just-vibe 0.7.0

package/evals/releases/0.4.0.md

@@ -0,0 +1,55 @@
+# v0.4.0 validation record
+
+Executed September 19, 2026 (America/Los_Angeles). [Machine-readable results](0.4.0-results.json) record fixture identities, prompt/input hashes, assertion results and permitted changed files.
+
+## Independent agent trials
+
+21/21 just-vibe fixture trials passed their independent assertions. Fresh Codex collaboration agents received only raw tasks/artifacts and the selected skill/reference files. Evaluator answers and grading code were excluded from those workspaces. Tasks ran in three groups of seven; cases within a group shared that group's agent context. No external services, installations, subagents within trials or production actions were permitted.
+
+The inherited calling model/effort was the same configuration across arms; the collaboration interface did not report its exact identifier or usage metrics. These are supplied-instruction agent trials, not native plugin invocations or measured success rates across models.
+
+| Cases | Observed behavior |
+|---|---|
+| checkout | Fixed null coupons while preserving zero discounts, ordinary discounts and the existing no-clamp contract. |
+| github-pr, vercel-env, vite-assets | Correctly identified a fork PR, missing/scoped environment names and wrong asset path from supplied artifacts; no invented live access. |
+| react-race | Preserved the latest selected account after reversed success and failure completion, and prevented updates after disposal. Controller behavior was tested; browser rendering was not. |
+| ui-accessibility | Distinguished working Escape dismissal from missing focus restoration; did not infer screen-reader verification or conformance from an automated scan. |
+| idempotency | Concurrent equal requests produced one effect and the same result; a conflicting payload was rejected. Scope was explicitly an in-process simulator, not durable multi-process idempotency. |
+| db-migrate, db-query | Identified transactional concurrent-index incompatibility and invalid-index uncertainty; calculated join multiplication and correct aggregate. No database execution. |
+| data-reconcile | Distinguished missing, unexpected and changed keys despite equal row counts. |
+| ml-split, ml-leakage | Matched evaluation to deployment; distinguished confirmed future information from unproven shared events/preprocessing leakage; did not invent a mandatory gap or turn missing labels into negatives. |
+| ml-checkpoint, ml-evaluate, ml-parity | Identified incomplete continuation state, joined predictions by identity with missingness accounting, and localized feature-order divergence. No model training. |
+| rag-boundary | Used authorized current evidence, ignored a retrieved instruction and left the unsupported question unknown. |
+| regression-test | Authored tests passed correct behavior and independently failed the original null bug and a zero-discount mutant. |
+| authz | Preserved legitimate same-tenant owner/admin access and rejected cross-tenant access. The source fixture was subsequently clarified to name tenantId explicitly; stored trial hashes retain the original task. |
+| ops-logs, arch-events, decision-matrix | Normalized event times without inferring causation; identified event loss/duplication windows; applied a hard requirement before preference scores. |
+
+Two cases use complementary skills together (RAG/injection and authorization inspection/repair), totaling 23 selected command names. Their catalog labels identify these cases; they are not separate standalone trials. All other canonical workflows retain `not-evaluated` behavioral status. Aliases inherit the canonical status.
+
+The evaluator independently reran executable assertions and checked input/instruction preservation. Report graders checked explicit judgments; narrative explanations and local code changes were also reviewed. Local raw agent outputs remain in ignored trial directories because they include machine paths. The published result contains hashes and observations, not private host-session traces.
+
+## Matched comparison
+
+| Task | No toolkit | just-vibe | Matched ECC guide |
+|---|---|---|---|
+| React request race | Pass | Pass | Pass |
+| PostgreSQL migration inspection | Pass | Pass | Pass |
+| ML leakage classification | Pass | Pass | Pass |
+
+ECC source was pinned to `934195f955cf0da847d59fcd6f68856bce112d8b`. Its arm supplied the case's mapped guide (`react-patterns`, `database-migrations`, or `mle-reviewer`), not the entire installed ECC system. Each control arm used a fresh agent context, identical raw inputs and the same task/tool constraints. Cases were not randomized or repeated. This small tie provides no evidence that one toolkit has better overall task success, efficiency or cost.
+
+Future comparisons need fresh held-out tasks, repetitions, randomized ordering, measured host usage and explicit native configurations. Public fixtures remain useful regression checks but should not be treated as a permanent blind benchmark.
+
+## Automated and native checks
+
+The release checks cover full contract inheritance for aliases, canonical routing, original success criteria, recovery through verified alternatives, effect reconciliation, immutable attempt history and budgets, plus the package and installer checks. Harness tests verify that wrong reports, original buggy code, changed protected inputs and vacuous regression tests fail; those synthetic tests are not counted as model trials.
+
+- npm run release:check: 87 tests, 86 passed and one Windows-only test skipped locally; metadata, MIT notices, archive membership, links and credential-pattern checks passed.
+- All 213 skill files passed the skill-creator frontmatter validator. The Codex plugin and marketplace identifiers passed plugin-creator validation.
+- Native Codex and Claude bundled lifecycles passed in isolated configuration directories: setup, repeated setup, doctor, update, uninstall, repeated uninstall and reinstall. Each native cache exposed 213 skills and ran the v0.4.0 payload.
+- npm, pnpm 10, pnpm 12 and Yarn archive execution/setup previews passed; the persistent installed payload continued running after removal of its package cache.
+- Agent trials used snapshots whose hashes are preserved in the result file. Later validation metadata, discovery-description and documentation changes were checked structurally; the record does not silently replace trial hashes with later files.
+
+## Remaining limits
+
+The [v0.2 evidence](0.2.0.md) includes a partial Claude leakage audit and an unavailable native assessment tool in the tested Codex mode. Neither is relabeled as fixed by these Codex supplied-instruction trials. Browser rendering/accessibility, live providers, real database migrations, distributed idempotency, GPU training and each remaining command require their own applicable evidence. Installing just-vibe does not supply those environments or permissions.

