# Changelog

## v1.12.1 - 2026-06-14

Patch release for hook-surface honesty and `post-turn-safety` precision after the 1.12.0 Stop-hook changes.

- **Plan checkbox guard removed from shipped hooks** - `plan-checkbox-guard` no longer installs, registers, appears in `hooks list`, or contributes dashboard/audit state. `hooks sync` and setup prune stale guard registrations, stale central/per-agent scripts, `hooks.plan-checkbox-guard`, the `plan-guard` config block, and the old `plan-guard-state` ignore entry while leaving `post-turn-safety` as the only shipped Stop hook. Historical ADR/changelog entries remain as release history; no replacement reminder hook ships in this patch.
- **Removed hook cleanup also runs on direct toggles** - `goat-flow hooks enable|disable <hook>` and dashboard single-hook toggles now prune stale removed-hook tombstones before applying the requested hook state, matching `hooks sync`. Upgrading from 1.12.0 no longer leaves old `plan-checkbox-guard` launcher entries or config blocks behind when an operator only toggles `post-turn-safety`.
- **Generic credential-assignment scanning now requires env/config context and literal secrets** - `scan_env_assignment` no longer treats source-code expressions such as `tokens = re.findall(...)`, `token_count = len(items)`, `next_token = page["next_token"]`, `access_token = get_token()`, `tokenizer = build_tokenizer(cfg)`, `password_field = form["password"]`, or uppercase/Pascal-case config references such as `SETTINGS.API_TOKEN1` and `Config.DEFAULT_PASSWORD1` as hardcoded credentials. The generic assignment heuristic now runs only for env/config-shaped files such as `.env*`, shell scripts, YAML, TOML, INI, properties, and Dockerfiles; inside those files it classifies credential-shaped keys by key segments and suffix exclusions, then blocks only quoted string literals or bare credential-shaped tokens with enough entropy. Camel/Pascal-case config keys such as `clientSecret`, `authToken`, and `refreshToken` normalize to the same segment rules without restoring broad substring matching. Dockerfiles cover both equals and space-separated `ARG`/`ENV` forms, including multi-assignment `ENV SAFE=x API_TOKEN=...` instructions. Plural secret/password keys such as `CLIENT_SECRETS` and `DB_PASSWORDS` are scanned in those config surfaces, while interpolated double-quoted expressions such as `API_KEY="${PREFIX}..."` are not treated as literal hardcoded secrets. Provider-specific token detectors, private-key detection, and merge-conflict scanning are unchanged and still run everywhere.
- **Local data pipes into inline interpreters are allowed without reopening download-to-execute bypasses** - `deny-dangerous` now permits simple local data producers (`cat`, `printf`, `echo`) piped into visible inline interpreter code such as `node -e` or `python3 -c`, so read-only JSON/text inspection does not trip the "pipe to interpreter" rule. Raw interpreter execution (`cat script.py | python3`), direct network producers (`curl ... | python3 -c ...`), and filtered downloader pipelines such as `curl ... | cat | python3 -c ...` remain blocked, with clearer remediation copy.
- **Preflight test runs have an internal timeout** - `scripts/preflight-checks.sh` wraps the test/coverage command in a process-group timeout (`GOAT_FLOW_PREFLIGHT_TEST_TIMEOUT_SECONDS`, default 600; `0` disables), flushes captured output before reporting the child exit status, and reports a timed-out test phase instead of depending on an outer harness kill when a suite hangs. Retry runs use the same timeout.
- **Upgrade cleanup and generated indexes are more exact** - The standalone installer compacts removed `plan-guard` config blocks correctly in CRLF files, config block removal ignores unsafe internal keys instead of building a dynamic regex from them, and generated decision indexes can display a dedicated `**Superseded:**` date without overwriting an ADR's original acceptance date.
- **Orientation docs match live dashboard and audit behaviour** - Architecture/code-map route inventories now include `dashboard-index-routes.ts`, and frontend coding standards now state that `audit --harness` failures contribute to the overall audit status and exit code.

## v1.12.0 - 2026-06-13

Verification-score, universal post-turn safety, Codex Workspace preflight reliability, jq compatibility, and skill-handoff polish release.

- **Default post-turn hook is universal safety, not project validation** - `post-turn-safety` now installs by default for Claude Stop events and scans tracked diffs, staged diffs, and untracked non-ignored files for obvious secrets, private keys, credential assignments, and merge conflict markers without requiring project toolchain setup. Gitignored local state is skipped unless it is force-staged. Codex and Antigravity are excluded because their Stop-hook delivery is unverified (Codex registered Stop hooks did not fire under codex exec 0.139.0; Antigravity hook trust gates execution and no Stop payload was captured firing).
- **Plan checkbox guard added as workflow hygiene** - `plan-checkbox-guard` installs beside `post-turn-safety` and blocks only when repo changes move while the active plan still has open checkboxes and the plan file stayed unchanged; it writes ignored local state under `.goat-flow/logs/plan-guard-state.json`, appears as workflow/planning support in the hooks page, and does not count as safety or validation evidence. It registers for Claude only: the Stop-payload spike verified Claude's `session_id`/`transcript_path`/`cwd`/`stop_hook_active` fields, while Codex Stop delivery never fired headlessly (codex exec 0.139.0) and Antigravity's payload could not be captured behind its hook-trust gate, so both are skipped with an explicit reason until verified.
- **Project-validation Stop hook removed** - goat-flow no longer ships `post-turn-validate` or `toolchain.post-turn-fast`; project-specific build, test, lint, typecheck, and format commands stay explicit verification gates instead of automatic default hook behaviour.
- **Copilot is no longer capped for a hook event it cannot host** - Agents with `supportsPostTurnHook=false` are skipped for `post-turn-hook-integrity`, while supported agents still lose Verification points for missing, masked, or no-validation hooks.
- **`goat-flow audit --untrusted-target` skips executing the target's hook code** - The deny-mechanism runtime smoke runs the audited checkout's own configured launcher and managed hook script, which is unsafe for a checkout you don't trust. The new `--untrusted-target` flag downgrades that to static deny checks only; the default audit is unchanged.
- **Codex Workspace terminals can run preflight** - Dashboard-launched Codex sessions now start with `--sandbox danger-full-access`, so `scripts/preflight-checks.sh` can run nested Node/git/npm subprocesses and npm registry checks instead of failing with sandbox `EPERM` and DNS errors.
- **`gruff-code-quality` supports stock distro jq 1.6** - Payload-range extraction no longer binds a jq keyword as a variable, and CI now runs the hook self-test against a pinned jq 1.6 binary so Ubuntu 22.04 and Debian 12 installs stay covered.
- **`goat` dispatcher routes ambiguous requests more concretely** - The dispatcher now records `target-files=unknown` when no files are named and gives Route Snapshot examples for explicit skill calls, symptoms, auth reviews, and ordered multi-intent requests.
- **`goat-plan` handoffs are more executable** - The planning skill now includes concrete Path-Only Intake and File-Write examples with expected plan artifacts, `.active` one-line pointer behavior, no-write outcomes, and stakeholder-facing `ISSUE.md` guidance instead of placeholders.
- **`goat-debug` is clearer at the first fork** - The debugging skill now gives deterministic Quick vs Full depth criteria, requires D1.5 minimisation before any quick-path D2 root-cause claim unless the reproduction is already minimal, and includes a portable worked D1-to-D2 example.
- **`goat-critique` examples and fresh-eyes rules are more concrete** - The skill now documents Agent C as a fresh-eyes control group with schema-compatible lens fields but no per-lens quota, keeps `## Outcomes` out of the initial Phase 5 gate response until the human chooses A/B/C/D, and replaces synthetic rubric examples with real goat-flow evidence plus a Phase 2 context-leak walkthrough.
- **`goat-security` report calibration is clearer** - The skill now includes a concrete confirmed-finding example, a false-positive removal example, and sharper guidance that `project-policy-template.md` is loaded only when creating or revising `.goat-flow/security-policy.md`, not during normal security reviews. The source template and all installed mirrors stay aligned.
- **`goat-review` reports review integrity more explicitly** - The skill now gives systemic patterns a dedicated output slot, mirrors automated-review and cross-model refuter summaries in Review Integrity, carries the matching degradation flags, and includes concrete refutation and finding-format examples across all installed mirrors.
- **`goat-qa` gives testers a concrete gap-analysis handoff** - The skill now includes a worked Standard Mode example, spells out Regression Guard handoff steps, and says Audit Mode creates no plan file unless separately approved.
- **Upgrade note** - Existing projects should rerun `goat-flow setup` or `goat-flow hooks sync` to install the default safety hook, remove stale validation-hook residue, and refresh agent hook registrations.

## v1.11.0 - 2026-06-11

Harness hardening release: hook guardrails now run from the active checkout, gruff diagnostics are less brittle in monorepos, learning-loop memory is indexed and visible, and skill/playbook authoring has stronger routing checks before stale guidance ships.

- **Hook guardrails resolve the active checkout** - Launchers run hooks from the current repo root; gruff startup failures skip rather than deny; version-stamped dispatchers flag partial upgrades.
- **`deny-dangerous` blocks pipeline and `xargs` bypasses** - Catches destructive payloads like `find ... | xargs rm -rf` or piped `git commit`; safe pipelines stay allowed.
- **Gruff hook diagnostics are safer in monorepos** - Scoped to edited paths, not blanket git changes; honours ignored files and reports timeout/config errors.
- **Learning-loop indexes are generated, checked, and visible** - `goat-flow index` regenerates `INDEX.md` files, `stats --check` flags stale ones, dashboard shows freshness.
- **goat-* Step 0 retrieval is observable** - Functional skills must emit `Relevant prior learnings:` (or `none found`), exposing skipped retrieval.
- **Skill/playbook authoring routes harder cases correctly** - `quality candidacy` and `skill new` now distinguish skills, playbooks, instruction rules, and learning-loop entries.
- **Reference/playbook quality gates are tighter** - Word-budget enforcement covers top-level playbooks, preflight warns near caps, and stale `skill-playbooks/` paths fail content checks.
- **PR review follow-ups** - Gruff hook timeout raised to 90s, `doc-paths-resolve` fails on missing `architecture.md`, and dashboard staleness/timer guards added.
- **Breaking changes** - None. Re-run `goat-flow setup` or `hooks sync` for hooks, and `goat-flow index` after editing learning-loop entries.

## v1.10.1 - 2026-06-09

Patch: upgrades now prune the stale Claude `MultiEdit` deny rules 1.10.0 left in existing projects, land dormant `gruff.hook.v1` analyzer-contract groundwork, back out the premature Reviews dashboard stub (deferred to 1.20.0), and make an internal docs pass.

- **Stale `MultiEdit` deny rules pruned on upgrade, not just on fresh installs** - 1.10.0 cleaned `MultiEdit(...)` only on fresh/`--force` installs, so upgrades kept warning `matches no known tool` on every launch. `goat-flow setup`/`install` now strips retired-tool deny rules while preserving valid and user-added ones - 13 stale to 0, `Read`/`Edit`/`Write` secret-path coverage intact, with a `setup-install.test.ts` regression.
- **`gruff-code-quality` hook gains `gruff.hook.v1` contract support (dormant until analyzers ship it)** - When an analyzer advertises the `gruff.hook.v1` capability, the PostToolUse hook renders its `hook`-subcommand envelope directly, so the analyzer - not Bash - owns scoping, metadata, and remediation. Pre-contract analyzers keep the unchanged `analyse` path, so it stays dormant until an analyzer ships the contract, then `goat-flow hooks sync`/`setup` enables it. Detection is timeout-guarded and shape-validated; bash before 4.4 now fails soft with `requires bash 4.4+`.

## v1.10.0 - 2026-06-07

Directory migration release: goat-flow now installs a coherent `.goat-flow/` layout with plans, learning-loop memory, central hooks, and grouped skill docs. Also includes `deny-dangerous` false-positive fixes and clears stale Claude Code `MultiEdit` permission rules that warned on every launch.

- **`.goat-flow/` folder layout migrated in one upgrade path** - Fresh installs now use `.goat-flow/plans/` instead of `.goat-flow/tasks/`, `.goat-flow/learning-loop/{decisions,footguns,lessons,patterns}/` instead of top-level learning-loop buckets, `.goat-flow/hooks/` instead of `hook-lib/` plus fat per-agent hook copies, and `.goat-flow/skill-docs/` for shared skill doctrine and playbooks. Upgrade migration preserves `.goat-flow/plans/.active`, existing local milestone subdirs, custom config path overrides, user-authored learning-loop entries, and same-named collision files by leaving old entries in place rather than overwriting new content. Dashboard plan APIs, the deprecated `/api/tasks` alias, `goat-plan` routing, setup templates, audit guidance, and hook sync now point at the new layout.

