@outcomeeng/spx 0.5.5 → 0.6.0

package/README.md

@@ -131,12 +131,13 @@ pnpm run test:coverage  # Tests with coverage
 ### Validation (Required Before Commits)
 
 ```bash
-pnpm run validate              # Source CLI: full validation pipeline
-pnpm run validate:production   # Source CLI: production scope only
+pnpm run validate              # Source CLI: full validation pipeline, excluding circular checks
+pnpm run validate:production   # Source CLI: production scope only, excluding circular checks
 pnpm run lint                  # Source CLI: ESLint only
 pnpm run lint:fix              # Source CLI: ESLint with auto-fix
 pnpm run typecheck             # Source CLI: TypeScript only
 pnpm run circular              # Source CLI: circular dependency detection
+pnpm run circular:published    # Packaged executable circular dependency detection
 pnpm run knip                  # Source CLI: unused code detection
 ```
 
@@ -145,11 +146,11 @@ The development validation scripts run `tsx src/cli.ts`, so they validate the cu
 ### Publish Validation
 
 ```bash
-pnpm run publish:check        # Source validation, build, tests, packaged validation
-pnpm run validate:published   # Packaged executable validation; requires dist/cli.js
+pnpm run publish:check        # Source validation, circular check, build, tests, packaged validation
+pnpm run validate:published   # Packaged executable validation excluding circular checks; requires dist/cli.js
 ```
 
-`pnpm run publish:check` is the required pre-publish gate. It runs source validation, builds `dist/`, runs the test suite, and then runs `node bin/spx.js validation all --scope production` against the built executable.
+`pnpm run publish:check` is the required pre-publish gate. It runs source validation, source circular dependency detection, builds `dist/`, runs the test suite, and then runs packaged validation plus packaged circular dependency detection against the built executable.
 
 ### Code Quality (SonarCloud)
 
@@ -163,6 +164,8 @@ sonar auth login -o outcomeeng   # opens a browser; the token is stored in the O
 
 Until then the MCP server entry is inert: it does not affect builds, tests, or validation.
 
+A Lefthook **pre-push** hook runs `sonar analyze --base origin/main` so SonarQube Cloud findings on the pushed changeset surface before the code leaves your machine, and a finding blocks the push. It uses the same `sonar` CLI and authentication as the MCP server above, so install the CLI and run `sonar auth login` before pushing. When the CLI is genuinely unavailable, `git push --no-verify` skips the hook.
+
 ## CI/CD
 
 The project uses GitHub Actions for continuous integration and publishing: