@antoneeo/agentic-sdlc-skill 1.8.0 → 1.8.1

package/CHANGELOG.md

@@ -2,6 +2,14 @@
 
 Tutte le modifiche significative a questa skill saranno documentate in questo file.
 
+## [1.8.1] - 2026-07-02
+### Fixed
+- **Guide freshness hash is now line-ending independent**: `sha256_file` in `sdlc_check.py` normalizes CRLF → LF before hashing. Previously the raw-byte hash made a fresh Windows checkout with `core.autocrlf=true` rewrite `.sources/` snapshots and flag every guide `[stale]` (false positive). Backward compatible: recorded hashes were computed on LF content, and normalization maps CRLF copies back to the same digest. (Edge case: a hash recorded pre-1.8.1 on a snapshot that genuinely contained CRLF bytes will flag `[stale]` once — regenerate the hash.)
+- `guides.md` step 3 now states the hash is computed over LF-normalized content and recommends the `ai_docs/reference/.sources/** -text` `.gitattributes` rule to consumer projects (defense in depth: keeps snapshots byte-verbatim).
+
+### Test battery addition
+- Scenario 10 (extends the unit-1 battery): snapshot checked out with CRLF endings + guide recording the LF-normalized hash → `stale` must NOT flag it; a genuine content edit must still flag `[stale]`.
+
 ## [1.8.0] - 2026-07-02 (Feature B unit 1: operative guides, project scope)
 ### Added
 - **Operative guides** (`ai_docs/reference/GUIDE_[topic].md`): a durable, source-faithful layer distilled from USER-PROVIDED indications — the capability neither agentic-sdlc nor superpowers had. New support file `guides.md` (pipeline: topic decomposition → user confirmation → verbatim snapshot in `reference/.sources/` with SHA-256 → source-anchored extraction → per-section fidelity markers `[source: …]` / `[not covered by source]`); guide template with provenance frontmatter (`source`, `source_version`, `distilled_from`, `source_hash`) in `templates.md`; short "Operative Guides" section in `SKILL.md`.

package/gemini-extension.json

@@ -1,6 +1,6 @@
 {
   "name": "agentic-sdlc-skill",
-  "version": "1.8.0",
+  "version": "1.8.1",
   "description": "Documentation-First SDLC protocol with triage, Vision governance and optional devPNT integration.",
   "author": "Antonio Pinto (https://github.com/Antoneeo)"
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@antoneeo/agentic-sdlc-skill",
-  "version": "1.8.0",
+  "version": "1.8.1",
   "description": "Documentation-First SDLC protocol for Claude Code, Gemini CLI and Codex with risk triage, Vision governance, installed support files and optional devPNT integration.",
   "keywords": [
     "claude-code",

package/skills/agentic-sdlc-skill/guides.md

@@ -83,6 +83,13 @@ guide with no `distilled_from` is not this pipeline's output.
    - `hash8` = first 8 hex chars of the snapshot file's own SHA-256 (compute
      the snapshot first, hash it, then name it — the hash is of the file you
      just wrote, not of the original source).
+   - The hash is computed over LF-normalized content (CRLF → LF), exactly as
+     `sdlc_check.py` does in `sha256_file` — so recorded hashes survive
+     checkouts that rewrite line endings (e.g. Windows `core.autocrlf=true`).
+   - Recommended for consumer projects: add
+     `ai_docs/reference/.sources/** -text` to `.gitattributes` so git never
+     rewrites snapshot bytes at all (keeps snapshots byte-verbatim; the
+     normalized hash stays stable either way).
    - The snapshot is verbatim: no paraphrasing, no reformatting beyond what is
      needed to save it as markdown.
 4. **Source-anchored SYNTHESIS (not restatement).** Select and compress what

package/skills/agentic-sdlc-skill/scripts/sdlc_check.py

@@ -109,8 +109,12 @@ def read_text(path):
 
 
 def sha256_file(path):
+    # CRLF->LF before hashing: a Windows checkout with core.autocrlf=true
+    # rewrites snapshot files, and a raw-byte hash would flag every guide
+    # [stale] on a fresh clone. Recorded hashes are LF-based, so normalizing
+    # maps CRLF copies back to the same digest.
     h = hashlib.sha256()
-    h.update(path.read_bytes())
+    h.update(path.read_bytes().replace(b"\r\n", b"\n"))
     return h.hexdigest()