@wipcomputer/wip-ai-devops-toolbox 1.9.55 → 1.9.57

package/.worktrees/toolbox--release-notes/_trash/RELEASE-NOTES-v1-9-0.md

@@ -0,0 +1,37 @@
+# v1.9.0: README Formatter, Repo Init, Dev Guide overhaul
+
+Two new tools, eight SKILL.md fixes, and a major Dev Guide update.
+
+## New: wip-readme-format
+
+Auto-generates READMEs following the WIP Computer standard. Detects all six interfaces, reads SKILL.md for tool names, generates badges, "Teach Your AI" block, features, interface coverage table, license block. Works on single repos and toolbox repos.
+
+The key design: generates separate section files instead of one monolithic README.
+
+```
+wip-readme-format /path/to/repo          # generates README-init-*.md section files
+wip-readme-format /path/to/repo --deploy  # assembles sections into README.md
+```
+
+Section files: `README-init-badges.md`, `README-init-title.md`, `README-init-teach.md`, `README-init-features.md`, `README-init-coverage.md`, `README-init-more-info.md`, `README-init-license.md`, `README-init-technical.md`. Edit any section independently, then deploy assembles them in order. Same pattern as release notes: staging, review, deploy.
+
+Also supports `--dry-run` (preview) and `--check` (validate existing README against the standard).
+
+## New: wip-repo-init
+
+Scaffolds the standard `ai/` directory in any repo. Plans, notes, ideas, dev updates, todos. Every folder has self-documenting READMEs.
+
+New repo: creates the full structure. Existing repo: moves old `ai/` contents to `ai/_sort/ai_old/` so you can sort at your own pace. Nothing is deleted.
+
+## Dev Guide: release notes workflow
+
+Both Dev Guides (public and private) now explicitly document the `RELEASE-NOTES-v{version}.md` workflow. Write the release notes file on the branch, commit it with the code, review it in the PR, `wip-release` auto-detects it after merge. Both guides cross-reference each other at the top so agents know to read both.
+
+## Fixes
+
+- Fixed SKILL.md `name:` frontmatter in all 8 existing tools. Interface coverage table now shows human-readable names ("Release Pipeline", "Identity File Protection") instead of directory names ("wip-release", "wip-file-guard").
+- Fixed interface coverage table: renamed "OpenClaw" column to "OC Plugin", corrected License Guard row (was falsely claiming Module + CC Hook).
+- Skill deployment: `wip-install` now deploys SKILL.md files to `~/.openclaw/skills/<tool>/` so OpenClaw agents can use them.
+- Amalgamated interface system notes, README standard, and Universal Installer vision into one reference document.
+- Dogfooded wip-repo-init on the toolbox itself. Filled in product bible, roadmap, and readme-first with real content.
+- Created plan stubs for all roadmap items (README Formatter, Daily Dev Summary, GitHub Actions Pack, Security Suite).

