godpowers 1.6.23 → 1.6.24

package/CHANGELOG.md

@@ -7,6 +7,40 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+## [1.6.24] - 2026-05-16
+
+Strict background release readiness.
+
+### Added
+- Added the `strict-release-readiness` automation template so delegated or
+  scheduled release checks fail closed when any required release surface is
+  unchecked, stale, missing, untested, or inconsistent with the intended
+  version.
+- Added a required release-surface manifest for root docs, docs, agents,
+  skills, routing, workflows, schema, templates, references, hooks, lib,
+  scripts, tests, fixtures, GitHub workflows, package metadata, npm latest,
+  git tag state, GitHub release state, CI, publish workflow, and local install
+  state.
+
+### Changed
+- `/god-automation-setup` now recommends `strict-release-readiness` for
+  background release checks and keeps the narrower `release-readiness`
+  template reserved for quick manual checks.
+- The release maintenance recipe now routes background-release setup through
+  `/god-automation-setup` with an explicit no-publish guardrail.
+- Auto-invoke visibility docs now classify strict release readiness as a
+  read-only, fail-closed Level 2 automation candidate.
+- The release checklist now names every folder and published surface that must
+  be checked before packaging, tagging, pushing, releasing, or publishing.
+
+### Guardrails
+- Added behavioral coverage that verifies the strict release readiness
+  template exists, is fail-closed, refuses file mutation, and names every
+  required release surface.
+- The strict readiness template may report blockers and exact next commands,
+  but it must not modify files, stage, commit, tag, push, create a GitHub
+  release, publish to npm, delete files, clear caches, or change installs.
+
 ## [1.6.23] - 2026-05-16
 
 Full repository audit, release gate hardening, and documentation repair.

package/README.md

@@ -2,7 +2,7 @@
 
 [![CI](https://github.com/aihxp/godpowers/actions/workflows/ci.yml/badge.svg)](https://github.com/aihxp/godpowers/actions/workflows/ci.yml)
 [![License: MIT](https://img.shields.io/badge/License-MIT-yellow.svg)](LICENSE)
-[![Version](https://img.shields.io/badge/version-1.6.23-blue)](CHANGELOG.md)
+[![Version](https://img.shields.io/badge/version-1.6.24-blue)](CHANGELOG.md)
 [![npm](https://img.shields.io/npm/v/godpowers.svg)](https://www.npmjs.com/package/godpowers)
 
 **Ship fast. Ship right. Ship everything. Ship accountably.**
@@ -12,10 +12,12 @@ idea to hardened production. It runs as **slash commands inside your AI coding
 tool** (Claude Code, Codex, Cursor, etc.) that orchestrate **specialist agents**
 in fresh contexts to do the work.
 
-Version 1.6.23 hardens the release surface after a full file-by-file audit.
-Godpowers now keeps repo documentation, release gates, feature awareness,
-host guarantees, source-system sync-back, and repository surface checks aligned
-from reconciliation through final sync.
+Version 1.6.24 makes background release readiness strict and fail-closed.
+Godpowers now requires delegated release checks to cover root docs, docs,
+agents, skills, routing, workflows, schema, templates, references, hooks, lib,
+scripts, tests, fixtures, GitHub workflows, package metadata, npm, GitHub
+release, CI, publish workflow, and local install state before a human-approved
+release executor can run.
 
 The dashboard now starts with an action brief and a host guarantee line: the
 next command, why it is recommended, whether the project is ready, the first

package/RELEASE.md

@@ -1,11 +1,12 @@
-# Godpowers 1.6.23 Release
+# Godpowers 1.6.24 Release
 
 Date: 2026-05-16
 
-Godpowers 1.6.23 hardens the repository after a full file-by-file audit. It
-aligns release gates, documentation sync, repository surface sync, feature
-awareness, source-system sync-back, host guarantees, dashboard closeouts, and
-package publishing into one verified release surface.
+Godpowers 1.6.24 turns release readiness automation into a strict,
+fail-closed background check. It packages the lesson from the 1.6.23 release:
+release readiness cannot be inferred from README, package metadata, and
+changelog alone. Every owned repo surface must be checked or the release is
+blocked.
 
 ## What is stable
 
@@ -38,56 +39,47 @@ package publishing into one verified release surface.
 
