claudemd-cli 0.53.0 → 0.55.0

package/CHANGELOG.md

@@ -8,6 +8,29 @@ All notable changes to the `claudemd` plugin. This changelog tracks plugin artif
 - **Canonical spec version source**: `spec/CLAUDE.md` top-line title (`# AI-CODING-SPEC vX.Y.Z — Core`) + `spec/CLAUDE-changelog.md` top `##` entry.
 - **Plugin semver vs spec semver** are independent: plugin patch (0.2.0 → 0.2.1) may ship when spec is unchanged (this release); plugin minor (0.1.9 → 0.2.0) ships when spec minor updates (v0.2.0 shipped spec v6.10.0).
 
+## [0.55.0] - 2026-07-25
+
+Ships spec **v6.21.2** (patch) plus two hermeticity/observability fixes surfaced by the 2026-07-25 spec audit ("按建议执行" pass over the audit's P0-P3).
+
+**What changes for users**: SessionStart now banners when Claude Code is loading hooks from an older build than the marketplace cache holds — the exact drift that let two releases (0.53.0, 0.54.0) run unnoticed on a stale 0.52.0 install; `scripts/perf-baseline.sh` can no longer commit into your repo or write live telemetry.
+
+- **feat(session-start): stale-registration banner (`stale_cache_check`).** `upstream_check` compares the cache max against the REMOTE tag, so after a release + local marketplace update (cache == remote) it stays silent even though the registered root is older — reproduced 2026-07-25: hooks running v0.52.0 while cache and remote both held v0.54.0, zero banners for two releases; only `doctor`'s on-demand `plugin cache:staleness` check saw it. The new check compares the running root against the local cache max — no network, no 24h sentinel, repeats every SessionStart until `/claudemd-refresh` re-registers. Skips the redundant remote probe when it fires. Telemetry reuses the registered `stale-root` event with `{hook_version, cache_max_version}` extra (no new event name). Shared `semver_cache_max()` helper replaces the inline glob in `upstream_check` (one source for the cache scan). Tests: `session-start.test.sh` cases 23-24 — case 23 RED pre-fix (hook emitted nothing on a newer cache), 24/24 post-fix.
+- **fix(perf-baseline): probes run in a throwaway repo + telemetry off.** The `git commit --allow-empty -m 'noop'` probe executed in the CALLER's cwd — 48 stray `noop` commits landed on this repo's main on 2026-07-17 (all stamped 15:14:04-05) and were pushed with the next release. All probe commands now execute inside a `mktemp -d` sandbox repo (trap-cleaned, spec §8.V3), and the script exports `DISABLE_RULE_HITS_LOG=1` so its synthetic hook invocations stop polluting live telemetry (`feedback_manual_hook_probe_pollutes_telemetry`). New regression gate `tests/integration/perf-baseline-hermetic.test.sh`: RED pre-fix (caller repo commits 1 → 3 at `--runs 1`), 3/3 post-fix.
+- **change(spec v6.21.2): §EXT §10-V compressed to OK-shapes + pointers** — rationale and demote-evaluation record in `spec/CLAUDE-changelog.md`. `banned-vocab-canonical.json` updated in step (pattern rows kept as in_spec=false, ten spec-only rows retired); `hooks/banned-vocab.patterns` untouched — mechanical enforcement byte-identical.
+
+## [0.54.0] - 2026-07-24
+
+Ships spec **v6.21.1** (patch) plus the detector repairs and closures that the same labeling pass produced. Two detectors changed behavior; six stopped presenting themselves as pending calibration work.
+
+**What changes for users**: `/claudemd-sampling-audit` stops counting file paths as banned vocabulary, stops counting "继续" as a §11 violation when the agent had just asked a question, and now reports six of its eight detectors as `closed` with a stated reason instead of a permanent `collecting`. Nothing blocks that did not block before — every one of these detectors is retrospective and advisory.
+
+- **fix(§10-V): `scanVocab` sanitizes identifier/path spans, restoring parity with the hook it mirrors.** `hooks/transcript-vocab-scan.sh` has stripped fenced blocks / backtick spans / slashed paths / bare `name.ext` since v0.23.19 (its lines 92-94); `scripts/sampling-audit.js` did not, so `\bcomprehensive\b` fired inside `docs/comprehensive-audit-….md`. That single class was 7 of the 8 §10-V hits in the 30d self-stratum and 51 more in the external stratum. Labeled precision on the flagged set was 0/8. **The header claimed fixtures pinned the node scanner and the bash hooks to the same counts — no test ever ran the hook**, which is why the drift survived. Closed by the join test below, not by the one-line flip.
+- **test: the parity gate the header promised** (`tests/scripts/sampling-audit.test.js`) — one transcript, both engines, verdicts must match, with a control arm asserting a bare-word value claim still fires on both sides so "sanitize everything" cannot pass. Against the pre-fix code it fails with `parity broken: node=true bash=false`. New fixture `vocab-path-only.jsonl`.
+- **fix(§11-turn-yield): the tell now carries the spec's new precondition.** `yieldTellSuppressed()` suppresses the tell when the prior assistant turn asked a question, closed with a four-section report, or produced no text at all (turn cut off externally — not attributable to the agent). New fixture `turn-yield-asked.jsonl`; unit arms cover ask / closed / empty / control.
+- **change: six detectors CLOSED** (`§iron-law-2`, `§10-four-section-order`, `§10-honesty`, `§7-bugfix-anchor`, `§11-post-compaction`, `§5-hard-auth`). Each keeps running and keeps emitting counts, but reports `status: "closed"` with a `closedReason` instead of `collecting`. Grounds, jointly: opportunity denominators of 3–87 across all 151 transcripts; FP roots that need command-vs-string-data semantics (`('npm install',"ALLOW")` inside a heredoc read as a real install) or per-project plan-file naming (`PLAN_SPEC_RE` hardcodes `tasks/*.md|plan*.md`, so `docs/*优化路线图.md` counted as "never re-read the plan" in 23 of 39 windows) rather than a regex patch; and their only consumer, the §13.2 demote queue, is empty. Precision upper bounds: hard-auth ≤0.16, bugfix-anchor ≤0.25, post-compaction ≤0.41.
+- **`§10-V` and `§11-turn-yield` return to `collecting` with the series re-baselined** — both detectors changed this release, so counts before 2026-07-24 are not comparable with counts after. The A1 2026-07-10 raw-text series ends here by design.
+- **A4 gate held.** Every one of these detectors was broken and not one bad rate reached a dashboard: the pre-registered `precision ≥ 0.8` admission gate withheld all eight. The failure mode this release fixes is the instrument, not the guard.
+
 ## [0.53.0] - 2026-07-24
 
