@andresmassello/uscha 1.51.1 → 1.51.3

package/uscha-kit/CHANGELOG-1.46.1.md

@@ -1,35 +0,0 @@
-# uscha-kit 1.46.1 — the statusline reads MEASURED acceptance, never narrated (2026-07-23)
-
-A doctrinal fix to the statusline shipped in 1.46.0, found by dogfooding it on this very repo.
-Smoke suite: 375/375.
-
-## The smell
-The progress hook counted checkboxes (`- [x]`) in `ACCEPTANCE.md` — the **narrated** progress.
-The engine's readiness counts green `AC-nn` testcases — the **measured** acceptance. The two can
-diverge, and on this repo they diverged badly: the statusline said **0%** while the ledger said
-**83.3% measured** (criteria tested green but not ticked). For a kit whose flag is *measured
-beats narrated*, its own at-a-glance summary was reading the wrong side — and could contradict
-the mirador.
-
-## The fix (write-once by the engine, read-many by the hook)
-The statusline must summarize the ledger, so it now reads the ledger's own truth:
-
-- **Engine**: `readiness --record` persists a compact measured summary into
-  `ledger["measured"]` — `{at, score, band, acceptance_done, acceptance_total, next}` — where
-  `next` is the first criterion NOT yet closed by a green test. Same opt-in write as
-  `readiness_history` (readiness stays read-only by default). `qa_ledger.py:cmd_readiness`.
-- **Hook** (`uscha_progress.py`): prefers `ledger["measured"]` — the exact truth the mirador
-  shows, so the two can never disagree. Counting checkboxes remains only as the **fallback** for
-  a fresh project that has not recorded a measurement yet. The hook stays fast: it never re-runs
-  the engine.
-
-Considered and rejected: having the Stop hook run the engine itself (breaks the "fast hook,
-never runs tests" design and couples it to locating `qa_ledger.py`), and merely relabeling the
-checkbox count as "marked" (honest, but keeps the narrated number as the headline).
-
-Regression: smoke **T90** — checkbox fallback shows 0/2; after `readiness --record` the
-statusline shows the MEASURED 1/2, agreeing with the ledger to the decimal.
-
-## Note on the test suite
-The installer/npm smoke checks still hardcode the version string, so this bump updated those
-literals.

package/uscha-kit/CHANGELOG-1.47.0.md

@@ -1,45 +0,0 @@
-# uscha-kit 1.47.0 — the trail feeds itself: loop odometer + measured phase (2026-07-23)
-
-Field feedback on the coordinator's real pain: with all the method's loops and passes, the
-human steering the work loses track of *where the method is* and *how it is going*. The data
-to answer that already existed in the ledger — derived phase (FSM 1.18.0), loop passes
-(`iterations`), plateau (1.14.0), history (`readiness --record`) — but nothing surfaced it,
-and the history starved because `--record` was opt-in and nobody ran it. Smoke suite: 376/376.
-
-## Doctrine first: what "how much is left" may honestly mean
-"Where am I" and "how many passes happened" are FACTS the engine already derives. "How much
-is left" is a forecast — the QA loop converges, it does not count down — so the kit never
-prints an ETA. The honest answers it CAN give: the derived phase, the pass count, and the
-convergence signal (findings going down vs. plateau). That is what this release surfaces.
-
-## The feed (the fix that unblocks everything)
-`uscha-devloop` now closes **every** pass with `readiness … --record`. One flag, two feeds:
-`readiness_history` (the mirador time-lapse stops saying "no history yet") and
-`ledger["measured"]`, which now also carries the **loop odometer** per repo:
-
-```jsonc
-"measured": { …, "repos": { "backend-api": { "phase": "qa", "loops": 3, "stalled": false } } }
-```
-
-All facts the readiness run ALREADY computed — `--record` only persists them (append-only,
-never a gate). `qa_ledger.py:cmd_readiness`.
-
-## The odometer in the mirador trail
-The trail's "QA loop" node now shows a measured badge via the `count` field the template
-always supported (it was emitted `null` since 1.32.0): `"3 loops"`, plus `"1 escalado"` when
-escalations are open, and the convergence verdict — `"plateau"` when the stall detector fires,
-`"convergido"` when every repo converged. `cmd_dashboard` fills it from the same `loops` +
-`advice` facts it already emitted; no new derivation.
-
-## The phase token in the statusline (A-lite)
-One compact token after the label: `qa×3` (derived phase × pass count), with a yellow
-`plateau` warning when iterating stopped helping. Read from `ledger["measured"]` — the Stop
-hook still never runs the engine. The phase shows even for projects with no AC-IDs (the
-phase is its own fact, independent of acceptance).
-
-Deferred (needs a phase-transition history the ledger does not keep, by design so far):
-counting Build↔Verify re-entries, and the odometer over time in the time-lapse.
-
-Regression: smoke **T91** — after two `log-step` passes and one `readiness --record`, the
-measured summary carries `{phase: qa, loops: 2, stalled: false}`, the mirador `qa` node badge
-reads `"2 loops"`, and the statusline renders `qa×2`.

