@codedology/code-forge 0.1.0 → 0.2.1

package/CHANGELOG.md

@@ -4,6 +4,49 @@ All notable changes to `@codedology/code-forge` are recorded here. Format loosel
 [Keep a Changelog](https://keepachangelog.com/); versions follow semver ahead of a 1.0.0 that
 waits on a second real consumer (plan §10.4, Q17).
 
+## [Unreleased]
+
+## [0.2.1] — 2026-10-01
+
+### Changed
+
+- **Two publish paths:** publish by hand with `npm publish` before pushing the tag (the tag run sees
+  the version on npm, skips its own publish and still creates the GitHub release), or push only and
+  let CI publish with provenance (needs `NPM_TOKEN`). See `docs/releasing.md`.
+- `init` no longer asks for gates or proof settings one by one: it reads them from the project
+  (gates from `detect`, `link_dirs` from the project's manifests, `copy_untracked` only for files
+  that exist, high-risk paths blank, isolation `export`), prints a "Project settings (detected)" summary that marks every blank
+  and names the keys to edit, then asks one choice: Use these, Customize now (the eight questions,
+  pre-filled) or Leave for later. `--no-interaction` asks nothing; agent JSON gains `settings` and
+  `blank`. Every question has a one-line hint; a re-run fills a gate that was blank and keeps
+  hand-set ones.
+
+## [0.2.0] — 2026-09-26
+
+### Added
+
+- **`code-forge review`** — review only: runs the review engine on changes you already have (your
+  branch against the merge base with the default branch, your uncommitted work, or `--files`), with
+  no plan, coder or proof, and never closes a block. One verdict per file, a fix list, totals or one
+  JSON document (`--json`); exit 0 only when every file is approved. The run and its worker are
+  always ended, also on Ctrl-C, SIGTERM and timeouts. See `docs/review-only.md`.
+- **Release tools:** `npm run release -- <patch|minor|major|x.y.z>` bumps every version location,
+  moves the changelog, runs every check (with rollback), commits and tags; `npm run changelog --
+  <type> "text"` records changes as you go. See `docs/releasing.md`.
+- **GitHub Releases:** a tag push publishes to npm and then creates the GitHub Release from the
+  changelog, with links to the npm version and the changelog.
+
+### Changed
+
+- **Reviewers see the acceptance clauses.** Every review packet now carries the block's acceptance
+  clauses (redacted, cut to fit the packet budget); a block without readable clauses is still
+  reviewed, with `(acceptance unavailable)`.
+
+### Fixed
+
+- CI is green on Linux: a macOS-only case-insensitivity test now skips on case-sensitive
+  filesystems, and the Node 22/24 matrix no longer cancels one job when the other fails.
+
 ## [0.1.0] — first release
 
 The `plan` → `harden` → `code` → `review` pipeline for cross-model, parallel, evidence-gated

package/README.md

@@ -10,8 +10,8 @@ for cross-model, parallel, evidence-gated feature delivery — on Claude Code, C
 
 ## What ships
 
-- A CLI (`code-forge`), installed globally via `npx @codedology/code-forge init` into every detected
-  harness (Claude Code, Codex, Grok, …).
+- A CLI (`code-forge`), installed globally with `npm install -g @codedology/code-forge`; `code-forge
+  init` then links the skill into every detected harness (Claude Code, Codex, Grok, …).
 - One Agent Skill (`skill/SKILL.md` + `references/`) that is prose only — every fact (model ids,
   efforts, commands, thresholds, paths) lives in config or in the CLI, never in the skill text.
 - A JSON Schema for `.code-forge.yml` (`schema/code-forge.schema.json`), documented in
@@ -23,14 +23,20 @@ policy and security model; `docs/reference/blocks.json` lists the build blocks.
 ## Install
 
 ```bash
-npx @codedology/code-forge init
+npm install -g @codedology/code-forge
+code-forge init
 ```
 
