luciazero 1.5.0

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
package/CHANGELOG.md ADDED
@@ -0,0 +1,423 @@
1
+ # Changelog
2
+
3
+ All notable changes to this project are documented in this file.
4
+
5
+ Format: [Keep a Changelog](https://keepachangelog.com/en/1.1.0/).
6
+ Versioning: [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
7
+
8
+ ## [Unreleased]
9
+
10
+ ## [1.5.0] - 2026-08-10
11
+
12
+ ### Changed
13
+
14
+ - **Project renamed to Luciazero** (from "lucidone", hours after 1.4.1, before
15
+ any adoption) — the mascot's name belongs in the project's name, and
16
+ Lucia + exit 0 says what the doctrine means by done. Every identifier moved:
17
+ files, `LUCIAZERO_*` env vars, hooks, markers, sidecars, npm/plugin names.
18
+ Versions 1.4.0–1.4.1 shipped to npm as `lucidone` and were unpublished
19
+ within npm's 72-hour window; GitHub tags v1.4.0/v1.4.1 keep the old-name
20
+ trees for the record. Earlier CHANGELOG entries read with the new name
21
+ applied retroactively.
22
+
23
+ ### Added
24
+
25
+ - **Learning layer** — the pack now compounds experience across sessions,
26
+ three stores, all mechanized and all pruned:
27
+ - `/retro` records debugged failures to a per-repo lesson ledger
28
+ (`docs/lessons.md`, fixed greppable shape: symptom → cause → proven-by →
29
+ fix) and repo-independent lessons to `luciazero-heuristics.md` in the
30
+ harness config dir (one line each, hard 100-line cap); stale entries are
31
+ corrected or deleted, since a wrong lesson mis-seeds every future debug.
32
+ - `/debug` seeds its hypothesis ledger from both files before inventing
33
+ hypotheses — a match becomes H1 but is still verified.
34
+ - The stop hook appends one line per stop outcome (`stop-clean` / `nudge` /
35
+ `strict-block`) to `luciazero-stats.log` in the config dir — local only,
36
+ fail-open, rotated at 500→250 lines — and `/retro` reads it to turn
37
+ recurring discipline gaps into recorded lessons. This is the one
38
+ documented exception to "state never leaves $TMPDIR"; the hook header
39
+ says so.
40
+ - Both uninstallers keep (and mention) the learned-data files.
41
+ - test.sh: stats logging proven for all three outcomes + rotation +
42
+ uninstall survival, learning-layer wiring greps on both skills, and the
43
+ whole run now exports a sandbox `CLAUDE_CONFIG_DIR` so no test can ever
44
+ write to the real `~/.claude`. New checks red-proven by mutation.
45
+
46
+ ## [1.4.1] - 2026-08-10
47
+
48
+ ### Added
49
+
50
+ - **Trusted publishing (OIDC)**: `release.yml` gained an `npm-publish` job —
51
+ every `v*` tag now publishes to npm from GitHub Actions with provenance
52
+ attestations and no token anywhere. Guards: the tag must equal the
53
+ `package.json` version, and already-live versions are skipped so re-runs
54
+ cannot fail. This release exists to exercise that pipeline end to end.
55
+
56
+ ### Fixed
57
+
58
+ - The README shipped inside the npm tarball no longer carries the
59
+ "npm publish is in flight" sentence that 1.4.0 froze in.
60
+
61
+ ## [1.4.0] - 2026-08-10
62
+
63
+ ### Changed
64
+
65
+ - **Project renamed to Luciazero** (from "agentic-engineering"). Every brand
66
+ identifier moved with it: doctrine file `claude/luciazero.md` (imported as
67
+ `@luciazero.md`), hooks `luciazero-verify.sh` / `luciazero-statusline.sh`,
68
+ skill `/luciazero-bootstrap`, env vars `LUCIAZERO_*` (was `AGENTIC_*`),
69
+ version sidecars `.luciazero-version`, CI example
70
+ `examples/luciazero-ci.example.yml`, hook state dir `luciazero-verify-state`,
71
+ and the settings-cleanup matchers in both uninstallers. Nothing was
72
+ published under the old name, so there is no migration path to keep.
