agentic-sdlc-wizard 1.46.1 → 1.48.0

package/.claude-plugin/marketplace.json

@@ -13,7 +13,7 @@
       "name": "sdlc-wizard",
       "source": ".",
       "description": "SDLC enforcement for AI agents — TDD, planning, self-review, CI shepherd",
-      "version": "1.46.1",
+      "version": "1.48.0",
       "author": {
         "name": "Stefan Ayala"
       },

package/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "sdlc-wizard",
-  "version": "1.46.1",
+  "version": "1.48.0",
   "description": "SDLC enforcement for AI agents — TDD, planning, self-review, CI shepherd",
   "author": {
     "name": "Stefan Ayala",

package/CHANGELOG.md

@@ -4,6 +4,46 @@ All notable changes to the SDLC Wizard.
 
 > **Note:** This changelog is for humans to read. Don't manually apply these changes - just run the wizard ("Check for SDLC wizard updates") and it handles everything automatically.
 
+## [1.48.0] - 2026-04-27
+
+### Changed
+
+- **SKILL.md trim — token bloat audit phase 2 follow-up.** PR #272's new `scripts/audit-session-load.sh` flagged 2 of 4 SKILL.md files as TRIM candidates (>=5000 tokens each — `skills/sdlc/SKILL.md` at 12,427t, `skills/update/SKILL.md` at 8,555t). Acting on the tool's findings closes the Prove-It loop: a tool that surfaces real bloat whose owner ignores it is just a louder lint warning. Both skills trimmed below threshold without losing operational content:
+  - `skills/sdlc/SKILL.md`: 12,427 → 4,995 tokens (-60%, 49,709 → 19,983 chars). Compressed prose, removed ASCII-art decoration boxes (kept the **bold sentences** they contained), tightened cross-model review section while preserving every Codex command, sandbox note, dialogue-loop template, and convergence rule. TodoWrite checklist intact (all 30 items, with `activeForm` removed since the spinner falls back to `subject` when omitted).
+  - `skills/update/SKILL.md`: 8,555 → 4,044 tokens (-53%, 34,220 → 16,179 chars). Step 1.5 CLI version detection's 30-line Node `cmp()` helper replaced with prose describing the algorithm (split on `-`, numeric major.minor.patch, prerelease ordering — `1.40.0-beta.1 < 1.40.0`). Step 3 changelog example shortened from 20-line frozen list to a placeholder pointing at the actual fetched CHANGELOG.
+  - Test anchor preservation traced manually: every grep'd phrase across `tests/test-{doc-consistency,self-update,update-skill-step-7-7,update-skill-cli-version,memory-audit-protocol,docs-usability,cli,prove-it,hooks}.sh` verified to still match. 45 unit suites + 4 e2e quick-tests green.
+- **New quality test** (`tests/test-audit-session-load.sh`): `test_wizard_own_skills_below_threshold` runs the audit on the wizard repo itself and fails if any SKILL.md flags TRIM. RED before the trim (both files flagged), GREEN after. Mutation-verifiable: bumping either file ~200 tokens flips the test red.
+- Codex round 1 CERTIFIED 10/10. No findings — Codex did its own RED/GREEN proof (stashed only the trimmed skill files to keep the new test active), verified every checklist item with shell evidence, ran the full CONTRIBUTING.md test suite, and read both files end-to-end against `git show HEAD:...` for semantic completeness.
+
+### Files
+
+- `skills/sdlc/SKILL.md` (trimmed)
+- `skills/update/SKILL.md` (trimmed)
+- `tests/test-audit-session-load.sh` (+test_wizard_own_skills_below_threshold)
+
+## [1.47.0] - 2026-04-27
+
+### Added
+
+- **Codex review progress wrapper** (closes #259). Consumer reported `codex exec` running opaquely during 1-5 minute xhigh reviews — no signal whether Codex is "still thinking" or "crashed silently". New `scripts/codex-review-with-progress.sh` backgrounds `codex exec` with the same default flags (`xhigh`, `danger-full-access`, `-o`) and emits a heartbeat to stderr every N seconds (`SDLC_CODEX_HEARTBEAT_INTERVAL`, default 10s):
+  ```
+  [codex 0m10s elapsed, 0 bytes written to .reviews/latest-review.md] still running...
+  [codex 0m20s elapsed, 1342 bytes written to .reviews/latest-review.md] still running...
+  [codex finished in 47s with rc=0]
+  ```
+  - **Signal-safe**: uses interruptible `sleep & wait` pattern (plain `sleep` blocks bash signal delivery for up to INTERVAL seconds). SIGTERM/INT/HUP propagates to the child codex within ~1s via TERM-then-KILL cleanup. No orphan codex processes after wrapper kill.
+  - **Preflight binary check**: missing/typoed `codex` binary exits 127 with a clear error before backgrounding anything.
+  - **No spurious heartbeats**: loop rechecks liveness after each sleep, so a fast-exiting codex doesn't print one final "still running..." after it has already finished.
+  - 11 quality tests (`tests/test-codex-progress-wrapper.sh`) using a stub codex binary — no real OpenAI tokens burned. Codex round 3 CERTIFIED 10/10 (rounds 1-2 surfaced subprocess management bugs: missing trap cleanup, sleep blocking signal delivery, missing-binary not exiting 127 — all fixed with regression tests).
+- `skills/sdlc/SKILL.md` Step 2 documents the wrapper as the recommended invocation for long reviews, alongside the bare `codex exec` form.
+
+### Files
+
+- `scripts/codex-review-with-progress.sh` (new, ~80 lines)
+- `tests/test-codex-progress-wrapper.sh` (new, 11 tests)
+- `.github/workflows/ci.yml` — wires the new test step
+- `skills/sdlc/SKILL.md` — Step 2 documents the wrapper
+
 ## [1.46.1] - 2026-04-27
 
