# Changelog

All notable changes to this project will be documented in this file.

The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).

## [Unreleased]

## [4.31.0] - 2026-05-08

Four-day sprint after v4.30.0 — single-session execution of the "Use the
Printing Press to Learn" plan, which mapped Matt Van Horn's CLI Printing
Press against the IS stack and shipped the four real gaps it surfaced:
generation capability (`/skill-creator --forge`), NOI cultural gate,
JRig behavioral evaluation integration end-to-end, and marketplace trust
signals (JRig-Verified badge + forge-generated provenance pill). The
forge workflow is no longer theoretical — `plugins/productivity/plane/`
is a Grade A (97/100) plugin produced through all 8 forge gates with a
full `.forge/` audit trail. JRig itself got real TypeScript code
(`spec-sources` module + 22 tests, ships in `j-rig-skill-binary-eval`).

### Added

- **`/skill-creator --forge` mode** (local skill, v8.1.0) — 8-gate workflow
  for generating plugins from API surfaces: NOI hard block (the API's
  "secret identity" must be named in 6–10 words before any code is
  written), ecosystem absorb (catalog 3–5 competing tools, gap analysis),
  API surface research, domain archetype detection, compound command
  design, generation, mandatory `/validate-skillmd --thorough`,
  PR + catalog wiring. Produces a `.forge/` audit trail (research.md,
  ecosystem.md, proofs.md) alongside the standard skill scaffold.
- **`/skill-creator --reforge` mode** (local skill, v8.1.0) — Regenerate
  an existing forge-generated plugin against the current API surface to
  fight catalog rot. Preserves NOI from `references/noi.md`, re-runs
  gates 3–7, auto-bumps version per detected change scope (patch for
  endpoint adds, minor for new compound commands, major for breaking
  surface changes).
- **`plugins/productivity/plane/`** (#703) — First end-to-end forge
  dogfood. NOI: "Plane is a team behavior observatory." Five compound
  commands (`/plane-cycle-velocity`, `/plane-stale-tickets`,
  `/plane-reviewer-gate-strength`, `/plane-priority-drift`,
  `/plane-cross-project-load`) that JOIN across multiple Plane endpoints
  to surface observations no single endpoint exposes. Validates Grade A
  (97/100), Tier 2 GREEN, JRig 12/12 deterministic checks. 1,123 lines
  across 8 files; full `.forge/` audit trail visible to anyone reviewing
  how the plugin came to exist.
- **Tier 2 static production gate in the validator** (#698) — Five
  deterministic checks added to `scripts/validate-skills-schema.py` (273
  lines Python). Run alongside the standard 100-point rubric: (1)
  `allowed-tools` accuracy — declared tools must appear in the body;
  (2) auth-documented — API surface mentions require an auth method
  documented; (3) dead-code — literal-false branches detected; (4) tool
  safety — unscoped Bash + Write/WebFetch requires Safety Justification
  section; (5) orchestration bounds — skills shouldn't claim cross-skill
  orchestration (with negation-marker guards to avoid false-positives on
  documentation). 180 new errors surfaced across the 3,535-skill catalog
  on first run; grade distribution unchanged at 68.9% A+B.
- **JRig-Verified marketplace badge data flow** (#696, #699, #700) —
  Three-PR trio that lights up the badge end-to-end: (1) plugin detail
  page renders `plugin.jrig?.verified` as a green "JRig-Verified · N/7
  layers" pill; (2) Freshie schema migration adds `jrig_passed`,
  `jrig_tier_blocked`, `jrig_baseline_delta` columns to `skill_compliance`
  + new `forge_proofs` table for per-plugin verification evidence;
  (3) new build step `enrich-jrig-data.mjs` reads `forge_proofs` via
  sqlite3 CLI, writes `marketplace/src/data/jrig-data.json` for the
  detail-page overlay. Build pipeline now 7 steps (added `jrig:enrich`).
- **Per-plugin `/plugins/<name>/verification` route** (#702) — 316-line
  Astro page that the JRig-Verified badge clicks through to. Two
  states: VERIFIED (shows passing-layer fraction, baseline delta, 7-layer
  framework breakdown) or PENDING (explains the two paths plugins reach
  JRig — forge generation or manual `j-rig eval`).
- **NOI tagline + forge-generated provenance pills** (#696) — Optional
  fields on plugin detail pages: italic NOI-framed subtitle under plugin
  name; indigo "Forge-generated" pill when `plugin.json` carries
  `"generated": true` or `"author_type": "forge"`. Anti-spam moat per
  Phase 5A: marketplace surfaces forge provenance for reviewer + end-user
  visibility.
- **Curated "Start here" homepage section** (#701) — 5-plugin onboarding
  pack between Hero and Jeremy's Stash. Eliminates "what should I
  install?" friction with 343 plugins to choose from. Each card: NOI
  tagline, "why this is in the pack" paragraph, copy-friendly install
  command. Editorial picks; quarterly rotation; re-evaluation against
  install velocity once Phase 5B telemetry lands.
- **JRig spec snapshots in `000-docs/`** (#695) —
  `anthropic-skills-spec-snapshot.md` + `agentskills-spec-snapshot.md`
  capture the source-of-truth specs JRig and the IS validator validate
  against. Versioned; refresh quarterly via PR cadence (live-fetch from
  CI is a rate-limit + flakiness risk). Same files mirror in
  `j-rig-skill-binary-eval/references/specs/`; future enhancement: sync
  script that diffs the two locations and fails CI on divergence.
- **JRig spec-sources TypeScript module** (j-rig PR #41, real TS code) —
  192-line module + 22 passing tests (full repo suite still green at
  173/173). Public API: `loadSpecAuthority()`, `classifyField(name)`,
  `isValidEffort(value)`. Records snapshot IDs so eval reports can detect
  spec drift in either direction. Quarterly refresh becomes a single PR
  cadence with the test suite catching divergence between the snapshot
  files and the embedded TypeScript constants.
- **IS-extension fields documented in `plugin-schema.md`** (#697) — Two
  provenance fields (`generated`: boolean, `author_type`:
  "human" | "forge") set by `/skill-creator --forge`. Documented
  alongside the 15 Anthropic spec fields. Stripped from `marketplace.json`
  (CLI catalog) by `sync-marketplace.cjs`'s `DISALLOWED_KEYS` set so the
  CLI never sees website-only metadata.
- **Master skills spec 3.1.0 → 3.3.1** (#693) —
  `000-docs/6767-b-SPEC-DR-STND-claude-skills-standard.md` brought into
  alignment with the validator's actual schema 3.3.1 behavior: 8-field
  enterprise required set (`name, description, allowed-tools, version,
  author, license, compatibility, tags`) is the IS marketplace tier
  requirement; missing any of these = ERROR (not warning). The 3.0.0–
  3.2.0 demotion-to-polish direction was reverted in 3.3.0; the doc never
  absorbed that revert until this PR. `allowed-tools` documented to
  accept all three forms (CSV string, space-separated string, YAML list).
- **Freshie discovery run 7 + compliance population under v7.0** (#694) —
  Refreshed `freshie/inventory.sqlite` with current validator scores.
  Anomalies dropped 44 → 7; duplicate file groups 41 → 0; cross-references
  301 → 684. 2,429 of 3,535 skills (68.9%) production-ready (A+B grade)
  at marketplace tier under schema 3.3.1.

### Changed

- **`scripts/sync-marketplace.cjs` `DISALLOWED_KEYS`** (#697) — Extended
  to strip 4 new website-only display fields from `marketplace.json`:
  `tagline`, `jrig`, `generated`, `author_type`. The website renders
  these from `marketplace.extended.json`; the CLI catalog never sees them.
- **`marketplace/scripts/build.mjs` step count** (#700) — 6 → 7 steps;
  added `jrig:enrich` after `catalog:sync`, before `search:generate`. New
  step reads `forge_proofs` from Freshie and writes `jrig-data.json` for
  the plugin detail page overlay.
- **`/validate-skillmd` v4.0.0 → v5.0.1** (local skill) — Four-tier
  validation framework: Tier 0 (locate), Tier 1 (standard or marketplace
  grading), Tier 2 (static production gate), Tier 3 (JRig opt-in via
  `--thorough`). Reconciled with JRig's actual CLI surface (`j-rig` with
  hyphen, `j-rig check`, `j-rig eval`) after initial documentation
  documented imaginary flags.
- **`/skill-creator` v7.0.0 → v8.1.0** (local skill) — Added `--forge`
  and `--reforge` modes (see Added section). Default `--create` mode
  unchanged for hand-authored skills.
- **`CLAUDE.md`** (#704) — Refreshed after the plan landed: plugin count
  425 → 427, schema 3.0.0 → 3.3.1, build pipeline 6 → 7 steps, new
  "Forge-Generated Plugins" subsection documenting `.forge/` pattern,
  new top-level "JRig — Behavioral Evaluation Integration" section
  explaining the full data flow. +70 / -13 lines, 22-section structure
  preserved.

