@massu/core 1.15.3 → 1.15.5

package/CHANGELOG.md

@@ -4,6 +4,85 @@ All notable changes to this project will be documented in this file.
 
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/).
 
+> **Bundled model attribution.** `@massu/core` ships a pre-trained sentence-embedding
+> model for offline semantic memory recall: **all-MiniLM-L6-v2** (384-dim, int8 ONNX
+> export from `sentence-transformers/all-MiniLM-L6-v2` via `Xenova/all-MiniLM-L6-v2`),
+> redistributed under the **Apache License 2.0**. Full license + NOTICE:
+> `packages/core/assets/embedder/MODEL-LICENSE`.
+
+## [1.15.5] - 2026-07-14
+
+### Fixed — CRITICAL: `install-commands` could destroy your customizations
+
+- **The installer recorded a hash for a file it did not write.** On meeting a command file with no
+  manifest entry, it kept the file (correct) and then recorded THAT FILE'S hash into the manifest —
+  a manifest whose entire meaning is "this is the hash of what massu installed". On the next run the
+  safe-upgrade path read that back, concluded the file was untouched, and **overwrote it**.
+  **Run 1 armed it; run 2 destroyed the work.** Measured against a real repo: 36 files of local
+  customization deleted on the second install, reported as success.
+
+  It now records **nothing** when it cannot prove authorship. The ambiguity is re-detected on every
+  run and the file is kept on every run. A customized file with no provenance now FREEZES: safe, but
+  stale. Upstream changes reach it via an explicit `rm <file> && massu install-commands`, or a future
+  three-way merge. Between "stale" and "your work is silently deleted", we choose stale.
+
+- **A test was protecting the bug.** `MANIFEST-06` asserted the fail-open as correct behaviour
+  ("Manifest seeded with EXISTING hash for kept"). The test agreed with the code because both were
+  written from the same wrong assumption. Assertion inverted.
+
+- **`scripts/quarantine-poisoned-manifest.mjs`** — repairs a manifest that already contains such a
+  hash. It does not re-derive what massu "would have written" (the installer resolves variants and
+  renders templates, so the installed bytes are a function of the repo's config); it runs the REAL
+  installer against a scratch copy and drops any entry that authorises an overwrite. Dry run by
+  default; backs the manifest up before writing.
+
+### Fixed — the golden path was missing the machinery that checks the work
+
+`8fff05d`, whose message announced only additions, silently **deleted** three quality subsystems.
+The spec files kept shipping; nothing invoked them. Restored and re-wired:
+
+- **Sprint contracts (2A.5)** — agree definition-of-done per item BEFORE implementing it.
+- **QA evaluator (2C)** — adversarial acceptance testing AGAINST those contracts.
+- **VR-VISUAL** — weighted 4-dimension scoring (threshold >= 3.0).
+- **Gap analyzer's 7th category** — sprint-contract compliance. Without it the loop could report
+  zero gaps while the work missed the definition of done it was built against.
+
+And a fourth that was **never wired at all**: **Phase 5.5 — Production Verification**, shipped in
+v0.6.0 and invoked by nothing for its entire life. Its own first line reads *"A feature is NOT
+complete until it is verified working in production with real data. 'Deployed' and 'working' are two
+completely different things."*
+
+- **A new gate that deletion cannot satisfy.** The previous check asked only "does every reference
+  file have a link?" — so deleting the spec files made it pass. The new one asserts, per subsystem,
+  that the file EXISTS **and** is LINKED **and** is INVOKED by name. Proven by attacking all three.
+
+### Fixed
+- `massu-pattern-scanner.sh` Check 40 used a relative path and silently failed from any directory but
+  the repo root — including `packages/core/`, which is where npm runs `prepublishOnly`. The
+  pre-publish check that runs it had therefore never worked.
+- `diff-commands-vs-docs.sh` derived its repo root via `git rev-parse || pwd`; outside a git tree the
+  fallback turned "I cannot find the repo" into a confident wrong answer.
+
+## [1.15.4] - 2026-07-13
+
+### Security
+
+- **Test fixtures are now synthetic.** Five config-migration fixtures were snapshots of real
+  private repositories, carrying their project names, stacks and custom verification-type names
+  into this package. They are replaced with invented projects, and each fixture directory is now
+  named for the migration SCENARIO it pins (`multi-runtime-fastapi-next`, `invalid-router-enum`,
+  `twelve-key-passthrough`, …) rather than for a repo it was copied from. A fixture that is a copy
+  of a real repository is a leak with a test around it.
+- **CI conditions no longer name a private repository or a maintainer account.** Job gates now
+  match positively on the public repo (`github.repository == 'massu-ai/massu'`) instead of matching
+  negatively against a private upstream. Same behaviour; nothing private in the expression.
+- **Docs reference the maintainer by role, not by personal account.**
+- **`prepublish-check.sh` now enumerates every GitHub URL in `package.json`** and requires each to
+  point at `massu-ai/massu`, replacing a check that grepped for one hardcoded legacy owner slug.
+  Strictly stronger: it catches any wrong owner, not only the one that was remembered.
+
+No functional or API changes. Every one of these is a docs/fixture/CI-metadata change.
+
 ## [1.15.3] - 2026-07-06
 