73
+ Prose still uses "agentic engineer(ing)" where it names the discipline,
74
+ not the project.
75
+ - **Skills moved to the repo root** (`skills/`, was `claude/skills/`) so
76
+ `npx skills add <owner>/luciazero` (vercel-labs/skills) discovers them with
77
+ zero registration. Installers, tests, and docs all read the new path.
78
+
79
+ ### Added
80
+
81
+ - **Claude Code plugin packaging**: `.claude-plugin/plugin.json` +
82
+ `.claude-plugin/marketplace.json` make the repo installable as a plugin
83
+ from its own single-plugin marketplace (`/plugin marketplace add
84
+ <owner>/luciazero` → `/plugin install luciazero@luciazero`); `claude plugin
85
+ validate` passes. `claude/hooks/hooks.json` wires the verify hooks via
86
+ `${CLAUDE_PLUGIN_ROOT}`, and a new `doctrine` subcommand of
87
+ `luciazero-verify.sh` loads the doctrine as SessionStart context — plugins
88
+ cannot add a CLAUDE.md import line — with a guard that stays silent when a
89
+ classic install exists, so the doctrine never loads twice. Honest limits
90
+ documented: no statusline via plugins; pick one channel so hooks are not
91
+ wired twice.
92
+ - **npm wrapper** (`package.json` + `bin/luciazero.js`): `npx luciazero`
93
+ routes to the bundled installers (`codex`, `uninstall`, `uninstall-codex`
94
+ subcommands; flags pass through). No lifecycle scripts, ever — test.sh
95
+ fails if one appears, matching npm v12's default block.
96
+ - **Lucia mascot** in both READMEs, cropped from the project's character
97
+ sheet (`docs/assets/lucia*.png`): plushie-hug under the title, laptop pose
98
+ at the eval paragraph, and the fist-up pose celebrating
99
+ `PASS all checks green` in Development.
100
+ - **README rewrite (both languages)**: install-channels-first — plugin
101
+ (recommended) and `npx skills add` lead, classic `git clone` demoted to the
102
+ reference channel; sections condensed; the stale "Why not a Claude Code
103
+ plugin" design note replaced with "How the plugin squares with this"; new
104
+ "Lucia family & support" section (Lucia Discord bot + donate link).
105
+ A 2-lens verification pass (bilingual fidelity + truth-to-code) confirmed
106
+ the new claims and caught 4 wording issues, all fixed.
107
+ - **docs/publishing.md**: dependency-ordered release checklist (GitHub →
108
+ plugin directory submission → npm trusted publishing → awesome-claude-code),
109
+ with the channel-honesty note that only the classic installer carries the
110
+ statusline and CLAUDE.md import.
111
+ - test.sh grew five gates for the above: manifest validity + version sync
112
+ across CHANGELOG/plugin.json/package.json, doctrine-mode behavior (emits
113
+ once, never twice), npm payload completeness + lifecycle-script ban
114
+ (with a live `--status` routing probe when node is present), the plugin
115
+ channel dedupe, and the installers' unknown-option rejection. All five
116
+ proven red by mutation before being trusted.
117
+
118
+ ### Fixed (post-review of the rename/packaging wave; 11 confirmed findings)
119
+
120
+ - `install-codex.sh`, `uninstall.sh`, and `uninstall-codex.sh` now reject
121
+ unknown options — previously `npx luciazero codex --status` silently
122
+ performed a FULL install instead of a status check, and stray flags to the
123
+ uninstallers were swallowed.
124
+ - Plugin doctrine mode no longer needs python3 or stdin: it is handled before
125
+ the script's shared setup, so machines without python3 (where every other
126
+ mode fails open to doing nothing) still load the doctrine. It also survives
127
+ an unset `HOME` (was an `set -u` abort violating the fail-open contract).
128
+ - Running any hook mode by hand from a terminal no longer hangs waiting for
129
+ stdin EOF.