### Fixed

- **JRig epic-index README accuracy** (j-rig PR #40) — The README said
  "Currently Active: Epic 01" with epics 02–10 marked Pending; reality
  was all 10 epics shipped 2026-03-29 at v0.14.0 with 6 CLI commands
  wired. Stale README triggered a false "JRig isn't ready" red-team
  finding in the downstream IS plan. Updated with merge dates per epic
  and a CLI-surface section.
- **Umami custom events + data-domains spam guard** (#692) — Wires
  marketplace events through Umami analytics; adds the data-domains
  guard to the analytics config so spam events don't pollute the
  legitimate signal.
- **Homepage npm-marquee total downloads relabel** (#691) — "30d" →
  "total downloads" reflects what the badge actually shows.
- **npm-stats fetch throttling** (#689) — Restores live total on the
  marquee; throttles fetch to dodge registry rate limits.
- **Homepage 30d total drop** (#688) — Dropped the "last 30d" segment
  from the npm marquee.
- **Header navigation cleanup** (#686) — Removed the ⌘ icon box from
  the header per design review.

### Security

- No new vulnerabilities introduced. Validator's Tier 2 tool-safety
  check now flags unscoped `Bash` + `Write`/`WebFetch` declarations
  without a Safety Justification section as ERROR at marketplace tier
  — surfaces the curl-pipe-shell exploit surface for review on every
  validation run.

### Plan reference

This release is the materialization of the "Use the Printing Press to
Learn" plan into shipped code. Full session breakdown in the email
record `<2282a9fe-14e1-d228-ded3-fd85c18aa1f7@intentsolutions.io>` and
in the AAR at `000-docs/032-RL-REPT-claude-code-plugins-release-v4.31.0.md`
(generated alongside this release).

## [4.30.0] - 2026-05-04

Two-day sprint following v4.29.0 — landed the same-session "ship workaround
→ file tracking issue → ship the real fix" loop several times in public, plus
the **guidewire-pack v2.0.0 rebuild** (24 skills → 10 production-engineer
skills), a new marketplace plugin (`engineer-design-diagram`), enforcement
of the lessons learned during v4.29.0 (pre-commit hook, sync-marketplace
orchestrator, pre-push warning), and post-release Freshie + compliance work
that surfaced + partially remediated 115 D+F skills.

### Added

- **`engineer-design-diagram` marketplace plugin** (#665) — Ports the global
  skill at `~/.claude/skills/engineer-design-diagram/` (live since 2026-04-19)
  into `plugins/devops/engineer-design-diagram/` so any Claude Code user can
  install it. Generates production-grade architecture/sequence/delta/drift
  diagrams as self-contained dark-themed HTML with inline SVG, grounded in
  real repo topology via DCI. Four modes (`/design:generate`, `/design:diff`,
  `/design:trace`, `/design:watch`). v0.2.0, A-grade (96/100). Closes
  `claude-2rb6.2` and `claude-2rb6.10`.
- **`guidewire-pack v2.0.0`** (#668-#678) — 11-PR coordinated rebuild of the
  Guidewire InsuranceSuite skill pack. **24 skills → 10 production-engineer
  skills**, each addressing real production failure modes. Highlights:
  - Rebuilt to A-grade: `install-auth`, `sdk-patterns`, `local-dev-loop`,
    `core-workflow-a` (PolicyCenter), `core-workflow-b` (ClaimCenter)
  - New unified skills (merging multiple v1 skills):
    `security-and-rbac` (basics + enterprise-rbac),
    `observability-and-incident-response` (3-skill merge),
    `ci-cd-pipeline` (4-skill merge: ci-integration + deploy-integration
    - multi-env-setup + prod-checklist),
      `migration-and-upgrade` (2-skill merge),
      `webhooks-integrations` (rename + deepen of webhooks-events)
  - Cuts (deferred or removed with rationale): `data-handling`,
    `reference-architecture`, `performance-tuning`, `cost-tuning`
  - Pack-level: `package.json` 1.0.x → 2.0.0, README rewritten to 10-skill
    production-problem framing
- **`contributing-clanker` v0.1.x community plugin** — New scaffold under
  `plugins/community/`, three patch releases (v0.1.0, v0.1.1, v0.1.2) over
  the two days for runtime correctness fixes synced to the marketplace.
- **Repo-wide automation** (#667) — `pnpm run sync-marketplace` is now an
  orchestrator that chains `sync-marketplace.cjs` + `generate-plugin-package-jsons.mjs`
  - `generate-readme-toc.mjs`. New pre-commit hook auto-runs the chain when
    `marketplace.extended.json` is staged and auto-stages derived files. New
    pre-push hook warns when the local branch is behind `origin/main`. The
    legacy single-step JSON-strip is preserved as `pnpm run sync-marketplace:json-only`.
- **2026-05-03 case study** (`marketplace/src/content/blog-posts/`) —
  Tier-3 case study post on the v4.29.0 release ceremony + the same-session
  loop closure pattern.

### Fixed

- **README ↔ Prettier ↔ generator 3-authority conflict** (#658) — Closes
  issue #657 in the same session it was opened. Both
  `scripts/generate-readme-toc.mjs` and `scripts/render-spotlight.mjs` now
  pipe their spliced output through `prettier.format()` (with
  `prettier.resolveConfig()` for project settings) before writing/comparing.
  Removes the README.md exclusion from `.prettierignore`. All three gates
  (`prettier --check`, generator `--check` modes) pass simultaneously, in any
  order. Workaround → real-fix loop closed in ~2 hours.
- **D+F skill remediation, partial** (#661) — Schema 3.3.1's stricter rubric
  surfaced 115 D+F skills (regression from the post-v4.24.0 "Zero D/F"
  baseline). Added `tags` + `compatibility` frontmatter to **102 skills**
  missing both fields (94 in `plugins/ai-agency/tonone/`, 8 across
  saas-packs). Result: 115 → 89 D+F (-26 grade improvements). Remaining 89
  are score 67-69 (1-3 points below C threshold) blocked by missing
  `references/`, `examples/`, `scripts/` subdirectories — a SaaS pack
  scaffolding template defect tracked in #660.
- **Post-v4.29.0 quality sweep** (#656) — Cleared pre-existing ESLint errors
  (`scripts/bulk-bump-versions.mjs:277` control-char regex,
  `scripts/check-official-links.mjs:138` unnecessary-escape) that the new
  root config from #629 surfaced for the first time. Plus a repo-wide
  Prettier `--write` sweep (40 files, all cosmetic — `*em*` → `_em_`,
  blank-line normalization). Plus `jeremy-adk-software-engineer` description
  no longer claims "placeholder - to be implemented" (the skill ships real
  content). Plus `repository`/`homepage`/`bugs` added to root `package.json`
  for npm provenance metadata.