-The wizard asks nine short questions (tools, harnesses, provider matrix, multimodel, keys, engine,
-gates, proof, doctor), every one with a default on Enter. Non-interactively:
+The scoped name is used only to install; the command is `code-forge`. The unscoped npm package
+`code-forge` is a different, unrelated tool.
+
+The wizard asks a few short questions (tools, harnesses, provider matrix, multimodel, keys,
+engine), every one with a default on Enter. Gates and proof settings come from the project:
+`init` prints what it found, marks what it left blank, and lets you use, customize or leave them
+for later. Non-interactively:
 
 ```bash
-npx @codedology/code-forge init --no-interaction --no-jev
+code-forge init --no-interaction --no-jev
 ```
 
 `--no-jev` skips the System-1 key for a first try; drop it and pass `--jev-ref op://vault/item/field`
@@ -51,6 +57,20 @@ code-forge --help                    # every verb, one per line
 code-forge version
 ```
 
+## Review only
+
+To review code you already wrote — no plan, no coder, no proof — run this in the repository:
+
+```bash
+code-forge review                    # verdict + fix list per changed file; exit 0 only if all approved
+```
+
+It reviews your branch against the merge base with the default branch (on the default branch: your
+uncommitted work), with the same fresh, closed-book reviewer sessions a block gets. Narrow it with
+`--files <path…>`, state the change with `--intent "<text>"`, pick the base with `--base <ref>`, or
+get one JSON document with `--json`. Exit codes: `0` all approved or nothing to review, `1` any
+finding, stop or unavailable review, `2` usage. See [docs/review-only.md](docs/review-only.md).
+
 ## The verbs
 
 Verbs are discovered from `src/cli/*.mjs` — adding one never touches the router
@@ -66,6 +86,7 @@ usage line.
 | `run` | `code-forge run start [--cwd <dir>] [--run <id>] [--engine <e>] [--worker-pid <pid>]` · `run start --reattach --run <id>` · `run status --run <id>` · `run end --run <id>` |
 | `block` | `code-forge block open <id> --run <r> --level L<n> --owned <paths…> --acceptance <file>` · `block attempt\|rebase\|claim\|close\|stop\|waive …` (§4.9; `waive` is human-only) |
 | `worker` | `code-forge worker --run <id> [--cwd <dir>] [--poll-ms <n>] [--once]` — started detached by `run start`, never by a coder |
+| `review` | `code-forge review [--base <ref>] [--files <path…>] [--acceptance <file> \| --intent "<text>"] [--run <id>] [--max <seconds>] [--json] [--keep-run]` — review only: no coder, no proof, never closes a block |
 | `review-file` | `code-forge review-file <path> --block <id> [--run <id>]` (enqueue) · `review-file --wait <ticket> [--max <seconds>s]` (poll) |
 | `spawn` | `code-forge spawn --level L<n> --role <role> --brief <file> [--schema <file>] [--cwd <dir>] [--run <id>] [--block <id>] [--timeout <s>] [--background]` |
 | `s2` | `code-forge s2 --packet <file.json> [--run <id>] [--block <id>] [--timeout <s>]` |
@@ -125,3 +146,5 @@ npm run typecheck     # tsc --checkJs --noEmit
 Node >= 22 required (ruling R7). No build step — the package ships plain ESM `.mjs`, run directly
 by Node. `docs/reference/blocks.json` maps each build block to the files it owns and what it
 depends on, kept in sync with the maintainer's design plan.
+
+Releasing: record changes with `npm run changelog -- <type> "<text>"`, then `npm run release -- <patch|minor|major|x.y.z> [--dry-run]` bumps, commits and tags (it never pushes or publishes). See [docs/releasing.md](docs/releasing.md).

package/docs/README.md

@@ -13,10 +13,12 @@ disagree, the verb is right: each verb prints its own usage line when its argume
