godpowers 2.4.2 → 2.5.0

package/CHANGELOG.md

@@ -7,6 +7,56 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+## [2.5.0] - 2026-06-10
+
+### Added
+- Added `npx godpowers gate --tier=<tier> --project=.` for PRD, design,
+  architecture, roadmap, stack, repo, build, and harden tier gates.
+- Added `lib/artifact-map.js`, `lib/gate.js`, and `lib/cli-dispatch.js` so
+  artifact paths, executable gates, and CLI command dispatch are tested outside
+  the installer binary.
+- Added gate fixtures and tests for green tier artifacts, missing artifacts,
+  lint failures, harden Critical findings, build verification evidence, JSON
+  shape stability, async API coverage, and CLI exit codes.
+
+### Changed
+- Updated eight tier skills and their routing metadata to require the
+  executable gate before downstream work proceeds.
+- Updated `/god-mode` and its runbook to run executable gates between tier
+  transitions.
+- Updated static checks and route-quality sync so missing gate instructions and
+  missing `standards.gate-command` metadata block release readiness.
+
+## [2.4.3] - 2026-06-09
+
+### Added
+- Added three external CLI adoption canary case studies for sindresorhus/is,
+  expressjs/cors, and tinyhttp/tinyhttp with commit hashes, elapsed time,
+  zero-dollar local CLI cost, pause counts, and explicit host-run gaps.
+- Added a shared Godpowers Dashboard contract and shared locking contract under
+  `references/shared/`.
+- Added detailed runbook references for `god-orchestrator` and `/god-next`.
+- Added CLI dispatch tests for status, next, quick-proof, automation, dogfood,
+  extension scaffold, and unknown-command branches.
+- Added `npm run coverage:lib`, enforcing a 90 percent line coverage floor for
+  `lib/**/*.js` through c8.
+
+### Changed
+- Slimmed `agents/god-orchestrator.md`, `skills/god-next.md`, and
+  `skills/god-status.md` into concise dispatch contracts that delegate
+  long-form operational detail to references.
+- Replaced repeated skill locking boilerplate with one-line pointers to the
+  shared locking reference.
+- Updated `npm run release:check` to run the full suite under the lib coverage
+  floor before audit and package checks.
+- Updated package verification to pack into a temporary directory and clean the
+  generated tarball automatically.
+- Marked `/god-roadmap-check` deprecated, removed it from the command-family
+  presentation, and locked non-full install profiles against installing it.
+
+### Fixed
+- Removed ignored root tarball and `.DS_Store` clutter before release.
+
 ## [2.4.2] - 2026-06-09
 
 ### Added

package/README.md

@@ -2,7 +2,7 @@
 
 [![CI](https://github.com/aihxp/godpowers/actions/workflows/ci.yml/badge.svg)](https://github.com/aihxp/godpowers/actions/workflows/ci.yml)
 [![License: MIT](https://img.shields.io/badge/License-MIT-yellow.svg)](LICENSE)
-[![Version](https://img.shields.io/badge/version-2.4.2-blue)](CHANGELOG.md)
+[![Version](https://img.shields.io/badge/version-2.5.0-blue)](CHANGELOG.md)
 [![npm](https://img.shields.io/npm/v/godpowers.svg)](https://www.npmjs.com/package/godpowers)
 
 **Ship fast. Ship right. Ship everything. Ship accountably.**
@@ -16,16 +16,20 @@ Want the short proof first? Start with [Quick Proof](docs/quick-proof.md) to
 run `npx godpowers quick-proof --project=. --brief`, see outcome metrics, pick
 a starter command set, and understand runtime expectations before reading the
 full reference. The [First 10 Minute Proof Case Study](docs/case-studies/first-10-minute-proof.md)
-shows the same evidence as a before-and-after adoption story.
+shows the same evidence as a before-and-after adoption story. External
+CLI-verifiable canaries now cover [sindresorhus/is](docs/case-studies/sindresorhus-is-adoption-canary.md),
+[expressjs/cors](docs/case-studies/expressjs-cors-adoption-canary.md), and
+[tinyhttp/tinyhttp](docs/case-studies/tinyhttp-adoption-canary.md), with host
+slash-command gaps called out rather than hidden.
 
 Godpowers makes AI coding accountable: every serious run should leave disk
 state, artifacts, validation gates, host guarantees, and a next action. Code is
 only one output. The project memory and proof trail matter too.
 
-Version 2.4.2 keeps the 2.4 command-family UX and hardens the release-facing
-runtime: strict YAML diagnostics for routing, recipes, workflows, and extension
-manifests; shared markdown frontmatter parsing; dev-only coverage tooling; and
-clean package hygiene before publish.
+Version 2.5.0 adds executable tier gates through `npx godpowers gate` while
+keeping the 2.4 command-family UX, external CLI canary evidence, prompt-size
+guardrails, legacy command quarantine, lib coverage gating, and package
+verification before publish.
 