### Changed

- **Freshie discovery run 6** (#659) — First inventory refresh since
  2026-04-06 (run 5). Captures the post-v4.29.0 ecosystem state on commit
  `531631f9d`: 17 packs / 423 plugins / 3,000 skills / 7,800 files.
  Compliance grade distribution: A 25.6% / B 42.9% / C 28.9% / D 2.5% / F
  0.0%. Average score 84.1/100. SQLite DB grew 53 MB → 63 MB (over GitHub's
  50 MB recommended limit; LFS plan tracked in #660). Surfaced three real
  issues hidden by the staleness — D+F regression, three-different-skill-counts
  inconsistency, and DB size — all with acceptance criteria documented in
  #660.
- **`CLAUDE.md`** updated:
  - "Two Catalog System" section explains the new sync-marketplace as
    orchestrator (the three chained steps + when to use the json-only variant)
  - "Auto-Generated Data Files" table now lists `plugins/**/package.json`
    and the README TOC block as chained from sync-marketplace
  - New "Git Hooks" section documents pre-commit + pre-push behavior +
    bypass instructions

### Tracking

- Issue #657 (closed by #658) — README.md generator/Prettier 3-authority conflict
- Issue #660 (open) — Post-Freshie-run-6 follow-ups (D+F regression second
  half, 250 orphan skills + 19 duplicate slugs catalog hygiene, Freshie LFS
  plan, Freshie compliance-snapshot design quirk)

### Stats

- 22 commits, 314 files changed, +16,124 / −10,545 lines
- 11-PR coordinated guidewire-pack v2.0.0 rebuild
- 8 PRs total merged this cycle (5 chore/fix + 3 features) plus the 11
  guidewire PRs = 19 PRs landed since v4.29.0

## [4.29.0] - 2026-05-02

This release bundles a major validator overhaul (schema 3.3.1), a fleet-wide
`compatible-with` → `compatibility` migration across ~3,200 skills, the testing
infrastructure rollout (husky, lint-staged, commitlint, audit-harness, a11y,
RTM/PERSONAS/JOURNEYS), the npm publish pipeline that broke the v1.0.0 freeze,
the Umami analytics tracker, two new external plugin sources (Skyvern,
ali5ter/claude-workflow-skills), and a long tail of CI hardening + sync-workflow
fixes. The validator section below is the original 4.29.0 entry from 2026-04-28
(the version was documented but never tagged); everything in subsequent sections
landed between 2026-04-28 and 2026-05-02 and is included in this release.

---

### Added (post-2026-04-28)

- **Release automation pipeline** (#647) — Broke the v1.0.0 plugin-freeze by adding three workflows: `auto-bump-on-pr.yml` (per-PR patch bumps for changed plugins), `publish-changed-packages.yml` (per-merge `npm publish --provenance` + per-package git tags + GitHub Releases), and a one-shot `publish-all-packages.yml` recovery workflow. Per-package tag convention is `@scope/name@version`. Full operator flow lives in `RELEASING.md`.
- **Umami analytics tracker** (#651) — Wired into `BaseLayout.astro` via env-driven script tag (`UMAMI_WEBSITE_ID` + `UMAMI_SCRIPT_URL`). Fail-soft: missing env = no tracker, no console error. Closes the empty-data gap that the `/analytics` skill kept hitting.
- **Testing infrastructure rollout** (#621, #629, #631) — Three-PR sequence installing the canonical Intent Solutions testing stack:
  - `@intentsolutions/audit-harness` as a dev dependency, `tests/TESTING.md` policy doc, coverage thresholds, hash-pinning manifest (#621)
  - Husky + lint-staged + commitlint + root ESLint/Prettier on every commit/PR (#629)
  - Marketplace a11y suite, RTM/PERSONAS/JOURNEYS files, CLI performance budget (#631)
- **External plugin sources** — Two new third-party repos added to the daily sync:
  - Skyvern (browser-automation MCP) — `productivity/skyvern` (#547, #650)
  - `ali5ter/claude-workflow-skills` (#649)
- **Killer Skill of the Week tooling** (#648) — Promoted Skyvern. Added `scripts/promote-spotlight.mjs` (atomic rotation: previous spotlight → top of hallOfFame) + `scripts/render-spotlight.mjs` (generates the README KILLER-SKILL block from `marketplace/src/data/spotlights.json`). CI enforces drift between `spotlights.json` and the README block.
- **Blog content** — Two case-study posts to `tonsofskills.com/blog`: `vps-as-the-home-day-1` (Contabo VPS migration program kickoff) and `propagation-day` (the harness/skills version-lock pattern). Plus 6 backfilled engineering posts covering 2026-04-23 → 2026-04-29 (#632).
- **ADRs declining audit-tests roadmap recommendations** (#619) — Four architectural decision records explaining why specific audit-tests roadmap items are not adopted in this repo.

### Fixed (post-2026-04-28)

- **Hero marquees** (#653) — Vertical spacing tightened and partner/npm-stats scroll speeds normalized so neither marquee runs in a visible "wait then jump" pattern.
- **`update-npm-stats` accuracy + Slack channel hygiene** (#646) — Drift fixes for `marketplace/src/data/npm-stats.json` (rate-limit was undercounting on retries), and the daily Slack download digest now posts to the correct channel only.
- **Orphaned plugins exposed** — `jeremy-google-adk` and `jeremy-vertex-ai` were on disk but absent from the catalog (#634, closes #597). Plus `plugins/**/skills/` orphan paths cleaned up + stragglers migrated to `compatibility` (#644, closes #630).
- **`x-bug-triage` SKILL.md compliance** (#633) — Five files brought to marketplace tier (frontmatter + body fixes).
- **Sync-external workflow stabilized** — Six-PR sequence working through cascading failures in the daily external-source sync workflow:
  - Replaced `peter-evans/create-pull-request` with hand-rolled `gh pr create` (#642) — eliminated the GHA-bot signature mismatch that was breaking branch protection
  - Disabled husky in the auto-PR step (#639) — pre-commit hook was rejecting bot commits
  - Switched to `--no-frozen-lockfile` for post-sync installs (#638) — synced packages can introduce dep changes
  - Graceful handling of empty files, submodules, and partial-failure scenarios (#637)
  - Workspace-aware install instead of bare `pnpm add` (#636)
  - Removed the duplicate pnpm version pin (#635) — was conflicting with the root `packageManager` field
- **Freshie anomaly detector + populator drift** (#618) — Run-versioning now correctly stamps `run_id` and normalizes paths. `x-bug-triage` template hardened.

### Changed (post-2026-04-28)

- **`compatible-with` → `compatibility` fleet migration** (#620, #622–#628) — The schema 3.3.1 migration from the original 4.29.0 work was applied across the entire skill catalog in eight batches: `ai-ml` category (34 skills, #620), 18 other categories (300 skills, #622), saas-packs 1/6 through 6/6 (~2,500 skills total, #623–#628). Total: ~2,850 skills now use the AgentSkills.io free-text `compatibility` field. The IS-invented closed-CSV `compatible-with` field is fully deprecated repo-wide; it still parses with a deprecation warning for any external sync that drags in legacy frontmatter.
- **Doc-filing standard v4.3** (#640) — Pulled the latest standard from `~/.claude/skills/doc-filing` and fixed a `.gitignore` re-include bug that was hiding `000-docs/*.md` files from `git status` after standard-driven renames.
- **CI: trust Gemini workspace + install bun for mcp-plugins tests** (#617) — Gemini PR Reviewer's GCP workspace is now in the trusted list; the mcp-plugins matrix job installs `bun` so the deno-style test entry-points actually run.

---

### Validator: spec-compliance fixes + `compatible-with` → `compatibility` migration

This release lands on **schema 3.3.1** of the validator after a one-day churn that
went through schema versions 3.0 → 3.1 → 3.2 before stabilizing. The full
back-and-forth is preserved in [`000-docs/SCHEMA_CHANGELOG.md`](000-docs/SCHEMA_CHANGELOG.md)
including a "Non-negotiables" section and a "How we got here — the 2026-04-28
schema debacle" post-mortem so the same dance doesn't get repeated.

The IS enterprise standard (8 required fields at marketplace tier — `name`,
`description`, `allowed-tools`, `version`, `author`, `license`, `compatibility`,
`tags`) is **unchanged**. Earlier intra-day attempts to relax this to Anthropic's
2-field spec floor were reverted.

### Changed

- **`compatible-with` → `compatibility`** — the IS-invented closed-CSV platform list (`compatible-with: claude-code, codex, openclaw`) is replaced by the AgentSkills.io free-text `compatibility` field (max 500 chars per spec). Old field still parses as a deprecated alias with a per-file migration suggestion. New ALWAYS_REQUIRED set substitutes `compatibility` for `compatible-with`. This is the only structural change to ALWAYS_REQUIRED in this release.
- **Validator script v6.0 → v7.0** — spec-source citations updated, deprecation messaging cleaned up.

