godpowers 2.4.1 → 2.4.3

package/CHANGELOG.md

@@ -7,6 +7,58 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+## [2.4.3] - 2026-06-09
+
+### Added
+- Added three external CLI adoption canary case studies for sindresorhus/is,
+  expressjs/cors, and tinyhttp/tinyhttp with commit hashes, elapsed time,
+  zero-dollar local CLI cost, pause counts, and explicit host-run gaps.
+- Added a shared Godpowers Dashboard contract and shared locking contract under
+  `references/shared/`.
+- Added detailed runbook references for `god-orchestrator` and `/god-next`.
+- Added CLI dispatch tests for status, next, quick-proof, automation, dogfood,
+  extension scaffold, and unknown-command branches.
+- Added `npm run coverage:lib`, enforcing a 90 percent line coverage floor for
+  `lib/**/*.js` through c8.
+
+### Changed
+- Slimmed `agents/god-orchestrator.md`, `skills/god-next.md`, and
+  `skills/god-status.md` into concise dispatch contracts that delegate
+  long-form operational detail to references.
+- Replaced repeated skill locking boilerplate with one-line pointers to the
+  shared locking reference.
+- Updated `npm run release:check` to run the full suite under the lib coverage
+  floor before audit and package checks.
+- Updated package verification to pack into a temporary directory and clean the
+  generated tarball automatically.
+- Marked `/god-roadmap-check` deprecated, removed it from the command-family
+  presentation, and locked non-full install profiles against installing it.
+
+### Fixed
+- Removed ignored root tarball and `.DS_Store` clutter before release.
+
+## [2.4.2] - 2026-06-09
+
+### Added
+- Added strict YAML diagnostics for the dependency-free parser, covering
+  skipped malformed lines, unsafe prototype-pollution keys, and legacy empty
+  array shorthand.
+- Added shared markdown frontmatter parsing through `lib/frontmatter.js` and a
+  static check that blocks new inline parser drift.
+- Added dev-only coverage tooling through `c8` and `npm run coverage`.
+
+### Changed
+- Routing, recipe, and workflow loaders now surface strict YAML warnings with
+  file and line context.
+- Installer metadata, Pillars, skill validation, agent validation, checkpoint
+  reads, context budgets, skill surface metadata, and DESIGN.md parsing now use
+  the shared frontmatter helper.
+
+### Fixed
+- Extension manifests now fail closed on malformed YAML lines and unsafe keys
+  instead of accepting partially parsed manifests.
+- Removed stale root tarballs and `.DS_Store` package clutter before release.
+
 ## [2.4.1] - 2026-06-08
 
 ### Added

package/README.md

@@ -2,7 +2,7 @@
 
 [![CI](https://github.com/aihxp/godpowers/actions/workflows/ci.yml/badge.svg)](https://github.com/aihxp/godpowers/actions/workflows/ci.yml)
 [![License: MIT](https://img.shields.io/badge/License-MIT-yellow.svg)](LICENSE)
-[![Version](https://img.shields.io/badge/version-2.4.1-blue)](CHANGELOG.md)
+[![Version](https://img.shields.io/badge/version-2.4.3-blue)](CHANGELOG.md)
 [![npm](https://img.shields.io/npm/v/godpowers.svg)](https://www.npmjs.com/package/godpowers)
 
 **Ship fast. Ship right. Ship everything. Ship accountably.**
@@ -16,16 +16,19 @@ Want the short proof first? Start with [Quick Proof](docs/quick-proof.md) to
 run `npx godpowers quick-proof --project=. --brief`, see outcome metrics, pick
 a starter command set, and understand runtime expectations before reading the
 full reference. The [First 10 Minute Proof Case Study](docs/case-studies/first-10-minute-proof.md)
-shows the same evidence as a before-and-after adoption story.
+shows the same evidence as a before-and-after adoption story. External
+CLI-verifiable canaries now cover [sindresorhus/is](docs/case-studies/sindresorhus-is-adoption-canary.md),
+[expressjs/cors](docs/case-studies/expressjs-cors-adoption-canary.md), and
+[tinyhttp/tinyhttp](docs/case-studies/tinyhttp-adoption-canary.md), with host
+slash-command gaps called out rather than hidden.
 
 Godpowers makes AI coding accountable: every serious run should leave disk
 state, artifacts, validation gates, host guarantees, and a next action. Code is
 only one output. The project memory and proof trail matter too.
 
-Version 2.4.1 keeps the 2.4 command-family UX and adds a clearer first trust
-step: Quick Proof outcome metrics, a First 10 Minute Proof case study,
-profile-first onboarding, and surface-discipline guidance for future command
-growth.
+Version 2.4.3 keeps the 2.4 command-family UX and adds external CLI canary
+evidence, prompt-size guardrails, legacy command quarantine, lib coverage
+gating, and temp-directory package verification before publish.
 
