# SkillFoundry v5.13.0 — Pipeline Quality

**Released:** 2026-05-13

---

## What's in This Release

v5.13.0 is a quality-of-process release. No single headline feature — eleven targeted enhancements that close gaps across the full pipeline, from PRD entry through knowledge harvest. Every layer gets something.

---

## New Skills

### `/prd-lint` — PRD Structural Validator

Validates `genesis/*.md` files before `/go` or `/forge` runs on them. 12 checks covering front matter completeness, required section presence, TBD/TODO markers, vague language, GuardLoop DoD items, and user story FR-IDs columns.

```
/prd-lint                     Lint all PRDs in genesis/
/prd-lint <file>              Lint a specific PRD file
/prd-lint --strict <file>     Fail on warnings too (CI mode)
/prd-lint --fix <file>        Auto-fix common issues as stubs
```

`/go` now runs `/prd-lint` as **Phase 1.5** — PRDs with errors are blocked from implementation. PRDs with warnings proceed with a prompt.

### `/parity` — Cross-Platform Skill Parity Detector

Compares `.claude/commands/` (reference) against Copilot, Cursor, Codex, and Gemini platform directories. Reports missing skills and H1 title drift per platform.

```
/parity                    Full parity report
/parity --missing          Missing skills only
/parity --drift            Title divergence only
/parity --skill <name>     Single skill across all platforms
/parity --json             Machine-readable output
```

---

## Pipeline Improvements

### PRD Dependency Ordering (`/go` Phase 2.5)

`/go` now computes execution waves from `dependencies.requires` front matter before implementation begins. Independent PRDs run in parallel within a wave; dependent PRDs wait for their prerequisites. Cycle detection halts with a clear error and the affected PRD IDs.

**`scripts/prd-wave-plan.sh`** — standalone tool for computing and visualising the wave plan outside of `/go`.

```
./scripts/prd-wave-plan.sh genesis/         Human-readable wave plan
./scripts/prd-wave-plan.sh --json genesis/  JSON for pipeline use
```

### GuardLoop × `done/` Gate

`move-story.sh` now refuses story promotion to `done/` when any CRITICAL GuardLoop pattern has been detected in the current session. Hardcoded secrets, localStorage tokens, and file-corruption artifacts must be resolved before a story can close.

Exit code 6 with actionable message. Override with `--no-guardloop-gate` when GuardLoop state is unavailable.

### Semgrep SAST in Anvil T4

`scripts/anvil.sh` gains a `sast` subcommand and Anvil T4 now runs it as Phase 4:

```
./scripts/anvil.sh sast <file-or-dir>
```

Runs `semgrep --config p/owasp-top-ten --config p/secrets`. HIGH findings block (`ERRORS++`); MEDIUM findings warn (`WARNINGS++`); absent semgrep skips gracefully with a WARN (non-blocking).

---

## MCP Server Improvements

### Streamable HTTP Transport (`/mcp/http`)

The MCP server now exposes `/mcp/http` (GET/POST/DELETE) alongside the existing `/mcp/sse` endpoint. Uses the `StreamableHTTPServerTransport` from the MCP SDK (spec: 2025-03-26). 

**Connecting via Streamable HTTP:**
1. POST to `/mcp/http` (no `mcp-session-id` header) — server responds with `mcp-session-id` header
2. Include that header on all subsequent requests to the same endpoint

### Skill Hot-Reload

The MCP server watches skill directories (`SKILL_DIRS`) and reloads `.md` files on save with a 400ms debounce. Changes take effect instantly — no server restart needed when editing or adding skills during development.