### Fixed (spec-compliance bugs)

- **`allowed-tools` accepts YAML list** per `code.claude.com/docs/en/skills` ("Accepts a space-separated string or a YAML list"). Old validator rejected YAML lists with _"must be a comma-separated string (CSV)"_.
- **`allowed-tools` parses space-separated form** per Anthropic's canonical example `Bash(git add *) Bash(git commit *) Bash(git status *)`. Old parser only split on commas. New parser is paren-depth-aware so multi-word tools stay as one token.
- **`when_to_use` reclassified as documented Anthropic optional** — earlier IS rubrics flagged it as deprecated, but Anthropic documents it explicitly. Validator now only warns when combined `description` + `when_to_use` exceeds the 1,536-char listing cap.
- **`agent` field no longer triggers "missing" warning when defaulting** — Anthropic doc states _"If omitted, uses general-purpose"_. Old validator warned that `agent` was missing whenever `context: fork` was set.
- **`argument-hint` conditional** — was incorrectly suppressed by `disable-model-invocation: true`, but the user can still invoke via `/`, so the hint is still relevant. Now tied to `user-invocable=true` only.

### Added

- **`scripts/batch-remediate.py`** — bulk-fix script for spec migrations. `--migrate-compatible-with` flag translates `compatible-with: claude-code, codex` → `compatibility: Designed for Claude Code, also compatible with Codex` per AgentSkills.io spec. Idempotent — safe to run twice.
- **`arguments`, `paths`, `shell` added to schema registry** — all documented Anthropic optional fields that were missing from `SKILL_FIELDS`. Type-validated.
- **`effort: xhigh`** added to valid values per Anthropic doc (`low/medium/high/xhigh/max`).
- **`${CLAUDE_EFFORT}`** added to `YAML_VALUE_ALLOWED_VARS` substitution allow-list.
- **`Skill()` permission rule documentation** in `references/frontmatter-spec.md` (`Skill(name)` exact match, `Skill(name *)` prefix match, `Skill` deny-all).
- **`000-docs/SCHEMA_CHANGELOG.md`** — new doc tracking validator schema versions independently from this main CHANGELOG. Includes the "Non-negotiables" rules and the "2026-04-28 schema debacle" post-mortem.

### Important: what was NOT changed (and won't be without explicit approval)

Per the new "Non-negotiables" section in `SCHEMA_CHANGELOG.md`:

- `ALWAYS_REQUIRED` is the IS enterprise 8-field set. Not reducible to Anthropic's 2-field spec floor without explicit user approval.
- Marketplace tier produces ERRORS for missing required fields, not warnings.
- The IS rubric SITS ON TOP of Anthropic's spec — additive, never subtractive.
- Tracking metadata (`version`, `author`, `license`) is REQUIRED at marketplace tier, not optional polish.

### Migration

Skills using the deprecated `compatible-with` field continue to validate (with a deprecation warning). Bulk-migrate via:

```bash
python3 scripts/batch-remediate.py --migrate-compatible-with --root <path>
```

Migration translation table:

```diff
 ---
 name: my-skill
 description: Does the thing. Use when ...
-compatible-with: claude-code, codex, openclaw
+compatibility: Designed for Claude Code, also compatible with Codex and OpenClaw
 ---
```

The 3,385 public-repo `SKILL.md` files under `plugins/` are **not** migrated in this release. Bulk migration tracked in #610.

### Tracking issue

[#610](https://github.com/jeremylongshore/claude-code-plugins-plus-skills/issues/610) — `[spec] Realign skill validator + master spec to Anthropic's authoritative sources`. Note: the issue title still says "Realign" — the actual outcome was "fix bugs and add tooling without realigning." See `000-docs/SCHEMA_CHANGELOG.md` for the corrected story.

## [4.28.0] - 2026-04-23

### Added

- **Gemini PR Review revival** (#602) — Fixed a 4-month silent-fail regression. Workflow was running green on every PR but posting zero review comments because of a broken MCP bridge pattern. Full fix:
  - Switched trigger from `pull_request` → `pull_request_target` so fork-PRs actually get CI + Gemini feedback (previously fork PRs received zero feedback of any kind)
  - SHA-pinned checkout of PR HEAD with `persist-credentials: false` for safe fork-PR handling
  - Extended `.gemini/commands/gemini-review.toml` with an "Intent Solutions Philosophy" section so Gemini frames failures in the context of the marketplace's enterprise-grade bar
  - Updated the prompt to lead with validator failures and link CONTRIBUTING.md anchors rather than re-explaining rules inline
  - Added Slack notification step on every review completion (pings `#operation-hired`)
- **Plane sync workflow** (#529) — New GitHub Actions workflow syncing CCP issues to `projects.intentsolutions.io` Plane project. Fires on `issues: opened` (creates matching Plane issue in Backlog) and `pull_request: closed` (parses close refs, flips Plane issues to Done)
- **CONTRIBUTING.md "Before You Submit" section** (#602) — Top-of-file philosophy framing that sets expectations upfront about the Intent Solutions "ship the full-capability version" standard
- **CODEOWNERS** (#602) — Jeremy as sole owner on every path, with emphasis paths (`.github/`, `.gemini/`, validator scripts, catalog files, dependency manifests). Combined with branch protection "require code owner reviews", external contributions cannot merge without his approval
- **Blog backfill** — 4 posts cross-posted from `startaitools.com` (Apr 19-22 window)
- **External audit response (NLPM, xiaolai)** — Expanded validator and CI coverage in response to the NLPM audit (issue #540).
  - `scripts/validate-skills-schema.py` now scans `.claude/agents/` and `workspace/**/agents/` in addition to `plugins/`, and flags shell-substitution patterns (`$(...)`, backticks, unguarded `${VAR}`) in YAML frontmatter values
  - `.github/workflows/validate-plugins.yml` PR trigger paths extended to `scripts/**`, `.claude/**`, and `workspace/**`
  - Credit to [xiaolai](https://github.com/xiaolai), author of [NLPM](https://github.com/xiaolai/nlpm-for-claude), for the audit and fix PRs (#535-#539)

### Changed

- **PR template callout** (#602) — Top-of-file disclosure pointing first-time contributors at the CONTRIBUTING.md philosophy section
- **`maintainer-ready-automerge.yml` triple-guarded** (#602) — Fires only on `labeled` event (not synchronize/reopened/ready_for_review), only when the label is exactly `maintainer-ready`, AND only when the sender is `jeremylongshore`
- **Marketplace playbooks layout** (#601) — Wrapped in `BaseLayout`; retired `/spotlight` page
- **`ccpi validate --strict` step** (#603, #604) — Temporarily degraded from `|| exit 1` to `|| true` in `validate-plugins.yml` to unblock CI while 177-agent pre-existing frontmatter debt is worked off over a multi-PR campaign. Reversal tracked in #604; hard gate returns once debt is cleared

### Fixed

- **Frontmatter cleanup campaign — Phase 1** (#604, #605) — 5 pre-existing errors: 4 shipwright command categories (`ai-agency` → `deployment`) and 1 over-length `backup-strategy` description (158 → 80 chars). 182 → 177 `ccpi validate --strict` errors
- **Frontmatter cleanup campaign — Phase 2A batch 1** (#604, #606) — 12 files in `fullstack-starter-pack` (6 top-level + 6 byte-identical nested mirrors) brought to production-grade frontmatter. 177 → 170
- **Frontmatter cleanup campaign — Phase 2A batch 2** (#604, #607) — 11 agents in `testing/code-cleanup` backfilled with capabilities + model + expertise_level. 170 → 159
- **Skills `allowed-tools` errors** (#603) — 3 pre-existing errors: `freshie-inventory-manager` used unknown `Agent` tool (→ `Task`); `sentry-pack` and `supabase-pack` had malformed wildcards missing colons (`Bash(python*)` → `Bash(python:*)`, `Bash(npx supabase *)` → `Bash(npx supabase:*)`)
- **Freshie compliance populator** (#593) — Stamps `run_id` and normalizes paths for correct run-versioning
- **Agent frontmatter quoting** (#579) — `phase_*.md` descriptions now properly quoted to avoid YAML mapping errors
- **`quick-test.sh`** (#538) — Replaced silent global `pnpm install` with a clear prerequisite error
- **Schema-optimization phase agents** (#536) — Added missing YAML frontmatter
- **fairdb-setup-backup webhook guard** (#539) — `curl` now guarded by env-var presence check
- **`backup-strategy.md`** (#537) — Replaced shell-substitution expressions in frontmatter
- **skill-auditor agent** (#535) — Added missing YAML frontmatter
- **Plane sync jq injection** (#529) — `$SEQ` now passed as jq `--arg` variable instead of shell-interpolated (defensive security fix per Gemini review)
- **Cloud Functions Slack webhook logging** — Webhook failures now surface in logs instead of silently swallowing