- **Command substitution with control operators no longer over-blocks** - A read-only `$(...)` containing `&&`, `||`, `;`, or a newline (e.g. `v=$(grep -m1 version "$f" 2>/dev/null || echo MISSING)` inside a `for` loop) was wrongly denied with `Policy destructive: Complex command substitution`. The command-segment splitter tracked quotes but not parenthesis depth, so an operator inside an unquoted substitution split `$( ... )` across two segments and left an orphan `$(` that the residual catch-all blocked. The splitter is now command/process-substitution aware (`$(`, `<(`, `>(` open a no-split region); operators inside a substitution are still policy-checked by recursing into the interior, and plain `( ... )` subshells stay splittable so `(cmd && rm -rf /)` cannot bypass the guard. Dangerous substitutions (`$(... | bash)`, backtick substitution, `$(true || rm -rf /)`, `$(git push ...)`) still block - and now report the accurate reason (e.g. `rm -r without safe scoping`) instead of the generic substitution message. The chained-segment cap is enforced at nested substitution depths too. (Deeply nested but benign substitutions such as `echo $(dirname $(dirname $(dirname $(pwd))))` are allowed - each interior segment is still policy-checked, so depth itself is not blocked.)
- **Arithmetic expansion is no longer mistaken for command substitution** - `echo $((1 + 2))`, `n=$((COUNT + 1))`, `$(( (1 + 2) * 3 ))`, and nested forms like `$(( $(( 1 )) ))` were denied with the same `Complex command substitution` message because the scanner only recognised `$( )`. Arithmetic `$(( ))` is now masked before the catch-all; a command substitution nested inside arithmetic is still stripped and policy-checked first, so `$(( $(rm -rf /) ))` still blocks.
- **Reading `.env.example` with a redirect is no longer treated as a write** - `ls -la .env.example 2>&1` and `cat .env.example 2>/dev/null` were denied as `.env.example ... read-only inspection only`, because any redirect on a command touching `.env.example` was classified as a write. Only a redirect whose target is `.env.example` itself now counts as a write; a stderr dup, a stderr discard, or a redirect to another file stays a read. Writes to `.env.example` still block - bare, clobber, append, and path-prefixed targets alike (`echo X > .env.example`, `printf x >.env.example`, `... >> .env.example`, `> ./.env.example`, `> sub/.env.example`) - as does all real secret-file access (`.env`, SSH/AWS/GCP keys, credentials). A broad `*.env*` glob was never blocked on its own.
- **Self-test corpus closed the gap** - The central `deny-dangerous` self-test now exercises every false-positive class above plus its dangerous counterpart on both sides; smoke and full modes stay green. New `.goat-flow/learning-loop/footguns/deny-dangerous.md` (a dedicated footgun bucket split out of the oversized `hooks.md`) and `.goat-flow/learning-loop/lessons/hook-testing.md` entries record the splitter parenthesis-depth trap and the `.env.example` redirect-classification trap. The change lands through the central `.goat-flow/hooks/deny-dangerous.sh` dispatcher and `.goat-flow/hooks/deny-dangerous/` policy modules, with workflow templates kept in sync. Existing projects pick up the fix by re-running `goat-flow setup` or `goat-flow hooks sync`.
- **Stale `MultiEdit` permission rules removed (Claude Code v2.x)** - Claude Code removed the `MultiEdit` tool, so the shipped `.claude/settings.json` printed `Permission deny rule "MultiEdit(**/.env*)" matches no known tool` warnings on every launch. The 13 redundant `MultiEdit(...)` secret-path deny rules are dropped from the Claude template and installed settings - every path keeps its `Read`/`Edit`/`Write` deny, so secret-path coverage is unchanged - and the dead `MultiEdit` gruff PostToolUse matcher is removed from `src/cli/server/hooks-registry.ts`, `.claude/settings.json`, and `.codex/hooks.json` (now `Edit`/`Write`). `workflow/hooks/README.md` and the gruff hook self-test fixture updated to match. Existing projects pick this up via `goat-flow hooks sync`.
- **Home setup CTA launches the generated setup prompt** - The Home "Fix with <runner>" setup action now fetches the same `/api/setup` output as the Setup page and launches that generated prompt through the selected runner, instead of pasting the literal `goat-flow setup . --agent <runner>` command. The Home preview copy now labels the generated setup prompt honestly, stale unused Home prompt builders were removed, and focused regressions cover generated setup launch, same-project request supersession, setup-generation failure handling without duplicate toasts, and harness runner-vs-target separation.
- **Review/security artifact contract spike** - Added typed review/security artifact contracts, a validating security fixture, and a read-only Reviews dashboard stub that renders the fixture posture and findings. The `goat-security` skill now documents `--emit json --output <path>` headless artifact behaviour across the workflow template and installed skill mirrors. Claude proved the security-target producer path by writing a contract-valid `SecurityResult` artifact after continuing with `claude -p -c --permission-mode acceptEdits`; the plain `claude -p` scan reached a write-permission prompt, so the 1.10.0 job runner must encode that non-interactive permission requirement. `codex exec` parity remains a recorded timeout gap.

## v1.9.1 - 2026-06-05

Guardrail hotfix for 1.9.0 hook regressions and release-safety gaps.

- **`deny-dangerous` nested-pipe bypass fixed** - The shell parser now preserves outer pipeline context while inspecting nested `bash -c` payloads, so commands like `bash -c "echo safe" | python3 -c "x"` are denied instead of being allowed by the benign nested shell segment. Bare `--self-test` now runs the full self-test suite by default, and the full suite includes the nested-pipe regression.
- **No-`jq` JSON extraction fails closed** - Copilot-style hook payload parsing now has a shell fallback for escaped JSON strings when `jq` is unavailable. Escaped-quote payloads are inspected instead of truncated, and unsupported escape forms fail closed for shell and secret-path hooks.
- **Submodule and bare-repo launcher hardening** - Agent launcher templates distinguish linked worktree gitdirs from absorbed submodule gitdirs and guard every `git rev-parse --show-toplevel` fallback. A missing worktree root now exits through the policy hook's deny path instead of falling through as an unguarded command failure.
- **Hook launcher no longer wedges sessions that leave the repo** - The PreToolUse launcher resolved its guard path with `git rev-parse` run in the agent's current working directory and failed closed when that directory was outside any git repo. A session that `cd`'d into `/tmp` (e.g. to stage scratch files) then had every Bash blocked with `BLOCKED: Policy hook unavailable: git repository root unavailable.` - including the `cd` back into the repo, since the guard runs before the command's own `cd` - leaving the shell permanently wedged while Read/Edit/Write still worked. The `--git-common-dir` worktree hardening did not help: it also fails from `/tmp`. Launchers in `src/cli/server/agent-hook-writer.ts`, `workflow/hooks/agent-config/claude.json`, `workflow/hooks/agent-config/antigravity-hooks.json`, and `workflow/install-goat-flow.sh` now fall back to the cwd-independent `$CLAUDE_PROJECT_DIR` (the project root Claude Code exports to hooks) before failing closed, and fail closed only when no `deny-dangerous.sh` is found by either the git root or that env var. They also `cd "$root"` before invoking the guard, because `deny-dangerous.sh` re-resolves its own `.goat-flow/hooks/deny-dangerous` root via `git rev-parse` from cwd - resolving only the script path left the guard failing closed from `/tmp` anyway; `cd` failure also fails closed. Git resolution still runs first, so worktree/submodule checkouts are unaffected; the guard still executes, so enforcement is unchanged. Only Claude exports `$CLAUDE_PROJECT_DIR`, so other agents still fail closed outside a repo until their own root env var is wired in. Existing projects re-run `goat-flow setup` or `goat-flow hooks sync` to pick up the new launcher. New `.goat-flow/learning-loop/footguns/hooks.md` and `.goat-flow/learning-loop/lessons/agent-behavior.md` entries record the trap and the `!cd <repo>` recovery.
- **Clearer hook failure copy** - Launcher startup failures now say `Policy hook unavailable` with the concrete root-resolution cause, deny responses identify the specific policy scope, and audit failures distinguish path mismatches from commands that exit before the managed hook script starts.
- **Audit validates the configured launcher path** - `runConfiguredHookCommandSmoke` now executes the registered launcher string rather than bypassing it with `bash <script>`, and per-agent self-tests use the installed dispatcher through `GOAT_DENY_DANGEROUS_HOOK`. Audit also flags stale 1.8.0 split guardrail files left behind after migration.
- **Hook sync and install migration fixes** - Dashboard/CLI hook sync now adds the `.goat-flow/.gitignore` exceptions required for committed `hook-lib/` policy files. The installer preserves a disabled split-guardrail toggle when collapsing legacy guard hooks into `deny-dangerous`.
- **Codex permission profiles launch again** - Codex configs now extend the built-in `:workspace` permission profile and add secret-path `deny` rules, instead of rebuilding workspace access with the older `:workspace_roots`/`none` shape that made shell commands fail before startup with `bwrap: execvp .../vendor/.../codex: No such file or directory` on Codex 0.136. `goat-flow install . --agent codex` migrates preserved `.codex/config.toml` files in place and keeps custom deny entries as `deny`.
- **Review artifacts moved out of scratchpad** - `/goat-review` now writes refutation ledgers and cross-model refuter JSON under `.goat-flow/logs/review/`, with setup, manifest, and gitignore support for the new local-only log bucket. `.goat-flow/scratchpad/` remains generic WIP.
- **Quality-report follow-ups** - Shell validation now covers `scripts/installers/*.sh` in hot-path commands and preflight, learning-loop `(search: ...)` validation accepts both backtick and double-quoted needles, and stale `SBAO` / full-depth critique wording was aligned with current `goat-critique` and `goat-plan` behavior.
- **Release command safety** - Removed `critique`, `fix`, and `eval` command aliases now return explicit migration guidance, and `npm publish` runs the existing `publish:check` gate through `prepublishOnly`.
- **PR review follow-ups** - Deny-hook fallback JSON parsing now preserves unsafe escape status, gruff changed-range fallback includes staged hunks, ADR-028 `gh comment` body-file coverage is restored, and audit rejects configured deny launchers that point at the wrong registered script.

## v1.9.0 - 2026-06-01

Worktree-safe hook launchers - Claude and Antigravity guardrails now run correctly inside `git worktree add` checkouts.

- **Single `deny-dangerous` guardrail hook** - The three split PreToolUse guardrails are consolidated back into one user-facing `deny-dangerous.sh` per agent. The CLI/dashboard hook registry now exposes exactly one required "Deny dangerous hook" instead of separate destructive-shell, secret-path, and repository-write entries, while keeping the same block/allow coverage for destructive shell commands, direct secret-path access, `git commit` / `git push`, destructive git flags, and GitHub CLI writes.
- **Shared hook policy store** - Shared guard logic now lives once per project in the committed `.goat-flow/hooks/deny-dangerous/` store (`patterns-shell.sh`, `patterns-paths.sh`, `patterns-writes.sh`, and `deny-dangerous-self-test.sh`). Fresh installs copy the dispatcher plus the store, chmod the scripts, and add `!hooks/` plus `!hooks/**` to `.goat-flow/.gitignore` so fresh clones keep the policy modules tracked.
- **Hook upgrade cleanup** - `goat-flow install` now prunes old per-agent `guard-common.sh`, `guard-destructive-shell.sh`, `guard-secret-paths.sh`, `guard-repository-writes.sh`, `guardrails-self-test.sh`, and legacy `deny-dangerous.self-test.sh` files from canonical agent hook directories. Existing hook config files are migrated in place: stale `guard-*` / old deny registrations are removed, the canonical `deny-dangerous.sh` registration is added, and `.goat-flow/config.yaml` aliases old guard hook toggles to `deny-dangerous`.
- **Fail-closed hook startup and verification** - Missing or unreadable `.goat-flow/hooks/deny-dangerous/` now denies with an agent-shaped failure instead of falling through to exit 127. Audit and preflight check the dispatcher, the shared store, and registered guard-script paths for Claude, Codex, Antigravity, and Copilot.
- **Release-review guardrail gaps** - The 1.9.0 review caught two pre-tag blockers: `runConfiguredHookCommandSmoke` still runs `bash <extracted-script-path>` instead of the configured launcher string, so wrapper resolver, shell syntax, or executable-bit failures can pass audit; and `hooks enable` / `hooks sync` copies `.goat-flow/hooks/deny-dangerous/` without appending the installer's `!hooks/` `.goat-flow/.gitignore` exceptions, leaving required policy modules local-only in projects with old templates.
- **Guardrails work inside git worktrees** - The shipped Claude/Antigravity launcher resolved `$root` with `git rev-parse --show-toplevel`, which inside a worktree returns the worktree's working directory (e.g. `<project>/.claude/worktrees/<branch>/`) instead of the main repo. With `.claude/` (or `.agents/`) gitignored in most projects, `git worktree add` checked out no hook scripts and every Bash failed before any guard could run, with errors like `bash: <worktree>/.claude/hooks/<guard>.sh: No such file or directory`. Launchers in `workflow/hooks/agent-config/claude.json`, `workflow/hooks/agent-config/antigravity-hooks.json`, the dashboard hook writer in `src/cli/server/agent-hook-writer.ts`, and the installer template in `workflow/install-goat-flow.sh` now resolve via `git rev-parse --git-common-dir` (whose parent is the main repo root in both main and worktree checkouts) and fall back to `--show-toplevel` only when `--git-common-dir` returns a relative `.git` from the main checkout's working directory. Existing projects need to re-run `goat-flow setup` or `goat-flow hooks sync` to pick up the new launcher; their old `$(git rev-parse --show-toplevel)/...` launchers will keep failing inside worktrees until updated.
- **Audit still recognises the registered script** - `normalizeHookPath` in `src/cli/facts/agent/hooks.ts` now strips both `$(...)/<path>.sh` (legacy) and `$root/<path>.sh` / `${root}/<path>.sh` (new) prefixes, so `goat-flow audit` and the dashboard report the canonical `.claude/hooks/<script>.sh` value across both launcher generations.
- **Documented as a learning-loop footgun** - New entry in `.goat-flow/learning-loop/footguns/hooks.md` records the worktree symptom, the `--show-toplevel`-vs-`--git-common-dir` root cause, and the invariant any future launcher edit must satisfy. `workflow/hooks/README.md` is rewritten to describe the new resolution flow.
- **One commit-conventions file, IDE-readable** - commit guidance now lives only at `docs/coding-standards/git-commit.md`; the removed `.github/git-commit-instructions.md` was never auto-read by IDEs (VS Code and JetBrains read `.github/copilot-instructions.md`), so its rules went unseen. The auto-read instruction files now carry a `## Commit Messages` summary pointing to the canonical doc and add a branch-prefix rule (a `feat/<digits>` branch → `#<digits>` subject prefix). The `commit-guidance` harness check and the Copilot `agent-instruction` bridge now require the docs location plus the instruction-file reference, and `src/cli/prompt/commit-guidance.ts` seeds the doc on install. See ADR-031.
- **gruff hook honours `paths.ignore`** - The `gruff-code-quality` PostToolUse hook now reads the analyzer's own `ignoredPaths` / `paths.skipped` output: when an agent edits a file ignored by the project's `.gruff-*.yaml` config, the hook prints a single `skipped <path> - out of scope` line and surfaces no findings, instead of pushing the agent to "fix" a file the project excludes. The verdict comes from gruff itself - the hook never re-derives ignore rules, so there is a single source of truth - and the change lands in both the active `.goat-flow/hooks/gruff-code-quality.sh` and the installed template `workflow/hooks/gruff-code-quality.sh` (kept byte-identical). All five analyzers (`gruff-go`, `gruff-rs`, `gruff-ts`, `gruff-php`, `gruff-py`) now apply `paths.ignore` to explicitly-passed file paths and diff/changed-range modes (verified against the `gruff-workspace` checkouts on 2026-05-30; the earlier `gruff-ts` explicit-arg bypass is fixed), so this hook is active, not a no-op. A new `.goat-flow/learning-loop/lessons/gruff-cleanup.md` entry records the historical explicit-arg bypass.
- **gruff hook explains config-schema rejections** - When the project's `.gruff-*.yaml` is missing the `schemaVersion:` line that `gruff-rs`, `gruff-ts`, and `gruff-php` now require, `analyse` exits non-zero with an empty findings payload. The hook previously discarded gruff's error and printed a misleading `produced non-JSON output` note to stderr, so the agent never learned the cause. The `gruff-code-quality` hook now detects the schema rejection and relays gruff's own message - including its `<binary> init --force` remediation - to stdout, while never editing the project's gruff config itself. Applied identically across all five shipped hook copies (`.claude`, `workflow`, `.github`, `.codex`, `.agents`); covered by a new smoke-test case.
- **gruff-ts cleanup follow-up** - Low-risk modernisation, naming, comment, assertion-constant, and test-readability findings were fixed across CLI, dashboard, scripts, and tests while leaving disputed rule families as explicit accepted debt instead of weakening gruff configuration. The full `gruff-ts analyse --fail-on none` snapshot now reports 428 findings, down from the 717-finding baseline for this pass, with `error=0`.
- **gruff-ts size cleanup** - The remaining `size` findings were fixed by splitting oversized CLI, audit, quality, server-route, dashboard, and test modules into focused files instead of raising analyzer thresholds. Dashboard classic-script assets now load through smaller fragments, terminal-launch tests moved into a subfolder suite, and long audit/quality/skill test filenames were shortened with grouped unit-test folders.
- **CI uses the split test contract** - GitHub Actions now runs `npm run test:full` instead of duplicating a raw `node --test` glob, so split audit-drift and dashboard integration suites use the same fast/serial-slow invocation as local verification. This keeps standalone test modules importing their helper scope and prevents stateful dashboard tests from racing each other.
- **Learning-loop index prototype** - 1.9.0 now includes a hand-built `.goat-flow/learning-loop/footguns/INDEX.md` prototype covering 69 active footguns with grep-friendly `(search: "...")` anchors. The spike measured 311 active/indexed learning-loop entries overall, rejected always-loaded index content as too large, chose per-bucket indexes plus mandatory Step 0 read, and moved the generator/freshness/emission work to `tasks/1.10.0/learning-loop/`.