package/uscha-kit/CHANGELOG-1.48.0.md

@@ -1,35 +0,0 @@
-# uscha-kit 1.48.0 — uscha-status: the statusline on demand, in chat (2026-07-23)
-
-Ninth skill. The statusline (1.46.0) is passive and terminal-bound — some surfaces
-(Claude Desktop, Codex, plain terminals, CI logs) may never show it. `uscha-status` is the
-same truth, printed in chat when the human asks. Smoke suite: 377/377.
-
-## Three zoom levels, each datum shown once
-- **Push** — one readiness verdict line at every pass close (the devloop already does this;
-  1.25.0 single-verdict + 1.47.0 `--record`).
-- **Pull** — `/uscha-status`: one compact block on demand (this release).
-- **Bird's-eye** — the mirador, when the human wants everything.
-
-Explicitly rejected: having every command print status blocks as it goes. The push line
-already exists; repeating the same truth several times per pass is ceremony.
-
-## What the skill does
-Renders ONE fenced block (max ~8 lines): label · derived phase `×loops` · measured
-acceptance bar · tests · coverage · `next →` criterion · per-repo loop odometer (multi-repo
-only, with `plateau ⚠`) · roadmap · `recorded` timestamp + score/band. Sources, in order:
-run `uscha_progress.py` if installed (fast, never runs tests) and read
-`.claude/uscha-progress.json`; else read `QA-LEDGER.json` `measured` directly; no config →
-not a uscha project, say so.
-
-Read-only by contract: it never runs `readiness`, tests or gates. No `measured` recorded →
-it says so and points at the feed (`readiness --record`, automatic at pass close since
-1.47.0); a checkbox-only count is shown labeled **narrated**, never passed off as measured.
-
-## Registration
-Installer `SKILLS` roster, doctor `USCHA_SKILLS` (T57 no-drift guard forced it), both
-plugin manifests, marketplace, READMEs (eight → nine), and the project template
-`CLAUDE.md` command list.
-
-Regression: smoke **T92** — `install-uscha.py` SKILLS must match the skill dirs on disk
-(same no-drift spirit as T57, for the installer), and `uscha-status/SKILL.md` carries a
-valid frontmatter and its read-only contract.

package/uscha-kit/CHANGELOG-1.48.1.md

@@ -1,55 +0,0 @@
-# uscha-kit 1.48.1 — one derivation: narrated is labeled, escalation agrees across views (2026-07-23)
-
-Found by running the kit's own QA loop (code-review · judgment-day · improve) over releases
-1.46.1–1.48.0 while dogfooding it on this repo. code-review came back clean; the other two
-passes returned four gated findings, all real. This is the fix cycle. Smoke suite: 378/378.
-
-## The mirador and the statusline disagreed — twice
-`cmd_dashboard` built a repo's state from two ad-hoc sources while `_derive_phase` — the FSM
-the statusline's odometer reads — used one. Both halves were wrong:
-
-- **Escalation.** The dashboard scanned `ledger["escalations"]` alone; `_derive_phase` also
-  treats an open **spec-doubt**, an open **spec-change-request** and a gated **production
-  finding** as escalations. A repo blocked by a spec-doubt read `escalated` in the statusline
-  and `active`/`converged` in the mirador.
-- **Convergence.** The dashboard took `converged` from `_converged()` alone, which ACCEPTS
-  agent-reported `tests_passed` when no snapshot was ever taken; `_derive_phase` requires
-  MEASURED green tests before it will say `pr-ready`. So a repo whose tests were only narrated
-  read **"convergido"** on the mirador — the view a human reads before deciding a merge —
-  while the statusline correctly withheld readiness.
-
-The second one was found by the loop's own second cycle, after the first fix closed only the
-escalation half. The dashboard now derives its state ENTIRELY from `_derive_phase`. One
-derivation, one truth — including about what "converged" is allowed to mean.
-
-## A checkbox no longer wears a measured face
-The statusline rendered `AC 5/6` identically whether it came from `ledger["measured"]` (closed
-by a green test) or from counting `- [x]` in ACCEPTANCE.md. The 1.46.1 headline said "never
-narrated", but the fallback was real and silent. It now travels with its provenance:
-`uscha_progress.py` records `acceptance_source` (`measured` | `narrated`) and the renderer
-marks the fallback on screen. Measured is the norm and stays unlabeled; narrated always says
-so.
-
-## The fast path now carries what its consumers need
-`.claude/uscha-progress.json` gained `measured_at`, `score`, `band` and the full per-repo
-`repos` odometer. The `uscha-status` skill documented a `recorded <at> · score <band>` line and
-a multi-repo `loops` line that its own primary source could not produce — inviting an agent to
-either break the declared source order or invent a timestamp. Now the documented output is
-fully producible from the fast path, and the SKILL.md says which field feeds each line.
-
-## One helper instead of five copies
-"Max iteration for a repo" was computed independently in five places (mirador badge, readiness
-churn, persisted odometer, first-time-yield, regression-close). A change to any one of them
-would have silently desynced the others — the root-cause pattern behind the bugs above.
-Extracted `_repo_loop_count`; every site calls it.
-
-Regression: smoke **T93** — the checkbox fallback is labeled `narrado` on screen; narrated
-tests never read as `convergido` on the mirador; and an open spec-doubt reports `escalated` in
-BOTH the mirador badge and the persisted odometer.
-
-## How this release was found
-Not by an audit — by running the kit's own loop on itself. Cycle 1: `code-review` clean,
-`judgment-day` 3 gated, `improve` 1 gated. Fix. Cycle 2: `code-review` clean, `judgment-day`
-clean (all three closed), `improve` found the FIRST FIX WAS PARTIAL and reproduced the
-remaining contradiction live. Fix. That is the loop doing exactly what it exists to do: a
-second pass that refuses to rubber-stamp the first one.

