loadout-ai 0.5.8 → 0.5.9

package/CHANGELOG.md

@@ -2,6 +2,23 @@
 
 ## Unreleased
 
+## 0.5.9 - 2026-07-21
+
+### Fixed
+
+- Preserve active Stable skills when preparing Maximum Library by reserving their
+  managed targets before ordinary overlap deferral, while retaining fail-closed
+  commit, quarantine, and missing-source validation.
+- Run the canonical `npm run verify` release gate on ordinary pushes and pull
+  requests so CI cannot silently omit evidence, README-flow, or package checks.
+
+### Changed
+
+- Use one shared 30-skill recommended active-set limit in planning, inventory,
+  upgrade guidance, CLI defaults, and public workflow documentation.
+- Clearly archive superseded dashboard-era release notes and keep the public launch
+  checklist aligned with completed demo work and the current CLI-only product.
+
 ## 0.5.8 - 2026-07-21
 
 ### Fixed

package/MASTER_PLAN.md

@@ -13,7 +13,7 @@ history** is evidence of how the product was built, not unfinished launch scope.
 
 ### Product complete
 
-- [x] Publish the CLI as `loadout-ai@0.5.8`; keep the product usable without cloning
+- [x] Publish the CLI as `loadout-ai`; keep the product usable without cloning
       this repository or providing an OpenAI/Anthropic API key.
 - [x] Ship Stable, Power, Maximum, and Custom profiles with preview-first apply,
       snapshots, drift protection, explicit rollback, removal, and complete uninstall.
@@ -46,10 +46,10 @@ history** is evidence of how the product was built, not unfinished launch scope.
 
 ### Submission work
 
-- [ ] Record the real CLI demo using `docs/DEMO_SCRIPT.md`; keep it under three
+- [x] Record the real CLI demo using `docs/DEMO_SCRIPT.md`; keep it under three
       minutes, include a voiceover, upload it publicly to YouTube, and verify the URL.
-- [ ] Replace the README demo placeholder with the final YouTube link.
-- [ ] In the voiceover, explain what Loadout does and how Codex and GPT-5.6 were used.
+- [x] Replace the README demo placeholder with the final YouTube link.
+- [x] In the voiceover, explain what Loadout does and how Codex and GPT-5.6 were used.
 - [ ] Run `/feedback` in Codex, copy the resulting session ID, and enter it in Devpost.
 - [x] Confirm the public repository URL is accessible to Devpost and OpenAI.
 - [x] Confirm all team invitations are accepted. Both teammates are collaborators and
@@ -72,12 +72,12 @@ These are not launch blockers and should not be rebuilt before submission:
 - Restoring GitHub-hosted Actions capacity before submission; the full gate can run
   locally, and the latest completed `main` CI is already passing.
 
-## Archived current-status diary (historical, not active scope)
+## Archived implementation diary (historical, not active scope)
 
-This section preserves the chronological implementation and founder-testing record.
-Its unchecked boxes may describe older release numbers, superseded acceptance paths,
-external research, or intentionally deferred work. They are not active launch tasks;
-use the launch finish line above.
+Everything below this heading is a frozen chronological implementation record. Its
+dashboard references, old release numbers, unchecked boxes, and superseded acceptance
+paths describe earlier product states; they are neither current capabilities nor
+active launch tasks. Use only the launch finish line above for current status.
 
 ### Implemented product work
 

package/README.md

@@ -34,7 +34,7 @@
 You need Node.js 20 or newer and Git.
 
 ```bash
-npm install --global loadout-ai@0.5.8
+npm install --global loadout-ai@0.5.9
 loadout setup --mode stable
 ```
 
@@ -112,13 +112,19 @@ their own explicit setup and permission steps.
 
 ### Demo
 
-**Demo video coming here.** The release walkthrough will show the real path, not a
-mock UI: Stable install, cross-agent inventory, project optimization, update and
-discovery checks, MCP setup, Graphify, rollback, and complete uninstall. The exact
-under-three-minute [recording and voiceover script](./docs/DEMO_SCRIPT.md) is public.
+<p align="center">
+  <a href="https://www.youtube.com/watch?v=opNqJKX7xMw">
+    <img src="https://img.youtube.com/vi/opNqJKX7xMw/maxresdefault.jpg" alt="Watch the 72-second Loadout demo" width="880">
+  </a>
+</p>
+
+**[Watch the 72-second Loadout demo on YouTube](https://www.youtube.com/watch?v=opNqJKX7xMw).**
+It shows the real CLI product, including profiles, project-aware selection,
+discovery, explicit integrations, and snapshot-backed rollback. The exact
+[recording and voiceover script](./docs/DEMO_SCRIPT.md) is public.
 