130
+ - Plugin + `install.sh --with-hooks` double-install: the plugin's hooks.json
131
+ now invokes every mode with `LUCIAZERO_CHANNEL=plugin`, and the hook stands
132
+ down when classic wiring exists in settings.json — the stop nudge can no
133
+ longer double-fire, and a strict verify command can no longer run twice
134
+ concurrently against the same repo.
135
+ - The debug and bootstrap skills no longer hardcode classic-install paths
136
+ (`~/.claude/...`) that do not exist under the plugin / `npx skills`
137
+ channels.
138
+ - Release procedure docs caught up with the version-sync gate: CONTRIBUTING's
139
+ Releasing step and docs/publishing.md now both say to bump plugin.json +
140
+ package.json together with the CHANGELOG heading (following the old steps
141
+ verbatim would have produced a red release workflow), and publishing.md no
142
+ longer hardcodes tagging the already-released v1.3.0.
143
+ - docs/comparison.md no longer lists "plugin marketplace" as something
144
+ superpowers has and we don't (this repo is now its own single-plugin
145
+ marketplace; theirs remains a multi-plugin ecosystem).
146
+
147
+ - **Strict verify gate** (opt-in on top of the opt-in enforcement pack): set
148
+ `LUCIAZERO_STRICT_VERIFY_CMD` in your *personal* settings and the Stop hook
149
+ actually runs that command (fast-pathing when the tracked state is already
150
+ green after the last edit) and blocks a red stop with the failing output
151
+ quoted. Hard timeout (`LUCIAZERO_STRICT_TIMEOUT`, default 120s); every
152
+ internal error degrades to the ordinary fail-open nudge. The variable
153
+ belongs in personal settings only; the hook cannot verify which settings
154
+ scope set it (a committed `.claude/settings.json` env block reaches it
155
+ too), and the docs say so plainly — never commit it, and treat a repo
156
+ that ships it as hostile. Documented honestly as a speed bump, not a
157
+ wall: a blocked stop's continuation is never re-blocked.
158
+ - **Exact-match verify tracking**: `LUCIAZERO_VERIFY_CMD` switches the Bash
159
+ tracker from the broad regex to prefix matching, closing a real
160
+ false-green — `cat test.sh` or `grep pytest README` no longer count as a
161
+ verify run. `/luciazero-bootstrap` Phase 2 now offers (ask-first) to record
162
+ the established command in the repo's `.claude/settings.local.json`.
163
+ - **SessionStart handoff pointer**: a `session` hook subcommand emits one
164
+ context line when the project has a `HANDOFF.md` capsule — age included,
165
+ stale warning past `LUCIAZERO_HANDOFF_STALE_DAYS` (default 7), silent and
166
+ zero-cost when there is none, pointer only (never the contents).
167
+ - **`revert-probe.sh`** (ships inside the done skill, works on both
168
+ harnesses): the mechanical form of "would the new tests fail if the change
169
+ were reverted?" — checks the pre-change code into a throwaway git
170
+ worktree, overlays only the changed test files, runs the verify command
171
+ there and inverts the result. Exit 0 tests bite / 1 vacuous or no test
172
+ changes / 2 unassessable; never touches the caller's tree. `/done` and
173
+ `/debug` reference it.
174
+ - **Three new eval tasks**, each probing a different doctrine rule:
175
+ `red-suite` (correct-but-red suite; the lazy fix is bending the tests to
176
+ the bug — caught by replaying the fixture's pristine tests against the
177
+ worked code), `flaky-report` (hash-seed-dependent output; graded
178
+ deterministically via a `PYTHONHASHSEED` 0–9 sweep), `pipeline` (bug in
179
+ the parser, symptom two modules away; graded by diff *locality* — the
180
+ untouched modules must stay AST-identical).
181
+ - **`gamed*/` cheat fixtures + grader auto-discovery**: every task now ships
182
+ one or more hand-built cheat trees its grader must reject — including
183
+ hardcoded-lookup (`red-suite/gamed-hardcode/`) and hardcoded-output
184
+ (`flaky-report/gamed-hardcode/`) variants killed by unseen-data criteria —
185
+ and `test.sh` auto-discovers `eval/tasks/*/` so no task can ship without
186
+ proving its grader goes red, green, and anti-gamed (a missing `gamed/` is
187
+ itself a red build) and speaks the new machine-readable
188
+ `CRIT <id> pass|fail` / `SCORE n/m` output contract.
