@thinkingsage/kanon 0.8.0

package/CHANGELOG.md

@@ -0,0 +1,410 @@
+# Changelog
+
+All notable changes to this project will be documented in this file.
+
+The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/),
+and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
+
+## [Unreleased]
+
+## [0.8.0] - 2026-09-08
+
+### Fixed
+- Progressive-steering rubric grader now grades the harness build, not its wrapper. When `--build` points at a directory that wraps the harness folder (`…/expected-build` or `…/expected-build/dist`), the grader descends into `kiro`/`dist/kiro` so artifact names resolve correctly instead of collapsing to `kiro`/`dist` and zeroing FMP/MD into a false RED. The grader now loads the workload that belongs to the build being graded: an explicit `--workload <path>` wins, else the scenario's own `workload.json` when `--build` points inside its `expected-build` tree, else the first discovered fixture workload. Adds the `--workload` CLI flag on `kanon eval rubric`.
+
+## [0.7.1] - 2026-08-27
+
+### Added
+- Import obra the-elements-of-style writing skill and support namespaced eval discovery
+- Solr Compass: per-request contentRoot on artifact tools and a ~/.solrcompass project registry, plus a legible error when the content root has no catalog.json (ADR-0062)
+- Rosetta Stone: write provenance at import and cache the base artifact (orchestration). The acquisition-driven import path (importOne with an acquisition context) now populates a machine-managed ProvenanceRecord — upstream, sourcePath, sourceFormat, sourceRevision, contract, baseDigest, importedAt — into the imported artifact frontmatter (Req 18.1) and writes the normalized, provenance-free Base_Artifact to a git-ignored upstream/.kanon-base/<upstream>/<name>@<digest> cache so re-sync can reconstruct the common ancestor for three-way reconciliation (Req 18.2). New src/base-cache.ts holds the pure provenance builder and the impure cache writer; all filesystem IO and the clock stay in the orchestration shell, outside the Pure_Translation_Boundary, per ADR-0049. Local path imports (no acquisition context) write no provenance and no cache. Adds upstream/.kanon-base/ to .gitignore.
+- rosetta-stone: add Property 29 fast-check test verifying curation-preserving deterministic three-way reconciliation — curation preservation, fast-forward-only-when-unchanged, conflict-keeps-Ours-while-applying-non-conflicting-fields, deterministic merge-by-union, and repeat-run canonical equivalence with identical ordered diagnostics
+- rosetta-stone: add Property 28 fast-check test verifying schema and registry documentation projections are complete and sound; export the doc-generator projection functions for testability
+- Add one-shot validate:rosetta entry point that runs targeted Rosetta suites, the full Bun test suite, tsc --noEmit, and lint while preserving raw fast-check output and nonzero exit status
+- rosetta-stone: add generated-guidance and executable-example tests — snapshot deterministic doc-generator output with checked-in parity, validate guidance code-example imports resolve against the public API, invoke CLI examples against a fixture, and fail when any registry/schema inventory entry is undocumented; make the doc generator importable via import.meta.main guard
+- ---
+type: fixed
+---
+
+Fix eval discovery for scaffolded artifact directories and preserve numeric-looking admin frontmatter strings during YAML round-trips.
+- Rosetta Stone: a Zod-validated functional-core translation subsystem with a new kanon rosetta CLI (formats, detect, inspect, translate — supporting explicit direction/variants, named acquisition/translation profiles, dry-run, strict mode, and versioned JSON output) and a stable library API exported from src/rosetta (RosettaStone, schemas/types, registry construction, built-in formats, detection, translation, inspection). Legacy import.ts, importers/, adapterRegistry, HARNESS_FORMAT_REGISTRY, kanon import, and the sync scripts continue to work as compatibility facades that delegate to Rosetta Stone during a documented migration window, emitting stable deprecation guidance; no legacy interface is removed in this release. Rosetta Stone enforces a pure-translation boundary: no filesystem, subprocess, network, environment, or Git access; source content is parsed and rendered as inert data (never executed); path normalization rejects traversal and normalized collisions; and sensitive values are handled fail-closed with reference-only redaction.
+- Rosetta Stone: add the `kanon rosetta backfill` command that records a ProvenanceRecord for existing distilled artifacts by matching them to the current upstream by name, writes the machine-managed provenance block into knowledge.md, and seeds the git-ignored base cache (supports --dry-run and --json); retire the superseded drift scripts (compare-kiro-powers.sh, compare-kiro-powers-full.sh, diff-kiro-body.sh, diff-kiro-steering.sh) and sync-kiro-powers.sh in favor of config-driven sync-upstream.sh plus reconciliation
+- Rosetta Stone: add reconciliation config validation and fixture regression tests (task 19.9). New validateFieldOwnershipPolicy in src/config.ts enforces Field_Ownership_Policy completeness (Req 18.14): it rejects a policy classifying any field outside ReconcilableFieldSchema, rejects an invalid ownership class, and rejects a policy that omits a classification for any reconcilable field, each as a clean field-addressed diagnostic; the documented DEFAULT_FIELD_OWNERSHIP_POLICY validates. Adds fixture-based re-sync regression tests driving reconcileUpstreams through all six scenarios (clean, fast-forward, conflict, orphaned, new, no-base), asserting deterministic ReconciliationReport ordering, conflict-field detail, plan production, and — the core guarantee — that no Curation_Loss occurs: curation-owned fields are preserved in every scenario (Req 18.6, 18.15).
+- rosetta-stone: add Property 30 fast-check test verifying total, stable provenance outcomes — Base_Digest stability across repeated translation and reordered frontmatter, clean outcome on digest equality, the reduced-confidence two-way path on a missing base or failed provenance self-verification (never a silent overwrite), orphaned/new classification via the reconcile orchestrator, and exactly-one-outcome totality per reconciled artifact
+- Rosetta Stone: compute and verify Base_Digest via the Canonical_Serializer. New src/rosetta/provenance-digest.ts adds computeBaseDigest — a deterministic sha256 over the serialized Theirs artifact reusing the Canonical_Serializer ordering so identical revisions yield identical digests (Req 18.2) — plus verifyProvenanceBase and selfVerifyReconcileInput, which recompute a candidate base digest against an artifact's recorded ProvenanceRecord.baseDigest and, on mismatch (hand-edited provenance), route reconciliation to the reduced-confidence two-way path with a warning diagnostic (Req 18.16). The digest math uses node:crypto and stays inside the Pure_Translation_Boundary (no fs/Git/clock); base-artifact cache IO remains in the orchestration shell per ADR-0049.