package/uscha-kit/CHANGELOG-1.48.2.md

@@ -1,47 +0,0 @@
-# uscha-kit 1.48.2 — the engine measures its own coverage (2026-07-23)
-
-`ACCEPTANCE.md` had left an open fork since 1.44.0: instrument the engine's coverage, or
-declare the exemption in config with provenance. **Resolved by measuring.** A measurement kit
-that cannot measure its own coverage is a weak calling card. Smoke suite: 379/379.
-
-## The problem was the shape of the suite, not the will
-The engine is exercised almost entirely through **subprocess** — the smoke is bash, and it
-drives `qa_ledger.py` ~370 times. Instrumenting that normally means the `COVERAGE_PROCESS_START`
-+ `.pth` dance in site-packages. It was unnecessary here: the suite already funnels every one
-of those calls through a single `run()` choke point. Wrapping that one function measures
-everything.
-
-```bash
-USCHA_COVERAGE=1 bash uscha-kit/tests/smoke-engine.sh
-coverage combine && coverage xml -o reports/coverage.xml
-```
-
-**Opt-in by design.** Off by default, so the normal suite stays fast and `coverage.py` is NOT
-a dependency of running the tests. `--source` is ONE absolute path (the suite runs from a temp
-sandbox): git-bash rewrites only the first POSIX path embedded in an argument, so a
-comma-joined list would reach Windows Python half-translated — and coverage.py does not report
-never-imported files anyway, so extra roots buy nothing. The distributable twin
-`uscha-kit/skills` is absent from the report because the suite never executes it (`$QL` points
-at `.claude/skills`), not because a flag excluded it.
-
-## The number, and what it does NOT cover
-**84.2%** on the engine, against a threshold of 60 now DECLARED in `uscha.config.json`
-(provenance: a human requirement, not the kit's default opinion — kit 1.17.0). The report is
-Cobertura at `reports/coverage.xml`, exactly the path and shape `cobertura_coverage()` already
-ingests; nothing new had to be taught to the engine.
-
-Honest limit, recorded in config as `defaults._coverage_scope` and in `ISSUES-DEFERRED.md`
-(D-03): the number covers **`qa_ledger.py`**. The auxiliary scripts (`templates/scripts`, the
-mirador renderer) are exercised by the suite but invoked outside the `run()` seam, so they
-contribute nothing to it. Calling 84.2% "the kit's coverage" would be exactly the inflated
-claim this project exists to remove.
-
-## Self-application: 35 → 100
-With coverage measured, every readiness dimension is now MEASURED for this repo and the
-score reads **100.0 — READY**: acceptance 6/6 (green tests, not checkboxes), ADR complete,
-coverage 84.2%, static gate clean (ruff + mypy), convergence closed by a real 3-cycle QA loop.
-The path was: stale snapshot cleared (35 → 50) → static gate wired (→ 72.2) → QA loop
-converged (→ 83.3) → coverage instrumented (→ 100).
-
-Regression: smoke **T94** — instrumentation stays opt-in (the suite runs with no `coverage.py`
-present), and a Cobertura report at `reports/coverage.xml` is ingested as MEASURED.

package/uscha-kit/CHANGELOG-1.49.0.md

@@ -1,45 +0,0 @@
-# uscha-kit 1.49.0 — the mirador tells what the ledger knows (2026-07-23)
-
-Operator feedback, twice over: a field session reported "empty panels with no reason given",
-and dogfooding on this repo landed the same verdict — *"me sabe a poco o confuso"*. Looking at
-the rendered page made both complaints concrete: the biggest block was kit metadata identical
-across projects, the method's crown jewel (measured acceptance) had no panel at all, and the
-loop's story — the reason the kit exists — was one line. Smoke suite: 380/380.
-
-## ACCEPTANCE replaces "Specifications"
-The `specs` field had been a hardcoded `[]` since 1.32.0 (comment: the engine tracks AC-nn,
-not SPEC-nnn) — a panel that could never fill, on every project, with a hint that read like a
-todo. Gone. In its place, the engine's real currency: an **Acceptance — measured** panel,
-criterion by criterion, with the status the engine computes (the template paints, never
-derives):
-
-- **measured** — closed by a green named test;
-- **narrated — sin test** — ticked by hand, no green test backs it;
-- **open** — neither.
-
-The data was already inside `cmd_dashboard` (it captures `readiness --json` verbatim); the
-release adds per-criterion `items` to the readiness acceptance block and passes the panel
-through. When JUnit evidence is stale, the panel says how many reports were discarded and asks
-for a re-run — it never presents stale green as current.
-
-## The loop tells its story: burn-down per cycle
-`loops[]` entries now carry the repo's REAL derived phase (`_derive_phase`, closing deferred
-finding D-01) and a per-cycle `series`: findings reported / gated / fixed / deferred, straight
-from the recorded steps. The mirador draws one line per cycle — `gated` hot while > 0, cool at
-0 — so reading left to right answers *"is iterating helping?"* without opening the ledger.
-**Agent steps only** (same filter as `_converged`): static-gate ingests carry below-gate noise
-(a linter's 35 LOWs re-reported on every refresh) that drowned the trend, and the gates
-already speak through readiness's own gate line.
-
-## Less noise, honest voids
-- **Execution policy demoted** to a collapsed drawer (same mechanism as sub-scores): it is
-  kit routing, identical across projects — policy, not project state. It was the largest
-  block on the page.
-- **Constitution invariants**: a `null` status now renders dashed with "sin gate — no medido".
-  A silent blank read as "fine", which is the exact lie the truth-pass forbids.
-- The sample fallback DATA in the template was realigned to the real contract (it still
-  showed `specs` and loop states the engine never emits).
-
-Regressions: smoke **T95** — per-AC statuses measured/narrated/open, `specs` absent from the
-contract, loops carry phase + an agent-only series that a static-gate ingest cannot pollute.
-The dashboard contract check (T-mirador) updated to the new shape.

