devlyn-cli 4.3.30 → 4.3.31

package/AGENTS.md

@@ -13,7 +13,7 @@ Seven rules govern every change. Cite them by name when a decision touches one.
 1. **No workaround** — fix the root cause, never the symptom. No `any`, no `@ts-ignore`, no silent `catch`, no hardcoded fallback that hides a broken contract. No config bypasses.
 2. **No overengineering** — smallest sufficient change, one responsibility per module. New abstractions need an observed failure. Subtractive-first: ask "what can I delete instead?" before writing anything new. Remove code your change makes unused; only report unrelated pre-existing dead code.
 3. **No guesswork** — verify with the actual files, logs, diffs, and run output before forming conclusions. State the falsifiable prediction BEFORE the experiment; record raw results AFTER. Retroactive prediction edits are dishonest.
-4. **Worldclass** — zero CRITICAL, zero HIGH security/design findings on the shippable path. Any review is one pass in which every reviewer, including each one the user requires, reads the source the checks ran on; fix each finding or reject it with a reason, re-check the fixes and the invariants they touch, and repeat the full review only while a CRITICAL or HIGH finding remains.
+4. **Worldclass** — zero CRITICAL, zero HIGH findings on the shippable path; each must name a concrete case of wrong behavior or results, a security hole, or lost or corrupted data. A review is one pass on the source the checks ran on, by the reviewers the user requires, else by one reviewer who has not seen the author's reasoning. Fix each finding or reject it with a reason, and verify every edit and the invariants it touches. Only a CRITICAL or HIGH calls for another reviewer pass, which reads the fixes, the rejections and the invariants they touch. If one survives that pass, or its fix caused a new one, repair once more; if the next pass finds either again, stop: the work does not ship and is reported blocked.
 5. **Best practice** — idiomatic for the language and framework. Use standard primitives; do not hand-roll what the library already provides.
 6. **Optimized** — efficient on the resource that matters (the user's time, tokens, attention, runtime) without weakening correctness or requirements. An extra check or process step must beat the simpler path.
 7. **Production ready** — error states are explicit and visible; behavior under failure is what the user expects, not silent corruption.

package/CLAUDE.md

@@ -13,7 +13,7 @@ Seven rules govern every change. Cite them by name when a decision touches one.
 1. **No workaround** — fix the root cause, never the symptom. No `any`, no `@ts-ignore`, no silent `catch`, no hardcoded fallback that hides a broken contract. No config bypasses.
 2. **No overengineering** — smallest sufficient change, one responsibility per module. New abstractions need an observed failure. Subtractive-first: ask "what can I delete instead?" before writing anything new. Remove code your change makes unused; only report unrelated pre-existing dead code.
 3. **No guesswork** — verify with the actual files, logs, diffs, and run output before forming conclusions. State the falsifiable prediction BEFORE the experiment; record raw results AFTER. Retroactive prediction edits are dishonest.
-4. **Worldclass** — zero CRITICAL, zero HIGH security/design findings on the shippable path. Any review is one pass in which every reviewer, including each one the user requires, reads the source the checks ran on; fix each finding or reject it with a reason, re-check the fixes and the invariants they touch, and repeat the full review only while a CRITICAL or HIGH finding remains.
+4. **Worldclass** — zero CRITICAL, zero HIGH findings on the shippable path; each must name a concrete case of wrong behavior or results, a security hole, or lost or corrupted data. A review is one pass on the source the checks ran on, by the reviewers the user requires, else by one reviewer who has not seen the author's reasoning. Fix each finding or reject it with a reason, and verify every edit and the invariants it touches. Only a CRITICAL or HIGH calls for another reviewer pass, which reads the fixes, the rejections and the invariants they touch. If one survives that pass, or its fix caused a new one, repair once more; if the next pass finds either again, stop: the work does not ship and is reported blocked.
 5. **Best practice** — idiomatic for the language and framework. Use standard primitives; do not hand-roll what the library already provides.
 6. **Optimized** — efficient on the resource that matters (the user's time, tokens, attention, runtime) without weakening correctness or requirements. An extra check or process step must beat the simpler path.
 7. **Production ready** — error states are explicit and visible; behavior under failure is what the user expects, not silent corruption.