### Security

- **Secret scanning hardened** — Replaced the previous regex-based secret scan in `validate-plugins.yml` with a dedicated workflow (`secret-scan.yml`) that runs `gitleaks` on every PR and push, plus a weekly `trufflehog` verified-credentials scan with Slack alerting. `.gitleaks.toml` adds rules for Anthropic, Groq, and Firebase/GCP credential shapes on top of the upstream defaults
- **Gemini reviewer WIF binding narrowed** (#602) — Service account IAM binding tightened from `attribute.repository_owner/jeremylongshore` (org-wide) to `attribute.repository/jeremylongshore/claude-code-plugins-plus-skills` (this repo only). Fully standalone GCP isolation across every layer
- **Branch protection hardened** (#602) — `require_code_owner_reviews: true`, `dismiss_stale_reviews: true`, 1 approval required. Combined with CODEOWNERS, no PR merges without Jeremy's approval

### Known issues

- **171 pre-existing agent frontmatter errors** tracked in #604 as a multi-PR cleanup campaign. `ccpi validate --strict` is currently reporting-only (`|| true`) until the campaign completes; strict enforcement returns when the final campaign PR restores `|| exit 1`

## [4.27.0] - 2026-04-21

### Added

- **LangChain Python Skill Pack v1.0** - Complete 33-skill pack for LangChain/LangGraph Python development:
  - Core skills (8): model-inference, embeddings-search, sdk-patterns, reference-architecture, multi-env-setup, debug-bundle, deep-agents, langgraph-basics
  - LangGraph advanced (10): agents, checkpointing, human-in-loop, streaming, subgraphs, middleware-patterns, content-blocks, otel-observability
  - Production patterns (8): performance-tuning, cost-tuning, rate-limits, security-basics, enterprise-rbac
  - DevOps (7): ci-integration, deploy-integration, observability, incident-runbook, local-dev-loop, webhooks-events, upgrade-migration
  - Support skills: common-errors, core-workflow, data-handling, prompt-engineering, eval-harness
  - Average enterprise score: 92.4/100 (A-grade)
  - Reference architecture with pain-catalog documenting 25+ real-world failure modes

### Fixed

- **Gemini PR Review workflow** - Added `workflow_dispatch` trigger for manual review runs on any PR (#546+)
- **npm Publish** - Fixed repository.url for npm provenance compliance (#545)
- **npm Publish** - Fixed SIGPIPE abort in mass-publish enumerate step (#544)

### Changed

- **VERSION file sync** - Corrected VERSION file to match package.json (4.25.0 → 4.26.0)

### Metrics

- Commits since v4.26.0: 4 (1 feature, 3 fixes)
- New skills added: 33 (langchain-py-pack)
- Total skills: 2,882 (+33)
- Enterprise score maintained: 92.4/100 average for new pack

---

## [4.26.0] - 2026-04-20

### Added

- **npm Download Tracking Infrastructure** - Daily stats aggregation (`fetch-npm-stats.mjs`), hero marquee showing top 8 packages with 30-day counts, Slack digest at 1pm Central via #operation-hired webhook (#543)
- **npm Publish Workflows** - Mass publish (`publish-all-packages.yml` with confirmation gate) and incremental publish (`publish-changed-packages.yml` on push to main) for all @intentsolutionsio/\* packages (#542)
- **Plugin Package.json Scaffolding** - Generated package.json for 305+ catalog plugins under @intentsolutionsio scope, enabling npm download tracking (#541)
- **README Awesome-List TOC** - Auto-generated table of contents with category counts, enforced by CI via `generate-readme-toc.mjs --check` (#531)
- **agent37.com Partner Integration** - Added to hero partner marquee alongside Nixtla (#532, #533)
- **Ultimate Code Cleanup Plugin** - 11-dimension, 11-agent comprehensive code analysis tool scoring 98/100 A+ enterprise grade
- **Bubble Invest Plugins** - local-tts (voice synthesis), boycott-filter (ethical filtering) from community PR #520
- **Killer Skill of the Week** - web-analytics skill with Umami MCP integration

### Fixed

- **Marquee Symmetry** - Restored translateX(-50%) pattern duplication so agent37 actually renders in seamless loop (#533)
- **Catalog Validation** - Removed phantom entries (tonone, claudebase), normalized 33 plugin author fields to object format
- **SKILL.md Compliance** - Split 13 files exceeding 500-line limit into references/, removed XML tags from frontmatter
- **Cowork Downloads** - Replaced non-existent stripe-pack with clerk-pack
- **CodeQL Finding** - Removed unused tableHeaderDone variable

### Changed

- **Micro-Category Consolidation** - Merged analytics→business-tools, code-quality→testing, finance→business-tools, automation→devops with CLI aliases for backwards compatibility (#530)
- **FS=Catalog Invariant** - Enforced filesystem path matching catalog category via `validate-catalog-invariants.py`
- **SaaS Pack Display** - Individual cards on /cowork page for better discoverability
- **Comprehensive Codebase Cleanup** - 8-parallel-agent refactor addressing code quality across repository

### Metrics

- Commits since v4.25.0: 34 (10 features, 8 fixes, 3 chore)
- Plugins with npm tracking: 305+ (newly scaffolded package.json files)
- Categories consolidated: 4 (analytics, code-quality, finance, automation)
- SaaS packs corrected: 106 → 105 (removed windsurf duplicate)

---

## [4.25.0] - 2026-04-14

### Added

- **Shopify Skill Pack v2.0** - Complete overhaul: 30 → 38 skills, 116 reference files extracted. Added 8 new skills (metafields-metaobjects, functions, storefront-headless, checkout-extensions, theme-performance, graphql-cost-optimizer, b2b-wholesale, ai-toolkit-wrapper). Enterprise score: 81.9 → 93.1/100.
- **Deep Evaluation Engine v1.0** - Intent Solutions 10-dimension skill quality assessment with coaching system and professional tier.
- **CLI Power Skills** - External plugin sync for enhanced CLI automation workflows.
- **CCHub plugin** - Desktop control panel for Claude Code / Codex / Gemini CLI management.
- **Work Diary blog** - Added Apr 6-13 posts to tonsofskills.com/blog.

### Changed

- **Shopify sdk-patterns rewrite** - Removed generic Zod/retry patterns, added codegen-typed operations, bulk operation helpers, and webhook registry.
- **Marketplace data sync** - Updated plugin counts to 430 plugins, 2,838 skills.

### Metrics

- Commits since v4.24.0: 10 (6 features, 2 chores, 2 merges)
- Shopify skills upgraded: 30 → 38 (+8 new)
- Reference files created: 116
- Lines added: +9,950 / -4,893

---

## [4.24.0] - 2026-04-06

### Added

- **SaaS pack skill upgrades** - Upgraded 232 D/F-grade skills to 70+ compliance (C+ or better). Expanded from ~30 lines to 90-150 lines each with Overview, Instructions, Error Handling tables, and product-specific TypeScript examples. Affected packs: appfolio, apple-notes, coreweave, fathom, glean, linktree, lucidchart, mindtickle, openevidence, together.
- **Legal & Compliance collection** - Added to homepage and /collections page with curated legal toolkit plugins.
- **General Legal Assistant plugin** - 12-skill, 5-agent legal toolkit (plugin #417) with contract analysis, compliance checking, and document drafting capabilities.
- **Agent Creator skill** - Added agent-creator skill and agent template to skill-creator plugin.
- **Work Diary blog** - Added Apr 3-5 posts to tonsofskills.com/blog.

### Changed

- **Legal plugin rename** - Renamed legal-assistant → general-legal-assistant for clarity.
- **Freshie inventory cleanup** - Removed 530 stale DB rows (500 legacy skills/, 30 ghost paths). Accurate skill count now 2,834.