### Token Budget Forecasting

`getSessionTokenReport()` now returns a `forecast` field (after ≥2 minutes of session data):

| Field | Description |
|-------|-------------|
| `tokensPerMinute` | Current burn rate |
| `projectedAt60min` | Extrapolated total at 60 minutes |
| `projectedAt120min` | Extrapolated total at 120 minutes |
| `minutesUntilWarning` | Time until 200K threshold |
| `minutesUntilCritical` | Time until 500K threshold |
| `budgetHealthPct` | % of 500K budget remaining |

### Model Tier Declarations

Skills can declare a minimum required model in their YAML front matter:

```yaml
---
min_model: opus
---
```

The MCP server appends `[min-model: opus]` to the tool description in `ListTools`, and prepends a model advisory to the skill content when the active tier (set via `SKILLFOUNDRY_MODEL_TIER` env var) is below the declared minimum.

`forge`, `go`, and `architect` are tagged `min_model: opus`.

### Secret Scan in Knowledge Harvester

`harvester.ts` now redacts 7 credential patterns before inserting content into the SQLite knowledge store. Patterns include AWS access keys, JWTs, Bearer tokens, API/password/secret assignments, and private key headers. Redacted as `[REDACTED-BY-HARVESTER]` with a console warning. `HarvestResult.secretsRedacted` tracks the count per harvest run.

---

## `update.sh` — Checkpoint & Rollback

Three new subcommands for safe framework updates:

```bash
# Snapshot current state before a major update
./update.sh --checkpoint . before-v6

# List all available snapshots
./update.sh --checkpoints .

# Restore from a specific snapshot
./update.sh --rollback . 20260513_120000_before-v6

# Restore from the most recent snapshot
./update.sh --rollback .
```

Each checkpoint saves a `MANIFEST.json` mapping backup filenames to original project paths. Rollback reads the manifest for precise restoration and automatically creates a `pre-rollback` safety checkpoint before overwriting anything.

---

## Breaking Changes

None. All changes are backwards-compatible.

---

## Upgrade Notes

- No migration steps required.
- If you use `move-story.sh` in CI and have GuardLoop state files present, a CRITICAL pattern hit will now block `→ done` transitions. Add `--no-guardloop-gate` to CI calls if needed until GuardLoop state is properly managed.
- To use `min_model` enforcement in the MCP server, set `SKILLFOUNDRY_MODEL_TIER=haiku|sonnet|opus` in your environment.
- `sf_cli/package-lock.json` updated — run `npm ci` in `sf_cli/` after pulling.

---

## Files Changed

| File | Change |
|------|--------|
| `scripts/prd-lint.sh` | **NEW** — PRD structural linter |
| `scripts/prd-wave-plan.sh` | **NEW** — Wave plan calculator |
| `scripts/parity-check.sh` | **NEW** — Platform parity detector |
| `scripts/anvil.sh` | `sast` subcommand + Phase 4 integration |
| `scripts/move-story.sh` | GuardLoop gate on `done/` promotion |
| `update.sh` | `--checkpoint`, `--checkpoints`, `--rollback` |
| `.claude/commands/prd-lint.md` | **NEW** — `/prd-lint` skill |
| `.claude/commands/parity.md` | **NEW** — `/parity` skill |
| `.claude/commands/go.md` | Phase 1.5 lint gate + Phase 2.5 dependency ordering |
| `.claude/commands/anvil.md` | T1/T4 SAST docs updated |
| `.claude/commands/forge.md` | Added `min_model: opus` |
| `.claude/commands/go.md` | Added `min_model: opus` |
| `.claude/commands/architect.md` | Added `min_model: opus` |
| `mcp-server/src/server.ts` | Hot-reload watcher + Streamable HTTP |
| `mcp-server/src/skills/loader.ts` | `reloadSkill()` + `minModel` field |
| `mcp-server/src/mcp/handler.ts` | Model tier advisory |
| `mcp-server/src/mcp/token-tracker.ts` | `TokenForecast` + `forecast` field |
| `mcp-server/src/knowledge/harvester.ts` | Secret scan + `secretsRedacted` |
| `genesis/TEMPLATE.md` | 10 structural improvements |

---

## Version

```
5.12.0 → 5.13.0 (MINOR — new features, backwards compatible)
```
