godpowers 2.5.0 → 2.5.1

package/CHANGELOG.md

@@ -7,6 +7,19 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+## [2.5.1] - 2026-06-10
+
+### Added
+- Added three Codex host-run proof case studies for slugify-cli, Countdown, and
+  react-github-readme-button.
+- Added Phase 2 proof evidence for successful CLI and web app runs plus one
+  blocked harden run with Critical dev-tooling findings preserved as a public
+  blocker.
+
+### Changed
+- Updated USERS, README, roadmap, reference, architecture, release notes, and
+  bridge-plan status for the Phase 2 host proof campaign.
+
 ## [2.5.0] - 2026-06-10
 
 ### Added

package/README.md

@@ -2,7 +2,7 @@
 
 [![CI](https://github.com/aihxp/godpowers/actions/workflows/ci.yml/badge.svg)](https://github.com/aihxp/godpowers/actions/workflows/ci.yml)
 [![License: MIT](https://img.shields.io/badge/License-MIT-yellow.svg)](LICENSE)
-[![Version](https://img.shields.io/badge/version-2.5.0-blue)](CHANGELOG.md)
+[![Version](https://img.shields.io/badge/version-2.5.1-blue)](CHANGELOG.md)
 [![npm](https://img.shields.io/npm/v/godpowers.svg)](https://www.npmjs.com/package/godpowers)
 
 **Ship fast. Ship right. Ship everything. Ship accountably.**
@@ -21,15 +21,19 @@ CLI-verifiable canaries now cover [sindresorhus/is](docs/case-studies/sindresorh
 [expressjs/cors](docs/case-studies/expressjs-cors-adoption-canary.md), and
 [tinyhttp/tinyhttp](docs/case-studies/tinyhttp-adoption-canary.md), with host
 slash-command gaps called out rather than hidden.
+Host-run proof studies now cover [slugify-cli](docs/case-studies/run-a.md),
+[Countdown](docs/case-studies/run-b.md), and
+[react-github-readme-button](docs/case-studies/run-c.md), including one
+blocked harden run recorded as evidence instead of hidden as success.
 
 Godpowers makes AI coding accountable: every serious run should leave disk
 state, artifacts, validation gates, host guarantees, and a next action. Code is
 only one output. The project memory and proof trail matter too.
 
-Version 2.5.0 adds executable tier gates through `npx godpowers gate` while
-keeping the 2.4 command-family UX, external CLI canary evidence, prompt-size
-guardrails, legacy command quarantine, lib coverage gating, and package
-verification before publish.
+Version 2.5.1 adds three Codex host-run proof studies on top of the 2.5.0
+executable tier gates, while keeping the 2.4 command-family UX, external CLI
+canary evidence, prompt-size guardrails, legacy command quarantine, lib
+coverage gating, and package verification before publish.
 
 Maintainer hardening continues on the 2.x line with small, audited public
 surface updates when they close real workflow gaps. The 2.1.0 patch closes a command-injection vector in the

package/RELEASE.md

@@ -1,12 +1,12 @@
-# Godpowers 2.5.0 Release
+# Godpowers 2.5.1 Release
 
-> Status: Ready for package verification
+> Status: Release candidate
 > Date: 2026-06-10
 
-Godpowers 2.5.0 ships executable tier gates for the code-first kernel
-migration. It keeps the slash-command workflow intact while giving command
-capable hosts a stable JSON gate contract and non-zero exit codes for blocked
-tier transitions.
+Godpowers 2.5.1 ships the Phase 2 host proof campaign as a docs patch release.
+It keeps the 2.5.0 executable tier gates intact while adding Codex host-run
+evidence for a CLI package, a browser app, and a TODO-backed React component
+project.
 
 ## What's in this release
 
@@ -18,35 +18,35 @@ tier transitions.
 
 ## Highlights
 
-- `npx godpowers gate --tier=<tier> --project=.` checks PRD, design,
-  architecture, roadmap, stack, repo, build, and harden artifacts.
-- Gate JSON returns `{tier, verdict, artifacts, checks, findings, summary}` for
-  host-visible evidence.
-- Build gates require `.godpowers/build/STATE.md` to record exact verification
-  commands that passed.
-- Harden gates fail unresolved Critical findings and blocked launch gates.
-- `/god-mode` now runs executable gates between tier transitions.
-- Tier routes declare `standards.gate-command`, and static checks enforce the
-  skill and route metadata.
-- CLI command dispatch now lives in `lib/cli-dispatch.js`, keeping
-  `bin/install.js` thin.
+- Run A completed a Codex host proof on slugify-cli with 13 of 13 workflow steps
+  complete, 16 of 16 requirements done, passing tests, passing production
+  audit, passing pack dry run, and no tracked source diff.
+- Run B completed a Codex host proof on Countdown with local browser evidence,
+  6 of 7 requirements done, dependency audit repair, and deployed-origin proof
+  deferred pending a staging URL.
+- Run C completed a documented failed Codex host proof on
+  react-github-readme-button, with local tests, lint, build, browser smoke, and
+  production audit passing before the run blocked on Critical dev-tooling audit
+  findings.
+- The host proof campaign captured command usage, gate failures, repairs,
+  blocker files, cost availability, and proof limits in `docs/case-studies/`.
 
 ## Validation
 
-- `node scripts/test-gate.js` green
-- `node scripts/test-cli-dispatch.js` green
-- `node scripts/static-check.js` green
-- `npm run release:check` required before publish
+- `npm run test:e2e` passed.
+- `node scripts/test-runtime-verification.js` passed.
+- `node scripts/test-agent-browser.js` passed.
+- `npm run release:check` passed before publish.
 
 ## Upgrade
 
-- `npm install -g godpowers@2.5.0` or `npx godpowers@2.5.0`
+- `npm install -g godpowers@2.5.1` or `npx godpowers@2.5.1`
 - Re-run `/god-context` in each project to refresh installed runtime metadata.
 - Existing `.godpowers/` state remains compatible.
 
 ## Notes
 
-- GitHub release creation for `v2.5.0`.
-- The tag should match the npm package version.
-- The `v2.5.0` tag should point to the release commit that matches the npm
-  `godpowers@2.5.0` package.
+- GitHub release created for `v2.5.1`.
+- The tag matches the npm package version.
+- The `v2.5.1` tag points to the release commit that matches the npm
+  `godpowers@2.5.1` package.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "godpowers",
-  "version": "2.5.0",
+  "version": "2.5.1",
   "description": "AI-powered development system: 112 slash commands and 40 specialist agents that take a project from raw idea to hardened production. Runs inside Claude Code, Codex, Cursor, Windsurf, Gemini, and 10+ other AI coding tools.",
   "bin": {
     "godpowers": "./bin/install.js"