package/uscha-kit/CHANGELOG-1.5.0.md

@@ -1,64 +0,0 @@
-# dev-loop-kit 1.5.0 — adapter `type: node` (TypeScript/JS) (2026-07-02)
-
-El adapter más barato del roadmap: reusa el parser lcov (Flutter) para coverage y el
-parser JUnit-envuelto (Python) para tests; lo único nuevo son los parsers de ESLint y
-tsc. Smoke suite: 31/31 (24 previos intactos + 7 node).
-
-## Engine (qa_ledger.py)
-
-- **`type: node`** — TypeScript/JS (jest o vitest sobre Node).
-- Coverage: `coverage/lcov.info` — **mismo parser que Flutter** (`flutter_coverage`,
-  docstring generalizado).
-- Test count: **`junit_test_count()`** (renombrado desde `python_test_count` — es de
-  familia JUnit, no de lenguaje): jest-junit / `vitest --reporter=junit`, root envuelto
-  `<testsuites>` soportado, first-location-wins.
-- **`parse_eslint()`** — `eslint --format json`: severity 2 (error) → HIGH,
-  1 (warn) → MEDIUM; reglas `security/*` con floor HIGH (como findsecbugs);
-  **`fatal: true`** (error de parseo) → HIGH siempre — la lección del `code: null`
-  de ruff (1.4.0). `ruleId: null` SIN fatal (directivas eslint-disable sin usar,
-  default de ESLint 9) sigue la severidad del mensaje — nunca un falso blocker.
-- **`parse_tsc()`** — `tsc --noEmit` texto (`file(line,col): error TSxxxx`):
-  error → HIGH (un type error es rotura real); paths Windows con drive soportados.
-  **Errores GLOBALES sin archivo** (TS18003/TS5023 — tsconfig roto) → HIGH con
-  ubicación `?`: un tsc que no chequeó NADA jamás lee como gate limpio.
-- IDs de finding node preservan el path repo-relativo (`_mk_id_rel`): los layouts
-  sin `src/` (app/pages con decenas de `page.tsx`/`index.ts`) no colisionan por
-  basename; los paths absolutos de eslint se relativizan a la base del repo.
-- `ingest-gate`: branch node (`reports/eslint.json` / `reports/tsc.txt`, o
-  `--eslint/--tsc`); combinado = `node-qa-gate`. Mismo contrato de ausencia.
-- Guard UNMEASURED ampliado: `maven`/`python`/`node`.
-- LOC node: test = `__tests__`/`tests`/`test` en el path o `*.test.*`/`*.spec.*`;
-  prod = el resto. `SOURCE_EXT` node: `.ts .tsx .js .jsx .mjs .cjs`.
-- `SKIP_DIRS` += `coverage` (el lcov-report HTML de jest contiene .js que
-  contaminaría el LOC), `.next`, `.turbo`. **Trade-off documentado**: el set es
-  global — un paquete fuente legítimamente llamado `coverage/` en cualquier type
-  queda fuera del LOC (métrica advisory; la detección de lcov es por glob y no
-  se afecta).
-- `LICENSE` (MIT) agregada al repo y copiada dentro de `dev-loop-kit/` para que
-  el zip la lleve.
-
-## Config / docs
-
-- `test_command_node` + repo de ejemplo `web-app`; version 1.5.0 (triple sync).
-- Kit README: tabla TypeScript/JS; SKILL.md types + `npm test`; docs ES/EN
-  actualizan tipos y versión vigente.
-
-## Smoke (tests/smoke-engine.sh)
-
-- `repo-d` (`type: node`): lcov 9/10 → 90.0%, junit envuelto → 7 tests,
-  LOC prod=4/test=2 (.ts vs .test.ts), eslint (security floor + null fatal HIGH,
-  prefer-const MEDIUM → reported=3 gated=2), tsc error → HIGH,
-  UNMEASURED pre-ingest → medido post-ingest.
-
-## Criterio pendiente (mismo contrato que el adapter python)
-
-El adapter node NO tiene todavía un repo real de dogfooding detrás — entra por decisión
-del autor pensando en el release público (audiencia TS/JS). El dry-run de solo lectura
-contra un repo TS/JS real (coverage vs jest, test count exacto, eslint/tsc) queda como
-criterio abierto — igual que el dry-run pendiente del adapter python (1.4.0).
-
-## Diferido consciente (sin cambios)
-
-- rebuild: densidad de asserts por test-file. Perfiles A-E mecanizados (`--profile`).
-- Roadmap de adapters: Go (golangci-lint emite formato checkstyle — reusable),
-  Rust (cargo-llvm-cov emite Cobertura — reusable). Entran cuando haya repo real.

