@tyroneross/build-loop 0.36.0 → 0.36.1

package/.agents/plugins/marketplace.json

@@ -1,6 +1,6 @@
 {
   "name": "build-loop",
-  "version": "0.36.0",
+  "version": "0.36.1",
   "plugins": [
     {
       "name": "build-loop",

package/.claude-plugin/marketplace.json

@@ -6,14 +6,14 @@
   },
   "metadata": {
     "description": "Official marketplace for build-loop — orchestrated 5-phase development loop with optional Learn phase",
-    "version": "0.36.0"
+    "version": "0.36.1"
   },
   "plugins": [
     {
       "name": "build-loop",
       "source": "./",
       "description": "Orchestrated 5-phase development loop (Assess → Plan → Execute → Review → Iterate) plus optional Learn phase. Review combines critic, validate, optimize, fact-check, simplify, and report as ordered sub-steps. Bundles native debug-loop, debugging-memory, and logging-tracer skills without a build-loop MCP server. The logging-tracer skill includes an optional Coding Debugger escalation hop to delegate to the standalone supporting plugin for extended capability (cross-project memory, additional assessors). NavGator integration via cherry-pick bridge. Opus 4.7 orchestrator, Sonnet execution, Haiku pattern-matching.",
-      "version": "0.36.0",
+      "version": "0.36.1",
       "author": {
         "name": "Tyrone Ross"
       },

package/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "build-loop",
-  "version": "0.36.0",
+  "version": "0.36.1",
   "description": "Multi-phase build orchestration with native debugging: assess, plan, execute, review, iterate. Plan-verify gate on Phase 2. Optional UI design gates. Native debug-loop, debugging-memory, and logging-tracer skills provide root-cause investigation without a bundled MCP server. Orchestrator owns when-to-fire; bundled skills own procedural detail; the logging-tracer skill includes an optional Coding Debugger escalation hop to the standalone supporting plugin for extended capability.",
   "author": {
     "name": "Tyrone Ross",

package/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "build-loop",
-  "version": "0.36.0",
+  "version": "0.36.1",
   "description": "Multi-phase build orchestration with native debugging: assess, plan, execute, review, iterate. Plan-verify gate on Phase 2. Optional UI design gates. Native debug-loop, debugging-memory, and logging-tracer skills provide root-cause investigation without a bundled MCP server. Orchestrator owns when-to-fire; bundled skills own procedural detail; bridges are optional escalation hops to supporting plugins for extended capability.",
   "author": {
     "name": "Tyrone Ross",

package/agents/database-assessor.md

@@ -79,7 +79,7 @@ Determine which type of database issue:
 
 ### Step 1b: Required destructive-FK / data-integrity sweep (LO-5)
 
-On any security-relevant or schema-touching pass, **enumerate destructive foreign-key actions** — grep the schema for `onDelete: Cascade` and `onDelete: SetNull`, plus merge/delete code paths that destroy rather than reassign rows, and missing FK indexes. A cascade that silently deletes user data is an integrity/security finding **even when every route is authed** — the access-control lens (`security-reviewer`) does not catch it, so this sweep is required, not optional. Pair with the `security-reviewer`'s route-auth enumeration; neither lens is a superset (proven both ways, atomize-ai 2026-06-30). Present findings blast-radius-first (see `Skill("build-loop:security-methodology")` §Required sweeps).
+On any security-relevant or schema-touching pass, **enumerate destructive foreign-key actions** — grep the schema for `onDelete: Cascade` and `onDelete: SetNull`, plus merge/delete code paths that destroy rather than reassign rows, and missing FK indexes. A cascade that silently deletes user data is an integrity/security finding **even when every route is authed** — the access-control lens (`security-reviewer`) does not catch it, so this sweep is required, not optional. Pair with the `security-reviewer`'s route-auth enumeration; neither lens is a superset (proven both ways in a private-app stress test on 2026-06-30). Present findings blast-radius-first (see `Skill("build-loop:security-methodology")` §Required sweeps).
 