+- Local-fixture sync integration tests for sync-upstream.sh and sync-kiro-powers.sh covering success, acquisition failure, pull-only, import-only, dry-run, Kiro power mapping, and multi-profile status isolation with no network access; fixed a set -e counter bug in sync-upstream.sh that made every successful run exit nonzero
+- Rosetta Stone: add provenance and reconciliation schemas to src/schemas.ts — an optional machine-managed provenance block on FrontmatterSchema (registered in KNOWN_FRONTMATTER_FIELDS), plus FieldOwnershipPolicySchema with a documented default field-ownership policy, ReconciliationRequestSchema, ReconciliationDiagnosticSchema, ReconciliationResultSchema, and ReconciliationReportSchema for curation-preserving three-way re-synchronization.
+- Rosetta Stone: add the reconcile collision policy and reconciliation report to the sync orchestrator. New src/reconcile-orchestrator.ts derives the reconcile set from ProvenanceRecords (never a hardcoded map), classifies orphaned (provenanced Ours whose upstream source is gone) and new (upstream artifact with no Ours counterpart), self-verifies the recorded base, runs the pure reconcileArtifact merge, and routes each merged artifact through the existing canonical serializer and plan validation path rather than bypassing it. Provenance-less artifacts are excluded and fall back to existing collision behavior. src/reconcile-report-renderer.ts renders the deterministic ReconciliationReport (ordered by outcome, then upstream, then artifact name) as human text and versioned schema-valid JSON.
+- CI drift check that fails when committed plugin skills/ or MCP bridge are out of sync with knowledge/ source
+- Make the committed MCP bridge build reproducible across CI and local environments by resolving its runtime root from the launched entrypoint instead of embedding the build machine's source path, and pin the generated-artifact check to the matching Bun compiler version.
+- Rosetta Stone: implement the pure three-way reconciliation core in src/rosetta/reconcile.ts. `reconcileArtifact` merges Base, Ours, and Theirs KnowledgeArtifacts under a FieldOwnershipPolicy — curation-owned fields keep Ours, upstream-owned fields fast-forward to Theirs only when Ours equals Base (otherwise a field-addressed conflict that keeps Ours while non-conflicting fields are still applied), merge-by-union fields take a deterministic union minus upstream removals, and machine-owned fields are left for orchestration to recompute. Includes a reduced-confidence two-way path when the base is absent or unverified, deterministic diagnostics, and per-artifact outcome classification (clean/fast-forward/merged/conflict). Runs entirely within the Pure_Translation_Boundary with no filesystem, Git, or clock access.
+
+### Fixed
+- Solr Compass: compass_reindex and compass_index_artifacts now delete an artifact's existing docs (top-level and chunks) before rewriting, so switching chunked/unchunked or removing an artifact no longer leaves orphaned chunk documents behind
+
+
+## [0.7.0] - 2026-08-10
+
+### Added
+- Add Souk Compass indexing-pipeline integration coverage for language presets, root-scoped deduplication, boost-map search ordering, and Git-aware reindexing.
+- Rosetta Stone deterministic canonical serializer with extra-field collision detection, YAML key-order normalization, and plan generation
+- Implement deterministic inspection models in src/rosetta/inspection.ts
+- Rosetta Stone immutable template bundle loader and pure renderer contract with in-memory Nunjucks rendering, content digest, and filesystem fallback prohibition
+- Add acquisitions and translations profile records to ForgeConfigSchema with validation (Req 10.3-10.8, 13.12)
+- Normalize legacy upstreams into typed acquisition/translation profiles (Req 10.6, 10.7, 13.12, 14.8)
+- Tenant-scoped, durable memory records for Solr Compass: personal and org tenants with per-tenant collections, precedence-based conflict resolution, record supersession and retraction, validity windows, and configurable replication with backup and restore
+- Implement deterministic pretty-printers for all source-capable format contracts (kiro-power, kiro-skill, superpowers, kiro-native, claude-code, codex, copilot, cursor, windsurf, cline, qdeveloper)
+- Add Rosetta Stone target translators for Copilot, Cursor, Windsurf, Cline, and Q Developer
+- Apply per-root boost maps to Souk Compass codebase search results
+- Publish Solr Compass as a Bun-powered npm package with a pinned bunx launch, independent package and content roots, and patch-pinned SolrCloud images
+- Add a Kiro Solr Compass Guided MCP Power artifact with seamless first-run Docker and SolrCloud initialization
+- Document the shared Souk Compass indexing-policy architecture: centralized scanning, root-local configuration, language-aware chunking, client-side path boosting, and typed git-diff fallbacks.
+- Implement target translators for Kiro, Claude Code, and Codex in src/rosetta/builtins/targets/
+- Personal and organizational backup storage backends for Solr Compass: snapshots survive 'docker compose down -v' and rebuild, via a host-mounted local repository or a tenant's S3 bucket, with a portable snapshot manifest, an embedding-model compatibility guard, and a new compass_backup tool
+- Add root-scoped deduplication property coverage for Souk Compass
+- Use Git diffs to incrementally reindex changed Souk Compass codebase files, delete removed documents, and advance root commit metadata.
+- Rosetta Stone source accounting and mapping helpers with consumed/preserved path tracking, field mappings, namespaced extra fields, and document order normalization
+- Rosetta Stone built-in compatibility profiles seeded from ASSET_HARNESS_COMPATIBILITY and CAPABILITY_MATRIX with per-harness constants and lookup API
+- Rosetta Stone transactional translation registry with atomic registration, frozen snapshots, and 12 built-in format contracts
+- Rosetta Stone application policy evaluation and cross-request collision analysis with deterministic path normalization and configurable collision resolution
+- Add shared format variant and option resolution module (src/rosetta/resolution.ts)
+- Add Rosetta Stone public Zod schemas and inferred TypeScript types to src/schemas.ts covering format contracts, detection models, translation requests/results, diagnostics, compatibility profiles, plans, profiles, provenance, and machine-output envelopes
+- Use Elixir-aware chunking when building Souk Compass codebase documents
+- Add Rosetta Stone translation engine (src/rosetta/engine.ts) coordinating request guard, registry, detection, source translation, canonical validation, compatibility, target translation, and plan validation phases
+- An 'aws' platform profile selecting Bedrock embeddings and S3 snapshot storage together with one shared region, and snapshot manifests moved onto Bun's Bun.file/S3File interface so local and S3 share one code path, the aws CLI becomes an optional fallback, and list finally sees snapshots in a bucket
+- Add path-based source translators for kiro-power, kiro-skill, and superpowers formats under src/rosetta/builtins/sources/
+- Rosetta Stone translation plan applier with atomic writes, symlink escape detection, collision rechecking, multi-file staging, and separate ApplicationReport
+- Document root-scoped Git baselines for incremental Souk Compass indexing
+- Store the current Git commit SHA on Souk Compass codebase index documents.