package/.worktrees/toolbox--release-notes/_trash/RELEASE-NOTES-v1-9-1.md

@@ -0,0 +1,38 @@
+# v1.9.1: Release gates ... product docs and release notes quality enforcement
+
+Agents read the Dev Guide, say "got it," and then release with garbage one-liner notes anyway. Documentation doesn't change behavior. Tools do. This release adds two new gates to `wip-release` that block bad releases before they happen.
+
+## Product docs gate
+
+Every PR is supposed to include updated product docs: a dev update, roadmap changes, and readme-first updates. This was documented in the Dev Guide as a manual checklist. Nobody followed it.
+
+`wip-release` now checks three things before publishing:
+
+1. **Dev update exists.** Looks in `ai/dev-updates/` for a file from the last 3 days. If you did work worth releasing, you should have written about it.
+2. **Roadmap was updated.** Checks `ai/product/plans-prds/roadmap.md` via `git diff` against the last tag. If the roadmap doesn't reflect what just shipped, it's stale.
+3. **Readme-first was updated.** Same check on `ai/product/readme-first-product.md`. The product bible should always describe what's actually built.
+
+Repos without an `ai/` directory are skipped silently. This only applies to repos that have adopted the `ai/` folder standard.
+
+For **patch** releases: warns but doesn't block. Hotfixes shouldn't be held up by docs.
+For **minor/major** releases: blocks the release. You can't ship a meaningful feature with stale product docs.
+
+`--skip-product-check` overrides for exceptional cases.
+
+## Release notes quality gate
+
+On 2026-03-11, the other CC session released memory-crystal v0.7.4. It read the Dev Guide (which now explicitly says "write a RELEASE-NOTES file on the branch"). It said it understood. Then it ran `wip-release patch --notes="MCP fix and agent ID config"` and published a one-liner to GitHub. The old `warnIfNotesAreThin()` function printed a warning to console. The agent ignored it.
+
+The root cause was architectural, not behavioral. The warning ran at step 8 of the pipeline, AFTER the version was already bumped, committed, tagged, and pushed. By the time the warning appeared, the damage was done. And it was a warning, not a gate. Agents don't read warnings.
+
+The fix:
+- `checkReleaseNotes()` replaces `warnIfNotesAreThin()`. It runs before the version bump, not after.
+- The CLI now tracks `notesSource`: where the notes came from (`file`, `dev-update`, `flag`, or `none`).
+- For minor/major releases: if notes came from a bare `--notes` flag instead of a `RELEASE-NOTES-v{version}.md` file, the release is **blocked**. The agent gets explicit instructions: "Write RELEASE-NOTES-v{version}.md (dashes not dots), commit it, then release."
+- For patch releases: warns if notes are short, but doesn't block.
+
+## Both gates follow the same pattern
+
+The existing license compliance gate (step 0) checks `.license-guard.json` and blocks if licensing is wrong. The new product docs gate (step 0.5) and release notes gate (step 0.75) work the same way: check early, block before any changes, show status in `--dry-run`, give clear instructions on how to fix it.
+
+The MCP server was also updated with `skipProductCheck` and `notesSource` passthrough so agents calling wip-release via MCP get the same enforcement.

package/.worktrees/toolbox--release-notes/_trash/RELEASE-NOTES-v1-9-10.md

@@ -0,0 +1,40 @@
+# Release Notes: AI DevOps Toolbox v1.9.10
+
+**Fix: Release notes files on disk always beat --notes flag**
+
+v1.9.9 shipped with a one-liner on the GitHub release instead of the full narrative release notes. The RELEASE-NOTES-v1-9-9.md file was sitting right there on disk, but `--notes="short text"` took priority because the auto-detect only ran when `--notes` was absent.
+
+This is exactly the kind of bug that happens when a rule exists in documentation but not in code. "Write release notes on the branch" is in the Dev Guide. The tool ignored them.
+
+## What changed
+
+### Notes priority is now enforced (highest wins):
+
+1. `--notes-file=path` ... explicit file path (always wins)
+2. `RELEASE-NOTES-v{ver}.md` ... in repo root (always wins over `--notes` flag)
+3. `ai/dev-updates/YYYY-MM-DD*` ... today's dev update (wins over `--notes` flag if longer)
+4. `--notes="text"` ... fallback only. Use for repos without release notes files.
+
+If a RELEASE-NOTES file exists on disk, `--notes` is ignored and a warning is printed:
+
+```
+! --notes flag ignored: RELEASE-NOTES-v1-9-10.md takes priority
+```
+
+Written notes on disk always take priority over a CLI one-liner. The agent wrote the file. The tool should use it.
+
+## Files changed
+
+```
+ tools/wip-release/cli.js | ~40 lines rewritten (notes cascade logic)
+```
+
+## Install
+
+```bash
+git pull origin main
+```
+
+## Attribution
+
+Built by Parker Todd Brooks, Lesa, and Claude Opus 4.6 at WIP.computer.