189
+ - **`eval/run.sh --runs N --out results.jsonl` + `eval/report.sh`**: repeat
190
+ runs, record per-criterion results as JSONL, and render the doctrine-vs-
191
+ bare pass-*rate* table the honesty box has always prescribed — with n and
192
+ a low-n warning printed unconditionally. `report.sh` is byte-compared
193
+ against a frozen fixture in CI and rejects malformed input.
194
+ - **`install.sh --status`**: read-only health check of an existing install —
195
+ every piece listed, hook wiring verified in `settings.json` (the hooks
196
+ fail open, so a broken install was previously silent), version compared,
197
+ non-zero exit when a core piece is missing. Plus a version sidecar
198
+ (`.luciazero-version`, both harnesses) and a documented update
199
+ path in the README.
200
+ - **`demo.sh`**: scaffolds the slugify planted-bug fixture into a throwaway
201
+ git repo, prints the bug report and the exact commands — fix it in your
202
+ own Claude session, then score the tree with the offline grader. Never
203
+ invokes `claude` itself; refuses to scaffold inside the repo.
204
+ - **`docs/comparison.md`**: dated, sourced, deliberately two-sided
205
+ comparison against superpowers, SuperClaude, proof-loop, orchestrator
206
+ runtimes, template catalogs, and the harness built-ins.
207
+ - README: 60-second quickstart, a "What it looks like" section showing the
208
+ actual statusline/nudge/strict-gate output (captured, not composed), and
209
+ an Updating section.
210
+ - **`README.th.md`** — full Thai translation of the README, replacing the
211
+ abridged Thai section; English stays the default, both files cross-link,
212
+ and `test.sh` trips when the section structures drift apart.
213
+
214
+ - `/done` skill — closeout ritual before declaring a non-trivial task
215
+ complete: full-tier verify with the decisive line quoted, a skeptic pass
216
+ over the final diff, an independent adversarial review when the diff
217
+ earns it, an explicit scope check naming anything left out, and a fixed
218
+ report format. Doctrine rule 1 now points to it.
219
+ - `/handoff` skill — transient state capsule (`HANDOFF.md`) for resuming
220
+ unfinished work across sessions, machines, or harnesses: goal, verified
221
+ state, one literal next command, open and refuted hypotheses, landmines.
222
+ Consumed and deleted by the reader; `/retro` stays the home of permanent
223
+ lessons.
224
+ - `/experiment` skill — measured-change protocol for optimization work:
225
+ metric and win threshold defined before any change, multi-run baseline,
226
+ one variable per experiment, verdicts (including null results) recorded
227
+ to `docs/experiments.md`, losers reverted immediately.
228
+ - Enforcement pack (`./install.sh --with-hooks`, Claude Code only,
229
+ requires python3): a verify-tracking hook pair plus statusline —
230
+ PostToolUse hooks record edits and verify-ish Bash runs per project, a
231
+ Stop hook nudges once (fails open, never loops) when a session ends
232
+ with unverified edits, and the statusline shows `model | branch |
233
+ ✅ verify 3m` / `❌ verify RED` / `✎ unverified` at a glance. The
234
+ settings.json merge is additive, idempotent, backed up, respects an
235
+ existing custom statusLine, and `uninstall.sh` removes exactly our
236
+ entries while preserving everything else.
237
+ - `examples/luciazero-ci.example.yml` — inert, REPLACE-ME-gated GitHub
238
+ Actions template: on CI failure, an agent diagnoses the root cause from
239
+ the failing logs (hypothesis + evidence line, logs treated as untrusted
240
+ input) and posts a size-capped PR comment. Diagnosis only — it cannot
241
+ push or edit code (`contents: read`, tool allowlist without Bash,
242
+ `persist-credentials: false`); its single write scope is
243
+ `pull-requests: write` for the comment. Fork-guarded secrets, no
244
+ auto-fix.