+- Add harness-native source translators for Kiro, Claude Code, and Codex
+- Add root-scoped content-hash deduplication to Souk Compass folder indexing.
+
+### Changed
+- Move the paid LLM eval suite to a manual-dispatch workflow and drop the redundant per-PR eval job from CI; the deterministic Kiro progressive-steering rubric stays a PR gate
+- Refactor Souk Compass full-folder indexing to use shared language-aware scanning and root-local ignore rules.
+- Deduplicate Souk Compass reindex chunks by root-scoped content hash before embedding and upserting.
+- Refactor Souk Compass incremental reindexing to use the shared file scanner with project presets, explicit excludes, and `.solrcompass-ignore` rules.
+- Upgrade TypeScript to 7.0.2 and bring kanon and souk-compass dependencies (biome, zod, chalk, promptfoo, clack, rollup, AWS SDK, MCP SDK, fast-check) up to date
+
+### Deprecated
+- Deprecate type: "power" as an asset-taxonomy value in favor of type: "skill" + harness-config.kiro.format: "power"; migrate all 47 existing power-typed artifacts
+
+### Fixed
+- Reconcile agent asset-type compatibility with per-harness agent capability support, make temper agent-degradation detection content-aware, and add agent validation rules
+
+
+## [0.6.0] - 2026-07-27
+
+### Added
+- Imported the Library AI Workshop facilitator, cohort, reference-interview, and research-output-review skills from eudaemon-ai/academic-ai-library-workshop, including their course references and simulated practice data, and exposed them through a dedicated catalog collection.
+- kanon spec next command to atomically pull the next ready task for an agent
+- Config-driven upstream marketplace sync with superpowers import format
+- kanon spec now reads and writes Kiro's [~] in-progress checkbox marker in tasks.md, keeping claim/next/release/done in sync with COORDINATION.md
+- Added an optional Souk Compass practice module for safe semantic-search retrieval evaluation
+- kiro-specs skill for reading, writing, and executing Kiro Specs with multi-agent coordination
+- Added Windows installation instructions for Bun alongside the existing macOS/Linux instructions in tutorial.md and self-paced-module.md, covering PowerShell, package managers (npm, Scoop, WinGet), and WSL options.
+- Souk Compass supports Amazon Titan embeddings on Bedrock as a first-class provider, with connection reuse and retry for long reindexes, `embed_provider` recorded on every document, and a `providerMismatch` warning from `compass_status` when a collection was built by a different model.
+- Souk Compass can pack artifact sections into larger chunks so each vector fills more of the embedding model's context window.
+- Added the JHU Editorial Check skill as a Kanon knowledge artifact with bundled style, brand-asset, website-audit, scoring, checker, evaluation, and sample references.
+- kanon spec channel alias and a Kirouija glossary for the multi-agent coordination protocol
+- Progressive Steering for the Kiro harness: explicit `harness-config.kiro.inclusion` field with three-level resolver precedence (harness-config > top-level > default), build pipeline Kiro Inclusion Summary and configurable `alwaysWarnThreshold` warning, install pipeline `--max-always` gating with post-install summary, `<!-- forge:kiro-inclusion: ... -->` audit comment in emitted steering files, cross-field validation rules and progressive conventions in the validator, conditional Kiro inclusion prompt in the wizard, and a new `progressive-steering` eval rubric with six metrics (AOCW, PR, FMP, MD, DER, WCA).
+- Add a generated skill-library index skill listing all installed plugin skills, reframe the kanon skill and plugin manifests to lead with the skill library.
+- Souk Compass indexes more than one repository into the shared codebase collection. Documents record `index_root`, `compass_search_codebase` accepts a `root` filter and reports each hit's repository, the folder tools accept a `collection` override, `compass_setup` gains a `create_collection` action, and `compass_status` reports per-repository counts.
+- kanon spec commands to coordinate multi-agent work on Kiro Specs via COORDINATION.md
+- Per-harness body overrides: a `bodyOverrides` schema field, `body.<harness>.md` loading in the parser, a `resolveBody` helper, resolution in the compile pipeline, and generated plugin skills for powers.
+- Task dependencies (_Depends:_) and claim leases for parallel multi-agent spec work
+
+### Changed
+- Refresh contributor guidance for current Kanon, curriculum, harness, and Souk Compass workflows
+- Reclassify kanon guide as a skill so it ships as a discoverable Claude Code plugin skill
+- Preserve nested and non-Markdown workflow reference files during parsing so imported skills retain their progressive-disclosure trees and simulated fixtures.
+- Renamed codeshop to whetstone throughout, and community archon to codefactory.
+- Souk Compass builds an ESM bundle to the tracked `bridge/mcp-server.mjs` instead of a gitignored `dist/`, so published releases carry a runnable server.
+- Updated committed Claude plugin skill generation to create parent directories for nested workflow references.
+- Expanded the Kanon curriculum for Johns Hopkins Libraries staff with accurate CLI exercises, safe practice content, assessments, a capstone rubric, and a coordinator guide
+- Souk Compass fuses hybrid search scores on the client (ADR-0052). Solr rejects a `{!knn}` clause nested inside `{!func}`, so vector and keyword searches now run in parallel and merge locally. `SoukVectorClient.search()` accepts only `vector` and `keyword`. In hybrid mode `score` is a fused value normalized per request rather than a raw Solr score, so scores are not comparable across queries.
+
+### Deprecated
+- Deprecate type: "power" as an asset-taxonomy value in favor of type: "skill" + harness-config.kiro.format: "power"; migrate all 47 existing power-typed artifacts
+
+### Fixed
+- Souk Compass now honours the catalog's `path` field when reading artifacts. Deriving the path from the artifact name excluded every nested collection, leaving 42 of 63 artifacts absent from the index.
+- Fix plugin install showing 0 skills — generate and commit real SKILL.md files for Claude Code discovery
+- Souk Compass reported a healthy SolrCloud collection as missing, because cores are named `<collection>_shard1_replica_n1` rather than after the collection.
+- Souk Compass fails loudly when a configured embedding provider cannot start, instead of silently falling back to a different model and embedding queries in the wrong vector space.
+- `compass_search` no longer fails in its default mode, which is hybrid.
+- Souk Compass failed to connect with JSON-RPC error -32000 when installed as a plugin, because no build artifact was published.
+- The Souk Compass embedding cache is keyed by provider and dimensionality. Keyed on text alone, switching providers served the previous model's vectors — meaningless similarity scores with nothing to indicate it.