 | 3 | [how-it-works.md](how-it-works.md) | follow the full workflow from a brief to a closed block, and see who does what and where state lives |
 | 4 | [getting-started.md](getting-started.md) | install it, answer `init`, run `doctor`, and try the first commands |
 | 5 | [tutorial-first-test.md](tutorial-first-test.md) | run one real end-to-end test: build the code-forge marketing site in a new repo |
+| 5a | [review-only.md](review-only.md) | only review code you already wrote: a branch, uncommitted work or some files, with CI exit codes |
 | 6 | [examples/marketing-site/brief.md](examples/marketing-site/brief.md) | copy the brief the tutorial uses |
 | 7 | [marketing.md](marketing.md) | read the product story: the problem, the promise, the honest limits |
 
-New to the tool? Read 1 → 3 → 4, then do 5. Keep 2 open as a glossary.
+New to the tool? Read 1 → 3 → 4, then do 5. Keep 2 open as a glossary. Only want reviews? Read 4,
+then 5a.
 
 ## Reference pages (already in the repo)
 
@@ -25,6 +27,7 @@ New to the tool? Read 1 → 3 → 4, then do 5. Keep 2 open as a glossary.
 | [reference/config.md](reference/config.md) | every `.code-forge.yml` key, its type and default. Generated from `schema/code-forge.schema.json` |
 | [reference/blocks.json](reference/blocks.json) | the build blocks of this package and what each one owns |
 | [marketing/code-forge-story.md](marketing/code-forge-story.md) | the marketing content bank (copy, lessons, what not to claim) |
+| [releasing.md](releasing.md) | for maintainers: record changes (`npm run changelog`), cut a release with one command (`npm run release`), GitHub Releases, what stays manual |
 | [`skill/SKILL.md`](../skill/SKILL.md) and [`skill/references/`](../skill/references/) | the Agent Skill the orchestrator follows. The deepest and most exact description of the rules |
 
 ## Conventions in these pages

package/docs/reference/blocks.json

@@ -1,10 +1,10 @@
 {
-  "$comment": "hand-maintained; checked against plan §10.4 + NIGHT-LOG by test/docs-blocks.test.mjs. Ids = every `| **Bxx** |` row in plans/code-forge-plan-v1.3.md §10.4 Waves 2-6 (19 ids), plus the blocks the root orchestrator added during the night run of 2026-09-25 that are not in that table (plans/NIGHT-LOG.md): B1.2, B4.1, B11.1, B12c (B3.1 was already in the v1.3 §10.4 table). Wave 0-1 blocks (B0-B8) are the pre-v1.3 baseline landed before this plan revision; they have no entry under blocks and are listed in baseline_ids so every depends_on id resolves; see plans/code-forge-plan-v1.3.md §10.2-§10.3 for their record. B10c is listed with deleted:true — the maintainer answered Q16 'cut' on 2026-09-25, so B10c (consumer-facing mutation-testing tools) never lands.",
+  "$comment": "hand-maintained; checked against plan §10.4 + NIGHT-LOG by test/docs-blocks.test.mjs. Ids = every `| **Bxx** |` row in plans/code-forge-plan-v1.3.md §10.4 Waves 2-6 (19 ids), plus the blocks the root orchestrator added during the night run of 2026-09-25 that are not in that table (plans/NIGHT-LOG.md): B1.2, B4.1, B11.1, B12c (B3.1 was already in the v1.3 §10.4 table); plus B22 (the review-only verb), which the root added on 2026-09-26 after the night run. Wave 0-1 blocks (B0-B8) are the pre-v1.3 baseline landed before this plan revision; they have no entry under blocks and are listed in baseline_ids so every depends_on id resolves; see plans/code-forge-plan-v1.3.md §10.2-§10.3 for their record. B10c is listed with deleted:true — the maintainer answered Q16 'cut' on 2026-09-25, so B10c (consumer-facing mutation-testing tools) never lands.",
   "checked_against": [
     "plans/code-forge-plan-v1.3.md §10.4",
     "plans/NIGHT-LOG.md"