package/uscha-kit/CHANGELOG-1.50.0.md

@@ -1,52 +0,0 @@
-# uscha-kit 1.50.0 — receipts: every number cites its evidence (2026-07-23)
-
-The mirador's footer has said *"click a milestone to see its receipt"* since 1.32.0 — and the
-engine fed that drawer a hardcoded `{}`. The machinery waited eighteen releases for data that
-never came. This release wires it, and extends the same principle to every number on the page:
-**a figure you cannot trace to a file and a timestamp is narration wearing a suit.**
-Smoke suite: 381/381.
-
-## The provenance was always in scope — and being thrown away
-Three separate places computed a fact while holding its receipt, then discarded it:
-
-- `_ac_tags` read the testcase NAME and the report PATH to tally green/red per criterion —
-  and kept only the integers. Now each tag carries `cases: [{test, report, ok}]` (capped at 8:
-  a receipt cites evidence, it is not a dump), aggregated across repos and carried through
-  `readiness --json` into the dashboard's per-criterion items.
-- Every coverage backend (maven, lcov, cobertura, go, gradle, ant) matched its report file
-  and returned only the numbers. Now the returned dict carries `reports: [paths]`.
-- `_mirador_adrs` derived id/title/status from the file it was reading and dropped the
-  filename. Now each ADR row carries `file`.
-
-## The drawer, fed
-`cmd_dashboard` now builds `evidence` from recorded facts only:
-
-- **spec** — the ACCEPTANCE file, criteria counts, measured tally, untagged warning.
-- **adr** — every ADR with its status and source file.
-- **build** — per repo, the last snapshot: when it was taken, prod/test LOC, tests verdict
-  with report paths + mtimes + freshness, coverage pct with its report path.
-- **qa** — cycles per repo with the burn-down tail, plus which gates are persisted.
-- **verify** — the last `readiness --record` entry, the current score/band, any active cap,
-  and how many history records back the time-lapse.
-- **prod** — a receipt for the ABSENCE of evidence: the method stops at the PR; merging and
-  deploying are human acts the ledger does not record, by design.
-- **ac:AC-nn** — one receipt per criterion, **cases-driven, never status-driven**: a measured
-  one cites the green testcases that carry its name and the reports they live in; a criterion
-  with green AND red testcases shows BOTH and names the veto (*"veto rojo"* — fail-closed, a
-  hidden vetoed green would be the receipt lying about the evidence it exists to cite); a
-  narrated one with no cases says *"tildado a mano — ningún testcase lo respalda"*; an open
-  one says nothing backs it yet. User-authored strings (testcase names, paths, titles) are
-  escaped before entering the drawer, so a crafted name cannot paint fake verdict tokens.
-
-A phase with no recorded facts gets NO key — and clicking it now opens an honest "sin recibo"
-drawer instead of the old silent no-op (a click that does nothing reads as broken; a missing
-receipt is itself a fact worth stating).
-
-## Acceptance rows are clickable
-Each row in the Acceptance panel opens its criterion's receipt (keyboard-accessible,
-`role=button`). The drawer is the same one the trail uses — one mechanism, more keys.
-
-Regression: smoke **T96** — the AC receipt cites testcase + report; the mixed green+red
-criterion does not close AND its receipt shows both cases naming the veto; narrated says so;
-build cites the coverage path; ADRs carry their file; a facts-less phase has no evidence key.
-The 1.10.0 edge-case check updated: tags now assert counts by key (the dict grew `cases`).