245
+ - `eval/` — A/B harness measuring whether the doctrine changes agent
246
+ behavior: planted-bug task fixtures graded offline by behavioral
247
+ criteria (bug actually fixed, a regression test that goes red when the
248
+ buggy implementation is restored, no weakened checks). `eval/run.sh`
249
+ runs both arms (doctrine vs bare config) and costs API money, so it is
250
+ manual; `test.sh` verifies the graders themselves can go both red and
251
+ green, offline.
252
+ - `test.sh` now also exercises the enforcement-pack hook state machine,
253
+ the `--with-hooks` install/uninstall cycle against a settings.json with
254
+ pre-existing user content, the eval graders' red/green behavior, and the
255
+ inertness of the luciazero-ci example.
256
+
257
+ - `/debug` skill — hypothesis-driven debugging procedure, the on-demand
258
+ expansion of the doctrine's hypothesis rule: deterministic reproduction
259
+ first, minimized repro, a visible hypothesis ledger (run the refuting
260
+ observation, not the edit), one variable per iteration with failed fixes
261
+ reverted, close-out via a regression test red before the fix and green
262
+ after. Installed by both harness installers.
263
+ - `luciazero-bootstrap` now bundles `scripts/detect.sh` — a read-only,
264
+ dependency-free evidence scan (bash plus standard tools; python3 to
265
+ parse `package.json` when available, `sed` fallback) covering docs,
266
+ manifests, script/target names, CI `run:` lines, test dirs, monorepo
267
+ markers, and git status, replacing a dozen manual reads in Phase 1. It surfaces candidates only; the agent still decides.
268
+ Ships to both harnesses via the existing skill copy.
269
+ - Bootstrap Phase 2 hardening: verify must run unattended (no watch or
270
+ interactive modes), the suite is timed once so the measurement (not a
271
+ guess) decides one tier or two, fast-tier output should be near-silent,
272
+ and monorepos scope the fast tier to the package being changed.
273
+ - Bootstrap Phase 6 rewrite: run the fast tier twice to catch flakes,
274
+ break a line a smoke test actually *covers* (breaking an uncovered line
275
+ proves nothing), restore via `git checkout`/`git stash`; Phase 1 now
276
+ reports git-repo status and proposes `git init` (ask first) for
277
+ unversioned dirs.
278
+ - `/retro` routing gate: lessons true for anyone who clones the repo go to
279
+ committed notes; machine-local or personal facts go to the harness's
280
+ memory system (Claude Code's per-project `memory/` dir + `MEMORY.md`
281
+ index) and are never committed; on Codex (no memory system) only the
282
+ machine-independent generalization is kept — an honest gap beats a note
283
+ no harness loads.
284
+ - `test.sh` now enforces the doctrine's word-count budget (≤420 words) and
285
+ platform-neutral vocabulary, smoke-runs `detect.sh` against the repo
286
+ itself, and covers the new skill and script in both sandbox cycles.
287
+ - Example settings: inert check-suppression guard hook (blocks edits that
288
+ add `noqa`/`ts-ignore`/`.skip(`-style markers, mechanizing "never weaken
289
+ a check"), and the derived-files hook example now explains scoping by
290
+ `tool_input.file_path` so it does not run on every edit.
291
+ - `reviewer` agent: `model: inherit` frontmatter — an adversarial reviewer
292
+ on a weaker model than the author defeats its purpose. The Codex
293
+ transform drops `model:` alongside `tools:`.
294
+
295
+ ### Changed
296
+
297
+ - **Doctrine cut from 15 rules to 9** (568 → ~415 words). Removed
298
+ outright — each relies on a behavior 2026 harnesses enforce by default;
299
+ if a harness regresses, restore from here: style matching (old R7
300
+ tail), read-before-overwrite (old R8 tail — mechanically enforced by
301
+ Write tools), wide-read delegation (old R10 — also impossible on
302
+ Codex). Folded into surviving rules, not cut: faithful run reporting
303
+ (old R3 → one clause in new R1), the loop itself (old R5 → preamble),
304
+ read-project-notes-first (old R12 → new R8), routine-work-without-
305
+ blocking (old R13 → new R9), whole-scope completion and honest handback
306
+ (old R15 / R5 tail → closing clause of new R9). The stop-and-ask list
307
+ survives as new R9.