   ],
-  "block_count": 23,
+  "block_count": 24,
   "baseline_ids": ["B0", "B1", "B2", "B3", "B4", "B5", "B6", "B7", "B8"],
   "baseline_note": "Wave 0-1 blocks, landed before v1.3; depends_on may name them, but they have no entry under blocks.",
   "blocks": {
@@ -283,6 +283,17 @@
         "src/proof/tools/**", "src/proof/nightly.mjs", "ci/nightly-proof.yml", "test/proof/tools/**", "test/proof/nightly.test.mjs"
       ],
       "depends_on": ["B10a", "B10b"]
+    },
+    "B22": {
+      "title": "Review-only verb: code-forge review (base/file discovery, run start -> block open -> review-file -> block stop -> run end) and its docs",
+      "wave": 6,
+      "level": "L2",
+      "status": "in_review",
+      "owned": [
+        "src/cli/review.mjs", "test/cli/review.test.mjs", "docs/review-only.md"
+      ],
+      "depends_on": ["B11", "B12a", "B12c"],
+      "note": "root-added 2026-09-26 (after the night run); not in the v1.3 §10.4 table"
     }
   }
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@codedology/code-forge",
-  "version": "0.1.0",
+  "version": "0.2.1",
   "description": "Plan/harden/code/review orchestration CLI and Agent Skill for cross-model, parallel, evidence-gated feature delivery.",
   "repository": {
     "type": "git",
@@ -29,13 +29,17 @@
     "docs/reference",
     "examples",
     "scripts",
+    "!scripts/release.mjs",
+    "!scripts/changelog.mjs",
     "README.md",
     "CHANGELOG.md",
     "LICENSE"
   ],
   "scripts": {
     "test": "CODE_FORGE_NO_LEAK=snapshot node --import ./test/helpers/isolate.mjs --test test/no-leak.test.mjs && node --import ./test/helpers/isolate.mjs --experimental-test-module-mocks --test 'test/**/*.test.mjs' && CODE_FORGE_NO_LEAK=final node --import ./test/helpers/isolate.mjs --test test/no-leak.test.mjs",
-    "typecheck": "tsc --checkJs --noEmit"
+    "typecheck": "tsc --checkJs --noEmit",
+    "release": "node scripts/release.mjs",
+    "changelog": "node scripts/changelog.mjs"
   },
   "dependencies": {
     "@clack/prompts": "1.8.1",

package/skill/references/review.md

@@ -40,3 +40,7 @@ Two L2 reviewers, one per effective provider (`resolve(L2)` and `review.second_l
 ## §7 The review budget per block
 
 `review.block_budget_tokens` (and optionally `review.block_budget_usd`) bounds every review, recheck, judge and S2 session made for the block. When the forecast exceeds it the worker degrades one step at a time, cheapest first: batch small files of one tier into one packet (`review.batch_small_files`) → one judge per block instead of per file → standard band `full` → `quick` → high tier `A + B + judge` → one `full` L2 + judge, the floor. Tools-only is never a review; a light `quick` stays `quick`. Still over ⇒ `review.over_budget`: raise the budget once per run (a config edit by the human, on record) or split the block — never silently, never below the floors. The ledger keeps `depth_unconstrained` and `depth_chosen` per file so `forge report` can show `missed_after_degrade`.
+
+## §8 Review only
+
+A human who wants a review and nothing else runs `forge review`: it reviews the changed files in one `R-<timestamp>` block at L2, prints the verdicts, then stops the block and ends the run — no plan, no coder, no proof, never a close. Inside a block the orchestrator keeps using `forge review-file`.

package/skill/scripts/forge

@@ -10,7 +10,7 @@
 #      copied install with no package next to it); `test/skill/shim.test.mjs` asserts the pin
 #      equals package.json's version.
 # The shim holds no logic of its own: every verb, flag and message is the CLI's.
-PINNED_VERSION="0.1.0"
+PINNED_VERSION="0.2.1"
 set -eu
 
 self="$0"