package/.worktrees/toolbox--release-notes/_trash/RELEASE-NOTES-v1-9-2.md

@@ -0,0 +1,40 @@
+# v1.9.2: Distribution Pipeline Fix
+
+The entire distribution pipeline was broken. Tools built but never reached users. 8 of 13 tools weren't on npm. ClawHub publish only shipped the root SKILL.md. deploy-public never ran npm publish. Errors were silent.
+
+This release fixes all of it.
+
+## What changed
+
+### Install fixes (#96, #110)
+- CLI binaries now have correct executable permissions (git +x on all bin entry files)
+- wip-license-hook dist/ committed to repo (TypeScript build output was gitignored)
+- Installer auto-detects TypeScript projects and runs build if dist/ missing
+- chmod +x safety net after every npm install -g
+- SSH fallback when HTTPS clone fails (private repos)
+
+### SKILL.md spec compliance (#107, #108)
+- All 12 SKILL.md files conform to agentskills.io spec
+- name field: lowercase-hyphen format matching directory name
+- Display names in metadata.display-name
+- version, homepage, author in metadata block
+- license: MIT on all files
+- metadata.openclaw blocks with install instructions and emoji
+- New SKILL.md created for wip-license-guard (was missing)
+
+### Distribution pipeline (#97, #100, #104)
+- ClawHub publish now iterates all sub-tool SKILL.md files, not just root
+- detectSkillSlug reads the name field from SKILL.md frontmatter
+- deploy-public.sh runs npm publish from the public clone after code sync
+- Handles both single repos and toolbox repos (iterates tools/*)
+- Distribution summary at end of release: shows all targets with pass/fail
+- syncSkillVersion handles quoted version strings in new metadata format
+
+## Install
+
+```bash
+npm install -g @wipcomputer/wip-ai-devops-toolbox
+wip-install wipcomputer/wip-ai-devops-toolbox
+```
+
+Built by Parker Todd Brooks, Lesa (OpenClaw, Claude Opus 4.6), Claude Code (Claude Opus 4.6).

package/.worktrees/toolbox--release-notes/_trash/RELEASE-NOTES-v1-9-31.md

@@ -0,0 +1,26 @@
+# Release Notes: wip-ai-devops-toolbox v1.9.31
+
+Branch guard no longer blocks global npm operations on main.
+
+## What changed
+
+Moved `npm install -g` and `npm link` from BLOCKED_BASH_PATTERNS to ALLOWED_BASH_PATTERNS in `wip-branch-guard/guard.mjs`. Global npm operations modify `/opt/homebrew/`, not the repo. Local `npm install` (no -g flag) remains blocked.
+
+## Why
+
+During LDM OS v0.4.0 dogfood, a CC session couldn't run `npm install -g @wipcomputer/wip-ldm-os@0.4.0` even after Parker explicitly said "install." The guard was too aggressive. Original intent (issue #137) was to block repo writes on main, not system-level package installs.
+
+## Issues closed
+
+- Closes #188 (branch guard blocks npm install -g)
+- Cross-ref: wipcomputer/wip-ldm-os#44
+
+## How to verify
+
+```bash
+# On main branch, these should now succeed:
+npm install -g @wipcomputer/wip-ldm-os@0.4.0
+npm link
+# This should still be blocked on main:
+npm install
+```

package/.worktrees/toolbox--release-notes/_trash/RELEASE-NOTES-v1-9-32.md

@@ -0,0 +1,18 @@
+# Release Notes: wip-ai-devops-toolbox v1.9.32
+
+Remove wip-install binary from toolbox. It lives in LDM OS now.
+
+## What changed
+
+The `wip-install` CLI binary has been removed from `@wipcomputer/universal-installer`. It now ships with `@wipcomputer/wip-ldm-os` (v0.4.1+). This prevents the EEXIST collision that blocked `npm install -g @wipcomputer/wip-ldm-os` when both packages tried to own the same binary.
+
+## Issues closed
+
+- Closes wipcomputer/wip-ldm-os#46
+
+## How to verify
+
+```bash
+npm install -g @wipcomputer/wip-ldm-os@0.4.1  # no EEXIST error
+which wip-install  # points to LDM OS, not toolbox
+```

package/.worktrees/toolbox--release-notes/_trash/RELEASE-NOTES-v1-9-41.md

@@ -0,0 +1,28 @@
+# Release Notes: wip-ai-devops-toolbox v1.9.41
+
+**One-line summary of what this release does**
+
+## What changed
+
+Describe the changes. Not a commit list. Explain:
+- What was built or fixed
+- Why it matters
+- What the user should know
+
+## Why
+
+What problem does this solve? What was broken or missing?
+
+## Issues closed
+
+- #251
+- #117
+- #128
+- #250
+- #73
+
+## How to verify
+
+```bash
+# Commands to test the changes
+```