 Maintainer hardening continues on the 2.x line with small, audited public
 surface updates when they close real workflow gaps. The 2.1.0 patch closes a command-injection vector in the
@@ -248,6 +252,7 @@ npx godpowers next --project=.
 npx godpowers status --project=. --brief
 npx godpowers status --project=. --json
 npx godpowers quick-proof --project=.
+npx godpowers gate --tier=prd --project=.
 npx godpowers dogfood
 npx godpowers extension-scaffold --name=@godpowers/my-pack --output=.
 ```
@@ -268,6 +273,17 @@ test order is maintained as a readable list instead of a long package script.
 decomposition, async runtime APIs, agent reference validation coverage, and God
 Mode runbook delegation.
 
+Tier skills now run the executable gate before downstream work proceeds:
+
+```bash
+npx godpowers gate --tier=prd --project=.
+npx godpowers gate --tier=build --project=.
+npx godpowers gate --tier=harden --project=.
+```
+
+The gate reads disk artifacts, runs the shared artifact linter, checks build
+verification evidence, and blocks unresolved Critical harden findings.
+
 The runtime remains dependency-free. YAML parsing is intentionally limited to
 the documented Godpowers subset used by intent, routing, workflow, and
 extension files, with parser coverage in `scripts/test-yaml-parser.js`.

package/RELEASE.md

@@ -1,12 +1,12 @@
-# Godpowers 2.4.2 Release
+# Godpowers 2.5.0 Release
 
 > Status: Ready for package verification
-> Date: 2026-06-09
+> Date: 2026-06-10
 
-Godpowers 2.4.2 is a release-hardening patch for the 2.4 line. It keeps the
-2.4 command-family UX intact while making parser failures, frontmatter
-metadata, coverage visibility, and package hygiene more accountable before
-publish.
+Godpowers 2.5.0 ships executable tier gates for the code-first kernel
+migration. It keeps the slash-command workflow intact while giving command
+capable hosts a stable JSON gate contract and non-zero exit codes for blocked
+tier transitions.
 
 ## What's in this release
 
@@ -14,45 +14,39 @@ publish.
 - 40 specialist agents
 - 13 executable workflows
 - 42 intent recipes
+- 8 installer CLI helpers
 
 ## Highlights
 
-- YAML parsing now exposes strict diagnostics for malformed skipped lines and
-  unsafe prototype-pollution keys while preserving default legacy reads.
-- Routing, recipe, and workflow YAML loaders now surface warnings with file and
-  line context.
-- Extension manifests now fail closed on malformed YAML lines and unsafe keys.
-- Markdown frontmatter parsing is centralized in `lib/frontmatter.js` and
-  enforced by `scripts/static-check.js`.
-- Installer metadata, Pillars, skill validation, agent validation,
-  checkpoints, context budgets, skill surface metadata, and DESIGN.md parsing
-  now share the same frontmatter path.
-- `npm run coverage` is available through dev-only `c8` tooling.
-- Stale root package tarballs and `.DS_Store` clutter were removed before
-  release.
+- `npx godpowers gate --tier=<tier> --project=.` checks PRD, design,
+  architecture, roadmap, stack, repo, build, and harden artifacts.
+- Gate JSON returns `{tier, verdict, artifacts, checks, findings, summary}` for
+  host-visible evidence.
+- Build gates require `.godpowers/build/STATE.md` to record exact verification
+  commands that passed.
+- Harden gates fail unresolved Critical findings and blocked launch gates.
+- `/god-mode` now runs executable gates between tier transitions.
+- Tier routes declare `standards.gate-command`, and static checks enforce the
+  skill and route metadata.
+- CLI command dispatch now lives in `lib/cli-dispatch.js`, keeping
+  `bin/install.js` thin.
 
 ## Validation
 
-- `node scripts/test-yaml-parser.js` green
-- `node scripts/test-frontmatter.js` green
-- `node scripts/test-extensions.js` green
-- `node scripts/test-router.js` green
-- `node scripts/test-recipes.js` green
-- `node scripts/test-install-smoke.js` green
+- `node scripts/test-gate.js` green
+- `node scripts/test-cli-dispatch.js` green
+- `node scripts/static-check.js` green
 - `npm run release:check` required before publish
-- `npm pack` creates a local `godpowers-2.4.2.tgz` tarball for package
-  inspection
 
 ## Upgrade
 
-- `npm install -g godpowers@2.4.2` or `npx godpowers@2.4.2`
-- Re-run `/god-context` in each project to refresh installed runtime metadata
-- No breaking changes for valid `.godpowers/` state. Invalid extension
-  manifests that were previously partially accepted now fail with parse errors.
+- `npm install -g godpowers@2.5.0` or `npx godpowers@2.5.0`
+- Re-run `/god-context` in each project to refresh installed runtime metadata.
+- Existing `.godpowers/` state remains compatible.
 
 ## Notes
 
-- GitHub release creation for `v2.4.2`
-- The tag should match the npm package version
-- The `v2.4.2` tag should point to the release commit that matches the npm
-  `godpowers@2.4.2` package.
+- GitHub release creation for `v2.5.0`.
+- The tag should match the npm package version.
+- The `v2.5.0` tag should point to the release commit that matches the npm
+  `godpowers@2.5.0` package.

package/SKILL.md

@@ -53,6 +53,11 @@ Each tier gates on a verified artifact from the prior tier. You cannot build
 without architecture. You cannot deploy without a build. You cannot launch with
 unresolved Critical security findings.
 
+For PRD, design, architecture, roadmap, stack, repo, build, and harden, run
+`npx godpowers gate --tier=<tier> --project=.` after the tier artifact is
+created and before starting downstream tier work. A non-zero exit blocks
+progress until the artifact or evidence is repaired.
+
 ### 5. Context Isolation
 Every execution agent gets a fresh context window. The orchestrator is thin; it
 spawns workers with full context budgets. This defeats context rot.