agentic-sdlc-wizard 1.84.0 → 1.85.0

package/.claude-plugin/marketplace.json

@@ -13,7 +13,7 @@
       "name": "sdlc-wizard",
       "source": ".",
       "description": "SDLC enforcement for AI agents — TDD, planning, self-review, CI shepherd",
-      "version": "1.84.0",
+      "version": "1.85.0",
       "author": {
         "name": "Stefan Ayala"
       },

package/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "sdlc-wizard",
-  "version": "1.84.0",
+  "version": "1.85.0",
   "description": "SDLC enforcement for AI agents — TDD, planning, self-review, CI shepherd",
   "author": {
     "name": "Stefan Ayala",

package/CHANGELOG.md

@@ -4,6 +4,19 @@ All notable changes to the SDLC Wizard.
 
 > **Note:** This changelog is for humans to read. Don't manually apply these changes - just run the wizard ("Check for SDLC wizard updates") and it handles everything automatically.
 
+## [1.85.0] - 2026-07-05
+
+### Fixed
+- **Post-ship retrospective on v1.84.0** (independent Fable + Codex audits, both verified against primary sources before acting on them): `CLAUDE_CODE_SDLC_WIZARD.md`'s "Exception — known-large migrations" example still cited the wrong round count ("7 rounds... round 5") after the review ran to 11 rounds and round 8 turned out to be the more consequential find — corrected to the actual numbers.
+- The `### Convergence` section had no record of this release's own sharpest lesson: cross-model review and CI are different verification layers. Round-11 CERTIFIED plus a full local sweep still missed 3 real bugs (a content regression, an npm-version JSON format change, a missing executable bit) that only surfaced once the PR was actually pushed and CI ran. Added a "CERTIFIED is not the finish line" callout so this isn't relearned per-release.
+- `## CI Feedback Loop — Local Shepherd` (the portable wizard doc's version) was measurably weaker than `skills/sdlc/SKILL.md`'s own copy of the same section — missing "read CI logs even when green" (a green checkmark hides warnings/skipped steps/degraded scores — see v1.24.0), missing the cross-model CI-log-audit step, missing explicit "NEVER AUTO-MERGE" language (PR #145 evidence). Synced to match.
+- `Release Review Focus` had no "Policy Migration Inventory" checklist item, despite the wizard doc itself documenting (in `SDLC.md`'s Lessons Learned) that exactly this gap is what turned v1.84.0's migration into an 11-round review instead of ~4-5. Added, with v1.84.0 as the cited evidence.
+- `ROADMAP.md` #437 (the codex-gate handoff-staleness gap, filed 2026-07-04) settled its previously-open design question: `commit_sha`-in-`handoff.json` compared against current HEAD, not a branch/files-changed heuristic — simpler, and directly answers the "how do legitimate follow-up commits not false-positive" question the original entry raised. Implementation is a separate, standalone TDD PR (not bundled with this doc-only release).
+- **Codex round 1 caught 2 more stale `1.84.0` version pointers this release's own version-bump checklist didn't cover:** `ROADMAP.md`'s "Built With SDLC Wizard" living-tracker row (this repo's own entry) and `cowork/README.md`'s "Version" section — neither matches the canonical checklist's two string patterns (`SDLC Wizard Version:` prefix or a `"version":` JSON key), since both read as plain prose. Fixed, and `SDLC.md`'s version-bump-checklist lesson updated with a broader canonical grep (`grep -rn "<previous-version>" . --include="*.md" --include="*.json"`, manually triage every hit) so the narrower two-pattern grep isn't the only check next release.
+
+### Why
+Same-session retrospective (2026-07-05) on the just-shipped v1.84.0: the user asked Fable and Codex, independently, "how well did this release follow its own `/sdlc` checklist, and what's missing from the doc itself." Both converged on real, independently-verified findings — this release fixes the doc-only subset; the hook-behavior fix (#437) and any sibling-repo (`claude-gdlc-wizard`, `claude-rdlc-wizard`, etc.) sync follow as separate, explicitly-scoped work per Fable's own recommendation to split rather than bundle.
+
 ## [1.84.0] - 2026-07-04
 
 ### Fixed

package/CLAUDE_CODE_SDLC_WIZARD.md

@@ -2503,7 +2503,9 @@ When the reviewer finds issues, respond per-finding instead of silently fixing e
 
 3 recheck rounds (4 total including initial review) is the default budget for a typical change. If still NOT CERTIFIED after round 4, escalate to the user with a summary of open findings rather than spinning indefinitely.
 