package/.worktrees/toolbox--release-notes/_trash/RELEASE-NOTES-v1-9-45.md

@@ -0,0 +1,25 @@
+# Release Notes: wip-ai-devops-toolbox v1.9.45
+
+**Guard now teaches the workflow instead of just blocking.**
+
+## What changed
+
+- **Branch guard error messages overhauled (#213).** When the guard blocks a write on main, it now shows the full 8-step process: worktree, branch, commit, push, PR, merge, wip-release, deploy-public. Includes the lesson that release notes go on the feature branch, not as a separate PR.
+- **Separate error for "on branch but not in worktree."** Tells the agent to go back to main and create a worktree properly.
+- **CLAUDE.md added to shared state allowlist.** Was patched in the deployed guard but missing from source. Now in sync.
+
+## Why
+
+Agents kept getting blocked by the guard and then trying workarounds instead of following the process. The error message said "Use a worktree" but didn't explain the full workflow. Today's session hit this 5+ times. The guard works. The gap was agent knowledge.
+
+## Issues closed
+
+- #213
+- #256
+
+## How to verify
+
+```bash
+# In any repo on main, try to edit a file. The error should show the full workflow.
+# In any repo on a branch (not worktree), try to edit. Should show worktree instructions.
+```

package/.worktrees/toolbox--release-notes/_trash/RELEASE-NOTES-v1-9-46.md

@@ -0,0 +1,38 @@
+# Release Notes: wip-ai-devops-toolbox v1.9.46
+
+**Centralized worktree management: guard rule, wip-release prune, Dev Guide convention.**
+
+## What changed
+
+### Guard: worktree path warning (#212)
+Branch guard now warns when `git worktree add` creates a worktree outside `_worktrees/`. Shows the convention and suggests `ldm worktree add`. Warning only, not a hard block.
+
+### wip-release: worktree prune (#212)
+New step 12 in the release pipeline. After branch cleanup, prunes stale worktrees from `_worktrees/` whose branches are merged into main. Automatic cleanup after every release.
+
+### Dev Guide: _worktrees/ convention (#212)
+Documents the centralized worktree convention:
+- All worktrees go in `_worktrees/<repo-name>--<branch-suffix>/`
+- Use `ldm worktree add` (auto-detects repo, creates in the right place)
+- Guard warns about worktrees outside the convention
+- `wip-release` auto-prunes merged worktrees
+
+## Why
+
+Worktrees created as repo siblings confused iCloud sync, looked like real repos in directory listings, and were never cleaned up. This session alone created 10+ stale worktrees. The convention keeps them organized and the release pipeline cleans them automatically.
+
+## Issues closed
+
+- #212
+- #213
+
+## How to verify
+
+```bash
+# Guard warning:
+cd /path/to/repo
+git worktree add ../my-worktree -b test   # should warn about _worktrees/
+
+# Correct path:
+ldm worktree add cc-mini/test             # creates _worktrees/<repo>--cc-mini--test/
+```

package/.worktrees/toolbox--release-notes/_trash/RELEASE-NOTES-v1-9-47.md

@@ -0,0 +1,42 @@
+# Release Notes: wip-ai-devops-toolbox v1.9.47
+
+**New: `wip-repos claude` command + CLAUDE.md templates.**
+
+## What changed
+
+### `wip-repos claude` (Phases 1-3 of the CLAUDE.md plan)
+
+New subcommand that generates cross-repo ecosystem sections in CLAUDE.md files. When an agent opens repo-A, it can't read repo-B. This command pre-generates the context.
+
+```bash
+wip-repos claude              # regenerate all repos
+wip-repos claude my-repo      # regenerate one repo
+wip-repos claude --init       # create CLAUDE.md for repos missing one
+wip-repos claude --dry-run    # preview changes
+```
+
+Features:
+- Reads all repos from manifest, extracts metadata (package.json, SKILL.md, directory structure)
+- Generates `## Ecosystem` sections with delimiter comments (`<!-- wip-repos:start/end -->`)
+- Hand-written sections are never overwritten
+- Relevance filtering: only related repos shown (same category + core repos)
+- `--init` creates starter CLAUDE.md from template for repos missing one
+
+### Templates
+
+- `templates/global-claude-md.md` ... universal CLAUDE.md for ~/.claude/CLAUDE.md
+- `templates/repo-claude-md.template` ... per-repo starter with ecosystem placeholder
+
+## Why
+
+Agents lose context across repos. They can't read sibling repos at runtime. Pre-generating cross-repo maps into CLAUDE.md solves this without requiring runtime access.
+
+## Issues closed
+
+- #212 (partial: Phases 1-3 of 6)
+
+## How to verify
+
+```bash
+wip-repos claude --dry-run
+```