package/uscha-kit/CHANGELOG-1.50.1.md

@@ -1,52 +0,0 @@
-# uscha-kit 1.50.1 — the privacy fix reaches the package (2026-07-23)
-
-A packaging and documentation release: 1.50.0 shipped a tarball that still carried what
-1.50.0's own repo had already stopped carrying. Smoke suite: 381/381.
-
-## What the published package was still doing
-The AC-03 leak detector — the criterion that forbids naming client or private projects
-anywhere in the kit — had those names **hardcoded as its own regex**. The guard published
-the very list it exists to keep out, in a public repo and inside the npm tarball. That was
-fixed in the repo, but a fix that never reaches the distributed artifact is not a fix.
-
-- The names now live in **`.uscha-private-names`** at the repo root: untracked, one name or
-  regex per line. Without it AC-03 emits `<skipped/>` → the criterion reads **UNMEASURED**,
-  never a silent pass. Absence is not success, applied to the guard itself.
-- **`uscha-kit/tests/`** is excluded from the npm package. The suite is the kit's own
-  regression harness; a consumer never runs it, and it was more than half the download.
-  Tarball: 449.6 kB → 388.9 kB (123 → 121 files).
-
-## A README written for whoever lands on it
-The published README was the repo's development map: it opened with the directory tree and
-buried the install command eighty lines down. Rewritten user-first — what the method is,
-the install line above the fold, the nine skills, the loop, and what makes it different —
-with the repo-development detail moved to the end. The same file serves GitHub and npm; the
-registry only captures it at publish time, which is why this release exists.
-
-Every number in it was verified against the engine rather than recalled: nine skills, 29
-subcommands, eleven language stacks, the readiness weights.
-
-## Published docs: a truth-pass to 1.50.0
-The decks were frozen around 1.27.0 and had drifted from stale into **false**:
-
-- All four team-pitch decks instructed `cp uscha-kit/uscha-devloop.config.json` — a filename
-  that has never existed. The same typo was corrected in the READMEs by 1.31.0 and never
-  reached the decks. The whole obsolete block (manual skill copying, a superseded doctor
-  script) is now the three-command npx flow.
-- The one-pagers offered a `uscha-kit-1.21.0.zip`: wrong version, and a distribution
-  mechanism replaced by npm/npx at 1.39.0–1.40.0. No published doc mentioned npx at all.
-- The long deck stated three different skill counts in one file (seven in prose, eight in
-  chips, eight in a table); none was nine. Counts corrected and `/uscha-status` added to the
-  visible roster.
-- The skills reference carried a `spec-loop · skills` wordmark — pre-1.29.0 branding, and
-  also the name of an unrelated third-party project this repo explicitly cites as distinct.
-- The paper (both the arXiv `.tex` and its parallel HTML source): seven → nine skills, with
-  `mirador` and `status` added to the skills table; 24 → 29 subcommands; nine → eleven
-  language stacks; nine → thirteen linter formats; 161 → 381 checks; five → six release
-  artifacts; the self-application arc extended from 1.27 to 1.50.
-
-## Known gap
-`docs/paper/uscha-paper.pdf` is now older than the sources it was rendered from, and the
-repository documents no command to regenerate it. The `.tex` is the canonical arXiv source
-and the `.html` is a parallel hand-authored render source; nothing enforces that the three
-agree. Recorded here rather than papered over.

package/uscha-kit/CHANGELOG-1.50.2.md

@@ -1,62 +0,0 @@
-# uscha-kit 1.50.2 — cross-platform: the kit runs, and proves it runs, on macOS and Linux (2026-07-24)
-
-The engine was already portable; the *wiring* around it assumed Windows. A field discovery
-run installed and ran the whole kit on real Linux and confirmed it: **0 engine defects**, and
-a short list of cabling bugs — plus one the static audit had missed because it only shows up
-on direct execution. This release fixes them and, more importantly, makes the claim
-**measured**: a CI matrix now runs the 385-check suite on ubuntu / macOS / windows × Python
-3.8 and 3.13. By the kit's own rule, "cross-platform" was narration until that grid was green.
-
-## The measurement (this is the durable fix)
-`.github/workflows/smoke.yml` runs the suite on all three OSes. Its very first run earned its
-keep: green on Windows, **red on Linux and macOS**, on a single check — and not one of the
-audited findings. The npm-router test asserted `! grep -Fq "$ROUTER_FALLBACK"`, a **substring**
-match: on POSIX the fallback `python` is a prefix of the primary `python3`, so the check
-believed the fallback had run when it had not (on Windows the fallback is `py -3`, not a
-substring, so it always passed). The router is correct; the test now counts installer
-invocations. A Windows-only assumption baked into the kit's own cross-platform test, invisible
-to every prior local run.
-
-## Runtime fixes
-- **The INV-GOLDEN hook shipped with a UTF-8 BOM before its shebang** (and CRLF in Windows /
-  zip working trees). On direct execution the
-  kernel does not see the shebang, hands the file to `/bin/sh`, which syntax-errors and exits
-  2 — the exact PreToolUse *block* code. The guard looked installed while blocking **every**
-  tool call on POSIX. Stripped BOM, normalized to LF, set the exec bit. Smoke **T98** now runs
-  the hook DIRECTLY (not via an interpreter, which is what masked it), asserting `allow→0`,
-  `block→2` on POSIX.
-- **The doctor misdiagnosed a healthy hook.** It checked only for the `.ps1` and required
-  `powershell`, so a `.py` install (what `uscha install` wires) read as broken on every OS,
-  worst on mac/Linux. It now accepts either hook and ties interpretability to the one actually
-  registered — `.py` needs only the engine's Python. Smoke **T97**.
-- **The statusline wired a bare `python`.** Stock macOS/Linux ship only `python3`; the status
-  line and Stop hook died silently. Now OS-resolved (`python3` on POSIX, `python` on Windows),
-  with an ours-by-suffix auto-refresh for an upgraded install. Smoke **T89**, now OS-aware.
-- **The plugin `hooks.json` invoked PowerShell only** — INV-GOLDEN-01 dead on the plugin path
-  on mac/Linux. It now invokes the portable `.py` directly (shebang+exec on POSIX, the `.py`
-  association on Windows, enabled by the BOM/exec fix); the `.ps1` was deleted. Smoke **T100**.
-  *Honest limit:* CI cannot exercise Claude Code's plugin-marketplace hook execution — that
-  path is proven by a real plugin install; `npx uscha install` is the CI-verified path.
-- **Reinstall left dead hook entries** (found by simulation): the hook command carries an
-  absolute `sys.executable`, so an interpreter move stranded a dead PreToolUse entry while the
-  fresh one was merely appended. The installer now prunes any prior uscha hook by script
-  basename before adding, preserving a user's foreign hooks. Smoke **T99**.
-
-## Hygiene, made structural
-- **Root `.gitattributes`** enforces `* text=auto eol=lf` (`.ps1` stays CRLF, goldens binary),
-  so a CRLF can never again ship in a shebang regardless of a contributor's `core.autocrlf`.
-  The kit's `.sh` files gained the exec bit.
-- **`AGENTS.md`** — the context file Codex and pi read (not `CLAUDE.md`) — was cp1252 mojibake,
-  had drifted, and was not emitted by `init`. Replaced with a thin pointer to `CLAUDE.md` (one
-  canonical source) and added to the `init` template set.
-- The repo's versioning rule said "five" surfaces; T44 checks **six** — corrected. The
-  self-application `uscha.config.json` was bumped off its stale `1.44.0`.
-
-## Not broken (recorded so it is not re-audited)
-The field run confirmed the engine's own hygiene: paths via `os.path`/`pathlib`, tool
-detection via `shutil.which`, all I/O `utf-8`-explicit; the ledger checksum is EOL-immune (it
-hashes canonical JSON, not raw bytes); the install transaction never crosses filesystems.
-`bin/uscha.js`, the installer's junction/symlink and browser-opening, and `workbench-doctor.sh`
-were already correctly cross-platform.
-
-The `pi` target (Earendil) and its design decisions are a **1.51.0** feature, out of this patch.