-**Exception — known-large migrations:** the round cap is a heuristic against spinning on a shrinking tail of nitpicks, not a hard stop. Judge convergence by the *trend* in finding quality, not the round number: if every round is still surfacing a genuinely new, independently-verified, real issue — especially if severity is flat or increasing (later rounds finding live-code bugs, not just prose) — keep going past round 4. Only stop when a round returns CERTIFIED, or consecutive rounds return nothing but nitpicks/false positives. (Source: v1.84.0 release review — a repo-wide model-recommendation migration ran 7 rounds, each finding something real; round 5 found a live `SessionStart` hook actively contradicting the new policy, more consequential than anything rounds 1-3 found. Escalating at round 4 per the default heuristic would have shipped that bug. 2026-07-04.)
+**Exception — known-large migrations:** the round cap is a heuristic against spinning on a shrinking tail of nitpicks, not a hard stop. Judge convergence by the *trend* in finding quality, not the round number: if every round is still surfacing a genuinely new, independently-verified, real issue — especially if severity is flat or increasing (later rounds finding live-code bugs, not just prose) — keep going past round 4. Only stop when a round returns CERTIFIED, or consecutive rounds return nothing but nitpicks/false positives. (Source: v1.84.0 release review — a repo-wide model-recommendation migration ran 11 rounds, each finding something real; round 8 found a mandatory-reading setup-wizard template whose tutorial hook code had silently drifted from the real shipped hook (broken, non-blocking), more consequential than anything in rounds 1-3. Escalating at round 4 per the default heuristic would have shipped that bug. 2026-07-04.)
+
+**CERTIFIED is not the finish line.** A CERTIFIED verdict and a green CI run are different verification layers that catch different bug classes — a CERTIFIED review does not substitute for actually pushing and watching CI. Confirmed on the same v1.84.0 release: after round-11 CERTIFIED and a full local test sweep, real CI still caught 3 more genuine bugs the review never touched — a content regression in an unrelated section silently dropped by an earlier edit (caught by a pre-existing local test that simply hadn't been re-run since), an environment-specific CLI output-format change invisible to any local run against an older tool version, and a new test file committed without the executable bit (passes every local `bash tests/foo.sh` invocation, only fails when CI runs it as `./tests/foo.sh`). Budget for at least one more fix-push-recheck cycle after CERTIFIED, and don't treat CERTIFIED as license to skip reading the actual CI logs — see the CI Feedback Loop section below.
 
 ```
 Self-review passes → handoff.json (round 1, PENDING_REVIEW)
@@ -2539,8 +2541,9 @@ Before any release/publish, add these to `review_instructions`:
 - **Stale examples** — hardcoded version strings in docs match current release
 - **Docs accuracy** — README, ARCHITECTURE.md reflect current feature set
 - **CLI-distributed file parity** — live skills, hooks, settings match CLI templates
+- **Policy Migration Inventory** — for a repo-wide blanket-recommendation migration (e.g. changing a default model, effort level, or policy referenced in many places), enumerate every surface it could touch *before* the first review round: skill frontmatter, setup/update wizard menus, live hooks, tutorial doc templates, CHANGELOG. Discovering surfaces one review round at a time is what turns a 4-5 round review into an 11-round one.
 
-Evidence: v1.20.0 cross-model review caught CHANGELOG section loss and stale wizard version examples that passed all tests and self-review.
+Evidence: v1.20.0 cross-model review caught CHANGELOG section loss and stale wizard version examples that passed all tests and self-review. v1.84.0's Sonnet-5-default migration ran 11 rounds because each round surfaced a new, previously-uninventoried surface (skill frontmatter, then setup wizard, then a live hook, then tutorial templates) rather than catching them all upfront.
 
 ### Multiple Reviewers (N-Reviewer Pipeline)
 
@@ -2663,12 +2666,12 @@ Reproduce → Isolate → Root Cause → Fix → Regression Test
 
 **This is the "local shepherd" — your CI fix mechanism.** It runs in your active session with full context.
 
-**The SDLC doesn't end at local tests.** CI must pass too.
+**The SDLC doesn't end at local tests.** CI must pass too. **NEVER AUTO-MERGE — do NOT run `gh pr merge --auto`.** Auto-merge fires before review feedback can be read; the shepherd loop below IS the process. (Evidence: PR #145 auto-merged before its review was read — a reviewer-found P1 dead-code bug shipped as a result.)
 
