ai-rulez 5.7.0 → 5.9.0

package/README.md

@@ -83,6 +83,7 @@ The table covers the implemented capabilities. The [CLI reference](docs/cli-refe
 | Skill search | Rank skills lexically, by vectors or with hybrid embeddings, maintain the index, evaluate ranking and mine queries from usage. | `search`, `search index/status/mine`, `search --eval` | [Search](docs/search.md) |
 | Catalog and inventory | Inspect item metadata, owners, roles, dependencies and lock status; join eval/usage results, compare catalogs and build a static catalog website. | `catalog`, `catalog diff`, `catalog --html` | [Catalog](docs/catalog.md) |
 | Token and context budgets | Report generated prompt tokens, compare profiles and roles, identify costly content and gate always-loaded or on-demand budgets. | `tokens`, `cost`, `--budget`, `--on-demand-budget` | [Token reports](docs/cli.md#tokens-command), [Cost reports](docs/cli.md#cost-command) |
+| Session exposure and areas | Show what a Claude Code session loads at its start and what that costs, map repository areas to owners and terms, and flag area terms leaking into start-of-session text, overlapping skill listings and unreadable gates (`AR9W0`-`AR9W6`). | `exposure`, `exposure inventory/areas/collisions/leakage`, `[exposure]` | [Session exposure](docs/exposure.md) |
 | Usage and item-load telemetry | Opt into identifier-only skill invocation, feedback and item-load records; report usage and optionally export item-load telemetry through OTLP. | `telemetry record/report/feedback/enable/export` | [Usage telemetry](docs/usage-telemetry.md), [Item loads and OTLP](docs/telemetry.md) |
 | Shared model access | Route model calls through liter-llm, including AWS Bedrock credential refresh and OpenAI-compatible gateways, with network consent, budgets, authenticated caching and redacted diagnostics. | `[llm]`, `llm doctor`, `llm estimate` | [LLM access](docs/llm.md) |
 | Automation and embedding | Use the composite GitHub Action, pre-commit/prek, Poly or Lefthook; call the experimental Go API to load, validate, plan/apply generation and manage locks. Shell completion and JSON schemas support other integrations. | [Action](action.yml), `init --setup-hooks`, `completion`, `pkg/airulez` | [Git hooks](#git-hooks), [GitHub Actions](#github-actions), [Go API](docs/embedding.md), [Schemas](docs/schema.md) |
@@ -389,6 +390,7 @@ An organization [policy](docs/policy.md) sets tighten-only floors a repository c
   `CLAUDE.md` files that apply to each unit, nested `.claude/` directories at any depth. `ai-rulez judge --estimate`, then
   `--allow-llm` to send; `--changed=origin/main` for a pull request, `--format sarif` for code scanning. See [judge](docs/judge.md).
 - **Cost and inventory.** `tokens`, `cost`, `catalog` and `search` report what the configuration contains and costs.
+- **Session exposure.** `exposure` reports what a Claude Code session loads at its start and gates it with `[exposure] start_budget`; with an `[exposure]` area map, `exposure leakage` and `exposure collisions` find area terms in start-of-session text and overlapping skill listings. See [Session exposure](docs/exposure.md).
 
 Existing project on 4.x? Run `ai-rulez migrate v5 --dry-run`, then see [Migrating to v5](docs/migration-v5.md).
 
@@ -409,7 +411,7 @@ Add to `.pre-commit-config.yaml`:
 ```yaml
 repos:
   - repo: https://github.com/Goldziher/ai-rulez
-    rev: v5.7.0
+    rev: v5.9.0
     hooks:
       - id: ai-rulez-recursive   # generate: write outputs for every nested .ai-rulez/ root
       - id: ai-rulez-validate    # validate --recursive: content, security and link checks
@@ -440,7 +442,7 @@ repository needs:
 [[hooks.sources]]
 id = "ai-rulez"
 git = "https://github.com/Goldziher/ai-rulez.git"
-revision = "v5.7.0"
+revision = "v5.9.0"
 hooks = ["ai-rulez-recursive", "ai-rulez-plugin-verify"]
 ```
 
@@ -493,14 +495,16 @@ the release's `checksums.txt`, caches it (keyed by OS, arch and the resolved ver
 toolchain, Node or Python needed in the job. It reuses the same `scripts/pre-commit/run-ai-rulez.sh`
 download-and-verify logic the pre-commit hooks above use, so the two stay in sync.
 