package/bin/instruction-templates.json

@@ -469,6 +469,7 @@
       "bddb4f88a0c11165b9cafe7a31027e9769313e1aee7c0a9ed9dad490e4fe1bcc",
       "be11c198a50be2884c4c1efec52bbddff55c7547a5daf0ec2ef046279c95dc45",
       "bfdb7c7e4db21e1c452e730cecadc8e97abd317c6e54ae58c298f4288b1f1354",
+      "c1970e6a96f0c4241907d29fb4cdf831ad255b2bbfdb5270fe0aefc32cb91f0d",
       "c1a1e9722a0f3c13c693eeaacdac8cc3d13d36d242f2bab58311170496ea4e2e",
       "c236da36a45d4013ffb7e131575229b605f662a30b5174f14754f519acc24252",
       "c276962617888c5ac2d352c5e2ed018c5ce9d00f199c73e1dd61438ec4a914fb",
@@ -997,6 +998,7 @@
       "c115b2ba9ec7abe2fa5261a5894e3c4899794b527f01ec682ae7fd2479199c08",
       "c150c40a04099d7b726eb8aecc8eec8e92f9f9248a6a5c15556c08000c4bd231",
       "c16ff4fe013ee2cef905d767a09305d9c1b2f778a06b439f0bc4645ac05bc82b",
+      "c1970e6a96f0c4241907d29fb4cdf831ad255b2bbfdb5270fe0aefc32cb91f0d",
       "c1c7e45fedafb97770b6726539694eb0668c70677c2031fe2db2bc8b5339423a",
       "c227759474dc46ec6df00fe7baf8ba4b6b0adc71f5068ef522ff46526c861a48",
       "c27b13c3ae4e6fb34d9b28b8f4e899e29bfbf606a69207b9532d0e44e6078a2e",

package/bin/skill-history.json

@@ -12,6 +12,7 @@
       "08c91060cfec04518de582599d1892ad50f6e6cec69aecd8678760c3e0039fa0",
       "0a60dd9b96442be24a571dd5fe6cac426bba7dd7a06ad17f3211f4f9fd9b1741",
       "0b5c3f72d18f8eea538bfef7192b207ff5cbac25c7e0d2ce080cc725bfdaa2e2",
+      "0d7e8097f36623f68b7cdc26e9c2eb80d9792b3776edf308d306febdfd9f26ae",
       "0f397a4edd6b1b3063d27f6205dc6b3d069fa616624bccf661539b174535fc7e",
       "110005e3c7052d35502186d907b169c9fc7c85d558ab7c7ad0ba2f0308aa7a5d",
       "11ac38b21ecc139211af1b335bb3acc4f0f1bc4b5c133e81a80cafebcaaca298",
@@ -224,7 +225,8 @@
       "3fe0742825aff05fa6fda49d3e3e0fbf5457307af944eb90f2771cbf611edd69",
       "4a8bed603191eeb6834a5008691bb3942e77462abd2818340b808a752ee5a224",
       "57c2481f9ae36623f59b365eae82f22d54253f8ba0fd690949a12858b5f6e308",
-      "b352d21d2a86def2997d89ae1ffa35b0fe428781f75cfa9e1b69a3384416ec31"
+      "b352d21d2a86def2997d89ae1ffa35b0fe428781f75cfa9e1b69a3384416ec31",
+      "be2562b5541d754c34e42b4242751bbaf3b3b2780f4314552ebb63a350e23170"
     ],
     "devlyn-auto-resolve": [
       "0740bb91fb99953631b0c2c273f00210544576f9497af5eecfdd5fe1e58349e2",
@@ -363,6 +365,7 @@
       "36b58dbdc26e51abc05a60872c4582faeebd67e9fe5626a3933467ba07c68dc4",
       "40237cd5259dbcf7c490f130e844a9e32eea48a8edabd50800edee5029bf95a4",
       "4213143689f7e7fe62ab8743c256a45492fafffc1757d64901b7b02725aee5c3",
+      "472d2ad853c96651324aa9a3de00cb61c0cecacb389e850ab1b380d535d22922",
       "49d6e024b343dd77e4c0cea0e513e40fe679a7a8192953190d042b3a21bbf69c",
       "5536f8391ec4442f1b793dba8dd5d7820d45f4b6dadf1111cbac9d54469a01ca",
       "573a6059a7383b37affd9c2e8bc6c88a4fb54117628a5a0746406cc32111e9aa",
@@ -825,6 +828,7 @@
     "4.3.29",
     "4.3.3",
     "4.3.30",
+    "4.3.31",
     "4.3.4",
     "4.3.5",
     "4.3.6",