 ```
 Local tests pass -> Commit -> Push -> Watch CI
                                          |
-                              CI passes? -+-> YES -> Present for review
+                              CI passes? -+-> YES -> Read logs anyway -> Cross-model audit -> Present for review
                                          |
                                          +-> NO -> Fix -> Push -> Watch CI
                                                            |
@@ -2697,7 +2700,9 @@ Local tests pass -> Commit -> Push -> Watch CI
    - Diagnose root cause (same philosophy as local test failures)
    - Fix and push again
 4. Max 2 fix attempts - if still failing, ASK USER
-5. If CI passes - proceed to present final summary
+5. **Read CI logs whether pass or fail — not just on failure.** A green checkmark hides warnings, skipped steps, and degraded scores (v1.24.0 shipped a degraded E2E score and a silently excluded test suite behind a passing check). Use `gh run view <RUN_ID> --log`, not just `--log-failed`.
+6. **Cross-model audit the CI logs** — same `codex exec` pattern as the Cross-Model Review Loop above. Prompt: *"Audit for silent failures, skipped tests, degraded metrics, warnings-that-should-be-errors."* Do this even when every check is green.
+7. Only after logs are read and audited — proceed to present final summary
 
 **Context GC (compact during idle):** While waiting for CI (typically 3-5 min), suggest `/compact` if the conversation is long. Think of it like a time-based garbage collector — idle time + high memory pressure = good time to collect. Don't suggest on short conversations.
 
@@ -3070,7 +3075,7 @@ If deployment fails or post-deploy verification catches issues:
 
 **SDLC.md:**
 ```markdown
-<!-- SDLC Wizard Version: 1.84.0 -->
+<!-- SDLC Wizard Version: 1.85.0 -->
 <!-- Setup Date: [DATE] -->
 <!-- Completed Steps: step-0.1, step-0.2, step-0.4, step-1, step-2, step-3, step-4, step-5, step-6, step-7, step-8, step-9 -->
 <!-- Git Workflow: [PRs or Solo] -->

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "agentic-sdlc-wizard",
-  "version": "1.84.0",
+  "version": "1.85.0",
   "description": "SDLC enforcement for Claude Code — hooks, skills, and wizard setup in one command",
   "bin": {
     "sdlc-wizard": "cli/bin/sdlc-wizard.js"

package/skills/update/SKILL.md

@@ -95,16 +95,16 @@ Parse CHANGELOG entries between the user's installed version and the resolved la
 
 ```
 Installed: 1.42.0
-Latest:    1.84.0
+Latest:    1.85.0
 
 What changed:
+- [1.85.0] Post-ship retrospective fixes: CI Feedback Loop synced to SKILL.md's stronger version (NEVER AUTO-MERGE, read-logs-even-when-green, cross-model CI audit), CERTIFIED≠CI lesson, Policy Migration Inventory checklist, stale round-count correction (#437 hook-staleness fix follows separately).
 - [1.84.0] Hook enforcement fix: cross-model review gate + TDD RED gate now actually block (#436); model-aware effort docs replace blanket max recommendation.
 - [1.83.0] Model config batch: multi-model hook recommendation (#403), global [1m] pin detection (#391), version race fix (#405), effort config check (#384).
 - [1.82.0] Usage diagnostics: fix /usage row, Reading Usage Signals guide, advisor fallback procedure, Fable effort guidance, autocompact cross-reference.
 - [1.81.0] Native `advisorModel` support: Setup A gets Fable advisor, Setup B gets Opus advisor. Replaces manual subagent spawning. Requires CC v2.1.170+.
 - [1.80.0] Flip default: Opus 4.6 max becomes recommended flagship; Opus 4.8 demoted to opt-in `[l] Latest` tier.
 - [1.77.0] release-dry-run.yml + cc-version-drift.yml (#350) + /goal SDLC gates (95% + DLC binding).
-- [1.76.0] /goal /sdlc wrapper (#347) + CC v2.1.150 feature adoption + ROADMAP demand-signal gate (4 excise, 4 kill).
 - [1.75.1] release-workflow fix — Node 22 → 24 (ships npm 11.x), dropped flaky `npm install -g` self-upgrade (hit MODULE_NOT_FOUND on v1.75.0 publish). Explicit npm-version guard.
 - [1.75.0] npm Trusted Publishing — `release.yml` swapped from `NPM_TOKEN` to OIDC. No more token rotation. Requires one-time publisher config on the npm package page.
 - [1.74.0] v1.43 salvage: #338 precedence preamble; #235ab `/insights`; codex `< /dev/null` stdin-hang fix; test env-isolation.