-Use `Goldziher/ai-rulez@v5` for compatible action updates: publishing a stable v5 release advances
-this floating tag after all distribution jobs succeed. Pin a full release tag or commit SHA to fix
-the action code. The action ref and installed CLI version are independent: set `version` as well
-to pin the binary; its default `latest` can eventually select a newer major release.
+Use `Goldziher/ai-rulez@v5` for compatible action updates: publishing a stable v5 release moves
+this annotated floating tag after all distribution jobs succeed. `uses: Goldziher/ai-rulez@v5` with
+`version: latest` keeps a workflow on the newest 5.x action and the newest released CLI with no
+per-release edits. Pin a full release tag or commit SHA to fix the action code. The action ref and
+installed CLI version are independent: set `version` as well to pin the binary; its default
+`latest` can eventually select a newer major release.
 
 | | |
 | --- | --- |
-| **Input** `version` | `X.Y.Z`, `vX.Y.Z`, or `latest` (default). Optional — omit it to always use the newest release. |
+| **Input** `version` | `X.Y.Z`, `vX.Y.Z`, `X.Y.Z-rc.N` or `latest` (default: the newest stable GitHub release). Optional — omit it to always use the newest release. |
 | **Inputs** `llm-*` | Optional provider, model, gateway, credential variable name, network opt-in, budgets and other LLM settings exported to later steps. [Full reference](docs/github-actions.md#llm-configuration-inputs). |
 | **Output** `version` | The resolved version, without the leading `v`. |
 | **Output** `path` | Absolute path to the installed `ai-rulez` binary. |
@@ -521,7 +525,7 @@ jobs:
       - uses: actions/checkout@v7
       - uses: Goldziher/ai-rulez@v5
         with:
-          version: 5.7.0   # pin the CLI independently of the floating action ref
+          version: 5.9.0   # pin the CLI independently of the floating action ref
       - run: ai-rulez generate --check   # the committed output matches the sources
       - run: ai-rulez validate --strict  # content and security checks, warnings fail
       - run: ai-rulez lock --check        # pins were updated when the sources were
@@ -529,6 +533,15 @@ jobs:
 
 </details>
 
+`uses: Goldziher/ai-rulez/check@v5` installs the CLI the same way and runs the whole governance gate per
+configuration root: `migrate okf --check`, `validate --strict --no-local`, `lock --check`, `generate` then
+`generate --check`, optionally `verify --plugin` and `tokens --budget`, then a clean `git diff HEAD` with no new
+untracked files. `expected-config-count` fails a run that finds a different number of roots, and a job summary lists
+every command. See [the check sub-action](docs/github-actions.md#governance-gate-check).
+`uses: Goldziher/ai-rulez/update@v5` on a schedule runs `ai-rulez update` when `lock --outdated` reports an allowed
+update, regenerates, re-pins the content and opens a pull request with the outdated table (or pushes directly with
+`direct: true`). See [scheduled pin updates](docs/github-actions.md#scheduled-pin-updates-update).
+
 For model-backed reviews, configure `llm-model`, `llm-allow-network: 'true'` and spend limits,
 pass provider credentials through `env:` on the command step or job, and run `ai-rulez judge
 --allow-llm`. Installation itself makes no model requests. See the [action guide](docs/github-actions.md)

package/THIRD_PARTY_NOTICES.md

@@ -47,9 +47,6 @@ after it, and describe the changes on the second line.
 // See THIRD_PARTY_NOTICES.md.
 ```
 
-`scripts/transcode-skillspector-tests.py` writes this header for the tables it generates; the output is a fragment to
-merge into a file that already carries the header once.
-
 ## Neo23x0 signature-base
 
 SkillSpector's YARA rules state that they are based on [Neo23x0/signature-base](https://github.com/Neo23x0/signature-base),

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "ai-rulez",
-  "version": "5.7.0",
+  "version": "5.9.0",
   "description": "Author, generate, validate and govern AI agent rules, skills, plugins and MCP configuration across 52 coding assistants. Review with verified model evidence, evaluate skills, lock and sign dependencies, and publish bundles. CLI, MCP server and Go API.",
   "keywords": [
     "agent-plugins",