package/config/skills/_shared/runtime-principles.md

@@ -15,7 +15,7 @@ Seven rules govern every change. Cite them by name when a decision touches one.
 1. **No workaround** — fix the root cause, never the symptom. No `any`, no `@ts-ignore`, no silent `catch`, no hardcoded fallback that hides a broken contract. No config bypasses.
 2. **No overengineering** — smallest sufficient change, one responsibility per module. New abstractions need an observed failure. Subtractive-first: ask "what can I delete instead?" before writing anything new. Remove code your change makes unused; only report unrelated pre-existing dead code.
 3. **No guesswork** — verify with the actual files, logs, diffs, and run output before forming conclusions. State the falsifiable prediction BEFORE the experiment; record raw results AFTER. Retroactive prediction edits are dishonest.
-4. **Worldclass** — zero CRITICAL, zero HIGH security/design findings on the shippable path. Any review is one pass in which every reviewer, including each one the user requires, reads the source the checks ran on; fix each finding or reject it with a reason, re-check the fixes and the invariants they touch, and repeat the full review only while a CRITICAL or HIGH finding remains.
+4. **Worldclass** — zero CRITICAL, zero HIGH findings on the shippable path; each must name a concrete case of wrong behavior or results, a security hole, or lost or corrupted data. A review is one pass on the source the checks ran on, by the reviewers the user requires, else by one reviewer who has not seen the author's reasoning. Fix each finding or reject it with a reason, and verify every edit and the invariants it touches. Only a CRITICAL or HIGH calls for another reviewer pass, which reads the fixes, the rejections and the invariants they touch. If one survives that pass, or its fix caused a new one, repair once more; if the next pass finds either again, stop: the work does not ship and is reported blocked.
 5. **Best practice** — idiomatic for the language and framework. Use standard primitives; do not hand-roll what the library already provides.
 6. **Optimized** — efficient on the resource that matters (the user's time, tokens, attention, runtime) without weakening correctness or requirements. An extra check or process step must beat the simpler path.
 7. **Production ready** — error states are explicit and visible; behavior under failure is what the user expects, not silent corruption.