## v1.8.0 - 2026-05-28

Antigravity replaces Gemini CLI as the third supported runner; the dashboard gains hook management with a guardrail split; report-only skills require a four-class proof tag on every finding; three new on-demand playbooks ship (observability, code comments, gruff code quality); and a wide learning-loop pass adds seven footguns, ten lessons, eight patterns, and two new ADRs.

- **Antigravity replaces Gemini CLI** - new third supported runner backed by `agy 1.0.1` (OAuth persistence verified on a fresh shell), sharing `AGENTS.md` and `.agents/skills/` with Codex; `--agent gemini` removed; dashboard composer-ready detection backed by a captured PTY fixture. See ADR-030.
- **Dashboard hook management + guardrail split** - new `/hooks` dashboard page and `goat-flow hooks <list|enable|disable|sync>` CLI manage shipped hooks across Claude, Codex, Antigravity, and Copilot via `.goat-flow/config.yaml`. The monolithic `deny-dangerous*` files are replaced by three togglable guardrails (`guard-destructive-shell.sh`, `guard-secret-paths.sh`, `guard-repository-writes.sh`) with one central `guardrails-self-test.sh`, plus an opt-in `gruff-code-quality.sh` PostToolUse hook that only surfaces findings on changed lines.
- **Proof class required on every finding** - `goat-critique`, `goat-qa`, and `goat-security` now tag every sub-agent finding, validated finding, and recommended change with one of `RUNTIME | CONTRACT-GREP | STATIC | NOT-REPRODUCED` alongside the existing OBSERVED/INFERRED/UNVERIFIED evidence quality; new contract tests pin the requirement.
- **Codex install migrates filesystem permissions** - `goat-flow install . --agent codex` rewrites the legacy `:project_roots` anchor to `:workspace_roots` and converts invalid glob `none` entries into the canonical shape Codex 0.131 accepts, with a post-install validator that aborts on any remaining unsupported form.
- **Dashboard awaiting-input badge: asymmetric trust** - after five rounds of output-driven heuristics failed, the badge is now SET from runner output but CLEARED only by input-side signals (keystrokes, programmatic sends, Ctrl+V paste, session lifecycle). New PTY fixtures cover Claude, Codex, Antigravity, and Copilot startup/running states.
- **Three new on-demand playbooks** - `.goat-flow/skill-docs/playbooks/observability.md` (logs / metrics / span events / trace context), `code-comments.md` (when and why to write a comment, portable across TS/Python/Go/Rust/shell), and `gruff-code-quality.md` (triage and verification for the gruff-* analyzer family).
- **GitHub CLI read-only by default (ADR-028)** - the deny hook now blocks `gh` write paths (issue/PR comments, releases, workflow runs, repo edits, gists, secrets, keys, `gh api` writes) while keeping `gh issue view`, `gh pr view/diff/checks`, `gh search`, `gh repo view`, and read-only `gh api` available.
- **Gruff-ts cleanup pass across ~80 files** - the new playbook applied to goat-flow's own TypeScript surface: JSDoc added to exported interfaces and functions, short identifiers renamed to domain terms across `src/cli/audit/`, `src/cli/server/`, `src/cli/quality/`, `src/cli/manifest/`, `src/cli/stats/`, `src/cli/prompt/`, `src/cli/detect/`, `src/cli/evidence/`, `src/cli/facts/`, and `src/dashboard/`. No runtime behaviour changes.
- **goat-review automated-reviewer overlap (PR mode)** - `/goat-review` in PR mode now ingests existing findings from common GitHub review bots and tags each Pass 2 finding `[overlap:<reviewer>]` or `[new]` via a same-file + Jaccard-token heuristic, with a new Review Integrity line summarising overlap and net-new counts.
- **ADR-029 two-ceiling runaway protection** - any orchestrated long-lived resource (PTY session, batch worker, scheduled remote agent) must ship with both a resource-layer ceiling and a consumer-loop ceiling, with the consumer ceiling firing strictly first so it can wind down through normal control flow before the resource is reaped.
- **Learning-loop expansion** - seven new footguns (`agent-output-trust.md`, `caching.md`, `cleanup-layering.md`, `config.md`, `internal-run-isolation.md`, `sentinels.md`, plus a `cli.md` extension), ten lessons (including new `external-pr-learnings.md` and a local-incident "never disable gruff-ts rules" rule), and eight patterns spanning a new `dependencies.md` plus appends to `architecture.md`, `refactoring.md`, and `verification.md`.

## v1.7.1 - 2026-05-21

Upgrade cleanup patch for stale skill reference files.

- **Stale reference pruning** - `goat-flow install` now removes manifest-unlisted Markdown files from installed per-skill `references/` directories before copying current templates, preventing merged or renamed reference packs from leaving old guidance behind.
- **Audit detection** - Agent setup audit now fails `agent-skills` when installed goat skill references are not listed in `workflow/manifest.json`, with remediation pointing back to `goat-flow install . --agent <id>`.
- **Setup guidance and regression coverage** - Setup and final-verification docs now require reference-pack pruning checks, with installer and audit tests covering the stale `goat-security` v1.6.0-to-v1.7.0 reference merge case.

## v1.7.0 - 2026-05-20

GOAT Flow 1.7.0 makes releases easier to check and the dashboard easier to use.

- **Clearer audits** - `audit --format sarif` adds CI-friendly output, and audit reports now say what is proven, limited, or agent-specific.
- **Agent settings from the manifest** - Agent setup now comes from `workflow/manifest.json`; aggregate audit covers Claude, Codex, Gemini, and Copilot by default.
- **Dashboard Plans** - New Plans view reads `.goat-flow/plans/`, previews milestones, tracks progress, and sets the active plan.
- **More reliable workspace** - Terminal sessions better handle waiting/running/detached states, keep the selected project separate from the goat-flow workspace, improve Codex startup, support image drops, and detect input prompts from Claude and terminal titles.
- **Safer dashboard basics** - Path checks, command execution, Markdown rendering, uploads, assets, project identity, navigation, and Quality page loading were tightened.
- **Shorter prompt context** - Quality and setup prompts now get selected lessons, footguns, patterns, and decisions instead of whole files, with stale items filtered out.
- **Stronger guardrails** - Deny hooks block GitHub writes through `gh`, tighten `.env.example` and heredoc checks, and expand self-tests across agent mirrors.
- **Skill and release cleanup** - `goat-critique`, `goat-qa`, and `goat-review` now ask for clearer evidence; package/config/manifest/docs/templates/fixtures were synced to 1.7.0.

## v1.6.4 - 2026-05-12

Dashboard cold-load and Skills evaluator release.

- **Faster setup detection** - `/api/setup/detect` now checks common project files first, so large repos do not stall before the first dashboard render.
- **More reliable terminal assets** - xterm assets load from a local cache, preload earlier, and clean up failed loads before retrying.
- **Faster terminal launch** - Terminal startup now loads xterm and creates the backend session at the same time, then cleans up failed starts safely.
- **Faster Quality page load** - The Quality page can use cached audit data on first paint instead of forcing a fresh audit every time.
- **Clearer Skills evaluator** - The Skills page now puts draft-skill and Markdown-bundle evaluation front and center, while keeping installed-skill audits available.
- **Safer browser-use installer** - `scripts/install-browser-tools.sh` now writes visible wrappers, checks they work through the real CLI path, handles root containers, and cleans up browser-use daemons.
- **Regression coverage** - Tests now cover setup detection, faster Quality loading, terminal startup, xterm retry cleanup, asset routes, and Skills page behavior.

## v1.6.3 - 2026-05-12

Dashboard terminal UX release for setup launches and cold-start visibility.

- **Claude setup paste-submit reliability** - Claude Code v2.1.139 can drop an Enter sent in the same redraw burst as its `[Pasted text #N +M lines]` composer marker. Claude now follows the same short commit-delay path as Gemini: paste the multiline prompt, wait for the pasted-text marker, pause briefly, then submit. This prevents Setup prompts from sitting in Claude's collapsed paste composer until the user manually presses Enter.
- **Workspace terminal loading overlay** - New terminal sessions now carry per-session loading state (`connecting`, `loading`, `ready`, `error`) and render an in-viewport overlay above the xterm pane until the first PTY output arrives. The overlay shows runner-specific startup text, a braille spinner, a 3s cold-start hint, and a 10s Retry action.
- **Terminal retry recovery** - Sessions that fail or stall before first output can be retried from the overlay. Retry cleans up the old backend session, preserves the original runner, prompt, cwd, target path, and prompt label, then relaunches a fresh terminal session.
- **Session-safe loading state** - Loading state is stored on each local session, so switching between terminal sessions mid-start preserves each session's own overlay phase instead of leaking global state across tabs.
- **Regression coverage and smoke proof** - Added focused unit coverage for loading escalation timers, fast first output, per-session switching, retry preservation, and overlay rendering. Dashboard integration tests and a rebuilt-dashboard browser smoke confirmed terminal sessions reach first PTY output without a stale overlay.

## v1.6.2 - 2026-05-12

Dashboard terminal reliability release for setup-page runner launches.

- **Gemini setup launch reliability** - Setup page launches with runner `gemini` now wait for Gemini CLI's real composer marker (`Type your message or @path/to/file`) instead of letting generic fallback timers consume the queued setup prompt during the auth/status splash. Multiline Gemini prompts now follow the same paste-then-submit contract as Claude, including detection of Gemini's `[Pasted Text: ...]` marker and a short delayed Enter submit after the TUI commits the collapsed paste.
- **Terminal paste-submit hardening** - Browser-side terminal sends now retry delayed Enter submits when the WebSocket is briefly unavailable, keep queued pastes behind a pending submit, normalize CRLF line endings, and strip embedded bracketed-paste markers from prompt bodies before wrapping them. This prevents setup/quality prompts from landing as inert pasted text or being truncated by accidental paste terminators.
- **Self-hosted xterm assets** - The dashboard no longer fetches xterm.js and the fit addon from jsDelivr on first terminal open. `@xterm/xterm` and `@xterm/addon-fit` are bundled through `scripts/build-dashboard-assets.mjs` and served from local `/assets/xterm.css`, `/assets/xterm.js`, and `/assets/addon-fit.js` routes, avoiding CDN latency/failure for a local dashboard.
- **Setup-page terminal prewarm** - Opening either Workspace or Setup now warms xterm assets when terminal support is available, reducing visible delay before `Run Setup in Terminal` can render the terminal pane.
- **Regression coverage and browser proof** - Added focused terminal-launch tests for Gemini auth readiness, Gemini pasted-text submission, WebSocket retry, paste-body normalization, setup/workspace xterm warming, and local xterm asset routes. Browser verification covered Gemini setup launch through auth to `Thinking...` after receiving `goat-flow audit . --harness --agent gemini`.

## v1.6.1 - 2026-05-11

Windows compatibility consolidation, dashboard Skills polish, runner launch reliability, skill evaluator shape detection and report export, skill-quality config toggles, goat-security reference consolidation, and pre-ship correctness fixes.