 ### Fixed

package/CLAUDE_CODE_SDLC_WIZARD.md

@@ -2967,7 +2967,7 @@ If deployment fails or post-deploy verification catches issues:
 
 **SDLC.md:**
 ```markdown
-<!-- SDLC Wizard Version: 1.46.1 -->
+<!-- SDLC Wizard Version: 1.48.0 -->
 <!-- Setup Date: [DATE] -->
 <!-- Completed Steps: step-0.1, step-0.2, step-0.4, step-1, step-2, step-3, step-4, step-5, step-6, step-7, step-8, step-9 -->
 <!-- Git Workflow: [PRs or Solo] -->
@@ -4032,7 +4032,7 @@ Walk through updates? (y/n)
 Store wizard state in `SDLC.md` as metadata comments (invisible to readers, parseable by Claude):
 
 ```markdown
-<!-- SDLC Wizard Version: 1.46.1 -->
+<!-- SDLC Wizard Version: 1.48.0 -->
 <!-- Setup Date: 2026-01-24 -->
 <!-- Completed Steps: step-0.1, step-0.2, step-1, step-2, step-3, step-4, step-5, step-6, step-7, step-8, step-9 -->
 <!-- Git Workflow: PRs -->

package/README.md

@@ -45,7 +45,7 @@ npm install -g agentic-sdlc-wizard
 sdlc-wizard init
 ```
 
-**Manual:** Download `CLAUDE_CODE_SDLC_WIZARD.md` to your project and tell Claude `Run the SDLC wizard setup`.
+**Manual (advanced — escape hatch only):** Download `CLAUDE_CODE_SDLC_WIZARD.md` to your project and tell Claude `Run the SDLC wizard setup`. This skips the live-session auto-invoke and is only intended for environments where `npx`, `curl`, `brew`, and `gh` are all unavailable. The default human path is `npx init` → restart CC → first-prompt auto-setup, not this manual flow.
 </details>
 
 <details>

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "agentic-sdlc-wizard",
-  "version": "1.46.1",
+  "version": "1.48.0",
   "description": "SDLC enforcement for Claude Code — hooks, skills, and wizard setup in one command",
   "bin": {
     "sdlc-wizard": "cli/bin/sdlc-wizard.js"