@rafinery/cli 0.11.0 → 0.13.0

package/lib/manifest.mjs

@@ -165,7 +165,8 @@ export default async function manifest() {
     return {
       id,
       priority: PRIORITIES.has(d.priority) ? d.priority : "P2",
-      lens: str(d.lens, "general"),
+      category: str(d.category ?? d.lens, "general"),
+      lens: str(d.category ?? d.lens, "general"), // transitional mirror of category
       status: IMP_STATUSES.has(d.status) ? d.status : "open",
       title: str(d.title, id),
       summary: str(d.summary),

package/lib/mcp-client.mjs

@@ -19,8 +19,9 @@ import { CLI_VERSION } from "./releases.mjs";
 // The CLI's own actor envelope for state-plane writes (wave 5: REQUIRED on every
 // loop event — strict, no legacy path). model is the explicit "mechanical"
 // sentinel: no LLM ruled here, and the split stays grep-able for sage. The
-// runner honors RAFA_ACTOR_RUNNER first (the platform's sandbox distiller and
-// other tiers export it — sandbox|ci|session), else CI env, else session.
+// runner honors RAFA_ACTOR_RUNNER first (platform tiers export it —
+// sandbox|ci|session; "sandbox" is a legacy wire value kept for historical
+// rows), else CI env, else session.
 export function cliActorMeta() {
   const declared = process.env.RAFA_ACTOR_RUNNER;
   return {

package/lib/releases.mjs

@@ -409,6 +409,53 @@ export const RELEASES = [
       "origin/HEAD → main) drives the checkpoint trunk guard + CI distill " +
       "target.",
   },
+  {
+    version: "0.12.0",
+    contract: 1,
+    plans: 2,
+    requires: "update",
+    summary:
+      "THE SECURITY MODULE (owner-ratified 2026-07-26; spec " +
+      ".arohi/2026-07-26-security-module-spec.md): `rafa audit` — the " +
+      "SELF-CONTAINED engine (rafa.audit/v1): dep CVEs via the built-in " +
+      "lockfile parser + keyless OSV.dev merged with pnpm audit; secrets via " +
+      "the built-in ruleset (tracked files only, .env* never opened, " +
+      "fingerprints never bytes); SAST via semgrep IF present — a tier that " +
+      "didn't run says ran:false, never an empty list. NO binaries bundled " +
+      "or installed, ever. Improvement frontmatter `lens` RENAMED `category` " +
+      "(same enum; `lens` accepted as a deprecated alias — old ledgers keep " +
+      "compiling). New blueprint SOP rafa-security (never a dev verb): " +
+      "mechanical priority map critical→P0…dev-only→P3, reachability " +
+      "annotated from the brain, P0 security rows travel outside the blast " +
+      "radius; bloom 0.10.0 (security-profile duty), atlas 4.1.0 (plan-time " +
+      "audit transparency — clean is said out loud), scan requires the " +
+      "security-posture playbook. doctor gains the security-tools block.",
+  },
+  {
+    version: "0.13.0",
+    contract: 1,
+    plans: 2,
+    requires: "update",
+    summary:
+      "WHOLE-BRAIN MANDATORY CAPTURE (owner r4–r6, 2026-07-26 — 'if the " +
+      "brain did not capture what happened during the session, it's a " +
+      "failure'): `rafa guard --pre-push` — the capture-integrity gate the " +
+      "pre-push hook runs FIRST: every outgoing commit must carry its 1-1 " +
+      "brain mirror; missing → self-heal → still missing → the push BLOCKS " +
+      "(RAFA_HOOKS_DISABLED=1 is the on-the-record escape hatch); " +
+      "post-commit mirror failures go LOUD. `rafa checkpoint` auto-CONVERGES " +
+      "reported improvement flips into real ledger files and COMPULSORILY " +
+      "hydrates notes citing touched code (dirty queue ∪ git branch-vs-trunk " +
+      "diff — manual edits count) so affected-note edits happen DURING " +
+      "development. report_improvement_status returns required_next. " +
+      "MULTI-MANAGER lockfiles in the audit core: pnpm · npm (v3+v1, " +
+      "dev/direct from the lockfile) · yarn (classic+berry) · bun (text " +
+      "JSONC), resolved dynamically richest-first; yarn/bun are honestly " +
+      "packages-only (chain/dev null); binary bun.lockb detected and pointed " +
+      "at --save-text-lockfile; doctor FAILS a package.json repo with no " +
+      "lockfile and prints the per-manager generate command. review.json " +
+      "joins the brain-repo bootstrap ignore.",
+  },
 ];
 
 // The release this CLI build ships (last entry).

package/lib/working-set.mjs

@@ -160,15 +160,16 @@ export function materializeImprovement(cwd, data, brainForSha) {
 }
 
 // Deterministic ledger-file writer for hydrated improvements — mirrors the shape
-// bloom authors (see any improve/improvements/*.md): priority · lens · status ·
+// bloom authors (see any improve/improvements/*.md): priority · category · status ·
 // fix · leverage · blast_radius · cites, then the prose body.
 export function renderImprovement(d) {
+  const category = d.category ?? d.lens;
   const lines = [
     "---",
     "schemaVersion: 1",
     `id: ${d.id}`,
     `priority: ${d.priority}`,
-    ...(d.lens ? [`lens: ${d.lens}`] : []),
+    ...(category ? [`category: ${category}`] : []),
     `status: ${d.status}`,
     `title: ${q(d.title)}`,
     ...(d.summary ? [`summary: ${q(d.summary)}`] : []),

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@rafinery/cli",
-  "version": "0.11.0",
+  "version": "0.13.0",
   "description": "rafa — the AI engineer CLI. Vendors the rafa blueprint into your repo (shadcn-style) and runs the deterministic contract gates.",
   "type": "module",
   "bin": {

package/skills-bundle/skills-manifest.json

@@ -1,5 +1,5 @@
 {
-  "generatedAt": "2026-07-25T21:14:46.864Z",
+  "generatedAt": "2026-07-26T18:16:15.258Z",
   "skills": {
     "tdd": {
       "version": "1.0.0",