engineering-workflow 0.8.1

Highlights

• Adds a stateless privacy-review-v1 flow for user-approved synthetic fixture findings during target workflow migration.
• Keeps matched values and per-line fingerprints inside the local scanner; agents receive only category, repository-relative path, line number, status, and one aggregate review token.
• Preserves unconditional hard blocks for user paths, file URLs, private key material, known token shapes, credential-bearing URLs, SSH repository URLs, and all other non-eligible categories.
• Invalidates approval when finding content, path, line, multiplicity, current workflow version, or target version changes, and rolls back when a new finding appears during apply.
• Moves Codex and Claude Code installation and invocation guidance to the top of the README and clarifies the agent approval procedure.
• Publishes matching self-contained Codex and Claude plugin packages at version 0.8.1.

Validation

• 212 tests passed with 1 platform-dependent skip.
• Repository validator passed before and after the suite.
• Deterministic package, skill, Codex plugin, and strict Claude plugin/marketplace checks passed.
• Claude plugin tag dry-run passed.
• Fully redacted gitleaks scans of the release tree and all Git refs reported zero findings.