+- Reconcile agent asset-type compatibility with per-harness agent capability support, make temper agent-degradation detection content-aware, and add agent validation rules
+- Every vector and hybrid search failed with HTTP 414 because a 1024-dimension query vector exceeds Jetty's default 8 KB header limit. The Solr container now raises `solr.jetty.request.header.size`, and searches POST their parameters.
+- Souk Compass silently dropped roughly half of all indexed documents. A long numeric token in a vector triggered a Solr ClassCastException when it landed on a JSON parser buffer boundary; vector components are now rounded before transmission, which loses no precision the 7-bit quantised field would have kept.
+- Souk Compass scopes `clear` and incremental reindex to the folder being indexed. Both previously deleted documents belonging to other indexed repositories.
+- Stale codeshop references after the whetstone rename, and CodeQL findings for incomplete string escaping and an unused loop iteration variable.
+
+
+## [0.5.0] - 2026-07-08
+
+### Added
+- Added Codex plugin packaging and hardened Codex harness output, including plugin manifest metadata, MCP config generation/import, native skill output, hook degradation warnings, and bundled bridge/catalog release assets.
+- skill-forge power brought to parity with adr: now a source-generated knowledge artifact (knowledge/skill-forge) using the lean Kiro power flags, with License/Privacy/Support metadata, MIT license, jh-drcc collection correction, and eval coverage
+- Kiro adapter: per-artifact harness-config.kiro flags inline-workflows and main-steering to emit lean, official-format powers (POWER.md + steering only, no inlined duplication or {name}.md duplicate)
+- ADR-0044: propose renaming Kanon to Kanon (κανών)
+- Expand alice-whiterabbit knowledge with doi-minting, preservation, and tutorials workflows
+- archon-reference-pack knowledge artifact and archon collection
+- Add Getting Started docs for project users, guild members, and skill-forge contributors
+
+### Changed
+- Renamed from Skill Forge to Kanon
+- ADR power prepared for official Kiro power submission: lean Kiro-optimized POWER.md, hooks delivered as installable native v2 JSON in steering/hooks.md (no shipped .kiro.hook files), License/Privacy/Support metadata, and license corrected to MIT
+- Upgrade Souk Compass to Solr 10 with scalar-quantized dense vectors and ACORN filtered search
+- Eval suite improvements: fixed infra (cost→latency), realism (inline context for tool-less evals), content (mandatory first-response directives), and keyword alignment across codeshop, secure-by-default, and adr artifacts
+
+### Fixed
+- Kiro adapter now emits description field in steering frontmatter for progressive steering compatibility
+
+
+### Added
+- Added Codex plugin packaging and hardened Codex harness output, including `.codex-plugin/plugin.json`, Codex-safe MCP config, native skill output checks, Codex importer coverage, and bundled MCP bridge/catalog release assets.
+
+### Changed
+- **Renamed from Skill Forge to Kanon.** The CLI, package, and all references now use the new name.
+
+  **Migration guide for existing users:**
+  - **CLI**: `forge` → `kanon` (the old `forge` command still works with a deprecation warning for one release)
+  - **Config**: `forge.config.yaml` → `kanon.config.yaml` (old name still works with a deprecation warning)
+  - **Package**: `@thinkingsage/skill-forge` → `@thinkingsage/kanon`
+  - **Directory**: `skill-forge/` → `kanon/`
+
+## [0.4.0] - 2026-05-03
+
+### Added
+- Add 4 eval dimensions: negative routing disambiguation (`not-icontains` on 10 routing tests), temperature sensitivity (7 tests at temp 0.3), prompt efficiency (4 tests with `cost` assertions at $0.10 threshold), and scenario-based shared concept adherence (7 tests covering vertical slices, deep modules, durable issues, contract-first, checksum discipline, domain language).
+- Hash-based deep links in browse SPA — artifacts are now bookmarkable and shareable via `#artifact/<name>` URL fragments. Browser back/forward navigation supported.
+- Codeshop skill #21: `migrate` — reliable data migration with checksum verification across 5 phases (Inventory, Plan, Dry-Run, Execute, Verify). Adds Migration Checksum Discipline shared concept and Migration Chain to workflow composition.
+- Add `--record` and `--trend` flags to `forge eval` for evolutionary prompt improvement tracking. `--record` appends per-run scores to `evals/history.jsonl`; `--trend` prints a table with sparkline showing score progression over time.
+- Upgrade Souk Compass from Solr 9 to Solr 10 with scalar quantized dense vectors (~4x memory reduction), ACORN filtered search support, and enhanced kNN query parameters. Requires reindexing after upgrade.
+- New `release-manager` companion power — tool-agnostic release lifecycle management with 4-phase cut-release workflow (Assess, Draft, Cut, Announce). Multi-harness support. Detects whatever release tooling the project uses.
+- Multi-turn workflow evals for `integrate` (5 tests) and `migrate` (5 tests) simulating phase progression with deterministic + semantic assertions. Chain transition evals (5 tests) verifying correct next-workflow suggestions. Deterministic `icontains` assertions added to all 14 routing eval tests. All evals upgraded from Claude Sonnet 4 to Claude Sonnet 4.6.
+- Codeshop skill #20: `integrate` — wire external systems through contract-first adapters with 5-phase workflow (Discover, Contract, Wire, Harden, Verify). Adds Contract-First Integration shared concept and Integration Chain to workflow composition.
+- New `secure-by-default` companion power — STRIDE threat modeling, auth/authz flow review, and secure coding reference (OWASP, input validation, secret hygiene). Multi-harness support. User-invoked only.
+- Structural validation tests for codeshop workflow phase sequencing, chain validity, and entry/exit criteria alignment — 11 tests covering dangling references, linear phase ordering, orphan detection, chain-to-router consistency, and phase numbering.
+
+### Changed
+- Revised ADR power (v0.4.0): expanded troubleshooting section, added configuration section, broadened changelog tool detection guidance, improved steering file descriptions with when-to-use context, added hook portability notes.
+- Bump promptfoo dependency from ^0.121.5 to ^0.121.9.
+- Remove `dist/` and `catalog.json` from git tracking. Both are now gitignored and built fresh in CI — dist is uploaded as a CI artifact on every PR and attached as a tarball to GitHub Releases. The `dist-drift` workflow is removed.
+
+### Fixed
+- Place forge:version comment after YAML frontmatter instead of before it, fixing Kiro power metadata parsing
+- Fix codeshop frontmatter: `name` field to lowercase `codeshop`, keyword `codebase-architecture` to `architecture`. Fix CategoryEnum test to include `writing` category (10 categories).