- **Skills sidebar scope** - Dashboard Skills filters to real installed skills; stale selections clear when filtered out; sidebar, counts, and copy updated.
- **Runner launch reliability** - Promptless session creation with browser-side send on readiness or short after-output cap (replaces 6s blanket fallback); pasted-text echo gate ends `[Pasted text #N]` stalls; new `terminalWaitingForRunner` indicator replaces the silent launch button.
- **Windows compatibility** - Fixes `npx install` on native Windows where PowerShell collapsed backslash paths (`C:\Users\…\install.sh` → `CUsers…install.sh`) or hung on WSL `bash.exe`. New `install-invocation.ts` normalises paths, picks Git Bash / MSYS2 ahead of WSL bash, and centralises runner-shim preference + PATH probing (314-line test suite). `toShellProjectPath` also preserves UNC roots so quality prompts no longer misroute `QUALITY_DIR=…` to a local absolute.
- **Skill evaluator shape detection** - New `detectedShape` / `shapeConfidence` / `shapeMismatch` flag "packaged as skill, reads like playbook" cases; fallback-only subtype matches drop confidence; browser/MCP commands count as tool dependencies; uploads score on explicit gates rather than preamble inheritance.
- **Skill evaluator clipboard report** - New "Copy report" emits a markdown summary; `copyTextToClipboard` prefers `navigator.clipboard.writeText` with `execCommand("copy")` boolean fallback, so blocked writes surface a real "Copy failed" toast.
- **Skill-quality config + scope toggles** - Workflow-completeness reads human-stop vocabulary from `quality-config`; `scanDisk` gates disk-side reference resolution; `prefetch` suppresses stale dashboard prompts on artifact switch.
- **goat-security reference consolidation** - `auth-authz.md`, `dependency-and-supply-chain.md`, and `secrets-and-data-exposure.md` merged into `identity-and-data.md` and an expanded `supply-chain-and-cicd.md` across all four skill mirrors.
- **Pre-ship correctness fixes** - Setup template Router Table splits skill-reference (meta) and skill-playbooks (tools); `docs/skills.md`, `.goat-flow/code-map.md`, and `workflow/setup/06-final-verification.md` aligned on canonical paths; launch-prompt fallback JSDoc documents the ungated cap as intentional.
- **UI polish, gitignore, regression coverage** - Consistent max-widths and disabled-state styling across dashboard views with an SVG dropzone icon; `.gitignore` template exposes `.goat-flow/skill-docs/playbooks/`; new unit coverage for Skills filtering, after-output cap, paste fallback, copy-feedback timer, `install-invocation`, and `scanDisk`.

## v1.6.0 - 2026-05-10

Skill authoring, quality assessment, and playbook/reference cleanup.

- **Skills workbench** - The dashboard Skills page audits installed artifacts, evaluates drafts, and launches qualitative runner assessments.
- **Draft evaluation** - `/api/quality/evaluate` is now canonical, with the old analyse route kept as a one-release deprecated alias.
- **Multi-file bundles** - Draft evaluation accepts Markdown bundles, composes sibling files, and reports every source in `composedFrom`.
- **Skill authoring CLI** - `goat-flow skill new` scaffolds from descriptions, drafts, or interactive prompts without silently choosing the wrong artifact type.
- **Configurable rubric** - Skill-quality scoring now supports project config for subtype profiles, gates, walk roots, composition, and fixtures.
- **Candidacy checks** - `goat-flow quality candidacy` recommends whether a request belongs as a skill, playbook, instruction rule, learning-loop entry, CLI command, or no artifact.
- **Semantic assessments** - Runner prompts now require anti-bias guidance, scored semantic dimensions, scope checks, final gate decisions, and a fenced JSON verdict.
- **Reference/playbook split** - Shared meta references stay in `.goat-flow/skill-docs/`; standalone tool and authoring playbooks live in `.goat-flow/skill-docs/playbooks/`.
- **Prime patterns** - Browser-use recovery, active-testing authorization, proof tables, trigger-only descriptions, API skill guardrails, and frontend guidance were folded into existing surfaces.
- **Release cleanup** - Version surfaces, docs, fixtures, stale path guidance, snapshot facts, and scratchpad link handling were aligned for the 1.6.0 release.

## v1.5.1 - 2026-05-08

Installer config registration fix and release propagation.

- **Existing config agent registration** - `workflow/install-goat-flow.sh` now preserves an existing `.goat-flow/config.yaml` while registering the requested agent in `agents:`. Second-agent installs no longer leave aggregate dashboard audits scoped to the first installed agent, and the updater handles missing, null, inline, and block-list agent configs without duplicating entries. (`workflow/install-goat-flow.sh`, `test/integration/setup-install.test.ts`)
- **Brand-new project setup smoothing** - Full setup, upgrade, and migration prompts now name both required audit gates (`audit --agent` and `audit --agent --harness`), `stats --check` treats fresh empty footgun/lesson directories as warnings instead of forcing invented entries, setup docs include copyable skill-reference snippets plus earlier workspace-boundary and commit-guidance requirements, and terminal launch prompts are chunked through PTY input while staying out of runner argv/env. (`src/cli/prompt/compose-setup.ts`, `src/cli/stats/stats.ts`, `workflow/setup/`, `src/cli/server/terminal.ts`, `test/unit/audit-command/main.test.ts`, `test/integration/stats-command.test.ts`, `test/unit/terminal-spawn.test.ts`)
- **Codex hooks flag migration** - Codex installs now non-destructively migrate existing `.codex/config.toml` files from deprecated `codex_hooks` to `hooks` without overwriting unrelated user settings, and `audit --agent codex` fails `agent-settings` when deprecated or disabled hook feature flags would prevent Codex hooks from running. (`workflow/install-goat-flow.sh`, `src/cli/facts/agent/settings.ts`, `src/cli/audit/check-agent-setup.ts`, `test/integration/setup-install.test.ts`, `test/unit/audit-command/main.test.ts`)
- **Release propagation** - Package/config/manifest, instruction files, skill templates and installed mirrors, shared references, security reference packs, hook templates and installed hooks, fixtures, docs sample output, and manifest snapshot catalog bumped to 1.5.1. Manifest snapshot `v1.5.1.json` frozen.

## v1.5.0 - 2026-05-06

Local dashboard control-plane hardening and honest harness/install signals.

- **Dashboard API authorization** - Dashboard HTML now receives a per-process token, `/api/*` routes require it, side-effectful browser requests are Origin-checked, and terminal WebSocket attaches reject missing tokens. The visible URL is cleaned after boot so the token does not linger in the address bar or persisted dashboard state. (`src/cli/server/dashboard.ts`, `src/cli/server/dashboard-routes.ts`, `test/integration/dashboard-server.test.ts`)
- **Terminal runner hygiene** - Unknown runners now return a 400 instead of falling back to another CLI, dashboard startup uses passive runner detection by default, and one-shot prompt environment variables are cleared before the persistent shell is handed to the user. (`src/cli/server/terminal.ts`, `src/dashboard/dashboard-terminal.ts`, `test/smoke/dashboard-endpoints.test.ts`)
- **Harness signal honesty** - Audit results now expose `displayStatus`, `impact`, `evidenceKind`, `assurance`, and framework-vs-target evidence paths. Metric-only degradation stays visible as score-only evidence, no-post-turn-hook Verification lowers the concern score instead of rendering as full readiness, and script-only deny coverage is labelled with limited assurance where settings/file-read deny is unavailable. (`src/cli/audit/audit.ts`, `src/cli/audit/types.ts`, `src/cli/audit/harness/`, `src/dashboard/views/home.html`)
- **Learning-loop and doc-path diagnostics** - `audit --harness` now reflects invalid/stale learning-loop evidence, feedback-loop copy names entries across files, and `doc-paths-resolve` reports exact unresolved literals while ignoring npm scopes, home paths, and known external glossary tokens. (`src/cli/audit/harness/check-feedback-loop.ts`, `src/cli/audit/harness/check-context.ts`, `src/cli/audit/harness/helpers.ts`)
- **Managed-agent coverage** - Configured-but-missing agents are represented in aggregate audit even when their instruction file is absent, explicit `--agent` selection wins over config filtering, and dependent skills/settings/deny checks no longer pass vacuously when the selected agent's primary instruction file is missing. (`src/cli/facts/orchestrator.ts`, `src/cli/audit/check-agent-setup.ts`, `src/cli/server/dashboard-routes.ts`)
- **Install upgrade controls** - `goat-flow install` and the deterministic installer now support `--update-config-version` for version-only config updates and `--clean-deprecated` for stale skill directory cleanup. Upgrade/setup guidance points v0.9/outdated projects at those targeted flags, audit remediation names the config-version command, and preserved settings now warn when a freshly copied deny hook still needs registration. (`src/cli/cli.ts`, `workflow/install-goat-flow.sh`, `src/cli/audit/check-agent-setup.ts`, `src/cli/prompt/compose-setup.ts`)
- **goat-plan file-write cleanup** - The dashboard "Break Into Milestones" preset now permits task-file creation, ADR-014 no longer cites gitignored task workspace files as durable future-work evidence, and the verification lessons capture the rule against using gitignored workspace files in durable learning-loop or decision artifacts. (`src/dashboard/preset-prompts.json`, `.goat-flow/learning-loop/decisions/ADR-014-optional-project-calibration-config.md`, `.goat-flow/learning-loop/lessons/verification.md`)
- **Quality and setup prompt fixes** - Quality prompts no longer claim lean config requires `line-limits`; quality history IDs for null-line findings now include a summary-text slug for stable disambiguation (existing history entries use the old format, so the first quality diff after upgrade may show phantom new/resolved findings - re-run once to reset the baseline); setup footgun status vocabulary now matches the linter-enforced `active | resolved` contract. (`src/cli/prompt/compose-quality.ts`, `src/cli/quality/ids.ts`, `workflow/setup/reference/footguns-readme.md`)
- **Package README contract** - Packed docs/assets are included and `npm pack --dry-run --json` link validation now runs in preflight/`publish:check` so README links in the npm package point at shipped files or stable external URLs. (`package.json`, `scripts/check-package-readme-links.mjs`, `scripts/preflight-checks.sh`, `test/unit/package-readme-links.test.ts`)
- **Release propagation** - Package/config/manifest, instruction files, skill templates and installed mirrors, shared references, security reference packs, hook templates and installed hooks, fixtures, docs sample output, and manifest snapshot catalog bumped to 1.5.0. Manifest snapshot `v1.5.0.json` frozen.

## v1.4.3 - 2026-05-04

Dashboard install-readiness scoring, setup prompt truthfulness, and `/api/setup` latency fixes.

- **Install readiness donut** - Home now labels the install donut as `READINESS` and calculates it from both the install checklist and harness average. The breakdown text shows the two inputs (`Install X% / Harness Y%`) so a partial install can no longer render as an unexplained 100% harness average. (`src/dashboard/views/home.html`, `src/dashboard/styles.css`)
- **Install checklist detail** - Failed install checklist rows now show the underlying audit failure message. Stale skills, config-version drift, and settings/config failures are visible directly under rows like "Skills installed and current" and "Verification gates configured" instead of hiding behind a red icon. (`src/dashboard/views/home.html`)
- **Setup target scoring** - Setup target cards now score setup scope, selected-agent install scope, and harness scope together instead of showing harness-only percentages. This keeps Setup card grades aligned with the project install state. (`src/dashboard/app.ts`, `src/dashboard/views/setup.html`)
- **Full-scope dashboard setup prompts** - The `/api/setup` route now generates prompts from the full audit scope instead of the harness-card prompt scope, so setup and agent install failures no longer produce "All audit checks pass" on the Setup page. (`src/cli/server/dashboard-routes.ts`, `src/cli/prompt/compose-setup.ts`)
- **Outdated install issue detail** - Upgrade and migration setup prompts now include a `Detected install issues` section before the install steps, listing concrete config-version, skill-version, and other install failures when audit data is available. (`src/cli/prompt/compose-setup.ts`)
- **Setup endpoint latency** - `/api/setup` now uses dashboard-summary facts, skips stack detection, and runs static deny-hook evidence instead of shelling out to `deny-dangerous.sh --self-test`. Local rebuilt-dashboard smoke measured setup prompt calls at about 0.06s for both healthy and stale synthetic targets. (`src/cli/server/dashboard-routes.ts`, `src/cli/audit/check-agent-setup.ts`)
- **Static deny evidence mode** - Audit gained a `denyMechanismEvidenceLevel: "static"` mode for dashboard routes. It still checks deny hook presence, syntax, patterns, and template version, while leaving runtime self-tests to explicit full validation paths. (`src/cli/audit/audit.ts`, `src/cli/audit/types.ts`, `src/cli/audit/check-agent-setup.ts`)
- **Regression coverage** - Added tests for Home readiness scoring, Setup target card scoring, full-scope setup prompt behavior, outdated prompt issue details, and `/api/setup` self-test avoidance. (`test/integration/dashboard-server.test.ts`, `test/unit/audit-command/main.test.ts`)
- **Verification lesson** - Recorded the lesson that behavior-scope changes need matching assertion updates before the first focused run, after an initial stale test assertion caught the old harness-only expectation. (`.goat-flow/learning-loop/lessons/verification.md`)
- **Release propagation** - Package/config/manifest, skill mirrors, shared references, hooks, fixtures, docs sample output, instruction files, and manifest snapshot catalog bumped to 1.4.3. Manifest snapshot `v1.4.3.json` frozen.
- **Verification run** - Rechecked with focused setup endpoint tests, compose setup unit tests, preset prompt tests, `npm run typecheck`, full `bash scripts/preflight-checks.sh`, browser-use Home/Setup smoke, and curl timing smoke.

## v1.4.2 - 2026-05-04

Dashboard agent-targeting fix, audit scope consistency for setup prompts, harness-card prompt scope, and harness fix prompt improvements.