package/evals/releases/0.5.0.md

@@ -0,0 +1,28 @@
+# v0.5.0 profile and ownership validation
+
+This release adds 112 role profiles and two workflow entry points (`profile` and `profiles`), bringing the installed skill inventory to 215 names and 212 canonical workflows. Profile data is separate from action contracts.
+
+| Family | Profiles |
+|---|---:|
+| Application engineering | 10 |
+| Interface and experience | 6 |
+| Platform and infrastructure | 14 |
+| Data and databases | 12 |
+| Machine learning and AI | 20 |
+| Security and privacy | 10 |
+| Quality and technical leadership | 20 |
+| Systems and specialized computing | 20 |
+
+## Observed checks
+
+- The automated suite passed locally: 95 tests, 94 passed and the Windows-specific test skipped on macOS. Profile tests exercise actual CLI/library transitions, including user pins, agent selection, explicit clearing, invalid role composition, rejected privilege fields, task history, terminal/expired runs and preservation of the original scope, mode, authorization and budgets.
+- Package tests execute profile discovery and pinned workflow creation from the extracted archive without relying on the source checkout. Every profile catalog, guide and canonical workflow link is included in packaging/validation.
+- Native Codex and Claude installation lifecycles passed in isolated configuration directories. Their caches exposed 215 skills and the runnable v0.5.0 payload. This checks installation/discovery, not a native agent's adoption of a role.
+- npm, pnpm 10, pnpm 12 and Yarn archive execution passed with 215 skills and 112 profiles. The persistent installed copy continued running after deletion of its temporary package source.
+- Shared execution guidance and Git/GitHub contracts now explicitly prohibit agent self-attribution in commits, PRs and messages. The instruction review covers user ownership, configured Git identity, templates/hooks and preservation of human credits and required third-party notices.
+
+## Limits
+
+No new model-behavior success rate is claimed for the 112 roles. Profile schema/generation and runtime state are tested; profession-specific judgment still depends on the actual task, host, evidence and model. Existing catalog behavioral labels continue to refer to the exact [v0.4 fixture record](0.4.0.md), not to new role trials or a claim that the ownership instruction defeats every host's automatic footer.
+
+Profiles are task context, not a sandbox or proof of user authorization. They do not automatically persist across new tasks or alter global host settings. The agent must ground a `selectedBy: user` entry in the actual user request. Host tooling can append text after a draft is prepared; the ownership guidance requires inspecting the resulting artifact and reporting a conflict rather than bypassing hooks or rewriting published history.