package/uscha-kit/CHANGELOG-1.51.0.md

@@ -1,44 +0,0 @@
-# uscha-kit 1.51.0 — a third install target: pi (Earendil) (2026-07-24)
-
-After the 1.50.2 portability patch made the kit run everywhere, this adds **pi** — Earendil's
-`@earendil-works/pi-coding-agent` — as a first-class install target alongside `codex` and
-`claude`. The 9 skills implement the Agent Skills standard, so they load into pi unmodified.
-Smoke suite: 386/386.
-
-## The target
-`install --target pi` places the 9 `uscha-*` skill directories flat under **`~/.agents/skills/`**
-— the harness-neutral sibling of the `codex` target's `~/.agents/plugins/` — plus an install
-marker so the doctor can measure presence and version. Skills only: no plugin manifest, no
-`settings.json`, no hook. It uses the same transactional install as the Claude target (stage →
-back up → atomic replace → marker last), so a late failure rolls the target back with nothing
-lost.
-
-- **`--target all`** installs codex + claude + pi in one run. **`both` stays a legacy alias**
-  for codex + claude, so existing scripts and users keep their exact prior behavior.
-- `doctor --target pi` reports `healthy`, `version_match`, and the skill roster, exactly like
-  the other targets.
-
-## `golden_guard`: INV-GOLDEN-01 per target, reported honestly
-The doctor now reports, per target, whether the golden-write guard is **mechanical** or
-**advisory** — the field `golden_guard`:
-
-- **claude: `enforced`** when the PreToolUse hook is registered (else `advisory`).
-- **codex: `advisory`** — the Codex plugin has no hooks mechanism, so INV-GOLDEN-01 has always
-  been advisory there (this just makes it visible).
-- **pi: `advisory`.** pi's blocking `tool_call` event can enforce the invariant, and the guard
-  ships as a precompiled extension — `uscha-kit/pi/golden-guard.js`, plain JS, no build step, to
-  respect the kit's stdlib-only limit. But the kit reports **advisory, not enforced**, because
-  the block has not been measured against a real pi run — the same honesty the plugin
-  `hooks.json` gap follows. A verified pi run flips it to enforced; until then the kit does not
-  claim enforcement it hasn't seen.
-
-## Not done (out of this release)
-Verified against a real pi install: the extension's actual load path and the `tool_call` block
-(the `advisory` above is exactly this gap). Also unverified: the Codex install roots on POSIX,
-and a real macOS end-to-end `npx` install (the CI matrix runs the suite on macOS runners, but
-not a user-style install flow). `AGENTS.md` (shipped 1.50.2) is the context file pi reads.
-
-Regression: smoke **T101** — pi installs 9 skills + marker under `~/.agents/skills`; doctor
-reads healthy for a real install and unhealthy for an empty home; `golden_guard` is `advisory`
-for pi and `enforced` for a hook-registered Claude install; `--target all` resolves to all
-three while `both` stays codex+claude.