+
+
+## [0.3.0] - 2026-04-27
+
+### Added
+- Added MCP bridge compilation smoke test to CI (`bun run build:bridge` + `node bridge/mcp-server.cjs --version`)
+- Added ADR-0031 documenting Souk Compass as a standalone MCP server for Solr-backed semantic search with pluggable embedding providers and multi-tier caching.
+- ADR-0030: authoring-level version embedding and manifests
+- Multi-harness `forge import --harness` command supporting all 7 harness-native formats (Kiro, Claude Code, Copilot, Cursor, Windsurf, Cline, Q Developer) with auto-detection, --force, and --dry-run
+- Admin UI components in Browse SPA: capability badges with color-coded matrix grid, inline temper preview panel, import modal with file scanner, version display with upgrade button, workspace tab with project management, interactive dependency graph (inline SVG with force-directed layout), and build dashboard with config persistence and history
+- Interactive `forge temper` command for previewing the compiled AI experience per artifact-harness pair, with terminal output, JSON mode, side-by-side comparison (--compare), and web preview (--web)
+- Admin API endpoints for capabilities (GET /api/capabilities), temper (POST /api/temper), import scan/execute (POST /api/import), versions/upgrade (GET/POST /api/versions, /api/upgrade), workspace (GET/PUT /api/workspace), dependency graph (GET /api/graph), and build trigger/status (POST /api/build, GET /api/build/status)
+- Comprehensive unit test suite for Souk Compass MCP server — 191 tests across 9 files covering SoukVectorClient, embedding provider factory, tool handlers, MCP error boundary, CachedEmbeddingProvider, chunker, serialization, workspace profiler, and hook/plugin validation.
+- Added `changelog-check` CI job that enforces a changelog fragment exists for PRs touching source files, with `skip-changelog` label escape hatch
+- Added daily `dist-drift.yml` scheduled workflow that rebuilds artifacts and MCP bridge on `main` and warns if `dist/` or `bridge/` have drifted from source
+- Harness capability matrix declaring support levels (full/partial/none) for 8 capabilities across all 7 harnesses, with configurable degradation strategies (inline/comment/omit) applied automatically during build
+- Added promptfoo eval suites for codeshop (routing, skill-quality, shared-concepts), all 8 byron-powers artifacts, ADR (workflow-correctness, template-quality, generate-from-diff, health-check), and karpathy-mode (principle-enforcement, tradeoff-awareness) — 71 tests total
+- Multi-repo and monorepo workspace support via forge.config.yaml with multiple knowledge sources, per-project harness/artifact configuration, workspace-aware build and install, and --project flag
+- Artifact versioning with semver version embedding in compiled output, .forge-manifest.json sidecar files, `forge upgrade` command with migration script support, --force, and --dry-run
+
+### Changed
+- Updated README with complete CLI command reference, project structure, capability matrix, and development instructions
+- Trimmed knowledge artifact keywords to 6-19 per artifact, removed keyword/category overlaps, established canonical 10-category taxonomy, and added 'writing' to CategoryEnum in schemas.ts
+- Added Bun dependency caching (`~/.bun/install/cache` + `node_modules`) keyed on `bun.lock` hash to all GitHub Actions workflows (CI, release, audit, pages)
+- Added event-driven hooks to five neon-caravan artifacts (commit-craft, review-ritual, type-guardian, debug-journal, karpathy-mode) and added missing Overview, Examples, and Troubleshooting sections to all knowledge artifacts per Kiro Power best practices.
+- Switched Souk Compass local Solr from standalone mode to SolrCloud (1 node + ZooKeeper), enabling the Collections API for programmatic collection management and configset-based schema deployment. Updated health check to use ping endpoint for mode-agnostic operation.
+- Added Overview, Examples, Troubleshooting, and Steering Files listing sections to all eight byron-powers artifacts (novelist, fantasy-novelist, scifi-novelist, mystery-series-novelist, series-continuity, book-agent-publicist, technical-author, proofreader-review-checklist) per Kiro Power best practices.
+- Updated the Hello test artifact with a fun onboarding section that greets users in 20 languages and bumped version to 0.2.0.
+- Split CI into parallel jobs (`lint-and-typecheck`, `test`, `validate-and-build`) so lint, tests, and artifact validation run concurrently
+- Added `concurrency` group with `cancel-in-progress: true` to CI so rapid pushes to a PR cancel stale in-progress runs
+- Rewrote top-level README with current collection counts, full repo structure, and complete Quick Start
+- Replaced stub skill-forge CONTRIBUTING with code-level guide covering module map, adapter/backend patterns, testing conventions, and common pitfalls
+- Overhauled CLI help metadata with thorough examples, option groups, and coverage for all commands including catalog export, guild, and collection
+- Updated the knowledge.md scaffold template to include skeleton Overview, Best Practices, Examples, and Troubleshooting sections so new artifacts start with the recommended Kiro Power structure.
+
+### Fixed
+- Fixed the CI eval job to use the eval suite's Bedrock credentials, and skip forked pull request runs where the required secrets are unavailable.
+- Fixed all Biome lint errors and TypeScript type-check failures: resolved Bun Dirent type incompatibility in versioning.ts, tightened mapKiroEvent return type to CanonicalEvent, added missing changelog/migrations fields to CatalogEntry test factories, added buildHistory to BrowseState test fixtures, removed unused imports, applied Biome formatting, and suppressed intentional ANSI escape regex checks
+- Updated GitHub workflows to install Node 22 and run repository automation from the `skill-forge` directory so CI, audit, CodeQL, and release jobs target the actual project files.
+- Fixed SQLite BLOB deserialization in CachedEmbeddingProvider — Bun's bun:sqlite returns Uint8Array for BLOB columns, now uses TextDecoder instead of toString() for correct embedding recovery.
+- Removed hardcoded test count from PR template checklist to prevent staleness
+- Static catalog export: use replacer function in generateStaticHtmlPage to prevent String.replace dollar-sign corruption of embedded JSON
+
+
+## [0.2.0] - 2026-04-21
+
+### Added
+- Added manifest entry management to `forge catalog browse` — view manifest entries with sync status indicators, add/edit/remove entries via REST API (`GET/POST/PUT/DELETE /api/manifest/entries`), and display synced/outdated/missing status from sync-lock comparison
+- Added 4 property-based tests for collection admin correctness (Properties 10–12, 16) — YAML round-trip, unknown key preservation, validation consistency, and filtering correctness.
+- Added unit tests for `manifest-admin.ts` — 9 tests covering `readManifest`, `readSyncLock`, `computeSyncStatus` (synced/outdated/missing), and error paths for `addManifestEntry`, `editManifestEntry`, `removeManifestEntry`.