package/config/skills/devlyn-ideate/references/executor.md

@@ -59,4 +59,4 @@ Each `review_requirements` ID needs review evidence: a JSON record under `<workt
 }
 ```
 
-A record counts only when it binds this task, the candidate source and both contract digests; any other well-formed record is reported under `ignored_reviews` (a source change invalidates earlier reviews). A listed review or runner record that is unreadable or not this shape fails acceptance with its path named; keys a review record or finding adds beyond this shape are ignored. The counted records' `requirements` must cover `review_requirements`. Each finding's `disposition` is `open`, `resolved` or `rejected` (`rejected` needs a `reason`); an open binding finding blocks acceptance. The loop requires no particular engine or number of reviewers.
+A record counts only when it binds this task, the candidate source and both contract digests; any other well-formed record is reported under `ignored_reviews` (a source change invalidates earlier reviews; the record for the changed source may come from a pass that reads only the change and the invariants it touches). A listed review or runner record that is unreadable or not this shape fails acceptance with its path named; keys a review record or finding adds beyond this shape are ignored. The counted records' `requirements` must cover `review_requirements`. Each finding's `disposition` is `open`, `resolved` or `rejected` (`rejected` needs a `reason`); an open binding finding blocks acceptance. The loop requires no particular engine or number of reviewers.

package/harness/AGENTS.md

@@ -1,4 +1,4 @@
-<!-- devlyn:instructions:begin sha256=eaf6d144bcb25ac8c5e628a134dc4422f5af7641f9c34ccdb8f06d1613718c48 -->
+<!-- devlyn:instructions:begin sha256=7a484752888c37d7e91a9edfaa17d36b34ada221fc1d533ab9d73bc08c56ae7e -->
 Project-specific instructions outside this managed block take precedence over these defaults.
 
 # Project Instructions
@@ -16,7 +16,7 @@ Seven rules govern every change. Cite them by name when a decision touches one.
 1. **No workaround** — fix the root cause, never the symptom. No `any`, no `@ts-ignore`, no silent `catch`, no hardcoded fallback that hides a broken contract. No config bypasses.
 2. **No overengineering** — smallest sufficient change, one responsibility per module. New abstractions need an observed failure. Subtractive-first: ask "what can I delete instead?" before writing anything new. Remove code your change makes unused; only report unrelated pre-existing dead code.
 3. **No guesswork** — verify with the actual files, logs, diffs, and run output before forming conclusions. State the falsifiable prediction BEFORE the experiment; record raw results AFTER. Retroactive prediction edits are dishonest.
-4. **Worldclass** — zero CRITICAL, zero HIGH security/design findings on the shippable path. Any review is one pass in which every reviewer, including each one the user requires, reads the source the checks ran on; fix each finding or reject it with a reason, re-check the fixes and the invariants they touch, and repeat the full review only while a CRITICAL or HIGH finding remains.
+4. **Worldclass** — zero CRITICAL, zero HIGH findings on the shippable path; each must name a concrete case of wrong behavior or results, a security hole, or lost or corrupted data. A review is one pass on the source the checks ran on, by the reviewers the user requires, else by one reviewer who has not seen the author's reasoning. Fix each finding or reject it with a reason, and verify every edit and the invariants it touches. Only a CRITICAL or HIGH calls for another reviewer pass, which reads the fixes, the rejections and the invariants they touch. If one survives that pass, or its fix caused a new one, repair once more; if the next pass finds either again, stop: the work does not ship and is reported blocked.
 5. **Best practice** — idiomatic for the language and framework. Use standard primitives; do not hand-roll what the library already provides.
 6. **Optimized** — efficient on the resource that matters (the user's time, tokens, attention, runtime) without weakening correctness or requirements. An extra check or process step must beat the simpler path.
 7. **Production ready** — error states are explicit and visible; behavior under failure is what the user expects, not silent corruption.

package/harness/CLAUDE.md

@@ -1,4 +1,4 @@
-<!-- devlyn:instructions:begin sha256=eaf6d144bcb25ac8c5e628a134dc4422f5af7641f9c34ccdb8f06d1613718c48 -->
+<!-- devlyn:instructions:begin sha256=7a484752888c37d7e91a9edfaa17d36b34ada221fc1d533ab9d73bc08c56ae7e -->
 Project-specific instructions outside this managed block take precedence over these defaults.
 
 # Project Instructions
@@ -16,7 +16,7 @@ Seven rules govern every change. Cite them by name when a decision touches one.
 1. **No workaround** — fix the root cause, never the symptom. No `any`, no `@ts-ignore`, no silent `catch`, no hardcoded fallback that hides a broken contract. No config bypasses.
 2. **No overengineering** — smallest sufficient change, one responsibility per module. New abstractions need an observed failure. Subtractive-first: ask "what can I delete instead?" before writing anything new. Remove code your change makes unused; only report unrelated pre-existing dead code.
 3. **No guesswork** — verify with the actual files, logs, diffs, and run output before forming conclusions. State the falsifiable prediction BEFORE the experiment; record raw results AFTER. Retroactive prediction edits are dishonest.
-4. **Worldclass** — zero CRITICAL, zero HIGH security/design findings on the shippable path. Any review is one pass in which every reviewer, including each one the user requires, reads the source the checks ran on; fix each finding or reject it with a reason, re-check the fixes and the invariants they touch, and repeat the full review only while a CRITICAL or HIGH finding remains.
+4. **Worldclass** — zero CRITICAL, zero HIGH findings on the shippable path; each must name a concrete case of wrong behavior or results, a security hole, or lost or corrupted data. A review is one pass on the source the checks ran on, by the reviewers the user requires, else by one reviewer who has not seen the author's reasoning. Fix each finding or reject it with a reason, and verify every edit and the invariants it touches. Only a CRITICAL or HIGH calls for another reviewer pass, which reads the fixes, the rejections and the invariants they touch. If one survives that pass, or its fix caused a new one, repair once more; if the next pass finds either again, stop: the work does not ship and is reported blocked.
 5. **Best practice** — idiomatic for the language and framework. Use standard primitives; do not hand-roll what the library already provides.
 6. **Optimized** — efficient on the resource that matters (the user's time, tokens, attention, runtime) without weakening correctness or requirements. An extra check or process step must beat the simpler path.
 7. **Production ready** — error states are explicit and visible; behavior under failure is what the user expects, not silent corruption.

package/native/claude/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "devlyn",
-  "version": "4.3.30",
+  "version": "4.3.31",
   "description": "Devlyn harness skills",
   "skills": "./skills/"
 }

package/native/claude/skills/_shared/runtime-principles.md

@@ -15,7 +15,7 @@ Seven rules govern every change. Cite them by name when a decision touches one.
 1. **No workaround** — fix the root cause, never the symptom. No `any`, no `@ts-ignore`, no silent `catch`, no hardcoded fallback that hides a broken contract. No config bypasses.
 2. **No overengineering** — smallest sufficient change, one responsibility per module. New abstractions need an observed failure. Subtractive-first: ask "what can I delete instead?" before writing anything new. Remove code your change makes unused; only report unrelated pre-existing dead code.
 3. **No guesswork** — verify with the actual files, logs, diffs, and run output before forming conclusions. State the falsifiable prediction BEFORE the experiment; record raw results AFTER. Retroactive prediction edits are dishonest.
-4. **Worldclass** — zero CRITICAL, zero HIGH security/design findings on the shippable path. Any review is one pass in which every reviewer, including each one the user requires, reads the source the checks ran on; fix each finding or reject it with a reason, re-check the fixes and the invariants they touch, and repeat the full review only while a CRITICAL or HIGH finding remains.
+4. **Worldclass** — zero CRITICAL, zero HIGH findings on the shippable path; each must name a concrete case of wrong behavior or results, a security hole, or lost or corrupted data. A review is one pass on the source the checks ran on, by the reviewers the user requires, else by one reviewer who has not seen the author's reasoning. Fix each finding or reject it with a reason, and verify every edit and the invariants it touches. Only a CRITICAL or HIGH calls for another reviewer pass, which reads the fixes, the rejections and the invariants they touch. If one survives that pass, or its fix caused a new one, repair once more; if the next pass finds either again, stop: the work does not ship and is reported blocked.
 5. **Best practice** — idiomatic for the language and framework. Use standard primitives; do not hand-roll what the library already provides.
 6. **Optimized** — efficient on the resource that matters (the user's time, tokens, attention, runtime) without weakening correctness or requirements. An extra check or process step must beat the simpler path.
 7. **Production ready** — error states are explicit and visible; behavior under failure is what the user expects, not silent corruption.

package/native/claude/skills/devlyn-ideate/references/executor.md

@@ -59,4 +59,4 @@ Each `review_requirements` ID needs review evidence: a JSON record under `<workt
 }
 ```
 
