says where the rest
  go.
• phase-0-detect.md said never to skip Phase 0, while SKILL.md routes past it whenever a state
  file exists. Both now say the same thing.
• Three statements disagreed about where the reasoning for each version lives. The changelog intro
  and the root README now match the plugin README: CHANGELOG.md from 2.7.0, frozen Status
  before it.
• 3.0.1 still recorded the frozen Status section twice, under Fixed and Changed, and 2.8.0
  still had a blank line splitting its Fixed list — both after 3.0.2 said they were merged.
• The changelog footer pointed [Unreleased] at v3.0.1, had no [3.0.2] ref, and linked
  v2.4.0, v2.5.0 and v2.6.0, tags that were never created. Those three headings are now
  plain text.
• Leftover project names in the plugin README title and the changelog intro; "the last five
  phases" in Phase 4, where four come before it; a dangling section reference and a miscounted
  list in dotnet-api-contracts.md; a CI comment that described set -eo pipefail where the
  runner uses bash -e.

Security

• /project pre-approved unscoped Bash, Write, Edit and WebFetch. allowed-tools
  grants permission without a prompt for the turn it runs in, so git commit, git init or a
  database command could run unasked — against the skill's own rule that git runs only on request.
  The command now pre-approves only reads and read-only git (git status, git log, git diff,
  ls); writes and fetches go through the normal permission flow.

v3.0.2

Fixed

• The research phase told the subagent to use Context7 and gave it no way to proceed without it.
  phase-2-research.md said "use Context7 (resolve-library-id, then query-docs) … Do not answer
  from memory", but this plugin declares no dependency on Context7 and nothing installs it. On a
  machine without it the branch had an instruction it could not follow and no stated alternative,
  against a rule that forbids answering from memory — so the only exit was the one the rule
  forbids. profile/code-style.md already said "Context7 or the registry", so the two files
  disagreed about whether the tool was required. The rule now leads with what is actually
  non-negotiable (never answer from memory), prefers a docs tool where the session has one, and
  names the registry commands to fall back to.
• self-improvement.md sent the observation log into a directory the next update deletes.
  "Where the edit has to land" tells the reader to stop when ${CLAUDE_PLUGIN_ROOT} is inside a
  plugins/cache/ path, but the "Logging" section below it said, without qualification, to append
  to feedback/observations.md — a file in that same cache. A reader arriving straight at Logging
  appended an observation that a marketplace update then wiped, silently, having counted it as
  recorded. The constraint is now restated where the writing happens.
• Two release blocks in the changelog held the same fixes twice. 3.0.1 and 2.8.0 each
  carried two ### Fixed headings, because separate pull requests each appended to [Unreleased]
  and the release stamped both without merging them. Merged, with every unique entry kept.

Added

• CI checks the changelog's structure: no section heading twice inside one version block, only
  Keep a Changelog section names, an [Unreleased] section that the next change can land in, and
  one dated heading per version.

Full changelog: https://github.com/voyvodka/claude-project-flow/blob/main/CHANGELOG.md

v3.0.1

Follow-ups from a full re-audit. All three are defects introduced or left standing by 3.0.0's own changes.

Fixed

• phase-3-decide.md said the decision record has four fields while a paragraph further down describes Kabul edilen bedel / accepted cost as mandatory, down to what to write when there is none. An agent following the explicit instruction drops the field the same file calls required — and it is the one that stops the next reader reopening a settled decision. The template now carries all five.
• The plugin README's Status section went stale twice in one day — backfilled at 2.7.0, then three releases shipped past it. Resetting it a third time would be the weakest possible fix, so the cause is gone: CHANGELOG.md is the record from 2.7.0 onward, and Status is explicitly frozen as pre-2.7.0 reasoning.
• The CI routing check aborted opaquely on the condition it exists to report. grep exits 1 when it matches nothing, and under set -eo pipefail that killed the step before the annotation printed. It always failed safe, but a gate that cannot say what it caught costs the next person the time it was meant to save.

v3.0.0

⚠️ Breaking: the install key changed

The plugin is renamed from project to project-flow:

/plugin install project-flow@voyvodka

The catalog carries a renames entry, so Claude Code v2.1.193+ rewrites enabledPlugins and pluginConfigs in your user, project and local settings automatically and tells you it did. Because the source is remote, expect one plugin-cache-miss and a single /plugin install to pick it up under the new name. On older Claude Code the old name reports plugin-not-found — install the new one.

Unchanged: the repository name, and the /project command. It still starts, resumes and advances a project exactly as before. What moved is the install key and the skill's namespaced id (project-flow:project-flow).

Why

project is a bare dictionary word standing in for a plugin about phased project delivery, and the plugin name is the install key — the one identifier you cannot disambiguate at install time. cyberswat/claude-plugin-projects already occupies the same space. The skill one directory down has been called project-flow since the first release; the plugin now matches it, and plugins/project/ became plugins/project-flow/ so the directory does too.

Fixed

• The .gitignore rule protecting profile/local/ was pinned to a literal path and stopped matching the moment the plugin directory was renamed — no error, no warning. It is now **/profile/local/, and CI asserts that nothing under profile/local/ is tracked, so the protection is checked rather than assumed. If you run this plugin from a clone with your own profile/local/, this is the release that makes that safe against future moves.

v2.8.0

A privacy fix worth upgrading for, plus four contract mismatches.

Fixed — a gitignored file was feeding something that gets committed

phase-2-research.md tells the Tech branch to paste profile/infrastructure.md into the subagent prompt. On any real machine that resolves to profile/local/infrastructure.md — gitignored precisely because it holds hostnames, provider and account names, port lists, domain portfolios and backup schedules. That branch writes into docs/research/tech.md, a file this tool tells you to commit, in a different repository from the one the profile describes. Nothing distinguished using that content for judgement from transcribing it. Now an explicit rule, worded after the constraint the committed infrastructure.md already places on itself.

Fixed — an interrupted research branch looked finished

Branches write straight to their final file, so a session that died mid-fan-out left a file Phase 0 read as complete. Launched branches are now recorded in 00-state.md at dispatch and marked done as each returns.

Fixed — the tool contradicting its own promises

• SKILL.md said "never edits itself without the user's approval" while self-improvement.md documents two repair exceptions. The exceptions are now named where the promise is made.
• "No application code before Phase 5" vs Phase 3's timeboxed throwaway spike. Now "no code that ships", with the spike named as the one exception.
• "Two documents instead of five" was offered without saying which two, while Phases 3-5 name files the compact shape does not have. There is now a table.

Fixed — Phase 4 overwrote existing context files silently

No merge, diff or approval step existed for a pre-existing CLAUDE.md, AGENTS.md or docs/ tree. It now stops, says what is there and where it disagrees, and offers merge / replace / write-alongside.

Also

The Aktif faz field enumerated phases 0-5 while Phase 5 writes "MVP complete" into it, and nothing marked a phase as running or interrupted. It now carries a parenthesised status.