 Ships spec **v6.21.0** (minor) plus the drift test that pins it. No hook, script, or command behavior changes.

package/README.md

@@ -353,7 +353,7 @@ claudemd/
 ├── commands/                 # 16 slash-command markdown files
 ├── bin/                      # standalone CLI entrypoint (claudemd-lint.js → `npx claudemd-cli` on npmjs.org)
 ├── scripts/                  # 18 Node.js scripts + scripts/lib/ (single-source registry, lint, etc.)
-├── spec/                     # shipped v6.21.0 CLAUDE*.md trio + OPERATOR.md + hard-rules.json manifest
+├── spec/                     # shipped v6.21.2 CLAUDE*.md trio + OPERATOR.md + hard-rules.json manifest
 ├── tests/                    # hook shell tests + Node.js tests + integration + fixtures
 ├── docs/                     # ADDING-NEW-HOOK.md + RULE-HITS-SCHEMA.md + superpowers/
 └── .github/workflows/        # ci.yml (ubuntu+macOS × node 20) + npm-publish.yml (tag-triggered)

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "claudemd-cli",
-  "version": "0.53.0",
+  "version": "0.55.0",
   "description": "Standalone CLI for §10-V banned-vocab + transcript scanning. Companion to the claudemd Claude Code plugin (github.com/sdsrss/claudemd) for use in git pre-commit hooks, GitHub Actions, and other agents.",
   "type": "module",
   "bin": {