loadout-ai 0.3.1 → 0.4.0

package/CHANGELOG.md

@@ -1,5 +1,47 @@
 # Changelog
 
+## 0.4.0 - 2026-07-20
+
+### Added
+
+- Add generated, test-enforced README facts and bounded release claims so public
+  documentation cannot silently drift away from the shipped catalog, profiles,
+  adapters, commands, or verification surface.
+- Add disposable filesystem lifecycle conformance coverage for all 12 configured
+  agent adapters and an offline README product journey covering library install,
+  activation, inspection, privacy-safe sharing, and rollback.
+- Add a new Loadout visual identity and a proof-first README organized around the
+  Choose -> Inspect -> Preview -> Apply -> Undo workflow.
+
+### Changed
+
+- Make CI and claim-generation paths portable on Windows, fetch the repository
+  history needed by evidence checks, and pin third-party Actions by immutable commit.
+- Consolidate active planning in `MASTER_PLAN.md` and retain completed implementation
+  documents only as historical evidence.
+
+### Fixed
+
+- Refuse explicit rollback when managed paths changed after a mutation, including
+  dashboard restores and unsupported filesystem entries, while retaining automatic
+  failed-transaction recovery.
+- Bind adoption to the complete safe skill tree, reject drift and forged plans, and
+  record ownership only after verifying the final bytes.
+- Record installed-profile state inside the setup transaction so Stable and other
+  profile changes can be rolled back consistently.
+
+## 0.3.2 - 2026-07-18
+
+### Fixed
+
+- Treat recursively empty skill directories left by an older removal as unoccupied,
+  while continuing to block every directory containing a file, symlink, or other
+  unmanaged entry.
+- Re-check target occupancy immediately before copying or replacing files to close the
+  preview/apply race.
+- Remove recursively empty managed skill directories during complete uninstall so a
+  clean reinstall does not encounter false conflicts.
+
 ## 0.3.1 - 2026-07-18
 
 ### Fixed

package/MASTER_PLAN.md

@@ -6,13 +6,14 @@ Category: Developer Tools
 Team size: 3  
 Target submission: July 21, 2026 at 5:00 PM Pacific / July 22 at 4:00 AM Dubai
 
-## Current remaining work (July 18, 2026)
+## Current status and remaining work (July 20, 2026)
 
 This is the authoritative active list. The long phase history below is retained as
-an engineering record, not a command to build every speculative system before users
-can test Loadout.
+an archival engineering record, not a second active plan and not a command to build
+every speculative system before users can test Loadout. Completed implementation
+plans and contributor-specific plans have been consolidated here and removed.
 
-### Required before calling the CLI polished for public testing
+### Implemented product work
 