308
+ - Doctrine rule 7 routes risky/wide diffs through the harness's built-in
309
+ review command when one exists (Claude Code: `/code-review`), with the
310
+ shipped `reviewer` agent as the portable fallback and the only reviewer
311
+ on Codex.
312
+ - Doctrine and skills are now platform-neutral: "notes file
313
+ (`CLAUDE.md` / `AGENTS.md`)" instead of assuming one harness; bootstrap
314
+ Phase 4 marks hooks/settings/`/fewer-permission-prompts` as Claude-only
315
+ and tells Codex sessions to encode the same guardrails in `AGENTS.md`;
316
+ Phase 5 retitled "Project notes file".
317
+ - Bootstrap Phase 1 no longer early-stops at possibly-stale docs: sources
318
+ are reordered CI-first and doc-claimed commands are cross-checked
319
+ against CI; a docs/CI mismatch is itself a finding.
320
+ - README: removed the free-floating version line (CHANGELOG is the version
321
+ source of truth), corrected the `SessionStart` design note (Claude Code
322
+ re-injects `CLAUDE.md` after compaction; the real anti-drift lever is
323
+ doctrine size), and recorded the decision against plugin packaging.
324
+
325
+ ### Fixed
326
+
327
+ - The slugify grader could be gamed for a perfect score: keeping the four
328
+ original test *names* with `pass` bodies plus one real regression test
329
+ passed every criterion. A new contract-mutant criterion (the worked suite
330
+ must go red against an implementation that breaks the original
331
+ leading/trailing-separator contract while handling unicode correctly)
332
+ closes it; the exact cheat is checked in as `gamed/` and CI proves the
333
+ grader rejects it.
334
+ - The verify-tracking hook counted *reading* the test file (`cat test.sh`,
335
+ `grep pytest README`) as a verify run, flipping the statusline green and
336
+ disarming the stop nudge with no test run — fixed opt-in via
337
+ `LUCIAZERO_VERIFY_CMD` exact matching (the broad regex remains the default).
338
+ - The example check-suppression guard blocked edits *near* a pre-existing
339
+ suppression marker (it regexed the whole tool input, so an untouched
340
+ `noqa` in `old_string` triggered it). Now diff-aware: it compares marker
341
+ counts between new and old text (`old_string` for Edit, the on-disk file
342
+ for Write) and blocks only when an edit *adds* a marker.
343
+ - `uninstall.sh` no longer aborts halfway (unguarded `grep` no-match under
344
+ `set -e`) when `CLAUDE.md` contains only the import line — exactly the
345
+ state `install.sh` creates for a user with no prior `CLAUDE.md`. It now
346
+ also removes an empty `CLAUDE.md` instead of leaving a zero-line file.
347
+ Regression-tested by a fresh-user install→uninstall cycle in `test.sh`.
348
+ - `install-codex.sh` reinstalls no longer grow `AGENTS.md` by one blank
349
+ line per run; a reinstall is now byte-identical (asserted in `test.sh`).
350
+ - Backup names (`*.bak.<timestamp>`) are collision-proof in all four
351
+ install/uninstall scripts — two runs in the same second previously
352
+ overwrote the earlier backup, destroying the pristine pre-install copy.
353
+
354
+ ## [1.3.0] - 2026-08-07
355
+
356
+ ### Added
357
+
358
+ - OpenAI Codex CLI support: `install-codex.sh` / `uninstall-codex.sh`.
