@andresmassello/uscha 1.54.0 → 1.56.0

package/README.md

@@ -40,8 +40,8 @@ Requires **Python 3.8+** on the machine (the engine is Python stdlib — no pip
 runtime dependencies). The npm package is a thin router; the canonical installer is
 `uscha-kit/install-uscha.py`.
 
-**Kit v1.54.0** <!-- uscha:version --> · [uscha.dev](https://uscha.dev) ·
-[changelog](https://github.com/andresmassello/uscha/blob/main/uscha-kit/CHANGELOG-1.54.0.md)
+**Kit v1.56.0** <!-- uscha:version --> · [uscha.dev](https://uscha.dev) ·
+[changelog](https://github.com/andresmassello/uscha/blob/main/uscha-kit/CHANGELOG-1.56.0.md)
 (the per-release changelogs live in the repo, not in the npm tarball)
 
 ---
@@ -80,6 +80,32 @@ and see which file, which test, and when.
 evidence from **11 language stacks** — maven, gradle, ant, python, node, go, rust, dotnet,
 cpp, swift, flutter — and computes a readiness score with hard caps and visible provenance.
 
+## Compatibility matrix
+
+Generated from `TARGETS`/`SKILL_ROOTS` in the installer, so it cannot drift from the code.
+
+| target | agent | installs to | INV-GOLDEN-01 | exercised against a real agent |
+|---|---|---|---|---|
+| `codex` | Codex | `~/plugins/uscha` | advisory | **yes** |
+| `claude` | Claude Code | `~/.claude/skills` | **enforced** (PreToolUse hook, best-effort) | **yes** |
+| `pi` | pi (Earendil) | `~/.agents/skills` | advisory | no — placement + read-back only |
+| `cursor` | Cursor | `~/.cursor/skills` | advisory | no — placement + read-back only |
+| `copilot` | VS Code / Copilot | `~/.copilot/skills` | advisory | no — placement + read-back only |
+| `gemini` | Gemini CLI | `~/.gemini/skills` | advisory | no — placement + read-back only |
+| `cline` | Cline | `~/.cline/skills` | advisory | no — placement + read-back only |
+
+**"Exercised" is the column that matters.** For every target but Claude Code and Codex, what
+is measured is that the nine skills land where that agent documents reading them and that
+`doctor` reads them back — *that they load is a documented expectation, not a measurement.*
+INV-GOLDEN-01 is mechanically attempted only where a blocking pre-tool hook exists; everywhere
+else `doctor` reports `advisory` rather than implying a guard it cannot see.
+
+| OS | how it is verified | status |
+|---|---|---|
+| Linux | CI matrix (py3.8 + py3.13) + local WSL | **measured** |
+| Windows | CI matrix (py3.8 + py3.13) + native local | **measured** |
+| macOS | CI matrix (py3.8 + py3.13), real runners | **measured** |
+
 ## The loop, in short
 
 1. **Model first.** `/uscha-discovery` (new) or `/uscha-adr-refine` (known feature) writes
@@ -135,7 +161,11 @@ audits/                 # adversarial audit outputs
 
 The rules are in [`CLAUDE.md`](CLAUDE.md). The short version: no doc may claim what the
 engine does not do; the ES and EN twins travel together; every engine change carries a
-smoke test; and the agent never writes a `.approved` file — that one is enforced by a hook.
+smoke test; and a PreToolUse hook stops the agent from writing a `.approved` golden.
+**Scoped honestly**: that hook is a *best-effort* guard and it is registered on the Claude
+target only — it inspects a tool call as TEXT, so an indirect write (a script that assembles
+the filename, a symlink) gets through, and every other target reports `golden_guard:
+advisory`. The MEASURED control is `golden-diff`, which compares bytes.
 
 ## History
 

package/package.json

@@ -1,7 +1,11 @@
 {
   "name": "@andresmassello/uscha",
-  "version": "1.54.0",
+  "version": "1.56.0",
   "description": "Spec-driven development for LLM coding agents: 9 skills + a stdlib evidence engine. Facts block, guesses advise; the human approves.",
+  "author": {
+    "name": "Andres Massello",
+    "url": "https://github.com/andresmassello"
+  },
   "bin": {
     "uscha": "bin/uscha.js",
     "uscha-kit": "bin/uscha.js"