 - [x] `P18-01 [TERRA]` Make the first CLI screen beginner-readable: a read-only
       `loadout guide`, concise default library summary, focused first-screen help,
@@ -21,9 +22,6 @@ can test Loadout.
 - [x] `P18-02 [TERRA]` Make core machine output honest: `catalog --json` returns
       JSON, and `update --package <id>` checks only that package rather than every
       tracked installation.
-- [ ] `P18-03 [HUMAN+TERRA]` Run the founder acceptance path in
-      `docs/USER_TEST_GUIDE.md` on the real Codex and Claude profiles. Record each
-      observed failure and turn reproducible ones into regression tests.
 - [x] `P18-04 [TERRA]` Bound and explain live network checks in `health --updates`
       and `watch --once`; they must show progress, a clear timeout, and an actionable
       result even when a large Maximum library is present.
@@ -36,9 +34,78 @@ can test Loadout.
 - [x] `P18-07 [TERRA]` Add a concise beginner section to README that links to the
       testing guide and explains Stable, Power, Maximum, project recommendations,
       daily discovery, and rollback in plain language.
-- [ ] `P18-08 [HUMAN+TERRA]` Run the full verification gate, publish the next npm
-      patch/minor only after founder acceptance, and test that exact tarball in a
-      fresh terminal.
+- [x] `P18-15 [TERRA]` Bind material README claims to checked repository evidence,
+      add generated facts and adapter lifecycle coverage, test the documented product
+      flow, and separate deterministic, live, and human evidence.
+- [x] `P18-16 [TERRA]` Make risky setup previews include every required approval
+      flag, reject unknown top-level commands, and make user-requested rollback fail
+      closed when files changed after a mutation or when a legacy snapshot lacks
+      post-mutation evidence. Internal failed-transaction recovery remains
+      authoritative.
+- [x] `P18-19 [SOL+TERRA]` Re-audit the final unmerged development branch before deletion and preserve its
+      one valuable adoption-safety intent in the current architecture. Adoption now
+      binds the complete safe tree, rejects drift and special entries, records only
+      final verified bytes, conservatively attributes catalog review, deep-freezes
+      previews, and accepts only the exact same-process planner-issued plan
+      (`186daa0`, `09e0e0c`, `3f2cafe`, `10d6109`). No valuable work remains on the
+      retired branch; its local and remote copies were deleted after synchronization while
+      the user's ignored `.superpowers/` directory was preserved.
+- [x] `P18-20 [SOL+TERRA]` Fix the fresh-clone live Stable rollback regression
+      without weakening drift protection. `5f8e38e` records installed-profile state
+      inside the catalog transaction before post-mutation evidence and makes the live
+      evidence journey roll Stable back before unrelated fixture transactions. An
+      unsafe proposal to ignore `state.json` drift was rejected because it could
+      orphan later installations.
+
+All intended work through P18-20 is on remote `main`, and there are no open PRs. The
+merged `codex/relatable-readme-hero` remote branch remains safe to delete after the
+0.4.0 release checkpoint.
+
+### Deterministic repository verification
+
+- [x] `P18-08 [TERRA]` Run the complete clean-state verification gate after plan and
+      documentation consolidation, including formatting, lint, type checking, build,
+      evidence checks, unit and integration tests, CLI and README product flows,
+      package smoke, performance, dashboard Playwright, package contents, and
+      `git diff --check`. The July 20 integrated-main audit passed 113 test files with
+      597 tests passing and one intentionally skipped, both product flows, package
+      smoke, the 1,000-skill performance gate at 2.40 seconds p95, and both dashboard
+      viewports.
+      The additional live Stable gate installed four pinned packages and completed
+      state and filesystem rollback assertions at `5f8e38e`.
+
+### Branch cleanup status
+
+- [x] Review all unique history on the final unmerged development branch before
+      deletion; the adoption gap above was the only remaining valuable intent.
+- [x] Reimplement and regression-test that intent in the current architecture.
+- [x] Complete the second remote synchronization, confirm the four adoption commits
+      are reachable from remote `main`, and delete the superseded development
+      branches. The temporary worktree was removed and the unrelated ignored
+      `.superpowers/` directory was preserved. The later merged README hero branch is
+      retained only until the 0.4.0 release checkpoint.
+
+### Human and external work (not provable by local tests)
+
+- [ ] `P18-03 [HUMAN+TERRA]` Run the founder acceptance path in
+      `docs/USER_TEST_GUIDE.md` on real Codex and Claude profiles. Record each
+      observed failure and turn reproducible ones into regression tests.
+- [ ] `P18-13 [HUMAN+TERRA]` Publish `loadout-ai@0.4.0` to npm, then test that exact
+      registry tarball in a fresh terminal through Stable -> rollback -> Power ->
+      rollback -> Maximum -> project optimization -> dashboard -> complete uninstall.
+      The registry exposed versions only through `0.3.1` before this release attempt;
+      local package metadata and a Git tag do not prove publication.
+- [ ] `P18-17 [HUMAN]` Resolve the GitHub account billing or spending-limit condition
+      that prevents Actions jobs from starting, rerun CI and daily discovery on the
+      integrated commit, and record the result. CI runs
+      [`29691581581`](https://github.com/VirajMishra1/loadout/actions/runs/29691581581)
+      (`4fdc473`) and [`29692535521`](https://github.com/VirajMishra1/loadout/actions/runs/29692535521)
+      (`e74ba16`) failed before any step ran; their annotations cite failed recent
+      account payments or a spending limit that must be increased. They are external
+      runner-account failures, not product-test failures.
+- [ ] `P18-18 [HUMAN]` Decide and configure appropriate `main` branch protection.
+      GitHub currently returns 404 for the protection endpoint, so protection is
+      absent or not observable; do not describe it as enabled.
 
 ### Release 0.3 lifecycle hardening
 
@@ -52,9 +119,9 @@ can test Loadout.
 - [x] `P18-12 [TERRA]` Add a pinned Chrome DevTools MCP recipe and distinguish
       separately billed AI/model API keys from unrelated service credentials. The
       no-model-key inventory includes GitHub read-only with its token disclosed.
-- [ ] `P18-13 [HUMAN+TERRA]` Publish `0.3.1`, then run Stable -> rollback -> Power ->
-      rollback -> Maximum -> project optimization -> dashboard -> complete uninstall
-      against the exact npm package.
+- [x] `P18-14 [TERRA]` Treat recursively empty directories from legacy cleanup as
+      unoccupied without weakening unmanaged-file protection, and make complete
+      uninstall remove empty nested directory shells.
 
 ### Explicitly deferred (do not expand during this usability pass)
 
@@ -66,6 +133,12 @@ can test Loadout.
 - A universal quality score, social-network scraping, or support claims for an agent
   that has not passed a real adapter test.
 
+## Archived implementation history
+
+Sections 1–20 below preserve the original product design, allocation, completed work,
+and deferred exploration. They are historical context. Only the current-status section
+above defines active work.
+
 ## 1. Executive summary
 
 Loadout is a universal extension manager for AI coding agents. It detects the agents