package/uscha-kit/CHANGELOG-1.51.1.md

@@ -1,33 +0,0 @@
-# uscha-kit 1.51.1 — the doctor recognizes the golden hook across an interpreter change (2026-07-24)
-
-A patch on 1.51.0, surfaced by the CI matrix's new real-installer end-to-end step (install
-`--target all` → doctor on every OS). On **Windows / Python 3.8** the step failed: `doctor
---target claude` reported `hook_registered: False` for a hook that was, in fact, correctly
-installed. Not a CI artifact — a real doctor false-negative. Smoke suite: 388/388.
-
-## Root cause
-The installer writes the INV-GOLDEN PreToolUse hook command via
-`list2cmdline([sys.executable, <hook path>])` — an **absolute interpreter path** plus the hook
-script. The doctor's `hook_registered` then checked for that command by **exact string
-equality**. When install-time and doctor-time run under different interpreters — a bare
-`python` that resolves to a different `sys.executable` between two invocations, as happened on
-the Windows 3.8 runner — the two command strings differ only in their interpreter prefix, and
-the exact-match reported the healthy hook as unregistered. That flipped `healthy` and the
-`golden_guard` trust signal to a false negative on an otherwise correct install.
-
-## Fix
-`hook_registered` now matches a registered `"*"` hook by the **guard script it references**,
-not by the full command string — the same robustness the N-1 reinstall prune already uses. The
-match is **path-anchored** (`/block-approved-writes.py` or `\block-approved-writes.py`) so a
-foreign command that merely *mentions* the name — `...not-block-approved-writes.py`, or the
-literal inside a `-c` snippet — cannot read as our enforced guard, since this check feeds
-`golden_guard`. Exact command stays a fallback; a `None` command entry is skipped, not a crash.
-
-The interpreter-path sensitivity was latent before 1.51.0 (any Python move after install would
-trip it); the real-installer CI step is what finally measured it. This is the step doing its
-job — the same way the first matrix run caught the T75 router substring bug.
-
-Regression: smoke **T103** — `hook_registered` matches across an interpreter change (install
-wrote interpreter A, doctor computes B, same script → recognized), and does **not** match a
-suffix-collision script, a bare `-c` mention, a foreign hook, a `None` command, or empty
-settings. The CI real-installer step (all three OSes × Python 3.8/3.13) is the end-to-end proof.

package/uscha-kit/CHANGELOG-1.6.0.md

@@ -1,57 +0,0 @@
-# dev-loop-kit 1.6.0 — adapter `type: go` (2026-07-02)
-
-Tercer adapter consecutivo donde el costo baja porque el engine habla FORMATOS, no
-lenguajes: el linter reusa `parse_checkstyle` (golangci-lint emite checkstyle) y los
-tests reusan `junit_test_count` (gotestsum emite JUnit). Lo único nuevo: el parser del
-cover profile nativo de Go. Smoke suite: 37/37 (31 previos intactos + 6 go).
-
-## Engine (qa_ledger.py)
-
-- **`type: go`**.
-- **`go_coverage()`** — cover profile nativo (`go test -coverprofile=coverage.out`):
-  formato `import/path/file.go:S.C,E.C numStatements hitCount`; cobertura por
-  **SENTENCIAS** (la convención Go, no líneas). First match: `coverage.out`,
-  `cover.out`, `reports/coverage.out`. Profile vacío (solo línea `mode:`) → 0.0
-  fail-closed, nunca un verde inventado.
-- Test count: **reusa `junit_test_count`** vía `gotestsum --junitfile` (root envuelto
-  ya soportado).
-- Linter: **reusa `parse_checkstyle` parametrizado** (`tool="golangci"`) — golangci-lint
-  `--out-format checkstyle`; error→HIGH, warning→MEDIUM; gosec entra por el mismo
-  reporte si está habilitado en la config del linter. Los IDs de finding llevan
-  `golangci:` (los de Java siguen `checkstyle:` — sin migración de IDs).
-- `ingest-gate`: branch go (`reports/golangci.xml` / `golangci.xml`, o `--golangci`);
-  combinado = `go-qa-gate`. Mismo contrato de ausencia.
-- Guard UNMEASURED: `maven`/`python`/`node`/`go`.
-- LOC go: test = sufijo `_test.go` (la convención — los tests viven junto al código);
-  prod = el resto. `SKIP_DIRS` += `vendor` (dependencias vendorizadas explotarían el
-  LOC) y `testdata` (fixtures no compilables).
-
-## Config / docs
-
-- `test_command_go` (gotestsum + coverprofile) + repo de ejemplo `api-svc`;
-  version 1.6.0 (triple sync).
-- Kit README: tabla Go; SKILL.md types + `go test`; docs ES/EN tipos y versión.
-
-## Smoke (tests/smoke-engine.sh)
-
-- `repo-e` (`type: go`): cover profile 3/5 sentencias → 60.0%, gotestsum junit → 4
-  tests, LOC prod=4/test=2 (`_test.go` junto al código), golangci checkstyle
-  (error gateado HIGH + warning MEDIUM), UNMEASURED pre-ingest → medido post-ingest.
-
-## Nota estructural (regla de tres cumplida)
-
-Con 5 types, los dispatchers siguen siendo ifs de 3 ramas y cada adapter nuevo reusó
-parsers existentes — la presión para refactorizar `type` → perfiles de reporte
-(cobertura+junit+linters como config, no código) existe pero todavía no duele. Si
-entra un 6º type o un type necesita MEZCLAR formatos, ese es el momento.
-
-## Criterio pendiente (mismo contrato que python/node)
-
-Dry-run de solo lectura contra un repo Go real — el adapter entra sin repo de
-dogfooding detrás, mismo criterio abierto que 1.4.0/1.5.0.
-
-## Diferido consciente (sin cambios)
-
-- rebuild: densidad de asserts por test-file. Perfiles A-E mecanizados (`--profile`).
-- Rust: cargo-llvm-cov emite Cobertura (reusa `python_coverage`) + cargo-nextest emite
-  JUnit — entra cuando haya repo real.