### Fixed

- **CI deploy trigger** - Added pnpm-lock.yaml to deploy-firebase workflow trigger paths.
- **Lockfile sync** - Added x-bug-triage to pnpm-lock.yaml, unblocking Firebase deploys.
- **Homepage sponsor** - Restored scrolling marquee for sponsor section under byline.

### Metrics

- Commits since v4.23.0: 11 (5 features, 4 fixes, 1 refactor, 1 chore)
- Skills upgraded: 232 (D/F → C+)
- SaaS packs improved: 10
- Lines added: +21,464 / -5,440

---

## [4.23.0] - 2026-04-04

### Added

- **Skill-creator Anthropic alignment** - Updated to 2026 AgentSkills.io spec and Anthropic best practices
- **Work Diary blog** - Added intentcad-viewer-dwg-fastview-parity post to tonsofskills.com/blog

### Changed

- **Homepage partner banner** - Moved strategic partners section above fold, replaced Agent37 with Nixtla sponsor
- **CLAUDE.md accuracy** - Updated plugin/skill counts to 416/2,574, fixed build pipeline (6 steps), added verify CI job, corrected test file listing

### Fixed

- **YAML frontmatter repairs** - Fixed 1,252 SKILL.md files across the plugin ecosystem:
  - 9 Wondelai skills: double-escaped quotes (`''` → `'`) in block scalars
  - 3 Grammarly pack skills: duplicate frontmatter keys dropping `Bash(curl:*)` access
  - 1,219 skills: removed blank lines before closing `---` delimiters
- **README sponsor badge** - Added Nixtla sponsor badge, updated counts

---

## [4.22.0] - 2026-03-27

### Added

- **Hooks `if` conditional upgrade** - 4 plugins upgraded to use Claude Code v2.1.85 native `if` field for in-process tool filtering, eliminating unnecessary subprocess spawns. (#496)
  - `jeremy-github-actions-gcp` - Replace non-standard `filePattern` with native `if` glob
  - `claude-reflect` - Add `if: "Bash(git commit*)"` to PostToolUse
  - `pm-ai-partner` - Add `if: "Bash(git commit*)|Bash(git push*)"` to PreToolUse
  - `formatter` - Add `if` matching 15 file extensions for Write|Edit
- **x-bug-triage plugin** - External plugin sync with auto-dispatch workflow for all external repos. (#493)
- **OneNote pack rewrite** - All 18 skills rewritten from stubs (61.7) to production quality (91.4/100). (#489)
- **Work Diary blog** - /blog with 100 posts backfilled from startaitools.com, plus March 24-25 daily posts.

### Changed

- **Navigation** - Renamed Blog to Work Diary, replaced Pro nav link with Work Diary link.

### Fixed

- **Hooks schema normalization** - 2 plugins fixed to standard event-keyed format:
  - `prettier-markdown-hook` - Convert non-standard root-level array to standard schema
  - `travel-assistant` - Convert content-based matchers to standard `matcher: ".*"` (scripts handle detection)
- **x-bug-triage catalog** - Convert author field from string to object format.
- **/pro page** - Deactivated with 301 redirect to homepage.

### Metrics

- Commits since v4.21.0: 16 (7 features, 5 fixes, 2 chore)
- Hook plugins upgraded: 6 (4 with `if` conditionals, 2 schema normalizations)
- OneNote skills rewritten: 18
- Contributors: Jeremy Longshore, intentsolutions.io

---

## [4.21.0] - 2026-03-23

### Added

- **oraclecloud-pack rewrite** - All 26 OCI skills rewritten from stubs (61.3) to production quality (92.8/100). Pain-point-driven content covering auth config, capacity errors, IAM policies, SDK memory leaks, Terraform bugs. (#488)
- **navan-pack rewrite** - All 25 Navan skills rewritten to 93.0/100 with Airbyte connector research, real API patterns. (#485, #486, #487)
- **claude-pack hand-written** - Claude API skills at 95.3/100 with real SDK code. (#482)
- **Killer Skill nomination form** - Firebase form for community skill nominations. (#483)
- **105 SaaS packs total** - Notion, Supabase, Sentry packs fully built out (30 skills each). (#391-#480)
- **Universal validator v5.0** - Anthropic schema alignment, 100-point rubric, `--populate-db` for freshie inventory. (#378)
- **Pro tier + benchmarks** - CLI performance benchmark suite, Pro tier landing page. (#381)
- **63 SaaS pack directories** - Generated from marketplace extended metadata. (#380)
- **Infrastructure compliance** - Tags + compatible-with mass migration to 1,412 skills. (#379)
- **Severity1 marketplace plugin** - Severity levels and prompt-improver. (#382)
- **Slack channel plugin** - Added to ecosystem. (#375)

### Changed

- **Performance budget** - Bumped to 40MB gzipped, 1MB largest file, 2800-4000 routes for 414 plugins + 63 SaaS packs.
- **Freshie inventory system** - SQLite CMDB with 50 tables, versioned discovery runs, batch remediation.
- **Gold standard docs** - PRD/ARD/references pattern established for 13 Jeremy plugins.

### Fixed

- **Firebase forms** - Broken killer skill signup fixed. (#374)
- **CI validation** - Python + pyyaml setup for validation-scripts job.
- **Enterprise compliance** - 0 D/F grades after remediation rounds. (#384, #385)
- **Bare except clauses** - Replaced with `except Exception`. (#387)

### Metrics

- Commits since v4.20.0: 124 features, 25 fixes
- Files changed: 5,161 (+large delta)
- SaaS packs: 105 total (42 newly populated)
- Skills: 2,788+ across 414 plugins
- Contributors: Jeremy Longshore, intentsolutions.io

---

## [4.20.0] - 2026-03-20

### Added

- **pr-to-spec MCP plugin** - Convert PRs and local diffs into structured, agent-consumable specs with intent drift detection. 6 MCP tools for agentic coding workflows.
- **claude-memory-kit plugin** - Persistent agent memory system (#370, @seankim-android)
- **prism-scanner plugin** - Added to ecosystem section (#369, @aidongise-cell)
- **Content consistency validator improvements** - Enhanced skill structure validation with skill-review CI (#347, @fernandezbaptiste)

### Changed

- **8 SaaS packs rewritten with production content** - 150+ skills upgraded:
  - MaintainX pack (24 skills) - CMMS API integration
  - Evernote pack (24 skills) - Note management workflows
  - Apollo pack (22 skills) - Sales engagement APIs
  - Clerk pack (22 skills) - Auth/user management
  - Speak pack (9 skills) - Language learning APIs
  - Obsidian pack (10 skills) - Vault plugin development
  - Lokalise pack (23 skills) - Localization workflows
  - Juicebox pack (18 skills) - Community platform APIs
- **Agent spec updated for v2.1.78** - New `effort`, `maxTurns`, `disallowedTools` fields; corrected agent vs skill tool patterns
- **Performance budget** - Bumped to 19.5MB for 346+ plugins

### Fixed

- **Homepage badges** - Removed redundant badges above Killer Skill and Jeremy's Stash headings
- **Skill-review CI** - Removed insecure workflow dispatch, restored Overview + Examples sections
- **HTML attribute sanitization** - Complete quote escaping in discover-skills.mjs
- **Repository URL consistency** - Fixed pr-to-spec → pr-to-prompt mapping
- **Validation script** - Fixed duplicate tuple entry, added anchor skip

### Metrics

- Commits since v4.19.0: 13
- Files changed: 432 (+56,454 lines)
- Contributors: Jeremy Longshore, fernandezbaptiste, aidongise-cell, seankim-android, intentsolutions.io

---

## [4.19.0] - 2026-03-17

### Added

- **box-cloud-filesystem plugin** - Box cloud storage integration with file operations (#368)
- **geepers plugin** - Added to catalog (#367)
- **lumera-agent-memory plugin** - MCP server for persistent agent memory (#367)