 ## What is new
 
-- Added `.planning/2026-05-16-surface-sync-status.md` to record the current
-  `.github/workflows`, `.planning`, and `agents` sync status without rewriting
-  historical planning evidence.
-- Expanded `god-reconciler` so feature reconciliation includes repository
-  documentation, repository surface, runtime feature awareness, source-system
-  sync-back, and host capability checks.
-- Expanded `god-updater` so closeout reports repo-doc sync, repo-surface sync,
-  feature awareness, source-system sync-back, host capability, dashboard
-  refresh, checkpoint sync, Pillars sync, and context refresh.
-- Updated workflow release jobs so root and first-party pack publishing run
-  the complete release gate first.
-- Updated `prepublishOnly` so local npm publish attempts also run the complete
-  release gate.
+- Added `strict-release-readiness` to the safe automation templates.
+- Added a strict release-surface manifest that covers root docs, docs, agents,
+  skills, routing, workflows, schema, templates, references, hooks, lib,
+  scripts, tests, fixtures, GitHub workflows, package metadata, npm latest, git
+  tag state, GitHub release state, CI status, publish workflow status, and
+  local install state.
+- Updated `/god-automation-setup` so background release checks use the strict
+  template by default.
+- Updated the release maintenance recipe so background release setup goes
+  through `/god-automation-setup` and keeps publishing behind explicit human
+  approval.
+- Updated auto-invoke visibility docs so strict release readiness is a Level 2
+  read-only local automation candidate.
 
-## Repairs
+## Guardrails
 
-- Repaired stale current-version claims in README, architecture, roadmap,
-  reference docs, `/god-version`, and agent context.
-- Repaired stale `/god-reconcile` docs so the command and specialist agent
-  describe the same expanded sync surfaces.
-- Repaired final sync docs so `/god-mode`, `god-orchestrator`, and agent specs
-  all describe core artifacts plus local runtime and repository sync surfaces.
-- Removed literal forbidden dash and emoji characters from primary source files
-  while keeping validator tests intact through Unicode escape sequences.
-- Repaired release documentation drift around package contents, route quality,
-  recipe coverage, release-surface checks, dogfood, host guarantees, extension
-  authoring, and Mode D suite release dry-runs.
+- Strict release readiness fails closed when any required surface is unchecked,
+  stale, missing, untested, or inconsistent with the intended version.
+- Strict release readiness reports blockers and exact next commands only.
+- Strict release readiness must not modify files, stage, commit, tag, push,
+  create a GitHub release, publish to npm, delete files, clear caches, or
+  change runtime installs.
+- Behavioral tests verify that the strict template is fail-closed, read-only,
+  and names every required release surface.
 
 ## Validation
 
 Release validation includes:
 
-- source audit over 639 tracked plus untracked source files
-- `node scripts/validate-skills.js`
-- `bash scripts/smoke.sh`
-- `node scripts/test-agent-validator.js`
-- `node scripts/test-artifact-linter.js`
-- `node scripts/test-repo-doc-sync.js`
-- `node scripts/test-repo-surface-sync.js`
+- `node scripts/test-automation-providers.js`
 - `node scripts/test-automation-surface-sync.js`
-- `node scripts/test-feature-awareness.js`
-- `node scripts/test-host-capabilities.js`
-- `node scripts/test-dogfood-runner.js`
-- `node scripts/test-extension-authoring.js`
-- `node scripts/test-mode-d.js`
-- `node scripts/test-extensions-publish.js`
-- `node scripts/test-install-smoke.js`
-- `npm audit --omit=dev`
-- `git diff --check`
+- `node scripts/test-recipes.js`
+- source scan for forbidden dash characters in edited files
 - `npm run release:check`
+- `npm pack --json`
+- npm cache clear before local install
+- local uninstall and reinstall from the generated tarball
+- tag-triggered npm publish workflow with provenance
+- npm registry verification after publish
+- local uninstall and reinstall from `godpowers@1.6.24`
+- all-runtime `godpowers --all` refresh after published install
 
-The `v1.6.23` tag should point to the release commit that matches the npm
-`godpowers@1.6.23` package.
+The `v1.6.24` tag should point to the release commit that matches the npm
+`godpowers@1.6.24` package.

package/lib/automation-providers.js

@@ -14,6 +14,24 @@ const os = require('os');
 
 const CONFIG_PATH = '.godpowers/automations.json';
 