- **Dashboard agent targeting** - Home "Fix First" card, harness fix prompts, and action commands now resolve the target agent from audit data (`failingHarnessAgent()`) instead of always using `activeRunner`. Prevents misleading `--agent claude` commands when a different agent (e.g. codex at 93%) has the actual failing harness check. Quality pill label now shows which agent the score belongs to. (`src/dashboard/views/home.html`)
- **Audit scope consistency** - The `/api/setup` route now runs audit with `harness: true` and requests `harness-card` prompt scope, matching the harness-scored grades shown on Setup target cards. Previously the route used `harness: false` while the display used harness scores, producing contradictory pass/fail signals on the same page. (`src/cli/server/dashboard-routes.ts`)
- **Harness-card prompt scope** - New `SetupPromptScope` type (`"full" | "harness-card"`) in `compose-setup.ts`. Harness-card scope isolates status and failed-check collection to `scopes.harness` only (excluding metrics and acknowledged checks), with a dedicated pass renderer (`renderHarnessCardPass`) and scope-aware re-run commands that include `--harness`. Full scope now collects failures from all three audit scopes (setup + agent + harness) instead of omitting harness.
- **Harness fix prompt rework** - `harnessFixPrompt()` in the Home view now targets `failingHarnessAgent()`, includes agent-scope and harness-scope check failures alongside concern findings, filters out metrics and acknowledged checks, and provides a safe empty-scores fallback that asks the agent to re-run audit before proposing fixes.
- **Setup cache invalidation** - Fresh audit loads now clear cached `setupOutputs` and reset the project-path tracker, triggering prompt regeneration when the Setup view is active. Prevents stale prompts from persisting after a re-audit. (`src/dashboard/app.ts`)
- **Footgun: runner-vs-target agent confusion** - New entry in `.goat-flow/learning-loop/footguns/dashboard.md` documenting the `activeRunner` vs failing-agent conflation and the audit-scope mismatch, with real evidence from 2026-05-03 (a real downstream project) and three prevention rules.
- **goat-plan skill wording** - Clarified that `/goat-critique` is invoked as the delegated alternatives pass before writing milestone files. Updated across all 4 agent skill copies.
- **Test coverage** - 2 new `/api/setup` integration tests for harness-card pass-through and failure remediation, with a ~100-line `makeDashboardSetupPromptProject()` factory. 2 new `composeSetup` unit tests for scope-aware routing. 1 new `dashboardGenerateSetupPrompt` unit test verifying cache invalidation on project-path change. `makeAuditReport()` helper extended with `harnessChecks` parameter.
- **Release propagation** - Package/config/manifest, skill mirrors, shared references, security reference packs, fixtures, hooks, and instruction files bumped to 1.4.2. Manifest snapshot `v1.4.2.json` frozen.

## v1.4.1 - 2026-05-03

Instruction file quality guards, execution loop skill integration, deny-dangerous search command blocking, harness audit expansion, and shared tool-playbook discoverability.

- **Instruction file quality guards** - `preflight-checks.sh` gained four guards: line count against the configured target, router table parity across instruction files and setup templates, encyclopedia/downstream detection (flagging verbatim setup-template content in live instruction files), and Quality Bar template presence.
- **Deterministic parity guard** - New `scripts/check-instruction-parity.mjs` validates canonical section order and required phrases across all four instruction files and their setup templates, catching structural drift between what setup generates and what the live files contain.
- **Execution loop skill integration** - goat-* skills now declare mode/depth at Step 0, replacing READ. SCOPE gates on write phases (e.g. `/goat-plan` Phase 2, `/goat-debug` D3) require explicit approval before file writes. Added to all four instruction files and setup agent templates.
- **Deny-dangerous search command blocking** - New `strip_shell_quotes_for_path_scan()` catches secret paths split or quoted with shell tricks (`cat '.'env`). Search command operand analysis blocks attempts to read secrets via search tool arguments or pattern files (`grep foo .env`, `grep -f .env`). Self-test suite expanded with search and quoting scenarios across all 6 hook copies.
- **Harness audit expansion** - Verification concern now scans for recent (≤14-day) validation artifacts in `.goat-flow/logs/`. Recovery concern tracks unchecked milestone items, next-action clarity, testing-gate status, and archive state. Constraints concern refactored with clearer fact-gathering. Audit test coverage expanded.
- **Skill-reference discoverability** - Generated and maintained instruction files now append the READ rule that agents must check `.goat-flow/skill-docs/` before declaring a tool or capability unavailable, and their Router Tables point at the tool playbooks directory.
- **Skill Reference Index** - Installs `.goat-flow/skill-docs/README.md` from `workflow/skills/reference/README.md`, with a ToolSearch/harness-only anti-pattern callout, available-reference table, authoring guidance for new references, and browser-use incident provenance.
- **Audit enforcement** - Added the default setup check [`instruction-file-skill-docs-pointer`](docs/audit-checks.md#setup-scope-14). When `.goat-flow/skill-docs/` exists, audit fails if the README index is missing or any present instruction file lacks a literal `.goat-flow/skill-docs/` pointer; projects without the directory get a skipped check.
- **Instruction file budget** - Line target raised from 120 to 125 across `config.yaml`, `compose-quality.ts`, and the Copilot template to accommodate skill-reference and execution-loop additions.
- **Release propagation** - Package/config/manifest, skill mirrors, shared references, security reference packs, fixtures, hooks, and instruction files bumped to 1.4.1. Manifest snapshot `v1.4.1.json` frozen.

## v1.4.0 - 2026-05-02

Cross-rater skill quality audit, skill hardening, deny-dangerous security fixes, structural reorg, dispatcher rewrite, and v1.3.3 features rolled in.

- **Cross-rater skill quality audit** - Three independent raters (Claude, Codex, Gemini) scored all 6 skills on a 10-axis rubric. Average improved from 76/100 to 87/100. All 6 skills now have Excuse/Reality tables grounded in real incidents.
- **Skill hardening** - goat-review gained Proof Capsule (4-class classification), Refutation Ledger, Blast Radius Rule, Ship Verdict, Step 0.5 Intent Reconstruction, and Pass 3 Cross-Model Refuter. goat-debug gained Debug Integrity and D1.5 Minimise. goat-security gained Security Assessment Integrity, Phase 5.5 Exploit Chaining, and Persist Gate. goat-critique gained Phase 5.5 meta-audit, Phase 5.6 outcome capture, and integration hooks. goat-qa gained A1.5 Scope-Size Gate, Verification Integrity with OBSERVED/INFERRED/UNVERIFIED tagging, and Coverage Depth vocabulary.
- **Deny-dangerous security fixes** - `rm_is_safely_scoped` hardened against trailing-slash bypass (`rm -rf src/`), multi-path bypass (`rm -rf src/old /`), and tilde-path bypass (`rm -rf ~/.ssh`). Restored accidentally-removed `sudo` prefix stripping and `env -S`/`--split-string` parsing for git-push enforcement. 18 new self-test cases across all 6 hook copies.
- **goat-critique context leak scan** - Scan now only flags references absent from the input artifact, preventing false positives when critiquing goat-flow itself.
- **Browser-use installer** - Added `browser-use` CLI wrapper alongside `browser-use-python` so `browser-use doctor` and subcommands work after install.
- **Dashboard session pruning** - `dashboardEndAllSessions` now prunes `_projectActiveSession` alongside other session structures, preventing stale mappings to deleted sessions.
- **Structural reorg** - Patterns directory split into 5 categorised buckets. 5 skill-specific reference packs relocated from shared `skill-reference/` to per-skill `references/` subdirectories. DDT layer removed (ADR-027).
- **Dispatcher rewrite** - Route Snapshot output contract, multi-intent decomposition, GATHER checklist, no-inspect constraint, degraded-routing fallback. ADR-023 amended.
- **Page-capture shared reference** - New `page-capture.md` for batch Playwright MCP capture. Wired into installer, drift checks, preflight sync, and content-quality audit.
- **Project-stack detection** - Separated test frameworks from app frameworks. Added 30+ framework/language/deploy/formatter signals. Fixed Jinja false-positive. Added Docker Compose V2 filenames.
- **Dashboard** - Workspace sidebar collapse, harness percentage parity (metric checks excluded from scores), aggregate boundary scoring, path-only task intake guard, ISSUE.md auto-creation in goat-plan, configurable goat-review local PR base.
- **Quality-report evidence** - `prior_report_id` for delta tracking, `delta_tag` validation, per-finding evidence fields.
- **Release propagation** - Package/config/manifest, skill mirrors, shared references, security reference packs, fixtures, hooks, and instruction files bumped to 1.4.0. Backfilled v1.3.1 and v1.3.2 manifest snapshots.

## v1.3.2 - 2026-05-01

Release-readiness hardening for decision records, dashboard audit performance, harness model alignment, and quality-report evidence.

- **Decision-record quality gate** - `.goat-flow/learning-loop/decisions/README.md` and the setup template now define a hard ADR filter, routing table, anti-patterns, required structure, and pre-write checklist. `goat-flow stats --check` fails non-`README.md` / non-`ADR-NNN-kebab-case-title.md` files and malformed ADRs missing `**Status:**`, `**Date:**`, `## Context`, `## Decision`, or a trade-off section, with routing guidance back to tasks, footguns, lessons, scratchpad, or issues.
- **Non-destructive decisions migration** - Fresh installs get the stricter decisions README, while existing projects keep customised `.goat-flow/learning-loop/decisions/README.md` files because the installer now uses `copy_if_missing` for that template. The old `.goat-flow/learning-loop/decisions/.gitkeep` anchor is removed.
- **Decision coverage and warning cleanup** - Content-quality audit now dynamically discovers current `ADR-NNN-*.md` files instead of relying on a hard-coded ADR list. The noisy `decision-metadata` warning stream for missing recommended `Author(s)` / `Ticket/Context` fields is removed; those fields remain recommended in the README but no longer pollute every `stats --check` run.
- **Dashboard audit fact profiles** - Audit now supports `full` and `dashboard-summary` fact profiles. Aggregate dashboard audits skip stack detection, stack-dependent checks must declare `requiresStack`, and regression tests pin that dashboard-summary audits do not call `detectStack` or read unavailable stack facts.
- **Dashboard audit cache and profiler** - `/api/audit?quality=true` caches eligible packaged aggregate reports using package version, config version, and high-impact input signatures; `fresh=true` bypasses the cache. Cache writes are synchronous to avoid the CI race fixed in this PR, and `scripts/profile-dashboard-audit.mjs` is published through `npm run profile:dashboard-audit`.
- **Filesystem and stack-detection performance** - `ReadonlyFS` gains `existsGlob()` for first-match recursive probes, and stack detection uses it for existence-only checks instead of materialising full glob result arrays on hot paths.
- **Five-concern harness model** - Removed `workspace_boundary` as a separate 6th harness concern. The `boundary-guidance-present` check (whether instruction files distinguish the controlling workspace from the selected target) moves to Context as an advisory check. The `boundary-path-separation` metric is removed. The harness model is now 5 concerns (context, constraints, verification, recovery, feedback loop) with 17 checks, matching the public harness engineering literature (Hashimoto, Bockeler, Anthropic, HumanLayer, LangChain).
- **Harness scoring honesty** - Metric checks no longer inflate concern score denominators or numerators in the CLI backend or the dashboard frontend. Dashboard `agentScore()` calculations in home, quality, and setup views now exclude metric checks from the pass/total ratio, matching how concern scores already worked. The test-runner metric now reports `fail` when no configured test command exists while still remaining informational.
- **Setup prompt verification gate** - The audit-pass setup prompt now says "Run now" instead of "Next step (recommended)" for the `--harness` command, preventing agents from skipping the harness verification gate.
- **Quality-report evidence contract** - Quality prompts and schema now carry `prior_report_id` so `delta_tag` has an explicit same-agent baseline. Runtime-backed findings can include compact evidence fields such as command, exit code, warning count, summary, and excerpt without pasting raw terminal blocks into JSON.
- **Package and release metadata** - Package version/config/manifest/installed skill and hook surfaces are bumped to `1.3.2`; npm description and keywords now position goat-flow as an AI harness engineering framework, and the dashboard audit profiler script is included in the published package.
- **Release regressions** - Added or expanded coverage for dashboard-summary no-stack behavior, dashboard audit cache speed/invalidation/cleanliness, existing-project decisions README compatibility, legacy decision-note failure guidance, dynamic ADR discovery, `existsGlob()`, harness concern model alignment, quality schema evidence fields, and stale-version strings in synthetic project fixtures.

## v1.3.1 - 2026-04-29

- **Commit-message guidance rewritten** - `.github/git-commit-instructions.md` and its mirror `docs/coding-standards/git-commit.md` now name the failure mode directly: ban weak-verb subjects (*enhance, improve, streamline, clarify, update, tweak, polish*), prescribe concrete verbs (*add, remove, replace, rename, fix, deny, gate, harden, cache*), require a body whenever the subject names more than one axis or has a non-obvious motivation, and include three bad→good rewrites built from the actual recent log. Adds a `type` selection table, drops the redundant typecheck/test/shellcheck list (preflight already runs them), and corrects the `.goat-flow/` what-not-to-commit list. Both files are now byte-equivalent below their preambles. New lesson `.goat-flow/learning-loop/lessons/agent-behavior.md` "Commit subjects paraphrased the diff with weak verbs" records the audit of the last 10 commits that motivated the rewrite.
- **Windows Workspace terminal fix** - `src/cli/server/terminal.ts` now builds PTY launch specs per platform, using PowerShell on native Windows while preserving the existing POSIX interactive-shell flow for Linux, WSL, and macOS. Windows runner detection now prefers runnable `.exe` / `.cmd` shims over extensionless npm wrapper files, fixing `Open terminal` failures such as `File not found` on the Workspace page.
- **Workspace terminal launch responsiveness** - The dashboard now creates the backend terminal session before waiting on xterm CDN assets, shows an immediate `Launching terminal...` state on the Workspace button, warms xterm in the background when the Workspace view opens, and cleans up the backend session if xterm asset loading still fails after creation.
- **Terminal regression coverage** - `test/smoke/dashboard-endpoints.test.ts` now pins the Windows runner-shim preference plus both Windows and POSIX PTY launch plans. The same file's path-validation assertion now uses `fileURLToPath(import.meta.url)` so the smoke suite exercises the intended "not a directory" branch on Windows too.
- **Cross-platform dashboard build scripts** - `package.json` now uses `node:fs` helpers for build cleanup, chmod, and dashboard asset copy steps instead of shell-specific `rm`, `mkdir`, `cp`, and `chmod` chains. `npm run build` / `npm run dashboard` now work under native Windows `cmd.exe` instead of failing at `mkdir -p dist/dashboard` with `The syntax of the command is incorrect.`
- **Dashboard Home audit latency fix** - Home-summary `/api/audit` loads now request presence-only deny-hook evidence so the page no longer pays four per-agent `deny-dangerous.sh --self-test` runs on Windows before rendering. Deeper verification paths such as explicit per-agent audits and quality/setup flows still keep full runtime deny-hook validation.
- **Audit-route regression coverage** - `test/integration/dashboard-server.test.ts` now pins the `/api/audit` summary contract that skips deny-hook self-tests during dashboard summary loads, while `test/integration/audit-build.test.ts` keeps the deeper quality/setup audit isolation checks in place.
- **Learning-loop guidance** - `.goat-flow/learning-loop/patterns.md` now captures the rule behind the dashboard latency fix: summary surfaces should use cheap evidence, while drill-in routes keep the expensive runtime proofs.