### Fixed

- **Content quality audit sweep** - Comprehensive remediation of stub files and boilerplate:
  - Final 3 audit findings resolved (2 stubs + 1 false positive) (#365)
  - Wondelai implementation.md stubs filled with methodology guides (#363)
  - Remaining reference stubs for lokalise, documenso, speak (#364)
  - SaaS packs prose expanded to meet body-substance threshold (#362)
  - 12 misc reference stubs across community/crypto/productivity (#361)
  - 22 devops/saas reference stubs filled (#360)
  - 13 API development reference stubs with real examples (#359)
  - OpenRouter pack: 30 skills replaced boilerplate with unique content (#358)
  - 7 AI/ML reference stubs with real code examples (#357)
  - 24 performance skills: replaced generic boilerplate openings (#356)
  - 21 AI/ML skills: replaced generic boilerplate openings (#355)
  - 4 empty shell skill-enhancers built out with real content (#354)
  - 13 security/packages skills: replaced generic boilerplate (#353)
  - Audit content quality false positives addressed (#352)

### Metrics

- Commits since v4.18.0: 46
- Files changed: 376 (+37,973 / -2,436 lines)
- Contributors: Jeremy Longshore, intentsolutions.io, Ahmed Khaled Mohamed

---

## [4.18.0] - 2026-03-16

### Added

- **navigating-github plugin** - Interactive GitHub setup and learning companion with 6 modes (setup, learn, save, share, understand, fix), adaptive skill assessment, and 9 progressive hands-on lessons
- **mgonto EA skills** - 5 executive assistant skills: action-items-todoist, email-drafting, executive-digest, meeting-prep, todoist-due-drafts
- **Enhanced plugin & skill detail pages** - README section extraction, markdown-to-HTML rendering, FAQ accordions, and improved CTAs
- **Killer Skills spotlight** - Featured hero section on homepage with email signup
- **/github-learn slash command** - User-invocable entry point for navigating-github plugin

### Changed

- **Full facelift Phase 2** - Terminal-Bold redesign across all pages with OKLCH color system
- **Contributor cards redesigned** - Cross-page consistency with new card layout
- **Performance budget bumped** - 16MB for 343+ plugins

### Fixed

- **Mobile UX on /explore** - Card overlap, 480px breakpoint, filter bar improvements
- **Firebase deploy** - Split targets to avoid serviceusage permission error
- **run_eval.py** - Fixed 0% recall for already-installed plugin skills

### Metrics

- Commits since v4.17.0: 27
- Files changed: 41 (+7,331 / -1,665 lines)
- Contributors: Jeremy Longshore, intentsolutions.io

---

## [4.17.0] - 2026-03-11

### Added

- **Intent Solutions skill standard** - Updated all 5 tutorial notebooks to current standard
- **Verified Plugins Program** - Badges, rubric, and /verification page (#326)
- **Blog with changelog posts** - Astro content collections at /blog (#324)
- **Compare Marketplaces page** - SEO landing page at /compare (#323)
- **Light/dark theme toggle** - Across entire marketplace (#329)
- **Doctor --fix flag** - Safe auto-remediation for ccpi doctor (#333)
- **Cross-platform skill headers** - compatible-with field, YAML parser fix (#332)
- **Automated weekly metrics** - GitHub Actions workflow (#330)
- **Wondelai skills pack** - 25 agent skills for business, design & marketing (#303)
- **CONTRIBUTING.md** - Contributor guide with SEO meta tags (#320)

### Fixed

- **4300+ validator warnings reduced to 258** - 94% reduction (#337)
- **130 stub SKILL.md files replaced** - Substantive domain-specific content (#335)
- **Skill counts corrected** - Add windsurf pack, fix cowork claims (#334)
- **Gemini model ID updated** - gemini-2.0-flash-exp → gemini-2.5-flash (#316)
- **Wondelai skills frontmatter** - Added required fields to all 25 skills (#317)
- **SECURITY.md added** - Security policy (#315)

### Changed

- **Validator compliance** - Community page, PDA skill quality upgrade (#336)
- **Playbooks converted** - 11 playbooks to Astro content collections (#325)
- **18 jeremy-owned plugins** - Version bump 1.0.0 → 2.0.0 (#331)
- **Performance budgets** - Bumped for 340+ plugins and dark mode CSS

### Metrics

- Commits since v4.16.0: 33
- Files changed: 2,956 (+272,838 / -215,356 lines)
- Contributors: intentsolutions.io, Jeremy Longshore, Michal Jaskolski, Eugene Aseev

---

## [4.16.0] - 2026-03-07

### Added

- **Domain migration to tonsofskills.com** - Primary domain with Firebase hosting and 301 redirects
- **Homepage dark theme redesign** - Braves Booth-inspired dark theme with modern UI
- **Production E2E tests** - Playwright tests for tonsofskills.com deployment validation
- **Research page** - `/research` with 6 data-driven analysis documents
- **Trading strategy backtester fixes** - 8 quality gaps fixed (#314):
  - Stop-loss and take-profit enforcement
  - Short position support for RSI, MACD, Bollinger, MeanReversion strategies
  - Settings.yaml loading with CLI override support
  - Full test suite with 31 pytest tests

### Fixed

- **Axiom submodule issue** - Converted broken submodule to regular directory, fixing CI on forks
- Mobile horizontal overflow on `/explore` page
- Badge text size and cowork plugin overflow on mobile
- Hidden nav links handling in Playwright tests
- Skills link to cowork page, updated skills page title

### Changed

- CI cron schedules disabled to reduce Actions minutes usage
- Workflow dispatch trigger added to Validate Plugins workflow
- Cowork zip integrity check now works without unzip (Node.js fallback)
- Production E2E job now independent of marketplace-validation

### Reverted

- Chainstack and deAPI plugins temporarily reverted pending review

### Metrics

- Commits since v4.15.0: 50
- Files changed: 183 (+25,792 / -1,584 lines)
- Contributors: Jeremy Longshore, intentsolutions.io, clowreed, Eugene Aseev

---

## [4.15.0] - 2026-02-13

### Added

- Products & Services section on homepage with Agent37 partner integration
- Penetration testing plugin v2.0.0 with 3 real Python security scanners (~4,500 lines):
  - `security_scanner.py` - HTTP headers, SSL/TLS, endpoint probing, CORS analysis
  - `dependency_auditor.py` - npm audit & pip-audit wrapper with unified reporting
  - `code_security_scanner.py` - bandit + 16 regex patterns for static analysis
- Security reference documentation: OWASP Top 10, Security Headers, Remediation Playbook

### Fixed

- Windows Defender false positive in penetration-tester plugin (#300) - removed literal PHP payloads
- Sponsor page pricing tiers replaced with email-for-details contact form
- stored-procedure-generator test functions renamed to avoid pytest collection conflicts
- Homepage product listing prices updated to $10
- Explore page style preservation when filtering search results

### Changed

- Copyrights updated to 2026 across all documentation
- Opus model ID now allowed in skills schema validation
- Schema references synced to 2026 spec

### Metrics

- Commits since v4.14.0: 8
- Files changed: 50+
- New Python code: ~4,500 lines (security scanners)
- New reference docs: 3 (~1,100 lines)

---

## [4.14.0] - 2026-01-31

### Added

- 17 additional SaaS skill packs (408 skills), completing the 42-pack SaaS collection:
  - **apollo-pack**: Sales engagement, sequences, analytics, CRM integration
  - **clerk-pack**: User authentication, session management, organization features
  - **coderabbit-pack**: AI code review, PR automation, code quality analysis
  - **customerio-pack**: Email marketing, customer messaging, campaigns, segments
  - **deepgram-pack**: Speech-to-text, audio transcription, real-time ASR
  - **fireflies-pack**: Meeting transcription, note-taking, conversation intelligence
  - **gamma-pack**: AI presentations, document generation, visual content
  - **granola-pack**: Meeting notes, AI summaries, productivity automation
  - **groq-pack**: LPU inference, ultra-fast AI, Groq Cloud deployment
  - **ideogram-pack**: AI image generation, text rendering, creative design
  - **instantly-pack**: Cold email, outreach automation, lead generation
  - **juicebox-pack**: People search, lead enrichment, contact data
  - **langchain-pack**: LLM orchestration, chains, agents, RAG patterns
  - **linear-pack**: Issue tracking, project management, engineering workflows
  - **lindy-pack**: AI assistants, workflow automation, business processes
  - **posthog-pack**: Product analytics, feature flags, session replay
  - **vastai-pack**: GPU marketplace, cloud compute, ML infrastructure