 Maintainer hardening continues on the 2.x line with small, audited public
 surface updates when they close real workflow gaps. The 2.1.0 patch closes a command-injection vector in the

package/RELEASE.md

@@ -1,11 +1,12 @@
-# Godpowers 2.4.1 Release
+# Godpowers 2.4.3 Release
 
 > Status: Ready for package verification
-> Date: 2026-06-08
+> Date: 2026-06-09
 
-Godpowers 2.4.1 is an adoption-proof patch for the 2.4 line. It keeps the
-2.4.0 command-family UX intact while making the first trust step smaller,
-measurable, and easier to inspect before a user commits to a full project arc.
+Godpowers 2.4.3 is a review-followup release for the 2.4 line. It keeps the
+2.4 command-family UX intact while adding external CLI proof, prompt-size
+guardrails, legacy surface quarantine, lib coverage gating, and clean package
+verification before publish.
 
 ## What's in this release
 
@@ -16,38 +17,42 @@ measurable, and easier to inspect before a user commits to a full project arc.
 
 ## Highlights
 
-- Quick Proof now reports outcome metrics: commands to first signal,
-  disk-state source, tracked steps, missing planning artifacts, next command,
-  host level, and host gaps.
-- Adoption Canary reports now include CLI-verifiable outcome metrics for
-  quick-proof, status, and next signals.
-- README and Getting Started now lead with `--profile=core` and the brief Quick
-  Proof path before full autonomy.
-- The First 10 Minute Proof case study documents the local before-and-after
-  proof while clearly naming what still requires an external repository canary.
-- Reference and Roadmap docs now include surface-discipline guidance: try
-  families, ladders, profiles, recipes, typed route outcomes, and docs before
-  adding new public commands.
-- Package guardrails now require `lib/adoption-metrics.js`.
+- Three external CLI adoption canary case studies now cover sindresorhus/is,
+  expressjs/cors, and tinyhttp/tinyhttp, including commit hashes, elapsed time,
+  zero-dollar local CLI cost, pause counts, and explicit host-run gaps.
+- `agents/god-orchestrator.md`, `skills/god-next.md`, and
+  `skills/god-status.md` are now concise dispatch contracts that delegate
+  detailed runbook content to `references/`.
+- Repeated skill locking boilerplate now points to
+  `references/shared/LOCKING.md`.
+- `/god-roadmap-check` is deprecated, kept for full-profile compatibility, and
+  excluded from non-full installer profiles by regression test.
+- `npm run coverage:lib` enforces a 90 percent line coverage floor for
+  `lib/**/*.js`.
+- `npm run release:check` runs the full suite under the lib coverage floor
+  before audit and package verification.
+- Package verification now creates the npm tarball in a temporary directory and
+  removes it automatically.
 
 ## Validation
 
-- `npm test` green across the full suite
-- `npm run test:audit` green
-- `npm run pack:check` green
-- `npm pack` creates a local `godpowers-2.4.1.tgz` tarball for package
-  inspection
+- `node scripts/static-check.js` green
+- `node scripts/test-cli-dispatch.js` green
+- `node scripts/test-installer-profiles.js` green
+- `node scripts/run-adoption-canary.js https://github.com/sindresorhus/is.git --output=docs/case-studies/sindresorhus-is-adoption-canary.md` green
+- `node scripts/run-adoption-canary.js https://github.com/expressjs/cors.git --output=docs/case-studies/expressjs-cors-adoption-canary.md` green
+- `node scripts/run-adoption-canary.js https://github.com/tinyhttp/tinyhttp.git --output=docs/case-studies/tinyhttp-adoption-canary.md` green
+- `npm run release:check` required before publish
 
 ## Upgrade
 
-- `npm install -g godpowers@2.4.1` or `npx godpowers@2.4.1`
+- `npm install -g godpowers@2.4.3` or `npx godpowers@2.4.3`
 - Re-run `/god-context` in each project to refresh installed runtime metadata
-- No breaking changes; existing `.godpowers/` state is compatible. Users who
-  want a compact install can run `npx godpowers --profile=core`.
+- No breaking changes for valid `.godpowers/` state.
 
 ## Notes
 
-- GitHub release creation for `v2.4.1`
-- The tag should match the npm package version
-- The `v2.4.1` tag should point to the release commit that matches the npm
-  `godpowers@2.4.1` package.
+- GitHub release creation for `v2.4.3`
+- The tag should match the npm package version.
+- The `v2.4.3` tag should point to the release commit that matches the npm
+  `godpowers@2.4.3` package.