+- Added collection management to `forge catalog browse` — list, view, create, edit, and delete collection YAML files via REST API (`GET/POST/PUT/DELETE /api/collections`) with trust-level and tag filtering in the UI
+- Added 9 property-based tests for artifact admin correctness (Properties 1–9) — frontmatter serialization round-trip, validation consistency, kebab-case enforcement, file structure verification, update preservation, delete removal, catalog consistency, toKebabCase output, and comma-separated parsing.
+- Added unit tests for `admin.ts` — 20 tests covering `serializeFrontmatter`, `validateArtifactInput`, `toKebabCase`, and error paths for `createArtifact`, `updateArtifact`, `deleteArtifact`.
+- Added unit tests for `collection-admin.ts` — 15 tests covering `parseCollectionFile`, `serializeCollection`, `validateCollectionInput`, `getCollection` member resolution, and error paths for CRUD operations.
+- Documented browse UI module extraction architecture (ADR-0025).
+- Added 30 integration tests for browse server mutation endpoints — artifact/collection/manifest CRUD round-trips, sync status verification, Content-Type validation, and structured error responses (400/404/409).
+- Added tab navigation (Artifacts | Collections | Manifest) to `forge catalog browse` with a shared UI design system including design tokens, reusable card/form/badge/toast/modal components, and context-aware create buttons
+- Added full CRUD capabilities to `forge catalog browse` for knowledge artifacts — create, edit, and delete artifacts directly from the browser UI via `POST /api/artifact`, `PUT /api/artifact/:name`, and `DELETE /api/artifact/:name` endpoints with validation, conflict detection, and automatic catalog refresh
+- Added 3 property-based tests for manifest admin correctness (Properties 13–15) — sync status computation, entry validation delegation, and top-level field preservation during mutations.
+- Extract browse UI template (`generateHtmlPage`, `generateStaticHtmlPage`, `escapeHtml`) into dedicated `browse-ui.ts` module, reducing `browse.ts` from ~2950 to ~500 lines (ADR-0025).
+- Documented browse server admin CRUD architecture with mutable state wrapper and modular admin layers (ADR-0024)
+
+### Fixed
+- Fix GitHub Pages workflow to deploy from `jhu-main` instead of `main` so the catalog browser shows all knowledge artifacts
+
+
+## [0.1.1] - 2026-04-13
+
+### Added
+- Added `src/asset-conventions.ts` registry mapping each of the 8 asset types to required files, optional files, and type-specific validation rule keys
+- Added `forge import <path> [--all] [--format] [--dry-run] [--collections]` command for ingesting external Kiro powers (`POWER.md` + `steering/`) and skills (`SKILL.md` + `references/`) into the skill-forge knowledge directory
+- Added forge tutorial command providing a step-by-step guided walkthrough for first-time users covering artifact creation via the interactive wizard, generated file exploration, and building with progress indicators and jargon-free language
+- Auto-fetch from configured backend when artifact or collection is not in global cache (guild init)
+- Added maturity badge, trust lane label, and maturity filter to catalog browser card and detail views in `forge catalog browse`
+- Add jhu collection and backend (jhu-sheridan-libraries/agentic-skill-forge)
+- Documented decision to use an auto-detecting multi-format importer for `forge import` over a hardcoded single-format path, enabling extensibility to future source formats without CLI surface changes (ADR-0019)
+- Implemented Kiro harness adapter with steering files, hook JSON, POWER.md, spec-hooks, and MCP config generation
+- Added `hello-world` example power and full `kiro-official` collection knowledge definitions covering 26 powers:
+
+- `arm-soc-migration`
+- `aws-agentcore`
+- `aws-amplify`
+- `aws-devops-agent`
+- `aws-healthomics`
+- `aws-infrastructure-as-code`
+- `aws-mcp`
+- `aws-observability`
+- `aws-sam`
+- `checkout-api-reference`
+- `cloud-architect`
+- `cloudwatch-application-signals`
+- `datadog`
+- `dynatrace`
+- `figma`
+- `gcp-aws-migrate`
+- `graviton-migration-power`
+- `neon`
+- `postman`
+- `power-builder`
+- `saas-builder`
+- `spark-troubleshooting-agent`
+- `stackgen`
+- `strands`
+- `stripe`
+- `terraform`
+- Added forge catalog browse subcommand with local web-based catalog browser featuring search, harness/type/category filtering, and artifact detail view with knowledge.md preview
+- Added AssetTypeSchema expanding the `type` field to 8 values (skill, power, rule, workflow, agent, prompt, template, reference-pack) as a semantic asset taxonomy, with ArtifactTypeSchema kept as a backward-compatible alias
+- Implemented forge new scaffolding command with template-driven artifact creation
+- Added DevSecOps GitHub Actions workflows: CodeQL static analysis (src/ and bridge/ with security-extended queries), scheduled dependency audit with bun audit and Gitleaks secret scanning (custom rules for mcp-servers.yaml env blocks), OSSF Scorecard, Dependabot weekly updates, path-based PR labeler, and stale issue management
+- Implemented Nunjucks template engine module with inheritance support and custom filters
+- Added --yes flag to forge new command to skip the interactive wizard and use template defaults for CI and scripting use cases
+- Added `forge help [command]` subcommand as an alternative to --help, with contextual command help and unknown command error handling
+- Added context-bazaar Claude Code plugin packaging with `.claude-plugin/plugin.json`, `.claude-plugin/marketplace.json`, `.mcp.json`, and a bundled MCP bridge (`bridge/mcp-server.cjs`) exposing `catalog_list`, `artifact_content`, and `collection_list` tools
+- Added styled help screens with chalk color styling, aligned command tables, per-command usage examples, grouped options, and --no-color support via a pure-function Help_Renderer module
+- Added CONTRIBUTING.md covering artifact scaffolding, frontmatter fields, quality bar, collection assignment, import workflow, development commands, changelog fragment process, and pull request checklist
+- Added `forge.config.yaml` per-repo configuration and `~/.forge/config.yaml` user-global configuration loaded via `src/config.ts`; declares named install backends, publish target, and governance author allowlists
+- Added asset type select prompt to the `forge new` interactive wizard with descriptions for all 8 asset types; prompt is skipped when `--type` is passed on the command line
+- Added harness-specific emoji icons to the catalog browser filter checkboxes, card footer, and detail view (👻 kiro, 🤖 claude-code, 🐙 copilot, 🖱️ cursor, 🏄 windsurf, 🔧 cline, ☁️ qdeveloper)
+- Added ecosystem, depends, and enhances metadata fields to frontmatter and catalog schemas with kebab-case validation
+- Documented decision to declare collection membership in artifact frontmatter rather than in collection manifests, with four alternatives considered and rationale for eliminating the two-source-of-truth problem (ADR-0016)
+- Documented decision to use a pre-bundled MCP server as the Claude Code plugin integration layer over pure skill file distribution or a slash command, enabling interactive parameterised catalog queries from inside the assistant (ADR-0020)