-A record counts only when it binds this task, the candidate source and both contract digests; any other well-formed record is reported under `ignored_reviews` (a source change invalidates earlier reviews). A listed review or runner record that is unreadable or not this shape fails acceptance with its path named; keys a review record or finding adds beyond this shape are ignored. The counted records' `requirements` must cover `review_requirements`. Each finding's `disposition` is `open`, `resolved` or `rejected` (`rejected` needs a `reason`); an open binding finding blocks acceptance. The loop requires no particular engine or number of reviewers.
+A record counts only when it binds this task, the candidate source and both contract digests; any other well-formed record is reported under `ignored_reviews` (a source change invalidates earlier reviews; the record for the changed source may come from a pass that reads only the change and the invariants it touches). A listed review or runner record that is unreadable or not this shape fails acceptance with its path named; keys a review record or finding adds beyond this shape are ignored. The counted records' `requirements` must cover `review_requirements`. Each finding's `disposition` is `open`, `resolved` or `rejected` (`rejected` needs a `reason`); an open binding finding blocks acceptance. The loop requires no particular engine or number of reviewers.

package/native/codex/.agents/plugins/marketplace.json

@@ -1,5 +1,5 @@
 {
-  "name": "devlyn-harness-v4-3-30",
+  "name": "devlyn-harness-v4-3-31",
   "plugins": [
     {
       "name": "devlyn",

package/native/codex/plugins/devlyn/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "devlyn",
-  "version": "4.3.30",
+  "version": "4.3.31",
   "description": "Devlyn harness skills",
   "skills": "./skills/"
 }