+const STRICT_RELEASE_SURFACES = [
+  'root docs: README.md, CHANGELOG.md, RELEASE.md, CONTRIBUTING.md, SUPPORT.md, USERS.md, ARCHITECTURE.md, ARCHITECTURE-MAP.md, AGENTS.md, SKILL.md',
+  'docs/: release checklist, roadmap, reference, validation, concepts, getting started, feature awareness, auto-invoke visibility, repo sync docs',
+  'agents/: pillar files and specialist agent contracts',
+  'skills/: command skills and release-visible examples',
+  'routing/: command routes and high-frequency recipes',
+  'workflows/: full arc, feature, hotfix, refactor, migration, docs, deps, hygiene, suite, and audit workflows',
+  'schema/: events, intent, routing, recipe, state, workflow, and extension schemas',
+  'templates/: generated artifact templates and update logs',
+  'references/: have-nots, orchestration, planning, building, design, and shared references',
+  'hooks/: session-start and pre-tool-use runtime hooks',
+  'lib/: sync detectors, release guardrails, host capabilities, automation providers, and runtime helpers',
+  'scripts/: release gate, smoke, package, and sync tests',
+  'tests/ and fixtures/: integration, dogfood, and golden fixtures',
+  '.github/workflows/: CI, publish, and pack publish gates',
+  'package surface: package.json, package-lock.json, npm files list, pack contents, npm latest, git tag, and release notes'
+];
+
 const SAFE_TEMPLATES = [
   {
     id: 'daily-status',
@@ -43,6 +61,20 @@ const SAFE_TEMPLATES = [
     risk: 'read-only',
     prompt: 'Run a read-only hygiene summary for docs drift, dependency signals, checkpoint age, and pending reviews.'
   },
+  {
+    id: 'strict-release-readiness',
+    title: 'Strict release readiness report',
+    cadence: 'Manual, before release, or weekly before planned releases',
+    risk: 'read-only, fail-closed',
+    surfaces: STRICT_RELEASE_SURFACES.slice(),
+    prompt: [
+      'Run strict release readiness for every required Godpowers release surface.',
+      'Check root docs, docs/, agents/, skills/, routing/, workflows/, schema/, templates/, references/, hooks/, lib/, scripts/, tests/, fixtures/, .github/workflows/, package metadata, git tag state, GitHub release state, npm latest, and local install state.',
+      'Run or report the status of repo documentation sync, repo surface sync, route quality sync, recipe coverage sync, release surface sync, automation surface sync, package content checks, release gate status, CI status, publish workflow status, forbidden character scan, stale version scan, and unstaged work.',
+      'Fail closed when any required surface is unchecked, stale, missing from the package manifest, not covered by tests, or inconsistent with the intended version.',
+      'Summarize blockers and exact next commands only. Do not modify files, stage, commit, tag, push, create a GitHub release, publish to npm, delete files, or clear caches.'
+    ].join(' ')
+  },
   {
     id: 'release-readiness',
     title: 'Release readiness report',

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "godpowers",
-  "version": "1.6.23",
+  "version": "1.6.24",
   "description": "AI-powered development system: 110 slash commands and 40 specialist agents that take a project from raw idea to hardened production. Runs inside Claude Code, Codex, Cursor, Windsurf, Gemini, and 10+ other AI coding tools.",
   "bin": {
     "godpowers": "./bin/install.js"

package/routing/recipes/release-maintenance.yaml

@@ -23,5 +23,7 @@ sequences:
         why: "Verify README, release notes, badges, and public docs against code"
       - command: "/god-version"
         why: "Confirm installed runtime and package version visibility"
+      - command: "/god-automation-setup"
+        why: "Use strict-release-readiness for any background release check; do not publish without explicit user approval"
 
 default-sequence: default

package/skills/god-automation-setup.md

@@ -83,8 +83,13 @@ for that exact write-capable automation:
 - `stale-checkpoint`: inspect checkpoint freshness and suggest `/god-sync` or `/god-resume-work`
 - `review-queue`: report unresolved review items without clearing them
 - `weekly-hygiene`: report docs, dependencies, checkpoint, reviews, and hygiene signals
+- `strict-release-readiness`: fail-closed release readiness across root docs, docs, agents, skills, routing, workflows, schema, templates, references, hooks, lib, scripts, tests, fixtures, GitHub workflows, package metadata, git tag state, GitHub release state, npm latest, and local install state
 - `release-readiness`: report release readiness without publishing
 
+Use `strict-release-readiness` for any background release automation. Use
+`release-readiness` only for quick manual checks where the user explicitly
+accepts a narrower report.
+
 ## Provider Guidance
 
 - Codex App: use native Codex automations when the host exposes them.

package/skills/god-version.md

@@ -14,7 +14,7 @@ Print version and a short capability summary.
 ## Output
 
 ```
-Godpowers v1.6.23
+Godpowers v1.6.24
 Install: /Users/.../.claude/  (matches package.json)
 Surface: 110 skills, 40 agents, 13 workflows, 40 recipes
 Schema: intent.v1, state.v1, events.v1, workflow.v1, routing.v1, recipe.v1