package/.worktrees/toolbox--release-notes/_trash/RELEASE-NOTES-v1-9-48.md

@@ -0,0 +1,22 @@
+# Release Notes: wip-ai-devops-toolbox v1.9.48
+
+**Document wip-repos claude command in SKILL.md and TECHNICAL.md.**
+
+## What changed
+
+- SKILL.md: added `wip-repos claude` commands to the wip-repos section
+- TECHNICAL.md: full documentation of how the ecosystem generator works, template locations, delimiter convention
+
+## Why
+
+v1.9.47 shipped the `wip-repos claude` command without updating technical docs. Now documented.
+
+## Issues closed
+
+- #212 (docs portion)
+
+## How to verify
+
+```bash
+grep "wip-repos claude" SKILL.md TECHNICAL.md
+```

package/.worktrees/toolbox--release-notes/_trash/RELEASE-NOTES-v1-9-49.md

@@ -0,0 +1,31 @@
+# Release Notes: wip-ai-devops-toolbox v1.9.49
+
+**TECHNICAL.md audit: 2 weeks of undocumented features now documented.**
+
+## What changed
+
+Full TECHNICAL.md audit covering v1.9.15 through v1.9.48. Two passes. Key additions:
+
+- **wip-release quality gates:** Technical docs gate, interface coverage gate, product docs auto-sync, all skip flags documented.
+- **deploy-public.sh:** Full 8-step pipeline including GitHub Packages publishing, repo URL rewrite, co-author sync.
+- **wip-license-guard:** Now documented as both CLI and Claude Code PreToolUse hook (guard.mjs). Enforcement details.
+- **wip-branch-guard:** Worktree requirement on branches, non-repo file passthrough, workflow teaching messages.
+- **wip-repos claude:** Cross-repo CLAUDE.md ecosystem generator fully documented.
+- **Source code table:** Missing files added (guard.mjs, claude.mjs, mcp-server.mjs).
+- **Log paths:** Fixed stale /tmp/ references to ~/.ldm/logs/.
+
+## Why
+
+15 releases shipped without TECHNICAL.md updates. Agents reading the docs were missing critical features: release gates, license enforcement hooks, deploy pipeline details.
+
+## Issues closed
+
+- #218
+
+## How to verify
+
+```bash
+grep "Interface coverage" TECHNICAL.md    # new gate
+grep "guard.mjs" TECHNICAL.md             # license-guard hook
+grep "GitHub Packages" TECHNICAL.md       # deploy pipeline
+```

package/.worktrees/toolbox--release-notes/_trash/RELEASE-NOTES-v1-9-50.md

@@ -0,0 +1,24 @@
+# Release Notes: wip-ai-devops-toolbox v1.9.50
+
+**wip-release: require product update doc on every release.**
+
+## What changed
+
+New quality gate in wip-release: checks that `ai/dev-updates/product-update/*-product-update.md` was modified since the last release tag. Same pattern as dev-updates, roadmap, and readme-first checks.
+
+The product update doc is a human-readable test guide. Each release entry has: what changed, how it's supposed to work, and how to test. New entries go at the top. Additive only.
+
+## Why
+
+Three repos now have product update docs but nothing enforced keeping them current. Without the gate, the docs will drift immediately (same problem we had with TECHNICAL.md).
+
+## Issues closed
+
+- #220
+
+## How to verify
+
+```bash
+wip-release patch --dry-run
+# Should warn if product update doc not modified since last release
+```

package/.worktrees/toolbox--release-notes/_trash/RELEASE-NOTES-v1-9-51.md

@@ -0,0 +1,11 @@
+# Release Notes: wip-ai-devops-toolbox v1.9.51
+
+## Branch Guard: Workspace Files Allowlist (#185)
+
+Added TOOLS.md, MEMORY.md, IDENTITY.md, SOUL.md, WHERE-TO-WRITE.md, HEARTBEAT.md to the shared state allowlist. Both agents can now write to workspace files on main without being blocked.
+
+Previously only SHARED-CONTEXT.md was allowed. This broke Lesa's ability to edit her own workspace files during the migration to ~/wipcomputerinc/.
+
+## TECHNICAL.md: Backup Documentation
+
+Updated LDM Dev Tools.app backup section to reflect the unified backup system. backup.sh now calls `~/.ldm/bin/ldm-backup.sh` (deployed by ldm install from wip-ldm-os-private/scripts/).