package/native/codex/plugins/devlyn/skills/_shared/runtime-principles.md

@@ -15,7 +15,7 @@ Seven rules govern every change. Cite them by name when a decision touches one.
 1. **No workaround** — fix the root cause, never the symptom. No `any`, no `@ts-ignore`, no silent `catch`, no hardcoded fallback that hides a broken contract. No config bypasses.
 2. **No overengineering** — smallest sufficient change, one responsibility per module. New abstractions need an observed failure. Subtractive-first: ask "what can I delete instead?" before writing anything new. Remove code your change makes unused; only report unrelated pre-existing dead code.
 3. **No guesswork** — verify with the actual files, logs, diffs, and run output before forming conclusions. State the falsifiable prediction BEFORE the experiment; record raw results AFTER. Retroactive prediction edits are dishonest.
-4. **Worldclass** — zero CRITICAL, zero HIGH security/design findings on the shippable path. Any review is one pass in which every reviewer, including each one the user requires, reads the source the checks ran on; fix each finding or reject it with a reason, re-check the fixes and the invariants they touch, and repeat the full review only while a CRITICAL or HIGH finding remains.
+4. **Worldclass** — zero CRITICAL, zero HIGH findings on the shippable path; each must name a concrete case of wrong behavior or results, a security hole, or lost or corrupted data. A review is one pass on the source the checks ran on, by the reviewers the user requires, else by one reviewer who has not seen the author's reasoning. Fix each finding or reject it with a reason, and verify every edit and the invariants it touches. Only a CRITICAL or HIGH calls for another reviewer pass, which reads the fixes, the rejections and the invariants they touch. If one survives that pass, or its fix caused a new one, repair once more; if the next pass finds either again, stop: the work does not ship and is reported blocked.
 5. **Best practice** — idiomatic for the language and framework. Use standard primitives; do not hand-roll what the library already provides.
 6. **Optimized** — efficient on the resource that matters (the user's time, tokens, attention, runtime) without weakening correctness or requirements. An extra check or process step must beat the simpler path.
 7. **Production ready** — error states are explicit and visible; behavior under failure is what the user expects, not silent corruption.