 **`massu login` hung forever in non-interactive shells (CI / scripts / agents) with `MASSU_API_KEY` set** (`plan-2026-07-06-login-noninteractive-env-hang`). `runLogin()` never read the `MASSU_API_KEY` environment variable and then read a non-TTY stdin unbounded (`for await … process.stdin`, blocking on an EOF that never arrives on an idle non-TTY stdin), so the documented, non-exposing scripted path (`MASSU_API_KEY=<key> massu login`) blocked indefinitely — the only working non-interactive path was `--key`, which leaks the key to shell history. Patch per semver: a bug fix with no API change, scoped entirely to the `login` command. Incident #1.
@@ -684,7 +763,7 @@ Pre-launch comprehensive audit remediation — combined Stage A + Stage B releas
 - **`website/src/app/api/license/activate/route.ts`** — TWO CRITICAL hardenings in one route refactor: (a) **P-014 atomic UPDATE** — SELECT-check-UPDATE pattern allowed two concurrent requests with the same key to both pass the JS-side status check and double-activate. Replaced with atomic `UPDATE book_purchases SET license_key_status='active', activated_at=NOW() WHERE id=$1 AND license_key_status='inactive' .select('id, activated_at')`. Race losers see `[]` from the post-update select and surface 409 `already_activated`. (b) **P-015 auth + email match** — route was anonymous and resolved identity via `user_profiles.email = purchase.email`, allowing an attacker to sign up as `victim@victim-corp.com` and bind a leaked license key to the victim's org. Now requires `createServerSupabaseClient().auth.getUser()`; returns 401 with `needs_signup` hint (no email leak — anonymous enumeration vector closed) when unauthenticated; returns 403 when `authedUser.email.toLowerCase() !== purchase.email.toLowerCase()`. Both closed in Stage B. Drift-guard: `integration/license-activate.test.ts` covers race-loser, 401 unauth, 403 mismatch, AND case-insensitive matching.
 - **NEW `website/src/lib/sso-flag.ts`** + GATED `website/src/app/api/sso/callback/route.ts`, `website/src/app/api/sso/route.ts`, `website/src/app/dashboard/settings/sso/page.tsx` — the custom OIDC verifier never cryptographically verified the JWT signature against the IdP's JWKS (P-016 — full SSO bypass for any attacker who registers their own OIDC config), and the custom SAML verifier was vulnerable to XML Signature Wrapping (P-017 — the first-element-wins regex parser allowed outer-wrapper substitution while inner signature still validated). Per operator decision (2026-05-16), SSO is DISABLED via `MASSU_SSO_ENABLED=false` (default) until the library replacement (`openid-client` + `@node-saml/node-saml`) ships in `plan-B.3-followup` post-launch + third-party pen-test. Every SSO entry point returns canonical 503 `SSO_DISABLED`; dashboard SSO settings page shows maintenance UI with `support@massu.ai` contact path. Legacy verifier code preserved below the gate so the followup PR can wire libraries without re-deriving the Supabase user-creation flow. Both closed at the entry point in Stage B. Drift-guard: `website/src/__tests__/sso-disabled-by-default.test.ts` (10 cases) asserts the flag defaults false, that all three entry-point files import + call `isSsoEnabled()`, and that the callback route returns `ssoDisabledResponse()` from BOTH POST and GET handlers.