## v1.3.0 - 2026-04-27

Plan completion protocol, browser-use shared reference, hook/push enforcement, dashboard prompt/quality upgrades, instruction artifact routing, harness-score honesty, performance/reference-version improvements, harness docs, and README rewrite.

- **Browser-use shared reference** - Browser-use guidance consolidated from per-skill copies into `.goat-flow/skill-docs/browser-use.md`. `/goat-debug` now detects UI bugs at Step 0, uses browser-use for D1 hypothesis testing and D4 post-fix verification, and offers installation guidance when unavailable. Manifest, install, drift, preflight, and quality checks treat browser-use as shared doctrine.
- **Hook and push enforcement** - ADR-025 blocks all agent-initiated `git push` across README, Help, harness, hook, and settings surfaces. Deny hooks gained no-space redirect detection (`echo foo>.env`), escaped regex dots to prevent false positives, `npm token delete/revoke` blocking, command-parsing fixes, and aggregate audit-scope support. New hook version comparison audit and hook drift detection in `check-drift.ts`; `bump-version.sh` syncs hook templates to all installed mirrors.
- **goat-plan Phase 4 - Plan Complete** - Formal completion protocol requiring an AI verification gate (every milestone, task, exit criterion, and testing gate evidenced from the current session) and a blocking human verification gate before close-out. Agents must not self-destruct plan artifacts or delete files without approval. Added to `skill-conventions.md` as shared doctrine.
- **Skill protocol hardening** - `/goat-plan` adds a mid-implementation proof checkpoint. `/goat-review` discovers PR base dynamically instead of assuming `origin/main` and separates reporting-only DoD from implementation DoD. `/goat-qa` includes Verification Integrity in first gap-analysis output. `/goat-critique` checks sub-agent output completeness before trusting self-report. Delegation-consent and interruption-freeze wording tightened across skill and instruction surfaces.
- **Quality modes and reporting** - `goat-flow quality . --mode <mode>` for mode-specific prompts, history, and diffs. Dashboard quality page adds GOAT Flow Process, Agent Installation, Harness Engineering, and Skills modes with the same persistence and validation contract as agent setup. Report contract enforces provenance fields (`scope`, `rubric_version`, `quality_mode`, per-finding `evidence_method`); dashboard uses injected package version.
- **Dashboard upgrades** - Custom prompt library with create/edit/delete, favorites, and global-safety gating. Preset catalog carries richer metadata (route, source, prerequisites, write risk, cost tier) with dry-run launch tests. Home/Workspace views improve cached-audit age display (minutes to hours to days) and tighten terminal/session handling for project switching. "Agent Setup Quality" renamed to "Agent Installation."
- **Performance** - Request-scoped read cache in `createFS` eliminates redundant disk reads across audit passes. `runAuditBatch()` shares config across aggregate and per-agent passes, removing the N+1 re-parse pattern. Quality history scans newest-first and stops at the first valid match. Agent detection and learning-loop enrichment cached with TTL. Audit cache writes switched to async fire-and-forget.
- **Reference version auditability** - Shared skill references, goat-security reference packs, and fixtures now carry `goat-flow-reference-version` frontmatter. `bump-version.sh`, `check-versions.mjs`, preflight, quality prompts, and contract tests verify reference docs alongside `SKILL.md` frontmatter.
- **Harness scoring honesty** - Feedback-loop checks now fail on stale footgun/lesson file references instead of treating them as informational. Recovery harness reports milestone checkbox progress as informational context rather than failing on unchecked gitignored files. Workspace Boundary treated as qualitative cross-cutting risk, not a deterministic harness score.
- **Instruction artifact routing** - `CLAUDE.md`, `AGENTS.md`, `GEMINI.md`, Copilot instructions, setup templates, and skill preamble now route "add a footgun/lesson/decision/pattern" requests to documentation artifacts instead of runtime code. README guidance added to footgun and lesson buckets.
- **Harness engineering site** - Standalone harness engineering page with structured data, SEO metadata, and OG imagery. Landing assets moved under `docs/site/`; footer and redundant-link copy cleaned up.
- **Learning loop** - `sizeBytes` property in bucket stats; `stats --check` warns when any bucket exceeds 40KB. Home view handles missing `footgunCount`/`lessonCount` gracefully. New lessons for deny-hook probe coverage and preflight-as-release-gate failures; new footguns for portable PR base selection and shared-reference drift. Stale local-path evidence rewritten.
- **README rewrite** - Dashboard-first positioning with view-by-view descriptions (Home, Setup, Prompts, Workspace, Projects, Quality) replacing the previous execution-loop framing. Updated getting-started and feature comparison table.

## v1.2.5 - 2026-04-24

CLI silently exited without running when invoked through a symlink - which is every `npx goat-flow`, `./node_modules/.bin/goat-flow`, and npm `scripts` invocation. Fixed the main-module guard and added a regression test.

- **fix: CLI no-op via symlink** - The ESM main-module guard compared `resolve(process.argv[1])` against `fileURLToPath(import.meta.url)`. `path.resolve()` does not follow symlinks, but Node's ESM loader resolves symlinks for `import.meta.url` by default. When the CLI was launched through the `node_modules/.bin/goat-flow` symlink (the standard npm/npx path), the two sides never matched, `main()` never ran, and the process exited 0 with zero output. The fix wraps both sides in `fs.realpathSync()` via an `isMainModule()` helper, with a try/catch for synthetic `argv[1]` values. Introduced in 918ca3e (v1.2.4).
- **regression test** - `test/integration/main-guard.test.ts` creates a temp-dir symlink to `dist/cli/cli.js` and verifies `--version` produces output through both the symlink and the real path. This is the exact invocation path that broke.
- **footgun** - New `.goat-flow/learning-loop/footguns/cli.md`: "ESM main-module guard breaks under symlinks" documents the structural trap and prevention rules.
- **lesson** - `.goat-flow/learning-loop/lessons/verification.md`: "Test suite must exercise the published invocation path" - all 359 tests passed while the CLI was broken for every real consumer, because no test went through the `.bin/` symlink.

## v1.2.4 - 2026-04-23

Quality report fixes, node-pty as optional dependency, configurable terminal timeout, dashboard settings/export, QA prompt improvements, preset prompt library expansion, ADR-024 semantic anchors, manifest snapshot backfill, and lesson line-ref validation.

- **node-pty optional** - Moved from `dependencies` to `optionalDependencies`. Install no longer fails on Linux/WSL without C++ build tools. Dashboard terminal banner now shows platform-specific install guidance.
- **Terminal timeout** - Configurable idle timeout via `config.yaml` `terminal.idle-timeout` (default 8 hours, was hardcoded 60 min). `0` disables auto-kill. Dashboard settings view shows current value.
- **Session export** - Export button on workspace sessions downloads terminal output as `.txt`.
- **Deny hook fix** - Quoted literal backticks (e.g. `printf 'use \` here'`) no longer trigger false-positive command-substitution blocks.
- **Content quality audit** - Setup templates excluded from legacy execution-loop detection. ADR-021/022/023 added to target list and decisions README.
- **Instruction file retrieval** - All four agent instruction files now include `.goat-flow/learning-loop/decisions/` in retrieval for architecture/policy/setup tasks.
- **goat-qa skill** - Standard mode output template split into Phase 2 (gap analysis, presented at gate) and Phase 3 (testing plan, gated by approval). Step 0 retrieval now includes patterns.md and decisions.
- **Preset prompts** - 23 to 28 presets. Five new: Critique a Plan, Critique an Artifact, Pressure-Test a Skill, Mermaid Flow Diagram, Test Plan vs Code Changes. Existing presets sharpened with change-type-first probing, tester-voice, output format hints, and security lenses.
- **docs/skills.md** - Planning Route corrected (File-Write default at Standard+). goat-critique sub-agent count corrected to 3. goat-qa Standard trigger clarified.
- **ADR-024: Semantic anchors over line numbers** - Line numbers banned from footgun/lesson evidence. All entries migrated to grep-friendly `(search: "pattern")` anchors. Instruction files (CLAUDE.md, AGENTS.md, GEMINI.md, copilot-instructions.md) and evaluation templates updated. `stats --check` validates search anchors against file content, catching stale evidence that line-number validation never could. Propagation sweep: `compose-quality.ts` quality prompt, `harness-quality.md`, `harness-audit.md`, setup templates (footguns-readme, 05-customise, 06-final-verification), `skill-conventions.md` entry templates, `glossary.md`, `architecture.md`, `code-map.md`, `README.md`, `goat-flow-landing.html`, and `help.html` all updated. Live-work contexts (skill-preamble, execution-loop VERIFY, adversarial-framing, review/debug/security/critique skills) correctly retain `file:line` for fresh code citation. Glossary Evidence Standard entry updated to describe both modes.
- **Manifest snapshot backfill** - Frozen v1.2.0–v1.2.4 snapshots added to `workflow/manifest-snapshots/`. Snapshot test expanded from single-version to all-release coverage (v1.1.0–v1.2.4). README updated with version table.
- **Lesson line-ref validation** - `invalidLineRefs` added to lesson facts in `stats --check` (was footguns-only). Lessons with out-of-bounds `file:line` refs now surface in health checks.
- **Decisions directory** - `.gitkeep` replaced with `README.md` containing ADR writing guidance. Installer copies the template; manifest and audit check updated for the new anchor file.
- **Quality prompt hardening** - `compose-quality.ts` adds a CRITICAL write-verification step: agents must `ls` the output file after writing to confirm it persists. `docs/audit-and-quality.md` corrected from "runs 7 skill invocations" to file-analysis-preferred approach.
- **Content-drift Round 3** - 3 findings from independent Copilot quality reports resolved: `docs/skills.md` /goat-plan summary, quality assessment invocation language, and architecture hot-path listing now includes `copilot-instructions.md`.
- **Learning loop** - 3 new lessons: fresh-eyes critique leak-scan citation format, line-number evidence debt (ADR-024 origin), snapshot fixture metadata beyond typed contract. 5 bucket files reviewed (2026-04-24).
- **Ask First boundary** - `.goat-flow/skill-docs/` added to CLAUDE.md Ask First boundaries. Shared doctrine loaded by every skill now requires approval before edits.
- **Presenting Findings format** - `skill-conventions.md` gains a "Presenting Findings" section standardising summary/problem/solution one-liner format for tasks, findings, and recommendations.
- **GEMINI.md cleanup** - Removed stale `.github/instructions/` from local-instruction checklist. Footgun evidence guidance updated to semantic anchors.

## v1.2.3 - 2026-04-22

`.env.example` read-only handling, richer dashboard presets, dashboard audit caching, reporting-only quality prompts, active-plan local-state handling, goat-critique contract tightening, terminal fixes, prompt-label tracking, deployment scripts, prompt-loading polish, shared-reference doc cleanup, widened dashboard lint coverage, and goat-qa gate clarification. 19 commits, 92 files changed, 2,584 insertions, 708 deletions.

- **Secret-file guardrails** - `.env.example` allowed for read-only inspection; real `.env`/`.env.*` and other secret paths stay blocked. All `deny-dangerous.sh` copies, agent settings, and ignore files updated with self-tests for the distinction.
- **Dashboard** - Richer preset prompts with explicit scope/evidence/handoff framing. Audit caching for packaged installs (keyed by version, `fresh=true` bypass). Dedicated loading states for setup/quality. Prompt labels now carry the runner name so terminal sessions show which agent launched them.
- **Terminal fixes** - Per-runner prompt flag (`-i`) for Copilot/Gemini sessions. Fixed duplicate paste from browser default handler firing alongside xterm clipboard write.
- **Landing page and deployment** - Standalone product page (`docs/goat-flow-landing.html`). New `deploy-landing.sh` (S3/CloudFront/ACM/Route 53) and `bump-version.sh` (version bump across all files in one pass).
- **Quality prompts** - "Reporting-only" mode replaces strict read-only language, allowing gitignored validation artifacts while forbidding tracked-file writes. Walkthrough comment prompt added. Execution-loop and footgun evidence corrected.
- **Skill contracts** - goat-critique: explicit invocation binding (no triviality bypass), tighter retrieval/rubric handling, context-leak scanning, per-agent tool budgets. goat-qa: Phase 2 is now a blocking gate awaiting human decision before producing the test plan.
- **Active plan semantics** - `.goat-flow/plans/.active` treated as an advisory local pointer, not a setup invariant. Missing/stale markers fall back to listing task dirs and asking. ADR-017, glossary, code-map, and quality prompt aligned.
- **Shared-reference docs** - Explicit `skill-quality-testing` split-file references replace brace shorthand. goat-security project-policy template documented across all agent skill copies.
- **Preflight coverage** - ESLint widened to `src/dashboard` in preflight and CI. Dashboard lint config and cleanup so the wider gate passes.
- **Cross-doc cleanup** - Router tables, code-map script listings, and instruction-file references synced to match current filesystem state.