package/native/codex/plugins/devlyn/skills/devlyn-ideate/references/executor.md

@@ -59,4 +59,4 @@ Each `review_requirements` ID needs review evidence: a JSON record under `<workt
 }
 ```
 
-A record counts only when it binds this task, the candidate source and both contract digests; any other well-formed record is reported under `ignored_reviews` (a source change invalidates earlier reviews). A listed review or runner record that is unreadable or not this shape fails acceptance with its path named; keys a review record or finding adds beyond this shape are ignored. The counted records' `requirements` must cover `review_requirements`. Each finding's `disposition` is `open`, `resolved` or `rejected` (`rejected` needs a `reason`); an open binding finding blocks acceptance. The loop requires no particular engine or number of reviewers.
+A record counts only when it binds this task, the candidate source and both contract digests; any other well-formed record is reported under `ignored_reviews` (a source change invalidates earlier reviews; the record for the changed source may come from a pass that reads only the change and the invariants it touches). A listed review or runner record that is unreadable or not this shape fails acceptance with its path named; keys a review record or finding adds beyond this shape are ignored. The counted records' `requirements` must cover `review_requirements`. Each finding's `disposition` is `open`, `resolved` or `rejected` (`rejected` needs a `reason`); an open binding finding blocks acceptance. The loop requires no particular engine or number of reviewers.

package/optional-skills/code-review-standards/SKILL.md

@@ -1,6 +1,6 @@
 ---
 name: code-review-standards
-description: Severity framework (CRITICAL security, HIGH code quality, MEDIUM best practice, LOW cleanup) and approval criteria for judging a code change. Use when reviewing, auditing or validating a diff, pull request or just-finished implementation, or when deciding whether a change is ready to approve.
+description: Severity framework (CRITICAL security, HIGH correctness and data, MEDIUM best practice, LOW cleanup) and approval criteria for judging a code change. Use when reviewing, auditing or validating a diff, pull request or just-finished implementation, or when deciding whether a change is ready to approve.
 ---
 # Code Review Standards
 
@@ -8,6 +8,8 @@ Severity framework and quality bar for reviewing code changes. Apply this framew
 
 ## Severity Framework
 
+A CRITICAL or HIGH finding names its concrete case: the input, state or path that leads to the harm. A finding that cannot name one is MEDIUM or lower.
+
 ### CRITICAL — Security (blocks approval)
 
 - Hardcoded credentials, API keys, tokens, secrets
@@ -17,17 +19,19 @@ Severity framework and quality bar for reviewing code changes. Apply this framew
 - Insecure dependencies (known CVEs)
 - Path traversal (unsanitized file paths)
 
-### HIGH — Code Quality (blocks approval)
+### HIGH — Correctness and data (blocks approval)
+
+- Wrong behavior or results
+- Lost or corrupted data
+- Missing error handling at a boundary, where a failure there gives one of the above
+
+### MEDIUM — Best Practices (fix or justify)
 
 - Functions > 50 lines → split
 - Files > 800 lines → decompose
 - Nesting > 4 levels → flatten or extract
-- Missing error handling at boundaries
 - `console.log` in production code → remove
 - Unresolved TODO/FIXME → resolve or remove
-
-### MEDIUM — Best Practices (fix or justify)
-
 - Mutation where immutable patterns preferred
 - Missing tests for new functionality
 - Accessibility gaps (alt text, ARIA, keyboard nav)

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "devlyn-cli",
-  "version": "4.3.30",
+  "version": "4.3.31",
   "description": "Loop & harness engineering for AI coding agents (Claude Code, Codex, and any AGENTS.md-driven agent) — core engineering principles for every session and a loop designer that splits one intent into tasks agents drain hands-free",
   "homepage": "https://github.com/fysoul17/devlyn-cli#readme",
   "bin": {

package/release.json

@@ -1,14 +1,14 @@
 {
   "schemaVersion": 1,
   "package": "devlyn-cli",
-  "version": "4.3.30",
+  "version": "4.3.31",
   "principles": {
     "defaults": "config/skills/_shared/runtime-principles.md",
     "memory": {
       "claude": "harness/CLAUDE.md",
       "agents": "harness/AGENTS.md"
     },
-    "sourceBlockSha256": "eaf6d144bcb25ac8c5e628a134dc4422f5af7641f9c34ccdb8f06d1613718c48"
+    "sourceBlockSha256": "7a484752888c37d7e91a9edfaa17d36b34ada221fc1d533ab9d73bc08c56ae7e"
   },
   "skills": {
     "root": "config/skills",
@@ -99,12 +99,12 @@
   "files": [
     {
       "path": "AGENTS.md",
-      "sha256": "df67efd70f4760d2415c414eb96d4cc426277c20e18f17e401257f85b489eb59",
+      "sha256": "207efe7b897a2704ec8a22163f02891ac1a17d521e8a44f4556e59d60a6de19f",
       "executable": false
     },
     {