 - **`website/src/data/stats.ts`** — added `MCP_TOOL_COUNT` (= 73) named export alongside the existing `stats: Stat[]` SoT, plus `WORKFLOW_COMMAND_COUNT`, `AI_AGENT_COUNT`, `LIFECYCLE_HOOK_COUNT`. Replaced literal `84 MCP tools` claims across 14 TSX/TS surfaces (`app/layout.tsx` 3x, `app/docs/layout.tsx`, `app/features/page.tsx` 4x, `app/about/page.tsx`, `app/overview/page.tsx` 5x, `app/pricing/page.tsx`, `app/checkout/cancel/page.tsx`, `components/sections/Hero.tsx` 2x, `components/sections/OpenSourceSection.tsx`, `components/sections/CloudPreview.tsx`, `components/pricing/PricingFAQ.tsx`, `components/pricing/FeatureComparison.tsx`, `data/articles.ts` 3x, `data/features.ts`, `data/pricing.ts`) with `${MCP_TOOL_COUNT}` interpolation; replaced `84` with literal `73` in 2 MDX content files. Closes P-019 (Stage B). Drift-guard: NEW `website/src/__tests__/marketing-tool-count-against-source-truth.test.ts` walks `website/src` + `website/content` for forbidden literals (`84 MCP`, `84 tools`, `all 84`, plus historical drift literals `47/56/62 MCP/tools`) and asserts zero matches.
-- **`.github/workflows/ci.public.yml`** — both `ci.yml` and `ci.public.yml` had workflow `name: CI` and shared `${{ github.workflow }}-${{ github.ref }}` concurrency group; on every main push the stronger `ci.yml` was being CANCELLED while the weaker `ci.public.yml` (4 of 6 internal jobs only — missing Pattern Scanner, Security Scanner, Generalization Scanner, Plan Status Validator, Plan Commit Drift, Plan-Token Changelog Coverage, Website Audit, Hook Build) satisfied branch protection. This is how the 4 API column-drift CRITICALs (P-005..P-008) reached production. Renamed `ci.public.yml` workflow + concurrency group + job-display names to `CI (public-mirror)`; 4 jobs gated `if: github.repository != 'ethankowen-73/massu-internal'` so the internal repo runs the FULL `ci.yml` and the public mirror keeps the public-facing subset. Job-level `name:` values PRESERVED (both rulesets reference them as required status checks). Closes P-020 (Stage A). Drift-guard: NEW `website/src/__tests__/workflow-uniqueness.test.ts` (3 assertions).
+- **`.github/workflows/ci.public.yml`** — both `ci.yml` and `ci.public.yml` had workflow `name: CI` and shared `${{ github.workflow }}-${{ github.ref }}` concurrency group; on every main push the stronger `ci.yml` was being CANCELLED while the weaker `ci.public.yml` (4 of 6 internal jobs only — missing Pattern Scanner, Security Scanner, Generalization Scanner, Plan Status Validator, Plan Commit Drift, Plan-Token Changelog Coverage, Website Audit, Hook Build) satisfied branch protection. This is how the 4 API column-drift CRITICALs (P-005..P-008) reached production. Renamed `ci.public.yml` workflow + concurrency group + job-display names to `CI (public-mirror)`; 4 jobs gated `if: github.repository == 'massu-ai/massu'` so the internal repo runs the FULL `ci.yml` and the public mirror keeps the public-facing subset. Job-level `name:` values PRESERVED (both rulesets reference them as required status checks). Closes P-020 (Stage A). Drift-guard: NEW `website/src/__tests__/workflow-uniqueness.test.ts` (3 assertions).