## v1.2.2 - 2026-04-21

Dashboard browser-code split, release metadata bump, and CLI documentation corrections.

- **Dashboard app split** - `src/dashboard/app.ts` is now the Alpine state/composition layer, with readers, projects, prompts, setup/quality, and terminal flows moved into focused classic browser scripts loaded before `app.js`.
- **Asset coverage** - Dashboard integration tests now assert the split script tags and asset endpoints. Knip ignores cover the classic script entry points so unused-export checks do not treat script-tag globals as dead code.
- **Docs + release metadata** - README and public docs now consistently show `npx goat-flow` for package usage. Package, manifest, config, instruction headers, skill frontmatter, and current test stubs are bumped to v1.2.2.
- **Cleanup** - Removed dead type imports exposed by full typecheck and formatted the prompts view so preflight remains clean after the split.

## v1.2.1 - 2026-04-20

Dashboard project rename, `gh`-powered PR/issue intake for `goat-review` and `goat-qa`, install anchors for `decisions/` and `logs/sessions/`, and follow-up doc/footgun/lesson fixes.

- **Dashboard project rename** - Inline header rename (double-click name or ✎ button) with user-supplied titles persisted alongside paths/favorites in `.goat-flow/dashboard-state.json`. New `decodeProjectTitles` server-boundary decoder (120-char cap, whitespace-only drops the override so clearing round-trips to the path-derived fallback). `displayNameFor(path)` replaces path-basename derivation across sorting, projects page, and sessions rail. Project accent color is now hashed from path (not display name) so renames don't shift the color.
- **External context sources (shared preamble)** - New section in `.goat-flow/skill-docs/skill-preamble.md` making `gh` (when installed and authenticated) the preferred channel for issues, PRs, Dependabot alerts, and CI runs. Fetched content is treated as citable evidence; when `gh` is missing the user is asked to paste rather than have the skill fabricate.
- **goat-review PR intake** - "PR mode" now asks for a PR URL or number first (`gh pr view --json` + `gh pr diff`) instead of the base-branch prompt - one input collapses base, head, description, and linked issues. Base-branch-vs-fetch flow retained as fallback when no PR link is supplied or `gh` is unavailable. Updated across `.claude/`, `.agents/`, `.github/`, and `workflow/` skill copies.
- **goat-qa PR / issue intake** - Step 0 Intake now asks for the linked PR or issue (`gh pr view` / `gh issue view`) so gap analysis maps against stated acceptance criteria rather than code shape alone. New `no-intent-spec` degradation flag in Verification Integrity when the spec is unavailable. Updated across all four skill copies.
- **Install + manifest anchors** - New `touch_anchor` helper in `workflow/install-goat-flow.sh` seeds `.goat-flow/learning-loop/decisions/.gitkeep` and `.goat-flow/logs/sessions/.gitkeep` on install so the learning-loop + continuity-note directories exist in fresh projects. `workflow/manifest.json` adds both anchors to required paths.
- **Preset prompts** - "Testing Gap Analysis" renamed to "Testing Gap & Overlap Analysis" with a new PR-scoped prompt body: overlap audit that excludes work already covered by PHPStan / Doctrine / CI access-control scanner / PHPUnit / Cypress / dev notes / Copilot review comments, then four grounding questions (A. entry points, B. production data shape, C. access control, D. prior incidents) with VERIFIED/INFERRED labels, then a time-budgeted residual test plan ranked by signal-per-minute, a sufficiency verdict, and one "action required on PR" item when testing can't compensate for a code-level issue. Description updated to match.
- **Docs + footguns** - `README.md` switches from `npx goat-flow` to `goat-flow` in usage examples (expects a global install). `docs/audit-and-quality.md` satellite-agents example corrected (`.gemini/skills/` → `.github/skills/`). New footgun in `.goat-flow/learning-loop/footguns/docs-and-crossrefs.md`: **Prose examples for agent-specific paths drift from the manifest** - name-based inference (`gemini` → `.gemini/skills/`) is wrong by default because codex and gemini both share `.agents/skills/`, and `doc-paths-resolve` only checks existence, so a plausible-but-wrong path that happens to exist passes the audit silently. Prevention: grep `workflow/manifest.json` before hand-writing agent-specific paths. `goat-plan` Excuse/Reality table drops the "team is experienced, spike is overkill" row.
- **Lesson + auditor footgun** (`1899366`) - Preflight's sanitization pipeline (`| grep -oE '^[0-9]+$' | tail -1`) could turn non-empty node output into empty output for the first time; `setup_count` was only assigned inside the `[[ -n "$build_count" ]]` branch but referenced unconditionally later, crashing under `set -u` with `unbound variable`. New lesson in `.goat-flow/learning-loop/lessons/agent-behavior.md` on tracing downstream references when adding output filters, and a matching auditor footgun update.

## v1.2.0 - 2026-04-20

Skill renames, Copilot CLI support, audit subsystem expansion (drift/content/manifest), proof-gate verification, structured learning loop, and a quality-report follow-up wave that closed a CRITICAL Bash secret-read gap. 324 files changed, 86 commits.

- **Renames** - `goat-sbao`→`goat-critique`, `goat-test`→`goat-qa`, CLI `critique`→`quality`. Old names recorded in `workflow/manifest.json:stale_names`. Dashboard view, `/api/critique`→`/api/quality`, `critique.html`→`quality.html`, `docs/audit-and-critique.md`→`docs/audit-and-quality.md`.
- **Copilot CLI** - 4th agent (ADR-020). `.github/skills/`, `.github/hooks/`, `.copilotignore`, standalone `.github/copilot-instructions.md`. `deny-dangerous.sh` emits `permissionDecision` JSON for all four agents.
- **Audit + manifest** - New `audit --check-drift` (installed vs template skills), `audit --check-content` (cold-path linter for docs/footguns/lessons), `goat-flow manifest` (validate/list/show). Factual + snapshot claim checks against `workflow/manifest.json`. Dead-CLI-command scanning in fenced code blocks. `getProjectStructure()` removed; callers use `loadManifest()`.
- **Harness typing** - 16 checks split into `integrity`/`advisory`/`metric`. Score reflects integrity + unacknowledged advisory only. `harness.acknowledge: [check-id]` opts out deliberate skips. `Notification`/`compact` hook removed (never a real Claude Code event).
- **Hallucination red-flags** - 5 rules added to CLAUDE.md VERIFY: tests-pass needs terminal output, completion needs files-list, fix needs reproduction steps, no hedged claims, check-passed needs verbatim output.
- **Proof-gate + skill hardening** - Shared evidence gate (file:line, exit codes, transcripts) across `goat-debug`/`goat-qa`/`goat-review`/`goat-security`. goat-review: two-pass reading, severity (BLOCK/WARN/NOTE) + action (FIX/INVESTIGATE/ACCEPT) tags, spec-drift lane, Review Integrity self-check. goat-qa audit mode: A1 scope→A2 inventory→A3 coverage→A4 gap report. goat-critique locked to delegated-only mode (ADR-021).
- **goat-security** - 7 per-topic reference packs: auth-authz, cicd-and-agent-surfaces, common-threats, dependency-and-supply-chain, file-upload-and-paths, project-policy-template, secrets-and-data-exposure (ADR-023).
- **Learning loop** - `last_reviewed` frontmatter on footguns/lessons/decisions. New `goat-flow stats --check` with per-bucket freshness bands + search-anchor resolution. Active-plan marker `.goat-flow/plans/.active` disambiguates live vs archived plans. 6 glossary terms added.
- **Quality reports** - Agents write JSON directly to `.goat-flow/logs/quality/` (HHMM+rand5 filename); `quality capture` removed. Schema v2 adds per-finding `evidence_method` + optional `scope`/`rubric_version`. New `goat-flow quality validate` and dashboard quality-history view.
- **Dashboard** - Dedicated Prompts page with category filters, Sessions rail (cap=10), quality-history view. Server split into `dashboard.ts` + `dashboard-routes.ts` + `dashboard-terminal.ts` + `setup-detect.ts` + `dashboard-assets.ts`. Presets moved to `src/dashboard/preset-prompts.json`, stack tables to `workflow/project-stack-data.json`. State persistence in `.goat-flow/dashboard-state.json` (was port-scoped localStorage).
- **goat-critique overhaul** - Conversational Phase 4 gate (question-first format with defaults), top-of-output Verdict block, SKEPTIC/ANALYST/STRATEGIST as explicit per-finding sub-fields, rubric coverage gates, Phase 3 budget cap (max 3 cross-exam agents) + early-exit on consensus, Agent C isolation hardening, Phase 3 persistence to `.goat-flow/logs/critiques/`, sharpened Agent B (ranked alternatives + must-surface-one).
- **follow-ups** - CRITICAL: `deny-dangerous.sh` now blocks Bash reads of `.env*`/`.ssh/`/`.aws/`/credentials/`*.pem`/`*.key` across all 4 hook dirs (settings.json Read() deny doesn't bind Bash). Server-boundary runtime decoders (`src/cli/server/decoders.ts`) for every HTTP/WS ingress. `loadConfig` fail-closed on validation error. Agent-id canonical source: `AgentId` union + `KNOWN_AGENT_IDS` tuple (ADR-022). Dashboard under TS bar. CLI ESLint 20→0 warnings. `npm test`: 307/307.

## v1.1.0 - 2026-04-17

Scanner/rubric system removed. Replaced by deterministic audit with 16 build checks (12 project setup + 4 per-agent) and 16 advisory harness checks across 5 concerns. Deterministic install script. Dashboard overhaul with dynamic recommended actions. 528 files changed.
- 
- **Critique Fixes** - Dual-critique synthesis resolved 10 findings. Fixed architecture.md build check count (17→16). Removed stop-lint.sh from core (project-specific concern, will revisit in a later version). Resolved 3 stale footgun entries (advisory hooks, swallows failures, dispatcher verb gap). Removed dead goat-review "code-review instruction file" reference. Reworded goat-test "multi-model" to actionable "cross-agent verification". Added analyse/evaluate/critique verbs to dispatcher disambiguation table. Improved critique prompt with 7 refinements: no-mutation warning, audit PASS caveat, severity definitions, scoped tool guidance, footgun currency checks, numeric claim verification, skill testing clarification.
- **Audit System** - Replaced scanner/rubric engine (79 checks + 12 anti-patterns, point-based scoring) with audit system. 12 project-wide setup checks (config, directories, required files) are agent-agnostic. 4 per-agent checks (instruction file, skills, settings, deny-dangerous hook) run independently per agent. Advisory harness scoring (`--harness`) grades 5 concerns with 16 checks total: context, constraints, verification, recovery, feedback loop. Audit became the sole evaluation engine.
- **Install Script** - `workflow/install-goat-flow.sh` handles all mechanical file copying: 7 skill templates, hooks, settings, templates, reference files, config scaffold. Deterministic, agent-aware (`--agent claude|codex|gemini`), idempotent. A separate migration script existed during v1.1.0 and was later removed as unused.
- **Setup Prompts** - Stripped stack/toolchain info, signal-driven tasks, stale artifact cleanup, multi-agent consistency directives. Setup prompt now: run install script → follow numbered setup steps → verify with audit. Upgrade prompt (v0.9/v1.0) structured as numbered steps with scripts first.
- **Dashboard** - Dynamic recommended actions panel: setup failing → fix wizard + fix agent buttons; harness checks failing → fix harness buttons; quality < 100% → fix harness buttons with per-concern recommendations; healthy → review/test/security presets. Per-agent harness score cards with grade, concern bars, and expandable recommendations. Projects page sorts alphabetically, clicks navigate to home view.
- **Config Agent Filtering** - Auditor respects `config.yaml` agents list. Project setup checks are agent-agnostic. Per-agent checks only run for agents with instruction files present. Config always lists all three agents (claude, codex, gemini) - setup is per-agent, not project-locked.
- **CLI Renames** - `--quality` → `--harness`. `quality-checks.ts` → `harness-checks.ts`. `build-checks.ts` → `agent-setup-checks.ts`. Dashboard label "AI Harness Checks" → "Agent Setup Checks".
- **Critique** - `goat-flow critique . --agent claude` generates agent-driven review prompts from audit data. Separate from audit (subjective vs deterministic).
- **Security** - `execSync` → `execFileSync` in hook syntax validator (shell injection fix). Host header validation on all dashboard API routes.
- **Skills** - 7 canonical skills (goat, goat-debug, goat-plan, goat-review, goat-sbao, goat-security, goat-test). Quick/full depth modes. Conversational structure with Step 0 adaptive gate. Skills installed verbatim from templates - project-specific context comes from instruction file and `.goat-flow/` docs.
- **Setup Flow** - 6 numbered steps (system overview → instruction file → install skills → architecture/code-map → customise → verification). Agent-specific configs in `workflow/setup/agents/`. Upgrade paths for v0.9 and v1.0 projects.
- **Hooks** - `deny-dangerous.sh` supports stdin and argv input, `--self-test` flag, blocks `rm -rf`, force push, `--no-verify`, `chmod 777`, pipe-to-interpreter patterns. Post-turn lint hook removed from core - project-specific concern (see `workflow/hooks/README.md`).
- **Templates** - 5 project templates (feature-brief, mob-elaboration, compliance-checklist, flow-diagram-guide, requirements-template) remain in `workflow/templates/` as reference material. Removed from core install (no longer copied to `.goat-flow/templates/`).
- **Tests** - 51 tests across unit, integration, and contract suites. Config filtering, scope coverage, quality concern coverage, cross-agent consistency.


## v1.0.0 - 2026-04-05

Version bump from v0.10.0 for semver compatibility (`^0.9.x` won't resolve to `0.10.0`).

- **CLI** - Removed `--no-open` flag and auto-open browser logic from dashboard. Removed `spawn` import. Dashboard always prints URL, user opens manually.
- **Dependencies** - `ws` moved from optionalDependencies to dependencies (required for dashboard WebSocket). `node-pty` stays optional.
- **Keywords** - Added `ai-agent`, `claude-code`, `copilot`, `dashboard`, `llm`, `scanner` to package.json for npm discoverability.

