@pilotspace/add 1.7.1 → 1.7.2

package/CHANGELOG.md

@@ -4,6 +4,25 @@ All notable changes to the ADD method (`@pilotspace/add` on npm,
 `pilotspace-add` on PyPI) are documented here. The format follows
 [Keep a Changelog](https://keepachangelog.com/); versions follow semver.
 
+## [1.7.2] — 2026-06-18
+
+Test-coverage and project-hygiene patch. Additive; no breaking changes.
+
+### Added
+- **PTY harness for clack interactive coverage (`installer-smarts-polish`)** — a
+  reusable PTY test helper (`tooling/pty_clack.py`) drives the clack
+  select/confirm prompts, so the agent-select step and the interactive
+  happy-path are exercised under a real pseudo-terminal in CI (previously
+  node-syntax-checked and logic-unit-tested only).
+- **`SECURITY.md` security policy** — supported-version table, private
+  vulnerability reporting via GitHub Security Advisories, and response SLAs;
+  shipped in both the npm tarball and the PyPI sdist/wheel.
+
+### Changed
+- **Brand tagline** — refreshed to *"One skill. Eight steps. Five disciplines.
+  Every feature ships through the loop."* across the README, the npm/PyPI
+  package descriptions, and the Claude Code plugin manifest.
+
 ## [1.7.1] — 2026-06-18
 
 Installer depth and method quality release: the onboarding installer gains

package/README.md

@@ -1,5 +1,7 @@
 # ADD — AI-Driven Development
 
+**One skill. Eight steps. Five disciplines. Every feature ships through the loop.**
+
 > A minimal, state-tracked Claude Code skill for building software when the AI
 > writes the code and **you** own the two things it cannot do alone: decide *what*
 > to build, and *verify* it is correct.
@@ -149,6 +151,13 @@ be upset to lose is "the code," you're still working the old way.
 Start at [`docs/README.md`](./docs/README.md) — Foundations → the six steps →
 operating it across a team → templates, prompts, and a full worked example.
 
+## What's next
+
+**Dynamic Agent Skills** — the next scope: skills that adapt at runtime to the
+project's current state, stage, and active phase rather than loading a static
+guide. The agent picks the right depth and tooling automatically as the project
+evolves.
+
 ## Develop
 
 ```bash

package/SECURITY.md

@@ -0,0 +1,48 @@
+# Security Policy
+
+ADD (AI-Driven Development) ships as [`@pilotspace/add`](https://www.npmjs.com/package/@pilotspace/add)
+on npm and [`pilotspace-add`](https://pypi.org/project/pilotspace-add/) on PyPI. This policy
+covers both distributions and the engine/tooling in this repository.
+
+## Supported Versions
+
+Security fixes land on the latest minor release line. Older lines are not
+back-patched — upgrade to the latest `1.7.x` to receive fixes.
+
+| Version | Supported          |
+| ------- | ------------------ |
+| 1.7.x   | :white_check_mark: |
+| < 1.7   | :x:                |
+
+To check your installed version: `python3 .add/tooling/add.py status` (project),
+`pip show pilotspace-add`, or `npm ls @pilotspace/add`.
+
+## Reporting a Vulnerability
+
+**Please do not open a public GitHub issue for security reports.**
+
+Report privately through one of:
+
+- **GitHub Security Advisories** (preferred) — open a private report via the
+  repository's **Security → Report a vulnerability** tab. This keeps the details
+  confidential until a fix ships.
+- **Email** — `tindang.ht97@gmail.com` with subject `SECURITY: <short summary>`.
+
+Please include:
+
+- the affected version, platform, and install channel (npm / PyPI / source);
+- a description of the issue and its impact;
+- reproduction steps or a proof of concept, if available.
+
+### What to expect
+
+- **Acknowledgement** within **3 business days** of your report.
+- **Triage assessment** (accepted / needs-info / declined, with rationale)
+  within **10 business days**.
+- For **accepted** reports: a coordinated fix and release, with credit to you in
+  the release notes unless you prefer to remain anonymous. We will keep you
+  updated on remediation progress.
+- For **declined** reports: an explanation of why the issue falls outside the
+  project's threat model.
+
+Please give us a reasonable window to release a fix before any public disclosure.

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@pilotspace/add",
-  "version": "1.7.1",
-  "description": "ADD (AI-Driven Development) — a minimal, state-tracked Claude Code skill that drives every feature through Specify → Scenarios → Contract → Tests → Build → Verify → Observe. Ships the AIDD book as its trust layer.",
+  "version": "1.7.2",
+  "description": "ADD (AI-Driven Development). One skill. Eight steps. Five disciplines. Every feature ships through the loop — a minimal, state-tracked Claude Code skill that ships the AIDD book as its trust layer.",
   "bin": {
     "add": "bin/cli.js"
   },
@@ -23,7 +23,8 @@
     "docs/",
     "README.md",
     "GETTING-STARTED.md",
-    "CHANGELOG.md"
+    "CHANGELOG.md",
+    "SECURITY.md"
   ],
   "keywords": [
     "ai-driven-development",

package/skill/add/SKILL.md

@@ -85,7 +85,9 @@ unsharp intent? **Interview before you size** — explore and suggest first (`in
 Once a request is classified `new-major`/`sub-milestone`, drafting the actual
 `MILESTONE.md` (goal · scope · exit criteria · breadth-first tasks) is the second
 half of intake: read `scope.md` for how to fill it well, the per-outcome behavior,
-and the confirm-before-create rule. You propose the draft; the human confirms.
+and the confirm-before-create rule. Or if it's classified `task`/`change-request`, 
+create the task with `add.py new-task` and then read the phase guide for the first phase (probably `0-setup.md`).
+You propose the draft; the human confirms.
 
 ## The flow and which file to load