 - **NEW `website/src/app/book/opengraph-image.tsx`** — `book/layout.tsx` referenced `/og-book.png` but the file didn't exist in `website/public/`, producing a 404 image preview on every Twitter / LinkedIn / Slack share of `/book`. Replaced with the Next.js `opengraph-image.tsx` file convention — `next/og` `ImageResponse` generates a brand-consistent 1200x630 PNG at build time, Next.js auto-wires `<meta property="og:image">` and `<meta name="twitter:image">`. No static asset to maintain. Removed the broken `/og-book.png` references from `book/layout.tsx`. Closes P-021 (Stage B). Drift-guard: `website/src/__tests__/og-book-image-resolves.test.ts` (4 cases) — asserts the file exists, exports `ImageResponse` with 1200x630 dimensions, AND that any future reintroduction of `/og-book.png` in `book/layout.tsx` requires the static file to also exist.
 - **`website/src/components/sections/Hero.tsx`** — homepage had ZERO `/book` promotion above-the-fold; `/book` was only reachable via 7th nav tab. Added a pill-style `<Link href="/book">` book-announcement BEFORE the existing "Free & Source Available" badge AND before the Install Free button. `trackEvent('cta_hero_book_announcement')` for funnel measurement. Closes P-022 (Stage B). Drift-guard: `website/src/__tests__/homepage-book-cta-presence.test.ts` enforces the ordering invariant (book CTA must precede Install Free).
 - **`website/src/components/redeem/RedeemForm.tsx`** — `needs_signup` branch lost the license key, forcing customers to dig through email to re-paste the 28-char code after signup. Implemented 2-layer persistence: localStorage `massu_pending_license_key` (primary) + `?license_key=` URL fallback. Auto-fills on mount; strips URL param after hydration (no Referer/history leak); persists on `needs_signup`; clears on success; signup CTA carries `redirect_to=/redeem?license_key=…`. Closes P-023 (Stage B). Drift-guard: `__tests__/redeem-license-key-persistence.test.ts` (7 cases).
@@ -1470,7 +1549,7 @@ Auto-detect on install; zero manual config; migration via `migrateV1ToV2()`.
 - **`migrateV1ToV2(v1Config, detectionResult)` pure function** (`packages/core/src/detect/migrate.ts`) — lifts existing v1 configs to v2 while preserving every user override (rules, domains, canonical_paths, accessScopes, analytics, governance, security, team, conventions, etc.).
 - **`computeFingerprint` and `detectDrift`** (`packages/core/src/detect/drift.ts`) — SHA-256 fingerprint over normalized `DetectionResult` plus a four-axis drift report (language set, per-language framework, manifest set, workspace set).
 - **`verification` config block** — per-language overrides for VR-TEST, VR-TYPE, VR-BUILD, VR-SYNTAX, VR-LINT.
-- **`verification_types` config block** — register custom VR-* types (e.g., `VR-IBKR-CONTRACT`, `VR-POLICY`) with descriptions.
+- **`verification_types` config block** — register custom VR-* types (e.g., `VR-LEDGER-PARITY`, `VR-POLICY`) with descriptions.
 - **`detection.rules` config block** — add project-specific framework signals or replace built-ins entirely with `detection.disable_builtin: true`.
 - **Monorepo detection** — identifies `turbo`, `nx`, `lerna`, `pnpm`, `yarn`, `bazel`, `generic`, `single`. Nested workspace support (e.g., turbo outer + pnpm inner).
 - **Atomic config writes** — `.tmp` file + `renameSync`; partial writes never persist. File permissions preserved on overwrite.

package/commands/massu-golden-path.md

@@ -106,15 +106,25 @@ Read `references/phase-1-plan-creation.md` for full details.
 
 Read `references/phase-2-implementation.md` for full details.
 
-**Summary**: Seven sub-phases:
+**Summary**: Eight sub-phases:
 - **2A**: Extract plan items into tracking table, initialize session state
+- **2A.5**: **Sprint contracts** — negotiate definition-of-done per plan item BEFORE implementing it (scope boundary, acceptance criteria, VR-* mapping). See `references/sprint-contract-protocol.md`
 - **2B**: Implementation loop (pre-check, execute, guardrail, verify, update per item)
-- **2C**: Multi-perspective review (3 parallel agents: security, architecture, quality)
-- **2D**: Verification audit loop (subagent, circuit breaker CR-37, max 10 iterations)
+- **2C**: Multi-perspective review (3 parallel agents: security, architecture, quality) + **QA evaluator** (conditional, UI plans only — adversarial Playwright-based acceptance testing **against the sprint contracts agreed in 2A.5**). See `references/qa-evaluator-spec.md`
+- **2D**: Verification audit loop (subagent, circuit breaker CR-37, sprint-contract verification, max 10 iterations)
 - **2E**: Post-build reflection + memory persist (CR-38)
 - **2F**: Documentation sync (if user-facing features)
 - **2G**: Browser verification & fix loop (auto-triggers if UI files changed, Playwright MCP)
 
+> **2A.5 and 2C are load-bearing, and they were missing.** Commit `8fff05d` — whose message
+> announced only ADDITIONS ("CR-45 zero-tolerance mandate") — silently deleted the sprint
+> contracts and the QA evaluator from this file. Every golden-path run since has implemented
+> against no agreed definition of done, and accepted its own work without an adversarial check.
+> The spec files never stopped shipping; nothing invoked them. Restored 2026-07-14.
+>
+> The order matters: **2A.5 agrees what "done" means BEFORE 2B builds it, so 2C has something
+> to judge against.** A QA evaluator with no contract is grading an exam with no answer key.
+
 **Gate**: APPROVAL POINT #2: NEW PATTERN (if needed, any sub-phase)
 
 ---
@@ -123,7 +133,12 @@ Read `references/phase-2-implementation.md` for full details.
 
 Read `references/phase-2.5-gap-analyzer.md` for full details.
 
-**Summary**: After implementation completes, run a continuous gap and enhancement analysis loop. A subagent analyzes all changed files across 6 categories (functional gaps, UX gaps, data integrity, security, pattern compliance, enhancements). Every gap/enhancement found is fixed immediately. The loop re-runs until a full pass discovers ZERO gaps. Max 10 iterations. Skippable only for documentation-only changes or explicit user request.
+**Summary**: After implementation completes, run a continuous gap and enhancement analysis loop. A subagent analyzes all changed files across **7 categories** (functional gaps, UX gaps, data integrity, security, pattern compliance, enhancements, **sprint-contract compliance**). **VR-VISUAL uses weighted 4-dimension scoring (threshold >= 3.0)** — see `references/vr-visual-calibration.md` for the 5/3/1 calibration examples. Every gap/enhancement found is fixed immediately. The loop re-runs until a full pass discovers ZERO gaps. Max 10 iterations. Skippable only for documentation-only changes or explicit user request.
+
+> **The 7th category and VR-VISUAL's scoring were deleted by `8fff05d` and restored 2026-07-14.**
+> Without the sprint-contract category, the loop could report ZERO gaps while the work missed the
+> definition of done it was built against. Without the weighted scoring, VR-VISUAL was a
+> pass/fail vibe check with a calibration file nobody read.
 
 ---
 
@@ -155,6 +170,30 @@ Read `references/phase-5-push.md` for full details.
 