## v0.10.0 - 2026-04-05

SBAO Phase 3, dashboard redesign, rubric priority grading, security hardening, copilot support, 48-file CLI refactor. 115 checks + 20 anti-patterns. 1,166 tests.

- **Dashboard Redesign** - Neutral zinc palette (#1a1a1e/#111114/#27272a), CSS extracted to `styles.css`, JS extracted to `app.js` (index.html 89 lines). Dark/light themes with `gf-*` design token classes. Live reload dev mode (`npm run dev`).
- **Home Page** - Action-driven: dynamic "What to do next" cards (issues → fix/details/workspace, passing → code review/test/security with play icons). Scanner-style 4-column agent cards with color-coded tier bars (green >80%, orange 50-80%, red <50%). Agents table with per-agent terminal launch. Welcome state for unconfigured projects.
- **Scanner** - Single-page with inline detail expansion (no separate detail page). Hover states via CSS classes. Severity badges themed for light mode.
- **Workspace** - Prompt preview on sidebar click (right panel shows prompt text + Launch button). Run state tracking (amber running, green pass). Category-colored filter pills. Round outline play/send buttons.
- **Setup** - Left column card (title + agents + detected config), right prompt card with dark code background. "Formatter" label. Page heading.
- **Config** - Two-row layout (path picker + role selector). userRole toggle (click to select, click again to deselect). Local-only (not in committed config). "Open Setup Wizard" button when config.yaml missing.
- **Header** - Centered nav, goat emoji, green project name. "Terminal:" agent selector with disabled state during session. Green dot on Workspace nav when terminal running.
- **Copilot** - Agent detection, terminal sessions, Runner type, RUNNER_BINARIES. Dashboard showed a dimmed card when not scanned. This experiment was later removed.
- **Security** - Host header validation on all API routes (DNS rebinding). Write/Edit deny for 12 sensitive file patterns. Terminal resize validation (`clampDim`). Session map cleanup on kill.
- **persona→userRole** - Renamed across config reader, types, facts, rubric, prompts, tests, fixtures. Added `tester` to schema.
- **SBAO** - goat-plan Phase 3 rewritten as multi-agent critique: 2 core trio + 1 fresh-context (never split perspectives). Bold reminder in skill file. SBAO routing in dispatcher.
- **Presets** - all 19 rewritten to `/goat [plain language]`. Guided forms removed.
- **Rubric** - priority field (required/recommended/optional) on all checks. Grade: A=all req+rec, B=all req+80% rec, C=all req. Full tier bonus-only. 24 checks hidden. `telemetry` in KNOWN_TOP_LEVEL_KEYS.
- **Scanner** - hook honesty, router validation, severity-grouped output. GOAT_FLOW_INLINE_SETUP dead code removed.
- **CLI** - 48 files refactored, 45→0 complexity violations. `setup/`→`workflow/setup/`, `ai/`→`.goat-flow/`. Server logging (errors, host blocks, dev request log).
- **Learning Loop** - category bucket files. Alpine.js `:style` footgun documented. SBAO agent structure lesson (3 recurrences). Checkbox discipline lesson (3 recurrences).
- **Tests** - 275→1,166. Terminal idle timeout updated for session deletion. Tautological/dead assertions fixed. deny-dangerous.sh hardened (long-form flags, pipe-to-interpreter).
- **Structure** - `docs/skills/` with Mermaid diagrams, `.goat-flow/glossary.md`, preflight with decimal timing. Footer: "Built by BlunderGOAT · v0.10.0".

## v0.9.4 - 2026-04-02

Scanner honesty, config file, directory restructure, embedded terminal, dashboard UX. Driven by 6 cross-project reviews + real-project testing. 275 tests.

- **Scanner** - stop faking Codex enforcement facts, remove harmful AP2, fix goat-goat derivation bug, new AP20/AP21, `.env` Edit/Write deny check, devDeps-only JS detection
- **Config** - `.goat-flow/config.yaml` with `js-yaml`, directory-based footguns/lessons (YAML frontmatter entries), committed vs local split, migration scripts
- **Restructure** - `docs/lessons/`→`.goat-flow/learning-loop/lessons/`, `docs/decisions/`→`.goat-flow/learning-loop/decisions/`, `agent-evals/`→`.goat-flow/evals/`, `ai/instructions/`→`.goat-flow/coding-standards/`, `tasks/`→`.goat-flow/plans/` (gitignored)
- **Skills** - all 5 check footguns in Step 0, dispatcher enriched with modes/chaining, version sync to 0.9.4
- **Setup** - stale skill cleanup (8 old names), router rewrite, static CI template, format hook wires into settings.json
- **Terminal** - `node-pty` + `ws` as optionalDeps, `TerminalManager` with multi-runner (claude/codex/gemini), REST API (create/list/delete/health), WebSocket streaming, idle timeout, Origin check. xterm.js lazy-loaded from CDN, Launch button on preset cards, Setup Launcher panel (pick agent + runner), session indicator, Ctrl+Shift+D exit
- **Dashboard** - dark mode toggle fixed, copy feedback on cards, Escape collapses checks, agent switch preserves tab, Reset filters, brighter focus rings, anti-patterns hidden during search. Deep Critique preset added (6-phase system review)
- **Tests** - 239→275 (+36). New: eval parser/loader, serve-dashboard API, terminal server

## v0.9.3 - 2026-03-30

Skill consolidation, scanner improvements, enforcement hardening. Driven by cross-project reviews from consumer projects. 101 checks + 17 anti-patterns. 216 tests.

- **Skills (9→6)** - goat-investigate/simplify/refactor merged into goat-debug/review/plan as modes. goat-security expanded with compliance + dependency audit. Dispatcher added as 6th canonical skill. All synced across 3 agent dirs. 1,790→1,067 lines.
- **Scanner** - AP deductions in default output. AP18 (ADAPT comments), AP19 (absolute paths in hooks). Fabrication detection validates file:line ranges. CI patterns hardened to invocation matching.
- **Enforcement** - `.env` Edit/Write deny. Format hook skips agent config dirs. guard-write-size.sh template. `--dangerously-skip-permissions` bypass documented.
- **Setup** - Migration fragments include router + CI sync. Python subdirectory detection fix. Ask First short/full forms. Dispatcher disambiguation + target-aware routing.

## v0.9.2 - 2026-03-30

Post-publish fixes. README restructured as dashboard-first. npm package description updated. Dashboard removed auto-open browser. Setup prompt "9 skills" wording fixed.

## v0.9.1 - 2026-03-30

Dashboard, full coding-standards wiring, skill conversation enforcement, npm publish. 103 checks + 16 anti-patterns. 191 tests.

- **Dashboard** - `goat-flow dashboard` local server with live scanning, 4 tabs, dark mode, ARIA accessibility. Alpine.js + Tailwind CSS v4 via CDN. `--format html/markdown` for reports.
- **Coding Standards** - All 57 templates routed (was 25). Framework detection: Laravel, Symfony, Django, FastAPI, Rails, Spring, Express, Cypress. 21 new fragment map entries.
- **Skills** - All 9 synced across 3 agent dirs (27 files). Step 0 adaptive gate. 100% conversational compliance (was 80%). Restored audit/onboard/hypothesis features.
- **Scanner** - Removed 2.2.5g (package mutation deny). Dispatcher counted for evaluation diversity. XSS fix, CORS wildcard removed.
- **npm** - Published as `@blundergoat/goat-flow`. 197 files, 300KB packed. Source maps excluded. `--output` flag.

## v0.9.0 - 2026-03-29

Dispatcher skill, coding-standards refresh, scanner hardening, telemetry, signal-aware setup. 104 checks + 16 anti-patterns. 167 tests.

- **Coding Standards** - Backend: Go/DRF/Rust/Spring/.NET/TS Node. Frontend: 9-framework routing. Security: llm-security, phi-compliance, 5 framework-specific. DevOps: terraform, packer.
- **Scanner** - Dispatcher + Shared Conventions checks. AP16 deprecated skills (-5), AP17 dangling refs (-3). Signal follow-through (LLM, PHI, formatter). Eval frontmatter enforcement.
- **Setup** - `mapSignalsToTemplates()` auto-routes phi/llm templates. `renderSignals()` produces tasks. `scan-logger.ts` per-agent JSONL.
- **Skills** - Dispatcher + Shared Conventions across all dirs. Preflight: headers, skills, templates, dual-agent consistency. Format hook (prettier), deny hooks (package + cloud).

## v0.8.0 - 2026-03-28

Skill model cleanup (10→8), setup prompt fix, documentation alignment, rubric scoring cleanup. 97 checks + 15 anti-patterns. 138 tests.

- **Rubric** - Advisory checks converted to scored. Zero-point checks removed. Empty decisions dir moved to AP16. Handoff template requires all 5 sections.
- **Skills (10→8)** - goat-reflect/audit→goat-review, goat-onboard→goat-debug, goat-context removed. goat-investigate/simplify/refactor merged as modes. Deprecated dirs deleted. This was later subsumed by the 9→6 consolidation.
- **Setup** - Fragment map fix (add-skill-* no longer resolve to goat-debug). `--agent all` removed. Language mapper expanded to 10 languages.
- **Docs** - 21 stale "10 skills" refs fixed across README, docs/, setup/, src/cli/. CI template fixed to canonical 8 skills. Setup prompts remained reference-based.
- **Tests** - 96→138. Full-pass fixture updated. 9-project audit: all score A (96-100%).

## v0.7.0 - 2026-03-26

Reference-based setup prompts, scanner accuracy, CLI simplification. Setup output ~860→~90 lines. 92 checks + 12 anti-patterns.

- **Setup** - ~90-line prompts with template path tables. Agent-branched tables, language mapper, `GOAT_FLOW_INLINE_SETUP=1` rollback.
- **Scanner** - 3.3.4 sync Jaccard ≥0.85. Lessons strips HTML comments. AP11 fires on EITHER empty. Check 2.2.7 removed with the ask-first-guard rollback.
- **Templates** - enforcement.md jq/sed guidance. docs-seed.md concrete commands. execution-loop.md DoD gate.
- **Removed** - `fix`/`audit` CLI commands. ask-first-guard hooks. 77→96 tests.

## v0.6.0 - 2026-03-24

10 skills, 49 coding standards, eval runner, multi-agent infra, CLI quality overhaul. 94 checks + 12 anti-patterns.

- **Scanner** - 4 new checks, 3 new APs. Confidence-weighted scoring. Deny hook security audit. Projects drop from 100% to 92-99%.
- **Skills** - 10 skills (+goat-onboard/reflect/resume). 49 coding standards (backend 13, frontend 14, security 12). Eval runner with YAML frontmatter.
- **CLI** - 0 ESLint warnings, 0 knip exports. 6 god functions split. JSDoc on all 35 files. Strict tsconfig.
- **Infra** - .codex/ dir, composite GitHub Action. Deny hooks hardened. CODEOWNERS, CONTRIBUTING, SECURITY added.

## v0.5.0 - 2026-03-22

All 7 skills rewritten with conversational structure. 84 checks. All 3 agents score A 100%.

- **Skills** - goat-preflight→goat-security. Conversational choices at every phase. goat-debug recurrence, goat-plan kill criteria, goat-test Track 0, goat-review diff-aware.
- **Scanner** - Quality threshold unified at 0.8. New: skill chaining (2.1.14), structured choices (2.1.15).
- **Infra** - Preflight rewritten. CLAUDE.md compressed to 119 lines. Copilot bridge file.

## v0.4.0 - 2026-03-22

CLI scanner + prompt generator, local context system. 80 checks. All 6 projects score A (93-98%).

- **Scanner** - 80-check rubric (3 tiers + 9 APs), 90 prompt fragments. `scan`/`fix`/`setup`/`audit` commands. `--min-score` CI gate. 78 tests.
- **Local Context** - `.goat-flow/coding-standards/` with router. Copilot bridge files. 11 workflow templates. Migration guide.
- **Fixes** - 9 new quality checks. Phantom paths, stale refs fixed across 6 projects. ProjectShape/confusion-log removed.

## v0.3.0 - 2026-03-21

Multi-agent alignment. First public release under MIT license.

- **Tri-Agent** - Claude Code, Gemini CLI, Codex with unified `.agents/skills/`. 7 skills with YAML frontmatter. goat-research→goat-debug, created goat-plan/goat-test.
- **Safety** - Reverted Gemini overwrites. `mv -n` enforcement. Overwrite protection in Never tier.
- **Public** - MIT LICENSE, README rewrite. CI validates router tables + skill dirs. 3 footguns, 2 lessons logged.

## v0.2.0 - 2026-03-21

Workflow deployed across 7 projects. Multi-agent support. 11 diagnostic rounds.

- **Loop** - 6-step: READ→CLASSIFY→SCOPE→ACT→VERIFY→LOG. Complexity budgets. Debug gate. LOG triggers on VERIFY failure + human correction.
- **Skills (7)** - goat-plan (triangular tension), goat-test (3-track doer-verifier). goat-review depth requirement.
- **Enforcement** - 5-item Ask First checklist. deny-dangerous covers Edit/Write. Content-preserving write guard (>80% blocked).
- **Multi-Agent** - Codex + Gemini CLI. Truth order defined. Data honesty labels. Context rot defense (40-60%).

---

## v0.1.0 - 2026-03-20

First release. Complete workflow system.

- **System** - 5-layer architecture. 6-step execution loop with SCOPE. 3-layer enforcement (permissions→hooks→rules). Autonomy tiers. DoD (6 gates). Doer-verifier testing.
- **Skills (6)** - preflight, debug, audit, research, review, plan. Planning playbooks (feature brief, mob elaboration, SBAO, implementation checklists). Testing playbooks (doer-verifier, 3 tracks).
- **Docs** - system-spec, five-layers, six-steps, getting-started, design-rationale. Cross-agent comparison. CI context validation.