359
+ Doctrine lands as a marker-delimited block in `~/.codex/AGENTS.md`;
360
+ `luciazero-bootstrap` and `retro` copy as-is (Codex reads the same
361
+ `SKILL.md` format); the `reviewer` agent ships as a Codex skill with the
362
+ Claude-only `tools:` frontmatter line dropped. Honors `CODEX_HOME`,
363
+ backs up `AGENTS.md`, idempotent, converts from the `claude/` sources at
364
+ install time so nothing is duplicated in the repo.
365
+ - `test.sh` covers the Codex cycle in its own sandbox (marker-block
366
+ idempotency, skill installs, `tools:` line stripped, uninstall restores
367
+ pre-existing `AGENTS.md` content).
368
+
369
+ ## [1.2.0] - 2026-08-07
370
+
371
+ ### Added
372
+
373
+ - Doctrine rule 6 — debugging starts with a hypothesis and the command
374
+ that would confirm or refute it, before any edit.
375
+ - Doctrine rule 9 — review the final diff as a skeptic before declaring
376
+ done; risky diffs get an independent reviewer agent. (15 rules total.)
377
+ - `/retro` skill — harvest session lessons (null results, footguns,
378
+ environment quirks) into the project's `CLAUDE.md`/`docs/`, deduping
379
+ against and correcting existing notes.
380
+ - `agents/reviewer.md` — read-only adversarial reviewer subagent:
381
+ severity-tagged findings, verified against source, `No findings.` over
382
+ invented ones.
383
+ - Bootstrap Phase 2 — two-tier verify guidance: fast `verify` every loop
384
+ iteration, `verify-full` before declaring done; single tier for small
385
+ repos.
386
+
387
+ ### Changed
388
+
389
+ - `install.sh`/`uninstall.sh`/`test.sh` cover the new skill and agent;
390
+ installer backs up a pre-existing customized `agents/reviewer.md`
391
+ before overwriting.
392
+
393
+ ## [1.1.0] - 2026-08-07
394
+
395
+ ### Added
396
+
397
+ - Doctrine rule 12 — **stop and ask before high-stakes moves, and ask
398
+ clearly**: deleting data, deploying or touching production,
399
+ force-pushing, changing a public API/contract, spending real money, or
400
+ leaving the agreed scope require a decidable question (what, why,
401
+ options, recommendation) before proceeding. "Finish the whole scope"
402
+ renumbered to 13.
403
+
404
+ ## [1.0.0] - 2026-08-07
405
+
406
+ ### Added
407
+
408
+ - 12-rule luciazero doctrine (`claude/luciazero.md`),
409
+ loaded in every session via an `@luciazero.md` import in the
410
+ global `~/.claude/CLAUDE.md`.
411
+ - `/luciazero-bootstrap` skill — six-phase, language-agnostic procedure that
412
+ makes a repository agent-ready (detect commands, establish a verify
413
+ command, smoke tests, guardrails, project `CLAUDE.md`, prove verify can
414
+ go red).
415
+ - `install.sh` / `uninstall.sh` — idempotent, back up `CLAUDE.md` before
416
+ editing, never write outside the Claude config dir, honor
417
+ `CLAUDE_CONFIG_DIR`.
418
+ - Inert per-repo settings example
419
+ (`examples/project-settings.example.json`): permission allowlist,
420
+ secret-read denies, disabled hook templates.
421
+ - `test.sh` verify command; GitHub Actions CI on every push and
422
+ zip-building release workflow on version tags.
423
+ - MIT license.
package/LICENSE ADDED
@@ -0,0 +1,21 @@
1
+ MIT License
2
+
3
+ Copyright (c) 2026 Naris (naris@riverpark.co.th)
4
+
5
+ Permission is hereby granted, free of charge, to any person obtaining a copy
6
+ of this software and associated documentation files (the "Software"), to deal
7
+ in the Software without restriction, including without limitation the rights
8
+ to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
9
+ copies of the Software, and to permit persons to whom the Software is
10
+ furnished to do so, subject to the following conditions:
11
+
12
+ The above copyright notice and this permission notice shall be included in all
13
+ copies or substantial portions of the Software.
14
+
15
+ THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
16
+ IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
17
+ FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
18
+ AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
19
+ LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
20
+ OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
21
+ SOFTWARE.