 ---
 
+## PHASE 5.5: PRODUCTION VERIFICATION
+
+Read `references/phase-5.5-production-verify.md` for full details.
+
+**Summary**: After push and CI success, verify the deployment actually LANDED and the feature
+actually WORKS — against production, with real data. Confirm the deploy reached READY, read the
+runtime logs for startup errors, then exercise the feature itself and read back what the system
+returns. Skippable ONLY when the change has no deployed surface (docs-only, tooling-only).
+
+**Core principle**: *A feature is NOT complete until it is verified working in production with real
+data. "Deployed" and "working" are two completely different things.*
+
+> **This phase was written, shipped in v0.6.0 — and NEVER WIRED IN.** It has been sitting in
+> `references/` for its entire life with nothing invoking it: a `git log -S` over this file finds
+> no commit that ever linked it. It was not deleted; it was never enabled. That is its own failure
+> class ("hunt the built-and-never-enabled"), and it is the more embarrassing one, because the
+> phase that would have caught "we shipped it but never checked it worked" was itself shipped and
+> never checked. Wired 2026-07-14.
+>
+> It goes AFTER the push (you cannot verify a deployment that has not happened) and BEFORE
+> completion (you may not call it done until the world agrees it is).
+
+---
+
 ## PHASE 6: COMPLETION
 
 Read `references/phase-6-completion.md` for full details.
@@ -171,12 +210,16 @@ This skill is a folder. The following files are available for reference:
 |------|---------|-----------|
 | `references/phase-0-requirements.md` | Requirements interview, ambiguity detection, 10-dimension coverage map | Starting a new implementation from a task description |
 | `references/phase-1-plan-creation.md` | Config/schema reality check, blast radius analysis, plan generation, audit loop | Writing or auditing a plan |
-| `references/phase-2-implementation.md` | Item loop, multi-perspective review, verification audit, browser testing | Executing implementation; any Phase 2 sub-phase |
-| `references/phase-2.5-gap-analyzer.md` | Gap/enhancement analysis loop, 6 categories, fix-and-repass until zero | After implementation, before simplification |
+| `references/phase-2-implementation.md` | Item loop, sprint contracts, multi-perspective review, QA evaluator, verification audit, browser testing | Executing implementation; any Phase 2 sub-phase |
+| `references/sprint-contract-protocol.md` | Sprint contract template, quality bar, negotiation rules, skip conditions | Phase 2A.5 — agreeing definition-of-done before implementing |
+| `references/qa-evaluator-spec.md` | Adversarial QA evaluator: 4 dimensions, anti-leniency rules, known failure patterns | Phase 2C — QA evaluation (UI plans only) |
+| `references/vr-visual-calibration.md` | Score 5/3/1 calibration examples for VR-VISUAL weighted dimensions | Calibrating VR-VISUAL scoring in Phase 2.5 |
+| `references/phase-2.5-gap-analyzer.md` | Gap/enhancement analysis loop, 7 categories (incl. sprint-contract compliance), fix-and-repass until zero | After implementation, before simplification |
 | `references/phase-3-simplify.md` | Pattern scanner fast gate, dead code detection, parallel semantic review agents | Running simplification after implementation |
 | `references/phase-4-commit.md` | Auto-verification gates, quality scoring, commit format | Preparing a commit |
 | `references/phase-5-push.md` | Pre-flight, 4-tier push verification, regression detection | Preparing to push to remote |
-| `references/phase-6-completion.md` | Final report, plan status update, auto-learning | After push; completing the golden path |
+| `references/phase-5.5-production-verify.md` | Deployment landed, runtime logs clean, feature exercised against production with real data | Phase 5.5 — after push, before calling it done |
+| `references/phase-6-completion.md` | Final report, plan status update, auto-learning | After production verification; completing the golden path |
 | `references/approval-points.md` | Exact format and options for all 4 approval points (5 with --competitive: Plan, New Pattern, Winner Selection, Commit, Push) | Presenting any approval gate to the user |
 | `references/competitive-mode.md` | Competitive mode protocol: agent spawning, scoring, winner selection | Using --competitive flag |
 | `references/error-handling.md` | Abort handling, non-recoverable errors, post-compaction re-verification, competitive mode errors | On user abort, blocker error, or after context compaction |