package/.worktrees/toolbox--release-notes/_trash/RELEASE-NOTES-v1-9-52.md

@@ -0,0 +1,25 @@
+# Release Notes: wip-ai-devops-toolbox v1.9.52
+
+**Fix branch guard false-blocking bash commands targeting worktree paths**
+
+## What changed
+
+- Branch guard now extracts absolute paths from any bash command (mkdir, cp, mv, touch, etc.) and resolves the git branch from the target path's repo, not the CWD
+- `findRepoRoot()` improved to walk up to existing directories for paths that don't exist yet (handles mkdir for new directories)
+- Added `.ldm/worktrees` to allowed worktree locations alongside `_worktrees/` and `.claude/worktrees`
+
+## Why
+
+When Claude Code launches from `~/wipcomputerinc/` (on main) and runs bash commands targeting files inside a worktree (e.g., `mkdir -p /path/to/_worktrees/repo--branch/new-dir/`), the guard only knew how to extract paths from `cd` and `git -C` patterns. Any other command fell back to CWD resolution, saw "main", and blocked incorrectly. This caused minutes of wasted time every session.
+
+## Issues closed
+
+- wipcomputer/wip-ldm-os#187
+
+## How to verify
+
+```bash
+# From CWD on main, this should no longer be blocked:
+# mkdir -p /path/to/_worktrees/repo--branch/new-directory/
+# cp file.txt /path/to/_worktrees/repo--branch/
+```

package/.worktrees/toolbox--release-notes/_trash/RELEASE-NOTES-v1-9-53.md

@@ -0,0 +1,22 @@
+# Release Notes: wip-ai-devops-toolbox v1.9.53
+
+**One-line summary of what this release does**
+
+Tell the story. What was broken or missing? What did we build? Why does the user care?
+Write at least one real paragraph of prose. Not just bullets. The release notes gate
+will block if there is no narrative. Bullets are fine for details, but the story comes first.
+
+## The story
+
+(Write a paragraph here. What was the problem? What does this release fix? Why does it matter?
+This is what users read. Make it worth reading.)
+
+## Issues closed
+
+- #282
+
+## How to verify
+
+```bash
+# Commands to test the changes
+```

package/.worktrees/toolbox--release-notes/_trash/RELEASE-NOTES-v1-9-54.md

@@ -0,0 +1,13 @@
+# Release Notes: wip-ai-devops-toolbox v1.9.54
+
+Force redeploy: guard files were stale after v1.9.53.
+
+## The story
+
+v1.9.53 published the .worktrees guard fix to npm but ldm install saw the version as current and skipped redeploying the files. The deployed guard.mjs was still the old version. This release forces a version bump so the installer re-deploys.
+
+This is a bug in the installer: it checks version numbers but not file contents. Filed for future fix.
+
+## Issues closed
+
+- #240 (partial: .worktrees convention)

package/.worktrees/toolbox--release-notes/_trash/RELEASE-NOTES-v1-9-55.md

@@ -0,0 +1,11 @@
+# Release Notes: wip-ai-devops-toolbox v1.9.55
+
+Force redeploy: .worktrees guard fix.
+
+## The story
+
+v1.9.53 had the guard fix but deploy-public was missed. v1.9.54 force-redeployed but installer had already cached v1.9.54. This version ensures the public repo and npm are in sync so ldm install deploys the correct guard.mjs with .worktrees convention.
+
+## Issues closed
+
+- #240 (partial)

