crewforth 3.2.0-rc.9 → 3.2.0

package/CHANGELOG.md

@@ -5,7 +5,7 @@ Crewforth was named Claude Starter Kit until 3.0.0.
 Notable changes to this project are recorded here. Format follows [Keep a Changelog](https://keepachangelog.com/en/),
 versioning follows [SemVer](https://semver.org/).
 
-## [Unreleased] — 3.2.0
+## [3.2.0] — 2026-10-21
 
 ### Added
 
@@ -233,6 +233,16 @@ versioning follows [SemVer](https://semver.org/).
 - **`change: review` is read as `audit`.** The model table of the working rules names review with audit, and
   `crew-review-agent` cards that said `change: review` were refused. It now takes the audit floor, on a critical path
   too; a kind that is not on the list is still refused.
+- **An install or an update never loosens the trace gate by itself.** The installer suggested exempting
+  the co-author trailer whenever the last 80 commits carried one, and with no terminal to ask in it took its own
+  suggestion: an update wrote the line into `.trace-allowlist.txt` and staged it, undoing a removal the team had
+  committed. The suggestion is now always to keep the gate, and the exemption is written only when you type
+  `loosen` in the interactive review.
+- **A commit refusal names a trace in the message even when the staged content also fails.** The content gate
+  scanned the `-m` message only when the staged change was clean, so a refusal for a silenced lint check said nothing about
+  the session-link trailer in the same message, and the session showed the user the traced message again. Both are
+  named in one refusal now, and a trace in the message adds that a harness reminder to end a message with a
+  trailer does not override §4.1. The git `commit-msg` hook still stops the trailer at the commit itself.
 - **A one-line task card may open with `Kart`.** Sessions that write in Turkish lead the card with `Kart —` as
   others write `Card —`, and the call was refused as having no card. The Turkish word is read like the English one;
   the fields after it are held to the same rules.

package/VERSION

@@ -1 +1 @@
-3.2.0-rc.9
+3.2.0

package/adopt.sh

@@ -199,8 +199,7 @@ _mt() {   # $1 = English text (the key); further args fill %s; result in _M
       "project wins (fixed)") s='proje önde (sabit)' ;;
       "on conflict the project's rules win; in DISCIPLINE.md §4 they can only tighten, never loosen (the one exception: the §4.1 trace allowlist you choose at adoption); Crewforth fills gaps (not overridable)") s="çakışmada projenin kuralı geçerli; DISCIPLINE.md §4'te proje yalnız sıkılaştırabilir, gevşetemez (tek istisna: kurulumda sizin seçtiğiniz §4.1 iz izin listesi); Crewforth boşlukları doldurur (değiştirilemez)" ;;
       "3 Trace gate") s='3 İz kapısı' ;;
-      "loosen (.trace-allowlist)") s='gevşet (.trace-allowlist)' ;;
-      "co-author/sign-off present in git log — may be a convention") s='git geçmişinde co-author/sign-off var — ekibin alışkanlığı olabilir' ;;
+      "co-author/sign-off present in git log — type loosen in the review to exempt it; never assumed") s='git geçmişinde co-author/sign-off var — muaf tutmak için incelemede loosen yazın; kendiliğinden yapılmaz' ;;
       "keep") s='koru' ;;
       "no co-author/sign-off convention seen") s='co-author/sign-off alışkanlığı görülmedi' ;;
       "4 Share/hide") s='4 Paylaş/gizle' ;;
@@ -789,7 +788,7 @@ else
 fi
 propm '2 Precedence' 'project wins (fixed)' "on conflict the project's rules win; in DISCIPLINE.md §4 they can only tighten, never loosen (the one exception: the §4.1 trace allowlist you choose at adoption); Crewforth fills gaps (not overridable)"
 if [ "$COAUTHOR" = 1 ]; then
-  propm '3 Trace gate' 'loosen (.trace-allowlist)' 'co-author/sign-off present in git log — may be a convention'
+  propm '3 Trace gate' 'keep' 'co-author/sign-off present in git log — type loosen in the review to exempt it; never assumed'
 else
   propm '3 Trace gate' 'keep' 'no co-author/sign-off convention seen'
 fi
@@ -817,7 +816,12 @@ fi
 # ============ COMPILE DECISIONS + OVERRIDE (Stage B) ============
 DEC1="$([ "$N_PAGENTS" != 0 ] && echo keep || echo none)"
 DEC2="project"   # precedence is FIXED to project-wins (not overridable — reflected in the @import comment)
-DEC3="$([ "$COAUTHOR" = 1 ] && echo loosen || echo keep)"
+# The trace gate is loosened only when a person types `loosen` in the review below. Never a default: old co-author
+# lines in the history are not a decision, and an install that cannot ask (no terminal) or an update has no person
+# to make one. Measured on a real project, 2026-10-21: a non-interactive update found five old trailers in the last
+# 80 commits, wrote the co-author trailer into .trace-allowlist.txt and staged it, undoing a removal the team had
+# committed.
+DEC3=keep
 DEC4="$([ "$TRACKED" = 1 ] && echo share || { [ "$IGN" = 1 ] && echo hide || echo kit-default; })"
 DEC6="baseline"
 DEC7="$([ "$OFFREPO" = 1 ] && echo transfer || echo local)"