       "path": "CLAUDE.md",
-      "sha256": "df67efd70f4760d2415c414eb96d4cc426277c20e18f17e401257f85b489eb59",
+      "sha256": "207efe7b897a2704ec8a22163f02891ac1a17d521e8a44f4556e59d60a6de19f",
       "executable": false
     },
     {
@@ -159,7 +159,7 @@
     },
     {
       "path": "bin/instruction-templates.json",
-      "sha256": "752cc4b023930ca696395fb071b93d17a6fabf34aec9e2b993e88f2d2d1673c9",
+      "sha256": "6e8998bcfa674c32fc92dc48c3e9b83e07fe7b48c3ae203e0943ae837181f473",
       "executable": false
     },
     {
@@ -174,7 +174,7 @@
     },
     {
       "path": "bin/skill-history.json",
-      "sha256": "de454d15a5d1e81f0f69f5d1d781ea02d8b19554695458a993d74596d5055146",
+      "sha256": "4a409eac690da7f3611c67a4fd5e3d9abb354199848bffff27ac441a6a491878",
       "executable": false
     },
     {
@@ -259,7 +259,7 @@
     },
     {
       "path": "config/skills/_shared/runtime-principles.md",
-      "sha256": "a8544f866db7b8e49617f14519908a601cbd8b92786cecb521cba5c28421a7f7",
+      "sha256": "7492c2e1854ef6b0aef8cf1f5dd85e612ed954cff90196ec7c17cc47d12c9937",
       "executable": false
     },
     {
@@ -309,7 +309,7 @@
     },
     {
       "path": "config/skills/devlyn-ideate/references/executor.md",
-      "sha256": "aa53076dffa1fcf49e2350206b5f0ba73306b92ccce3502160dca4f26113e4be",
+      "sha256": "40582ff8fad59f09fe327ac4f232463b6c55a91be1288c7470f7c8c0b3da95fe",
       "executable": false
     },
     {
@@ -344,17 +344,17 @@
     },
     {
       "path": "harness/AGENTS.md",
-      "sha256": "68c354a51eae0b77eaa909ec2a11b1ca498c62905e133375929c73085c638d10",
+      "sha256": "9c3daa27f67af1feff420f14d7c53cfbc905b7e72e2d32cc47bc8f2a6cbe3555",
       "executable": false
     },
     {
       "path": "harness/CLAUDE.md",
-      "sha256": "68c354a51eae0b77eaa909ec2a11b1ca498c62905e133375929c73085c638d10",
+      "sha256": "9c3daa27f67af1feff420f14d7c53cfbc905b7e72e2d32cc47bc8f2a6cbe3555",
       "executable": false
     },
     {
       "path": "native/claude/.claude-plugin/plugin.json",
-      "sha256": "1c66282653ed10919933b783dbff4353b9a315340d1ceb6d9edb9caf963a23e1",
+      "sha256": "a70dddfa4b8c6095d52066ae94fa4c0ff2223d2c601614b825d59c3de5a313f3",
       "executable": false
     },
     {
@@ -434,7 +434,7 @@
     },
     {
       "path": "native/claude/skills/_shared/runtime-principles.md",
-      "sha256": "a8544f866db7b8e49617f14519908a601cbd8b92786cecb521cba5c28421a7f7",
+      "sha256": "7492c2e1854ef6b0aef8cf1f5dd85e612ed954cff90196ec7c17cc47d12c9937",
       "executable": false
     },
     {
@@ -484,7 +484,7 @@
     },
     {
       "path": "native/claude/skills/devlyn-ideate/references/executor.md",
-      "sha256": "aa53076dffa1fcf49e2350206b5f0ba73306b92ccce3502160dca4f26113e4be",
+      "sha256": "40582ff8fad59f09fe327ac4f232463b6c55a91be1288c7470f7c8c0b3da95fe",
       "executable": false
     },
     {
@@ -514,12 +514,12 @@
     },
     {
       "path": "native/codex/.agents/plugins/marketplace.json",
-      "sha256": "2b589b387dd262bbb68f68738c9da6315dd06595d0af0dc5c088151235a5a7c8",
+      "sha256": "dd4ae6ddb1bad7d6670af67cbfc15de7bc1538a8a0a01c8f039bdf75bd981bd9",
       "executable": false
     },
     {
       "path": "native/codex/plugins/devlyn/.codex-plugin/plugin.json",
-      "sha256": "1c66282653ed10919933b783dbff4353b9a315340d1ceb6d9edb9caf963a23e1",
+      "sha256": "a70dddfa4b8c6095d52066ae94fa4c0ff2223d2c601614b825d59c3de5a313f3",
       "executable": false
     },
     {
@@ -599,7 +599,7 @@
     },
     {
       "path": "native/codex/plugins/devlyn/skills/_shared/runtime-principles.md",
-      "sha256": "a8544f866db7b8e49617f14519908a601cbd8b92786cecb521cba5c28421a7f7",
+      "sha256": "7492c2e1854ef6b0aef8cf1f5dd85e612ed954cff90196ec7c17cc47d12c9937",
       "executable": false
     },
     {
@@ -649,7 +649,7 @@
     },
     {
       "path": "native/codex/plugins/devlyn/skills/devlyn-ideate/references/executor.md",
-      "sha256": "aa53076dffa1fcf49e2350206b5f0ba73306b92ccce3502160dca4f26113e4be",
+      "sha256": "40582ff8fad59f09fe327ac4f232463b6c55a91be1288c7470f7c8c0b3da95fe",
       "executable": false
     },
     {
@@ -1554,7 +1554,7 @@
     },
     {
       "path": "optional-skills/code-review-standards/SKILL.md",
-      "sha256": "3f11f84adb7d3016c4d71bce743c40e35e682d09bc9376b03be957fc9c8d2b62",
+      "sha256": "24b5ffaea6876575cf9ae70ff8fb1f4b5a75633f5a7a976a87da82630d62a34f",
       "executable": false
     },
     {
@@ -1819,12 +1819,12 @@
     },
     {
       "path": "package.json",
-      "sha256": "e4f8b96ad2ca5dd7298d1db30e321e3e965f76d1fa0e4fc4a3e4e1012e124822",
+      "sha256": "1e85c3e53275ab575d882ab87040c79d5f5c0edc4202f1503c576cca797a0446",
       "executable": false
     }
   ],
   "digest": {
     "algorithm": "sha256",
-    "value": "53a2f9f2d3d8cf8cf43391dd92224aa5190e331f0a993649d0a06256ca6a417d"
+    "value": "7be19f082103d694d2c85ab15c7687e43b0e6038903b8b3e997c3744f7ee647e"
   }
 }