+- Added `--strict` flag to `forge build` that treats compatibility warnings (partial or missing harness support for an asset type) as hard errors
+- Documented decision to use the `gh` CLI rather than direct GitHub REST API calls for release creation and asset download, delegating auth management to an already-installed tool (ADR-0018)
+- Added CollectionSchema for metadata-only collection manifests in `collections/*.yaml`; collection membership is declared by artifacts in their own frontmatter via `collections: [name]` rather than listed in the manifest, eliminating stale cross-references
+- Added multi-root source scanning so `forge build`, `forge validate`, and `forge catalog generate` scan both `knowledge/` and `packages/` directories, skipping roots that do not exist
+- Added `src/collections.ts` with `loadCollections`, `validateArtifactCollectionRefs`, and `buildCollectionMembership` for loading collection manifests, cross-validating artifact collection references, and computing derived membership maps
+- Added `forge publish` command running the full pipeline (validate --strict, build, catalog, release-manifest.json, per-harness tarballs) and publishing via `gh release create` for GitHub or `aws s3 sync` for S3; `--dry-run` packages without uploading
+- Added pluggable backend abstraction in `src/backends/` with a shared `ArtifactBackend` interface and four implementations: `LocalBackend` (filesystem), `GitHubBackend` (gh CLI), `S3Backend` (aws CLI, compatible with R2/MinIO), and `HttpBackend` (generic HTTPS with bearer token support)
+- Added asset × harness compatibility matrix in `src/compatibility.ts` so `forge build` skips type/harness combinations with no meaningful output and emits partial-support warnings for degraded combinations
+- Documented decision to use a pluggable ArtifactBackend interface over hardcoding GitHub as the only install/publish target, enabling private S3 and HTTP backends alongside the public GitHub releases backend (ADR-0017)
+- Implemented Cursor, Windsurf, Cline, and Q Developer harness adapters
+- Documented decision to add `--security` flag to `forge validate` over a standalone command or CI-only approach, integrating prompt injection, hook exfiltration, and MCP surface checks as a local-and-CI gate (ADR-0021)
+- Added `--backend <name>` flag to `forge install` for fetching artifacts from a named backend declared in `forge.config.yaml`; enables installing from private S3 buckets and HTTP endpoints alongside the existing `--from-release` GitHub path
+- Added file-writer module with buildKnowledgeMd, buildHooksYaml, buildMcpServersYaml, and writeWizardResult functions for serializing wizard output to gray-matter markdown and YAML files
+- Added `collections` field to artifact frontmatter and catalog entries so artifacts declare their own collection membership; the catalog derives collection membership from artifact metadata rather than from a separate member list
+- Added governance lane validation warnings: `trust: official` or `partner` without a `license` field, `risk-level: high` without a `trust` lane, and artifacts declaring a collection name with no matching manifest in `collections/`
+- Added CODE_OF_CONDUCT.md addressing contributor responsibility in the AI harness era: curated vs. uncurated AI-assisted contributions, knowledge quality standards, attribution policy, and the expectation that all submitted content has been reviewed and understood by its author
+- Added four seed knowledge artifacts to the Neon Caravan collection: `commit-craft` (prompt), `type-guardian` (skill), `debug-journal` (workflow with three phase files), and `review-ritual` (skill)
+- Added `forge collection build` subcommand and `src/collection-builder.ts` that assembles per-collection dist bundles at `dist/<harness>/collections/<name>/` by merging pre-built member artifact outputs derived from catalog collection membership
+- Added category taxonomy (CategoryEnum) with 9 initial values for tagging knowledge artifacts by domain
+- Added generated `dist/` artifacts for kiro, claude-code, and copilot harnesses covering all power definitions including kiro-official, byron-powers, hello-world, and adr collections
+- Added `karpathy-mode` knowledge entry (Andrej Karpathy's behavioral coding guidelines) with kiro and claude-code harness targets, examples workflow, MIT license, and upstream provenance tracking
+- Added cross-artifact dependency reference validation with warnings for unresolved depends/enhances references
+- Implemented Claude Code adapter with CLAUDE.md, Stop hooks in settings.json, and MCP config
+- Added Collection filter group to `forge catalog browse` UI so users can browse artifacts scoped to a single collection; filter group is hidden when no artifacts have collection membership
+- Added GitHub issue templates for artifact submission (identity table, content preview, quality self-assessment) and content quality report (exact-quote requirement, severity taxonomy, fix capacity check)
+- Implemented eval framework with discovery, prompt resolver, harness context wrapping, promptfoo integration, and scaffold command
+- Added interactive wizard to forge new command using @clack/prompts for guided artifact configuration including frontmatter metadata, knowledge body, hooks, and MCP server definitions with inline Zod validation and cancellation safety
+- Added download cache at `~/.forge/cache/<backend>/<artifact>@<version>/` so remote backend artifacts (GitHub releases, S3, HTTP) are not re-downloaded on repeated installs
+- Added `.forge-manifest.json` written alongside installed artifacts recording artifact name, harness, version, backend label, and install timestamp to enable future upgrade tracking
+- Added enhanced version output with Bun runtime version and OS platform info to `forge --version`
+- Verified CLI entry point with all six commands wired and functional
+- Added root-level CLAUDE.md providing Claude Code with commands, architecture overview, compile pipeline, type system, collection model, MCP bridge details, test helper conventions, and changelog/ADR discipline
+- Added asset-type-aware validation warnings to `forge validate`: `reference-pack` without `inclusion: manual`, `workflow` with empty or missing `workflows/` directory, and `prompt` with a body shorter than 50 characters
+- Added `--type <type>` flag to `forge new` for pre-selecting the asset type and bypassing the wizard type prompt; validates against the 8-value AssetTypeSchema and scaffolds type-appropriate structure (e.g. `workflow` pre-creates `workflows/main.md`)
+- Added typo suggestion for unknown commands using Levenshtein distance (fastest-levenshtein), suggesting the closest match when distance ≤ 2
+- Implemented catalog generation with generateCatalog, serializeCatalog, and catalogCommand
+- Added namespaced artifact layout support for `packages/@org/<artifact>/knowledge.md` alongside the existing flat `knowledge/<artifact>/knowledge.md` layout; dist output paths always use the leaf artifact name
+- Add --backend option to guild init for specifying a named backend
+- Added CLI startup banners: full-color gradient banner with dark navy background for interactive use, and plain-text logBanner() export for log files