 ### Step 2: Search Memory
 

package/agents/security-reviewer.md

@@ -93,7 +93,7 @@ Severity rules:
 1. Read `.build-loop/state.json.triggers`. If `riskSurfaceChange` is not true, emit `{"findings": [], "skipped_reason": "..."}` and stop.
 2. Read `.build-loop/goal.md` and `.build-loop/intent.md` — orient on what was supposed to change.
 3. Load `Skill("build-loop:security-methodology")`. Read the cross-source matrix and the detection-pattern files for the OWASP layer that applies (LLM Top 10 always; Agentic Top 10 when an agent or tool was added; Web Top 10 when an HTTP endpoint changed).
-3b. **Required route-auth enumeration (LO-5, A01).** When any HTTP endpoint changed, do not sample — **walk every** `app/api/**/route.ts` (or framework equivalent) mutating/DDL handler and confirm each has an auth guard that **fails closed** when its secret env is unset (the `token !== process.env.X` bypass: if `X` is undefined the check passes). This access-control sweep is the counterpart to `database-assessor`'s destructive-FK sweep — neither lens is a superset (atomize-ai 2026-06-30: 8 A/B runs here missed a destructive cascade; a DB-RCA missed 4 unauth routes). Lead findings with a blast-radius verdict per the methodology's SC-1 default.
+3b. **Required route-auth enumeration (LO-5, A01).** When any HTTP endpoint changed, do not sample — **walk every** `app/api/**/route.ts` (or framework equivalent) mutating/DDL handler and confirm each has an auth guard that **fails closed** when its secret env is unset (the `token !== process.env.X` bypass: if `X` is undefined the check passes). This access-control sweep is the counterpart to `database-assessor`'s destructive-FK sweep — neither lens is a superset (private-app stress test on 2026-06-30: 8 A/B runs here missed a destructive cascade; a DB-RCA missed 4 unauth routes). Lead findings with a blast-radius verdict per the methodology's SC-1 default.
 4. Get the file list from the orchestrator's dispatch packet. Read each changed file; do not scan files outside the chunk.
 5. For each change, walk the table above. When a row matches, draft a finding with mandatory fields below.
 6. Cross-reference each finding against `skills/security-methodology/references/cross-source-matrix.md` to assign `mapped_risks`. If no row in the matrix applies, the finding is not security — drop it (other agents handle non-security drift).

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@tyroneross/build-loop",
-  "version": "0.36.0",
+  "version": "0.36.1",
   "publishConfig": {
     "registry": "https://npm.pkg.github.com",
     "access": "public"

package/plugin-artifacts/codex/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "build-loop",
-  "version": "0.36.0",
+  "version": "0.36.1",
   "description": "Multi-phase build orchestration with native debugging: assess, plan, execute, review, iterate. Plan-verify gate on Phase 2. Optional UI design gates. Native debug-loop, debugging-memory, and logging-tracer skills provide root-cause investigation without a bundled MCP server. Orchestrator owns when-to-fire; bundled skills own procedural detail; bridges are optional escalation hops to supporting plugins for extended capability.",
   "author": {
     "name": "Tyrone Ross",

package/skills/security-methodology/SKILL.md

@@ -106,7 +106,7 @@ The orchestrator scans the goal text for keywords matching these classes and ins
 
 ## Required sweeps for app+DB security passes (LO-5) + risk-presentation default (SC-1)
 
-**Two sweeps are REQUIRED, not optional, whenever a pass covers an app that has both HTTP routes and a database** — access-control review and data-integrity review are different lenses and neither is a superset of the other (proven both ways, atomize-ai 2026-06-30: an OWASP/access-control review missed a destructive `onDelete: Cascade`; a schema/secrets DB-RCA missed 4 unauthenticated mutation routes + a fail-open auth bug).
+**Two sweeps are REQUIRED, not optional, whenever a pass covers an app that has both HTTP routes and a database** — access-control review and data-integrity review are different lenses and neither is a superset of the other (proven both ways in a private-app stress test on 2026-06-30: an OWASP/access-control review missed a destructive `onDelete: Cascade`; a schema/secrets DB-RCA missed 4 unauthenticated mutation routes + a fail-open auth bug).
 
 1. **Route-auth enumeration** — walk **every** `app/api/**/route.ts` (or the framework equivalent) handler; confirm each mutating/DDL endpoint has an auth guard, AND that the guard **fails closed** when its secret env is unset (the `token !== process.env.X` bypass when `X` is undefined → `undefined !== undefined` is false → passes). Owned by `security-reviewer` (OWASP A01). Do not sample — enumerate.
 2. **Destructive-FK / data-integrity sweep** — grep the schema for `onDelete: Cascade` (and `SetNull`), missing FK indexes, and merge/delete paths that destroy rather than reassign. Owned by `database-assessor`. A cascade that silently deletes user data is a security/integrity finding even when every route is authed.