arcane-cli 0.33.6 → 0.33.7

package/dist/assets/.arcane/governance/universal-agent-rules.md

@@ -19,7 +19,7 @@ See also: [[README]], [[DECISIONS]], [[governance/git-conventions|Git Convention
 
 2. **No root commands without justification. Enforcement: explicitly advisory prose (ARC-023) — depends on judgment about what justifies root scope; no script inspects generated commands for root usage before they run.** Do not generate or suggest commands that run as root unless explicitly scoped and justified. The agent runtime should run as a dedicated non-root user by design. See [[security/hardening-checklist|Hardening Checklist]].
 
-3. **No secrets on the command line. Enforcement: explicitly advisory prose (ARC-023) — no secret-scanner exists in this repo yet (tracked as future work, BC-30), so no mechanical check catches a violation.** Never pass API keys, tokens, or secrets on the command line, in chat, or in config files. Use SecretRef (env vars) and `read -s` for interactive input.
+3. **No secrets on the command line. Enforcement: explicitly advisory prose (ARC-023) for the command-line/chat case this rule is really about — a secret only ever typed there, never written to a file, is invisible to any file scanner by construction, so no mechanical check catches that. The narrower config-file case is stronger: BC-30 shipped a repo-wide credential-pattern scan (`src/modules/secrets-scan.ts`, executable check) enforced at both pre-commit (`doctor:leaks`) and CI, catching a secret that lands in any committed file. (Corrected 2026-09-02, LH-08 — this previously claimed no scanner existed at all, which stopped being true once BC-30 shipped.)** Never pass API keys, tokens, or secrets on the command line, in chat, or in config files. Use SecretRef (env vars) and `read -s` for interactive input.
 
 4. **This is a production system. Enforcement: explicitly advisory prose (ARC-023) — the no-shortcuts and rollback-plan requirements depend on engineering judgment; no check evaluates whether a rollback plan exists.** No "fix it later" shortcuts. No experimental changes without rollback plans.
 

package/dist/assets/.github/prompts/spell-check-drift.prompt.md

@@ -46,6 +46,7 @@ Concrete detectors to run (in addition to general contradiction/stale-date check
 - **Journal chronology** — journal entries and their dates must be in sane order. Flag out-of-order entries, duplicate session numbers, and any future or otherwise contradictory dates.
 - **Done vs. carry-forward consistency** — items marked done must not still appear as open or carry-forward items, and items listed as open/carry-forward must not also be marked done elsewhere.
 - **Decision-ID existence** — decision IDs referenced in TODO, journal, or other docs must exist in `DECISIONS.md`, and the IDs in the decisions log must be sequential and unique (no gaps that imply a missing entry, no duplicates).
+- **Shipped-state staleness** (LH-08; only when this repo has its own `scripts/check-stale-claims.ts` — Arcane's own repo, or one that adopted the same convention; skip gracefully otherwise) — run `npm run check:stale-claims -- --report` and triage its Class B output (occurrences of "not yet built"/"not yet supported"/"tracked as future work" and similar phrases in shipped or living content): each hit is a prompt to verify the claim against the real tree, not proof of staleness by itself. Class A (`ARC-NNN (Status)` claims vs. `DECISIONS.md`) is already a separate, mechanically-enforced CI gate — do not re-litigate its findings here, only Class B needs this judgment pass.
 - **Canonical vs. installed-copy parity** — for every managed root file that has a canonical counterpart under `src/assets/`, compare bytes first. If bytes differ, normalize `CRLF` and lone `CR` to `LF` in both files and compare again:
   - If normalized content differs, report **real content drift** with normal severity grading.
   - If normalized content matches, report **line-ending-only drift** separately. Do not count these paths as real content findings and do not include them in severity totals or the Go / No-Go decision.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "arcane-cli",
-  "version": "0.33.6",
+  "version": "0.33.7",
   "description": "Arcane framework CLI — scaffold and manage governance files in consuming repositories",
   "keywords": [
     "arcane",
@@ -47,6 +47,7 @@
     "check:adr-references": "tsx scripts/check-distributed-adr-references.ts",
     "check:version-bump": "tsx scripts/check-version-bump.ts",
     "check:citations": "tsx scripts/check-citations.ts --report",
+    "check:stale-claims": "tsx scripts/check-stale-claims.ts --check",
     "check:review-round": "tsx scripts/check-review-round.ts",
     "doctor:leaks": "tsx src/index.ts doctor --leaks",
     "prepare": "husky"