### Changed

- Updated all skill counts in README.md (739 → 1,537 total skills)
- SaaS pack summary: 42 packs with 1,086 skills total
- Standalone skills: 1,298 (was 500)

### Metrics

- New SaaS skill packs: 17 (408 skills)
- Total SaaS packs: 42 (1,086 skills)
- Total skills: 1,537 (previously 1,027)
- 13 packs with 30 skills, 29 packs with 24 skills

---

## [4.13.0] - 2026-01-26

### Added

- 12 complete SaaS skill packs with real, production-ready content (288 skills total):
  - **databricks-pack**: Delta Lake, MLflow, notebooks, clusters, data engineering workflows
  - **mistral-pack**: Mistral AI inference, embeddings, fine-tuning, production deployment
  - **langfuse-pack**: LLM observability, tracing, prompt management, evaluation metrics
  - **obsidian-pack**: Vault management, plugins, sync, templates, personal knowledge management
  - **documenso-pack**: Document signing, templates, e-signature workflows, compliance
  - **evernote-pack**: Note management, notebooks, tags, search, productivity workflows
  - **guidewire-pack**: InsuranceSuite, PolicyCenter, ClaimCenter, insurance platform integration
  - **lokalise-pack**: Translation management system, localization, i18n automation
  - **maintainx-pack**: Work orders, preventive maintenance, CMMS workflows, asset tracking
  - **openevidence-pack**: Medical AI, clinical decision support, healthcare evidence platform
  - **speak-pack**: AI language learning, speech recognition, pronunciation training, education tech
  - **twinmind-pack**: AI meeting assistant, transcription, summaries, productivity automation
- Each pack follows standard template: S01-S12 (Standard), P13-P18 (Pro), F19-F24 (Flagship)
- All skills include 2026 schema frontmatter with proper tool permissions
- Brand strategy framework plugin integration (#292)

### Changed

- Updated all 2025 schema/spec references to 2026 across documentation
- Improved contributor ordering convention (newest first)
- Marketplace catalog extended with 12 new SaaS packs

### Metrics

- New SaaS skill packs: 12 (288 skills)
- Total skills: 1,027 (previously 739)
- Commits since v4.12.0: 15
- Contributors: Jeremy Longshore (10), Rowan Brooks (4)
- Files changed: 301
- Days since last release: 14

## [4.12.0] - 2026-01-12

### Added

- 5 crypto trading plugins to public repository
- Validator content quality validation checks (#299)

### Fixed

- creating-kubernetes-deployments skill quality (#298)
- automating-database-backups skill quality (#297)
- generating-stored-procedures skill quality (#296)
- All 3 skills improved based on Richard Hightower's quality feedback

### Changed

- Added Richard Hightower as contributor
- Banner text and mobile spacing improvements

## [4.11.0] - 2026-01-18

### Added

- 8 new crypto plugin skills with full PRD/ARD documentation and Python implementations:
  - **Blockchain & On-Chain**: blockchain-explorer-cli, on-chain-analytics, mempool-analyzer, whale-alert-monitor, gas-fee-optimizer
  - **NFT & Tokens**: nft-rarity-analyzer, token-launch-tracker
  - **Infrastructure**: cross-chain-bridge-monitor, wallet-security-auditor
- Firebase Hosting deployment workflow for claudecodeplugins.io
- Firebase Analytics integration with measurement ID tracking
- Google Secret Manager integration for secure Firebase config

### Fixed

- Gemini code review feedback for all new crypto skills:
  - Timezone-naive datetime operations (now UTC)
  - Empty except clauses with explanatory comments
  - Unused import cleanup
  - Config loading from settings.yaml
  - Mock data fallback with explicit --demo flag

### Infrastructure

- GitHub Actions workflow for Firebase Hosting deployment
- Workload Identity Federation for keyless GCP authentication
- All crypto skills follow nixtla enterprise PRD/ARD standard

### Metrics

- New crypto skills: 8 (completing Batch 5 & 6)
- Commits since v4.10.0: 29
- PRs merged: 10
- Total files changed: 221
- Lines changed: +23,839 / -19,891

## [4.10.0] - 2026-01-15

### Added

- 13 new crypto plugin skills with full PRD/ARD documentation and Python implementations:
  - **Market Data & Pricing**: market-price-tracker, market-movers-scanner, crypto-news-aggregator, market-sentiment-analyzer
  - **Portfolio & Tax**: crypto-portfolio-tracker, crypto-tax-calculator
  - **DeFi**: defi-yield-optimizer, liquidity-pool-analyzer, staking-rewards-optimizer, dex-aggregator-router, flash-loan-simulator
  - **Trading & Derivatives**: arbitrage-opportunity-finder, crypto-derivatives-tracker
- Firebase Hosting integration for marketplace website
- Firebase Analytics for download tracking

### Changed

- Updated skill validator compliance for backtester and signal generator skills
- Unified theme colors across all marketplace pages (CSS consolidation)
- Updated .gitignore for firebase cache and skill data files

### Infrastructure

- All crypto skills follow nixtla enterprise PRD/ARD standard
- Each skill includes: SKILL.md, PRD.md, ARD.md, Python scripts, references, config
- Skills use DeFiLlama, CoinGecko, CryptoCompare APIs (free tiers)

### Metrics

- New crypto skills: 13 (with full documentation)
- Commits since v4.9.0: 50
- PRs merged: 8 (crypto skill branches)
- Total files changed: ~200
- Lines added: ~25,000

## [4.9.0] - 2026-01-08

### Added

- 10 new SaaS vendor skill packs (Batch 3): Apollo, Deepgram, Juicebox, Customer.io, LangChain, Lindy, Granola, Gamma, Clerk, Linear
- 240 new skills across Batch 3 vendors (24 skills per pack)
- npm packages for all 30 SaaS packs with download tracking
- Learn pages for all Batch 3 vendors on claudecodeplugins.io

### Changed

- Updated marketplace.extended.json with 10 new pack entries
- Updated vendor-packs.json with Batch 3 vendor metadata
- Updated TRACKER.csv with Batch 3 completion status

### Infrastructure

- All 30 SaaS packs now published to npm (@intentsolutionsio/{vendor}-pack)
- Consistent naming across marketplace and npm registries
- Website deployed with 642 pages including all vendor learn pages

### Metrics

- Total SaaS skill packs: 30 (720 skills)
- Batch 3 packs: 10 (240 skills)
- npm packages published: 30
- Files changed: 305
- Lines added: +72,405

## [4.8.0] - 2026-01-06

### Added

- Marketplace redirects for deleted learning pages
- 14 new vendor skill packs with website pages

### Changed

- Updated learn hub with all vendor icons
- Synced marketplace catalogs

## [4.7.0] - 2026-01-06

### Added

- Progressive Disclosure Architecture (PDA) pattern for all skills
- Intent Solutions 100-point grading system integrated into validator
- 348 reference files for detailed skill content extraction
- `scripts/refactor-skills-pda.py` automation script for skill restructuring

### Changed

- Refactored 98 skills to PDA pattern (SKILL.md files now <150 lines)
- Merged `validate-frontmatter.py` into unified `validate-skills-schema.py` (v3.0)
- Improved average skill score from 88.0/100 (B) to 92.5/100 (A)
- All 957 skills now 100% production ready

### Fixed

- Excel skills quality issues (GitHub Issues #250, #251, #252, #253)
- OpenRouter pack skills grading (8 skills improved from 80 to 95+ points)
- All C/D grade skills elevated to A/B grade
- Kling AI common-errors skill malformed code fences

### Metrics

- Skills validated: 957
- A grade: 897 (93.7%)
- B grade: 60 (6.3%)
- C/D/F grade: 0 (0%)
- Files changed: 2,173
- Lines added: +77,698
- Lines removed: -70,011

## [4.6.0] - 2026-01-05

### Added

- Batch 2 vendor skill databases (217 files)
- Skill databases for 6 published SaaS packs
- Kling AI flagship+ skill pack (30 skills)

### Fixed

- OpenRouter pack skill quality improvements

## [4.5.0] - 2026-01-04

### Added

- External plugin sync infrastructure
- ZCF integration
- 50-vendor SaaS skill packs initiative

### Changed

- Skill quality improvements to 99.9% compliance