-For now, the [end-to-end acceptance guide](./docs/USER_TEST_GUIDE.md) contains the same
-commands you can run yourself.
+The [end-to-end acceptance guide](./docs/USER_TEST_GUIDE.md) contains the commands
+you can run yourself.
 
 ## Stable workflow
 
@@ -324,7 +330,7 @@ The bundled catalog currently contains **53 credited public repositories** acros
 
 <!-- loadout:evidence-stages:start -->
 
-Catalog maturity: **53 sourced**, **53 technically inspected**, and **4 selected for Stable**. Independent human-review attestations and signed comparative benchmarks are not yet published, so Loadout does not pretend static inspection proves usefulness. The pinned catalog remains usable today, and local outcomes can be recorded to improve later rankings. Definitions and promotion rules are in the [catalog policy](./docs/CATALOG_POLICY.md).
+Catalog maturity: **53 sourced**, **53 technically inspected**, and **4 selected for Stable**. Independent human-review attestations are not yet published, so Loadout does not pretend static inspection proves usefulness. The pinned catalog remains usable today, and local outcomes can be recorded to improve later rankings. Definitions and promotion rules are in the [catalog policy](./docs/CATALOG_POLICY.md).
 
 <!-- loadout:evidence-stages:end -->
 
@@ -332,7 +338,7 @@ Loadout does not claim there is one universally “best” configuration. Recomm
 
 <!-- loadout:daily-discovery:start -->
 
-**Discovery snapshot (generated 2026-07-21):** [240 repositories observed](./docs/DISCOVERED.md), including 216 uncataloged review candidates and 24 repositories already in the inspected catalog.
+**Discovery snapshot (generated 2026-08-27):** [236 repositories observed](./docs/DISCOVERED.md), including 217 uncataloged review candidates and 19 repositories already in the inspected catalog.
 <!-- loadout:daily-discovery:end -->
 
 The checked-in discovery report proves only its dated snapshot, not the success of every scheduled run. Use `loadout discover --source all --queue`, `loadout review-queue`, and `loadout candidate inspect owner/repository` to inspect candidates before catalog promotion.
@@ -341,7 +347,7 @@ The checked-in discovery report proves only its dated snapshot, not the success
 
 - A pinned commit identifies source bytes; it does not prove safety, correct licensing, usefulness, or future compatibility.
 - Static inspection reports scripts, hooks, binaries, domains, credential references, and unsupported components. It is not a security audit.
-- No bundled source is called benchmarked until isolated real trials, signed evidence, and human approval exist.
+- No bundled source is called proven until human review and recorded local outcomes support it; static inspection alone never earns that label.
 - Project recommendations read bounded local metadata. The documented local flow does not upload project source.
 - Catalog fetches, discovery, update checks, and optional live checks use the network where stated.
 - MCP servers and executable tools have separate preview and approval paths because they can use credentials, start processes, or contact services.
@@ -435,7 +441,7 @@ without loading thousands of skills into every prompt.
 | Ecosystem research | Compared repositories, checked source layouts and licenses, and separated popularity from evidence                           | 53 pinned catalog sources plus a discovery snapshot watching 240 repositories                               |
 | Implementation     | Wrote and refactored CLI commands, schemas, source fetchers, installers, active-set logic, and MCP configuration             | The published `loadout-ai` package and the commands documented above                                        |
 | Safety work        | Looked for scripts, hooks, binaries, credential references, target collisions, stale previews, and external edits            | Preview-first changes, quarantined skill units, explicit risk approval, drift protection, and rollback      |
-| Testing            | Generated adversarial cases, reproduced failures from real terminal sessions, and converted them into regression tests       | 625 passing tests, CLI and README end-to-end flows, package smoke tests, and a 1,000-skill performance gate |
+| Testing            | Generated adversarial cases, reproduced failures from real terminal sessions, and converted them into regression tests       | 632 passing tests, CLI and README end-to-end flows, package smoke tests, and a 1,000-skill performance gate |
 | Team integration   | Audited teammate branches, compared them with `main`, prepared focused pull requests, and checked what was actually complete | One public history instead of three disconnected prototypes                                                 |
 | Release work       | Verified npm contents, version behavior, GitHub metadata, documentation claims, and public CI                                | A public npm package, credited upstream catalog, release evidence, and a reproducible verification command  |