package/.worktrees/toolbox--release-notes/_trash/RELEASE-NOTES-v1-9-6.md

@@ -0,0 +1,72 @@
+# v1.9.6 ... Enforcement Gates
+
+Three fixes that move the release pipeline from "suggestions agents forget" to "gates that block."
+
+---
+
+## syncSkillVersion corrupted quoted versions (#71)
+
+Every release was appending the old version instead of replacing it. SKILL.md went from `"1.9.5"` to `"1.9.5".9.4".9.3".9.2".9.1"` over five releases.
+
+Root cause: the regex `"?\S+?"?` used non-greedy matching. For quoted values, it consumed only part of the string, leaving the rest as trailing garbage.
+
+Fix: replaced with `(?:"[^\n]*|\S+)`. Quoted values now match through end of line. Unquoted values use greedy `\S+`. Also fixed the staleness-check regex to extract clean semver from corrupted strings.
+
+**Files changed:**
+- `tools/wip-release/core.mjs` ... `syncSkillVersion()` regex fix
+- `SKILL.md` ... repaired corrupted version back to `"1.9.5"`
+
+---
+
+## gh pr merge now always deletes branch (#74)
+
+Every `gh pr merge` call in the codebase now includes `--delete-branch`. Previously, deploy-public.sh had a manual 3-line `gh api -X DELETE` cleanup block. That's gone. The flag handles it.
+
+Also verified every merge uses `--merge` (never squash). Dev Guide updated with the new convention.
+
+**Files changed:**
+- `scripts/deploy-public.sh` ... added `--delete-branch`, removed manual cleanup
+- `tools/deploy-public/deploy-public.sh` ... same
+- `DEV-GUIDE-GENERAL-PUBLIC.md` ... updated merge examples
+- `ai/DEV-GUIDE-FOR-WIP-ONLY-PRIVATE.md` ... updated merge rules
+- `ai/_trash/DEV-GUIDE-private.md` ... updated
+- `ai/_sort/_trash/ai_old/_trash/DEV-GUIDE-private.md` ... updated
+
+---
+
+## wip-release blocks on stale remote branches (#75)
+
+New gate in the release pipeline. Before releasing, wip-release checks for remote branches that are fully merged into main but haven't been cleaned up.
+
+- **Patch:** warns with the list of stale branches (non-blocking)
+- **Minor/major:** blocks the release. Clean up first.
+- **`--skip-stale-check`:** override flag for emergencies
+
+Follows the existing gate pattern: fetches with `--prune`, filters out `origin/main`, `origin/HEAD`, and `--merged-` branches. Fails gracefully if git commands error.
+
+**Files changed:**
+- `tools/wip-release/core.mjs` ... `checkStaleBranches()` function, integrated as gate 0.8
+- `tools/wip-release/cli.js` ... `--skip-stale-check` flag, help text
+
+---
+
+## Diffstat
+
+```
+ 10 files changed, 102 insertions(+), 21 deletions(-)
+```
+
+## Install
+
+```bash
+npm install -g @wipcomputer/wip-ai-devops-toolbox
+```
+
+Or update an existing install:
+```bash
+wip-install wipcomputer/wip-ai-devops-toolbox
+```
+
+---
+
+Built by Parker Todd Brooks, Lēsa (OpenClaw, Claude Opus 4.6), Claude Code (Claude Opus 4.6).

package/.worktrees/toolbox--release-notes/_trash/RELEASE-NOTES-v1-9-7.md

@@ -0,0 +1,23 @@
+# Release Notes: AI DevOps Toolbox v1.9.7
+
+## LDM OS Integration
+
+AI DevOps Toolbox now works with LDM OS when it's available.
+
+### wip-install delegates to ldm install
+
+When the `ldm` CLI exists on PATH, `wip-install` delegates to `ldm install`. LDM OS handles the scaffold, interface detection, and extension deployment. The Toolbox's standalone behavior is preserved as a fallback when `ldm` isn't available.
+
+Supports `--dry-run` and `--json` passthrough to `ldm install`.
+
+### LDM OS tip
+
+After standalone installs, the Toolbox prints a tip: "Run `ldm install` to see more skills you can add."
+
+### Universal Installer link
+
+The "Read more about Universal Installer" link now points to the LDM OS docs page. The Universal Installer engine moved to LDM OS. The Toolbox keeps `wip-install` as an entry point that delegates.
+
+### Part of LDM OS
+
+README includes a "Part of LDM OS" section linking back to the LDM OS repo.