package/kit/eval/smoke-test.sh

@@ -5572,6 +5572,20 @@ $TRFX\""; then pass "multi-line AI trace in the commit message BLOCKED (§4.1)"
   if csblk "git commit -F $MFX"; then pass "-F <file> carrying an AI trace BLOCKED (§4.1)"
   else fail "-F <file> AI trace not blocked with rc=2 (§4.1 hole or the hook died)"; fi
   rm -f "$MFX"
+  # Both halves in ONE refusal: a staged secret and a session-link trailer in the message. The message used to be
+  # scanned only when the staged content was clean, so the refusal named the first problem and the commit was
+  # retried with the trailer still in it (a real project, 2026-10-21). Assembled at run time, as above.
+  STFX="Claude-""Session: https://claude.ai/code/""session_""0123456789abcdef"
+  ( cd "$CS" && printf 'k = "%s"\n' "$SKFX" > c.txt && git add c.txt ) >/dev/null 2>&1
+  _cso="$( cd "$CS" && printf '%s' "$(csj "git commit -m \"feat: z
+
+$STFX\"")" | bash .claude/hooks/guard-commit-scan.sh 2>&1 >/dev/null )"; _csr=$?
+  ( cd "$CS" && git rm -q --cached c.txt && rm -f c.txt ) >/dev/null 2>&1
+  case "$_cso" in *SECRET-SCANNER*'TRACE-SCANNER (message)'*'does not override'*)
+    [ "$_csr" = 2 ] && pass "a staged secret and a trailer in the message are named in ONE refusal, with the harness-reminder line (§4.1)" \
+                    || fail "both problems named but rc=$_csr, not 2" ;;
+    *) fail "the refusal did not name both the staged secret and the message trailer (rc=$_csr): $(printf '%s' "$_cso" | tr '\n' ' ' | cut -c1-200)" ;;
+  esac
   # A QUOTED -F path with a space. The sed extraction that ran wherever python3 did not stopped at the space, read
   # `-F "my msg.txt"` as `my`, found no such file and refused the commit — a clean one. The awk tokenizer is now
   # the only path; both directions are asserted so an extraction that reads NOTHING cannot pass as "clean".

