@vamsiivarmaa/proofloop 1.0.0-rc.2 → 1.0.0-rc.6

package/.claude-plugin/marketplace.json

@@ -7,7 +7,7 @@
       "name": "proofloop",
       "source": "./",
       "description": "Plan, approve, implement, verify, report. Nothing is called done without gate evidence on the head commit.",
-      "version": "1.0.0-rc.2",
+      "version": "1.0.0-rc.6",
       "license": "Apache-2.0",
       "keywords": ["harness", "verification", "workflow", "evidence"]
     }

package/.claude-plugin/plugin.json

@@ -1,7 +1,7 @@
 {
   "name": "proofloop",
   "displayName": "ProofLoop",
-  "version": "1.0.0-rc.2",
+  "version": "1.0.0-rc.6",
   "description": "Protocol-driven, evidence-based engineering harness: plan, approve, implement, verify, report.",
   "author": { "name": "Vamsi Varma" },
   "repository": "https://github.com/vamsivarma27/proofloop",

package/CHANGELOG.md

@@ -1,7 +1,22 @@
 # Changelog
 
 
-## Unreleased
+## 1.0.0-rc.6
+- `proofloop audit` / `/proofloop:audit` (or typing "audit for 5000 users, p99 under 500ms"): capacity model, real latency probe (p50/p95/p99, errors) against targets, load-test gate, static scalability scan, and a system-design checklist review. Never reports ok unless something was measured. See docs/guides/audit-and-design.md.
+- Plans can carry a `design` section (expected scale, p95/p99/error targets, decisions per area); a stated scale requires a load/performance check; the planner, implementer and reviewer prompts use the design checklist.
+- Load scripts (`test:load`, `load`, `loadtest`, `bench`) are detected.
+
+## 1.0.0-rc.5
+- `proofloop test` is now the full project test (the `test` protocol): lint, typecheck, unit/regression suite, build, integration, Playwright browser journeys once per persona (ordinary, impatient, unauthorized, accessibility), security scan and migration on the current commit, compared gate by gate with the merge base in a detached worktree (regression / pre-existing / fixed). Writes `.proofloop/test-runs/<time>/report.{md,json}` plus gate logs and evidence; failures become bugs (optionally GitHub issues via `--file-bugs`); a missing check is a coverage gap, never a pass. `/proofloop:test` and a bare "test" prompt run it without asking which suites.
+- The earlier scripted self-suites moved to `proofloop selftest`.
+
+## 1.0.0-rc.4
+- `/proofloop:test` and `proofloop test [suite...|all]`: end-to-end suites (feature, bug, integration, browser, performance, recovery, blocked) through the real engine; writes `.proofloop/test-runs/<time>/log.jsonl`, `report.md`, `report.json`; wrong outcomes, safety and evidence problems become bugs, optionally filed as GitHub issues with `--file-bugs owner/repo` (idempotent). Typing just "test" / "run all tests" / "test bug and recovery" starts it via a UserPromptSubmit hook.
+
+## 1.0.0-rc.3
+- Fix: the guard hook asked for approval on any command that merely mentioned `approve` near a path containing `proofloop` (e.g. a grep in the plugin cache). It now judges the command actually run.
+- Plans open with an at-a-glance table and end with next steps; `/proofloop:approve` asks once.
+- V0.2 engineering memory: `RETRIEVING_MEMORY` workflow state, append-only incident records (hypotheses vs evidence-confirmed root causes, preserved failed attempts), explainable historical retrieval over local incidents, GitHub issues/PRs and decision records with partial-failure reporting, and an exportable Proof Ledger (`proofloop ledger export`, JSON and Markdown) with revision-specific, stale-aware verification. See docs/guides/memory-and-ledger.md.
 - Real-model eval keeps the directory of any failed run and names it in the report notes, so unexplained failures can be diagnosed.
 - Claude Code marketplace manifest (`/plugin marketplace add vamsivarma27/proofloop`), scoped npm package `@vamsiivarmaa/proofloop` (publish tag `next`), new README with hero figure.
 - Fix: `bin/proofloop` failed when npm linked it into `node_modules/.bin` (symlink not resolved); found by installing the packed tarball into a fresh project. Covered by a test.

package/README.md

@@ -9,7 +9,8 @@
 A Claude Code plugin that wraps every change in a plan you approve, gates that must pass on the exact commit, and an evidence trail you can audit.
 
 [![License: Apache-2.0](https://img.shields.io/badge/license-Apache--2.0-blue.svg)](LICENSE)
-![Status](https://img.shields.io/badge/status-1.0.0--rc.2-orange)
+[![npm](https://img.shields.io/npm/v/@vamsiivarmaa/proofloop/next)](https://www.npmjs.com/package/@vamsiivarmaa/proofloop)
+![Status](https://img.shields.io/badge/status-1.0.0--rc.6-orange)
 ![Node](https://img.shields.io/badge/node-%E2%89%A5%2022.13-339933)
 
 </div>
@@ -42,6 +43,8 @@ describe ─► plan + acceptance criteria ─► YOU approve the plan hash ─
 | **Scope stays in scope** | Out-of-scope edits are reverted; risky commands need scoped approval. |
 | **Crashes don't cost you the run** | Interrupted runs reconcile with Git and resume instead of restarting. |
 | **A report that says what is *not* proven** | Limits and blocked items are listed, not hidden. |
+| **It remembers** | Bugs become append-only incident records; the next similar task retrieves them, with why they matched and whether they may be stale. |
+| **One document per change** | `proofloop ledger export <run>` produces a JSON or Markdown Proof Ledger: criteria, attempts (failed ones included), and the exact commit each check ran on. |
 
 The rules are enforced in code (a state machine, a command policy, a PreToolUse hook), not in prompts an agent can talk its way around.
 
@@ -81,6 +84,10 @@ proofloop run <run-id>                        implement, verify, review, open a
 /proofloop:status
 ```
 
+Type `test` (or `/proofloop:test`, or `proofloop test [unit browser ...]`) for the full project test: every check on the current commit, Playwright journeys per persona, and a regression comparison with your base branch, with a report, logs and a bug list. `proofloop selftest` runs ProofLoop's own scripted suites.
+
+Type `audit for 5000 users, p99 under 500ms` (or `/proofloop:audit`) for a scale and system-design audit: measured p50/p95/p99 and error rate, load test, scalability smells, and a design review. Plans also record expected scale and design decisions up front. See [audit and design](docs/guides/audit-and-design.md).
+
 Other protocols: `:bug`, `:diagnose`, `:performance`, `:verify`, and `:start-project` (idea → researched blueprint → roadmap issues).
 
 ## Honest numbers

package/SECURITY.md

@@ -1,5 +1,5 @@
 # Security policy
 
-Report vulnerabilities privately to the maintainer (GitHub security advisories on this repository). Do not open public issues for security problems. Expect an acknowledgement within 3 working days. Severity SLAs follow the engineering standard: critical ≤ 7 days, high ≤ 30, medium ≤ 90.
+Report vulnerabilities privately through [GitHub security advisories](https://github.com/vamsivarma27/proofloop/security/advisories/new). Do not open public issues for security problems. Expect an acknowledgement within 3 working days. Severity SLAs follow the engineering standard: critical ≤ 7 days, high ≤ 30, medium ≤ 90.
 
 In scope: approval bypass, gate/evidence forgery, policy bypass (command, path, production), secret leakage into artifacts/logs/GitHub, sandbox escape in Code Mode, hook bypass. Design and residual risks: [docs/security/threat-model.md](docs/security/threat-model.md).