+- Added `forge collection new [name]` interactive wizard for scaffolding collection manifests; changed `forge collection` bare invocation to show a status overview with member counts and an interactive "create first collection?" prompt when none exist
+- Added three ADR power hooks (agent-stop reminder, pre-task ADR listing, post-task diff summary) and updated ADR knowledge metadata with `harness-config` and corrected author field
+- Implemented install module with direct CLI install, interactive wizard using clack/prompts, and installCommand handler
+- Added bazaar governance and discovery fields to artifact frontmatter and catalog entries: `maturity`, `trust`, `risk-level`, `audience`, `model-assumptions`, `id`, `license`, `successor`, and `replaces`, all optional with safe defaults so existing artifacts require no changes
+- Documented decision to combine static pattern matching with LLM adversarial rubric evals as a two-layer artifact security review, using the existing promptfoo eval infrastructure against compiled CLAUDE.md artifacts (ADR-0022)
+- Implemented build orchestrator with full and single-harness build, shared MCP server resolution, and CLI handler
+- Added `harness-config` field (with `kiro.format: "power"`) to `importKiroPower` frontmatter output so imported powers carry their format declaration forward
+- Implemented parser module with parseKnowledgeMd, parseHooksYaml, parseMcpServersYaml, parseWorkflows, and loadKnowledgeArtifact
+- Implemented validation module with validateArtifact, validateAll, and validateCommand CLI handler
+- Verified and completed Zod schemas in src/schemas.ts with all required schemas, types, and passthrough support
+- Added biome.json config scoping lint to src/, scripts/, evals/, and collections/, excluding generated files (bridge/, coverage/, dist/, .forge/, upstream/, catalog.json)
+- Implemented Copilot adapter with instructions, path-scoped files, and AGENTS.md generation
+- Added dependency composition for `workflow` and `agent` artifact types: MCP servers from `depends` artifacts are merged before compilation, and hooks are merged when `inherit-hooks: true` is set in the artifact's frontmatter
+- Added `kiro-official.yaml` collection manifest, `sync-kiro-powers.sh` script for pulling upstream power sources, and `upstream/.gitkeep` placeholder directory
+- Added dependency cycle detection to `forge validate` using DFS over the `depends` graph; cycles now produce hard validation errors identifying the full cycle path
+
+### Changed
+- Changed detail view to merge redundant Harnesses and Formats sections into a single Targets section showing icon, harness name, and format inline; improved back-to-catalog button with pill styling and animated arrow
+- Changed writing-related power knowledge (novelist, technical-author, proofreader-review-checklist, book-agent-publicist, scifi-novelist, fantasy-novelist, mystery-series-novelist, series-continuity) to live under `knowledge/byron-powers/` namespace with new hooks and workflow content
+- Expanded SECURITY.md with MCP bridge attack surface documentation, distinction between security issues and content quality issues, coordinated disclosure timeline, and in-scope vs. out-of-scope table
+- Updated forge new scaffold template to include categories, ecosystem, depends, and enhances fields with guiding YAML comments
+- Changed eval output formatting to use horizontal rules, filled progress bars, tree connectors (├─/╰─) for response and grading reason detail lines, and suppressed noisy GCP metadata probe warnings from promptfoo
+- Changed root help screen to display subcommands indented under their parent commands (catalog, collection) in a structured hierarchy; stripped `[options]` noise from command names at the overview level
+- Expanded pull request template with artifact changes table, breaking changes callout, split checklist (Code / Artifacts / Housekeeping), harness output preview command, and structured prompting to prevent empty sections
+- Changed `maturity: deprecated` without a `successor` field from a validation warning to a validation error, enforcing that deprecated artifacts always point to their replacement
+- Changed banner display logic to suppress on --help, -h, and `forge help` invocations, showing only on bare `forge` with no arguments
+- Changed the type-field deprecation warning to a lifecycle warning emitted during `forge validate` when an artifact has `maturity: deprecated` but no `successor` field set
+- Changed `forge new` scaffold template to include commented-out bazaar metadata stubs (maturity, trust, license, audience, risk-level, model-assumptions) so authors can see available fields without being required to fill them in
+- Changed catalog browser to registry-style card hierarchy with display name, monospace package name, 2-line description, pill keywords, and icon-only harness footer; added Space Grotesk display font and Inter body font; improved filter bar with labeled groups and pill-style checkboxes
+
+### Deprecated
+- Deprecated `BuildOptions.knowledgeDir` (singular string) in favor of `BuildOptions.knowledgeDirs: string[]` to support multi-root scanning; the old field is still accepted but will be removed in a future version
+
+### Fixed
+- Fixed trailing `help` on CLI commands (e.g. `forge build help`, `forge catalog browse help`) now showing the help screen instead of erroring with "too many arguments"
+- Fixed type errors across source and test files for strict TypeScript compliance — added missing collections/inherit-hooks fields, corrected Dirent typing for Node.js compatibility, and resolved narrowing issues in tests
+- Fixed wizard validateField returning parsed string values as error messages, causing text prompts to mirror input instead of proceeding
+- GitHubBackend fetchArtifact tarball extraction double-nesting (harness prefix already in archive)
+- Fixed `forge import` crashing on non-artifact directories by verifying `POWER.md` / `SKILL.md` existence before dispatching, and filtering out dot-directories (`.github`, `.kiro`, etc.) during source scanning
+- Fixed `forge tutorial` crashing on re-run when the hello-world artifact already exists by removing the existing directory before re-scaffolding when the user confirms overwrite
+- GitHubBackend fetchArtifact directory existence check (Bun.file().exists() does not work on directories)
+- Fixed CLI banner right edge so all lines render as a uniform rectangle by computing visual terminal column width (handling wide emoji including ⚡) and normalising trailing padding dynamically rather than hardcoding it per line
+- Global install version selection now picks newest release instead of oldest
+- GitHubBackend fetchCatalog now uses gh release download instead of broken gh api path
+- Fixed build.ts resolveComposition destructuring that referenced a nonexistent `resolved` property, causing a type error and potential runtime failure
+
+
+### Architecture Decisions
+
+- [ADR-009](docs/adr/0009-clack-prompts-for-interactive-cli.md): Use @clack/prompts for interactive CLI flows
+- [ADR-010](docs/adr/0010-scaffold-first-overwrite-on-success.md): Scaffold-first, overwrite-on-success pattern for interactive wizard

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2025 Johns Hopkins Sheridan Libraries
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.