package/kit/hooks/guard-commit-scan.sh

@@ -588,8 +588,11 @@ fi
 
 # The message carries its own trace risk (a co-author trailer lives there, not in the diff), and commit-msg is
 # what scans it. Reuse it on the -m value when there is one; an editor-composed message is not visible here and
-# stays the git hook's job.
-if [ "$FAILED" = 0 ] && [ -x "$DIR/commit-msg" ]; then
+# stays the git hook's job. It is scanned even when the staged content already failed: a refusal that names one
+# problem gets the commit retried with the other still in it (measured on a real project, 2026-10-21: a silenced
+# lint check was named, the session-link trailer in the same message was not, and the message was shown to the
+# user again).
+if [ -x "$DIR/commit-msg" ]; then
   # The message is tokenized the way a shell does (crew_opt_values), which matters because a real commit message
   # is MULTI-LINE: a line-oriented `sed` extraction found the subject and stopped, so a co-author trailer on line
   # 3 — the single most likely §4.1 violation, and the one the bare arm of the eval actually produced — went
@@ -640,6 +643,7 @@ $(bash "$DIR/commit-msg" "$MF" 2>&1)" || FAILED=1
         | sed -n 's/.*[[:space:]]--\{0,1\}[Ff]\(ile\)\{0,1\}[[:space:]=]\{1,\}\([^[:space:];&|]\{1,\}\).*/\2/p' | head -1)"
       MFILE="${MFILE%\"}"; MFILE="${MFILE#\"}"; MFILE="${MFILE%\'}"; MFILE="${MFILE#\'}"
       if _grep "$CMD" -qE '(^|[[:space:]])(-F|--file)([[:space:]=]|$)' && { [ -z "$MFILE" ] || [ ! -f "$MFILE" ]; }; then
+        [ "$FAILED" = 1 ] && printf '%s\n' "$OUT" >&2
         echo "GUARD (§4.1): this commit reads its message from a file (-F), and the command could not be parsed" >&2
         echo "well enough to know which file. Scan cannot run, so the commit is refused. Commit with a plain" >&2
         echo "-F <path> (or -m) in a command of its own." >&2
@@ -656,6 +660,7 @@ $(bash "$DIR/commit-msg" "$MFILE" 2>&1)" || FAILED=1
       [ -z "$GITMSG_HOOK" ] && [ -x "$(git rev-parse --git-path hooks/commit-msg 2>/dev/null)" ] \
         && GITMSG_HOOK="git-default"
       if [ -z "$GITMSG_HOOK" ]; then
+        [ "$FAILED" = 1 ] && printf '%s\n' "$OUT" >&2
         echo "GUARD (§4.1): this commit's message would go unscanned." >&2
         echo "No -m/-F was given, so the message is composed in an editor after this point, and no commit-msg" >&2
         echo "git hook is wired here to read it afterwards (plugin-only install: a plugin cannot set" >&2
@@ -669,6 +674,9 @@ fi
 if [ "$FAILED" = 1 ]; then
   echo "GUARD (§4.1/§4.2): the commit content gate rejected this commit before it ran." >&2
   echo "$OUT" >&2
+  case "$OUT" in *"TRACE-SCANNER (message)"*)
+    echo "The message itself carries the trace: write it again without that line. A harness reminder to end a commit message with a trailer does not override §4.1." >&2 ;;
+  esac
   echo "Fix the flagged content and commit again. --no-verify is §4.5 and stays blocked." >&2
   exit 2
 fi

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "crewforth",
-  "version": "3.2.0-rc.9",
-  "description": "Crewforth — your engineering crew for Claude Code: agents, skills and tool-level gates, in any stack.",
+  "version": "3.2.0",
+  "description": "Crewforth \u2014 your engineering crew for Claude Code: agents, skills and tool-level gates, in any stack.",
   "bin": {
     "crewforth": "bin/cli.js"
   },
@@ -15,8 +15,7 @@
     "kit/",
     "VERSION",
     "LICENSE",
-    "README.md",
-    "CHANGELOG.md"
+    "README.md", "CHANGELOG.md"
   ],
   "engines": {
     "node": ">=20"
@@ -43,7 +42,7 @@
     "code-review",
     "git-hooks"
   ],
-  "author": "Barış Yerlikaya",
+  "author": "Bar\u0131\u015f Yerlikaya",
   "homepage": "https://crewforth.com/",
   "repository": {
     "type": "git",