minimal-vibe-coding-kit 0.4.2 → 0.5.1

package/.vibekit/skills/tutien/scripts/story-ledger.mjs

@@ -0,0 +1,241 @@
+#!/usr/bin/env node
+// Deterministic storage helpers for the agent-authored living chronicle.
+// This module never generates story prose. It only builds an aggregate-only
+// evidence packet and validates the plot/chapter ledger written by the agent.
+
+import crypto from 'node:crypto';
+import fs from 'node:fs';
+import path from 'node:path';
+import process from 'node:process';
+import { fileURLToPath } from 'node:url';
+
+export const STORY_SCHEMA = 1;
+export const STORY_CONTEXT_SCHEMA = 'tutien-story-context-v1';
+export const STORY_STATE_SCHEMA = 'tutien-story-state-v1';
+export const STORY_CHAPTER_SCHEMA = 'tutien-story-chapter-v1';
+
+const sha16 = (value) => crypto.createHash('sha256').update(String(value)).digest('hex').slice(0, 16);
+
+export function storyPaths(root = process.cwd()) {
+  const base = path.join(path.resolve(root), '.vibekit', 'reports', 'tutien', 'story');
+  return {
+    base,
+    plot: path.join(base, 'plot.md'),
+    state: path.join(base, 'story-state.json'),
+    context: path.join(base, 'latest-context.json'),
+    chapters: path.join(base, 'chapters')
+  };
+}
+
+// Preserve letters from every language, including Han characters. Latin
+// scripts are normalized so Vietnamese titles remain readable in filenames.
+export function slugifyChapterTitle(title) {
+  const raw = String(title ?? '').trim();
+  if (!raw) throw new Error('chapter title is required');
+  const slug = raw
+    .normalize('NFD')
+    .replace(/\p{M}+/gu, '')
+    .toLocaleLowerCase('und')
+    .replace(/[^\p{L}\p{N}]+/gu, '-')
+    .replace(/^-+|-+$/g, '')
+    .slice(0, 80)
+    .replace(/-+$/g, '');
+  if (!slug || slug === '.' || slug === '..') throw new Error('chapter title does not produce a safe filename');
+  return slug;
+}
+
+export function chapterFilename(number, title) {
+  if (!Number.isInteger(number) || number < 1 || number > 9999) {
+    throw new Error('chapter number must be an integer from 1 to 9999');
+  }
+  return `${String(number).padStart(4, '0')}-${slugifyChapterTitle(title)}.md`;
+}
+
+export function listChapters(root = process.cwd()) {
+  const dir = storyPaths(root).chapters;
+  if (!fs.existsSync(dir)) return [];
+  return fs.readdirSync(dir)
+    .filter((file) => /^\d{4}-[\p{L}\p{N}][\p{L}\p{N}-]*\.md$/u.test(file))
+    .map((file) => ({ file, number: Number(file.slice(0, 4)), path: path.join(dir, file) }))
+    .sort((a, b) => a.number - b.number || a.file.localeCompare(b.file));
+}
+
+export function nextChapterNumber(root = process.cwd()) {
+  const chapters = listChapters(root);
+  return chapters.length ? chapters[chapters.length - 1].number + 1 : 1;
+}
+
+export function resolveStoryLanguage(requested = 'auto', invocationText = '', fallback = 'en') {
+  const explicit = String(requested).toLowerCase();
+  if (['vi', 'en', 'zh'].includes(explicit)) return explicit;
+  if (/\p{Script=Han}/u.test(invocationText)) return 'zh';
+  if (/[À-ỹĐđ]/u.test(invocationText) || /\b(hãy|giúp|của|và|không|chương|tu tiên)\b/iu.test(invocationText)) return 'vi';
+  return ['vi', 'en', 'zh'].includes(fallback) ? fallback : 'en';
+}
+
+function safeSlug(value, fallback = null) {
+  const text = String(value ?? '');
+  return /^[a-z0-9][a-z0-9_-]{0,63}$/i.test(text) ? text : fallback;
+}
+
+function safeValidationCommand(value) {
+  const text = String(value ?? '');
+  return /^(?:npm run|yarn|pnpm|bun run) [A-Za-z0-9][A-Za-z0-9:_-]{0,63}$/.test(text) ? text : null;
+}
+
+function storyFacts(model, profile = {}) {
+  const cultivation = model.cultivation ?? null;
+  const progression = cultivation?.progression ?? null;
+  return {
+    project: {
+      id: safeSlug(profile.projectId, 'repo'),
+      type: safeSlug(profile.projectType),
+      primaryLanguage: safeSlug(profile.primaryLanguage),
+      domains: (profile.domains ?? []).map((v) => safeSlug(v)).filter(Boolean).slice(0, 12),
+      stack: (profile.stack ?? []).map((v) => safeSlug(v)).filter(Boolean).slice(0, 12),
+      validationCommands: (profile.validationCommands ?? []).map((v) => safeValidationCommand(v)).filter(Boolean).slice(0, 3),
+      metadataSources: (profile.metadataSources ?? []).map((v) => safeSlug(String(v).replace(/\.[^.]+$/, ''))).filter(Boolean).slice(0, 12),
+      authorsCount: Number.isInteger(profile.authorsCount) && profile.authorsCount >= 0 ? profile.authorsCount : null
+    },
+    evidence: {
+      window: model.coverage?.window ?? { start: null, end: null },
+      sessions: model.coverage?.sessions ?? 0,
+      prompts: model.coverage?.userPrompts ?? 0,
+      commits: model.coverage?.commits ?? 0,
+      confidence: model.coverage?.confidence ?? 'low',
+      tokens: {
+        reported: model.tokens?.reportedTotal ?? 0,
+        estimated: model.tokens?.estimatedTotal ?? 0,
+        unknownTurns: model.tokens?.unknownTurns ?? 0
+      },
+      realm: model.realm ? { name: model.realm.name, score: model.score } : null,
+      problems: (model.problems ?? []).map((p) => ({
+        type: p.problemType,
+        confidence: p.confidence,
+        priority: p.priority
+      })),
+      classification: cultivation ? {
+        faction: cultivation.classification?.faction?.id ?? null,
+        affiliation: cultivation.classification?.affiliation?.id ?? null,
+        paths: (cultivation.classification?.paths ?? []).map((p) => p.id)
+      } : null,
+      progression: progression ? {
+        tuVi: progression.tuVi?.window ?? 0,
+        congDuc: progression.congDuc?.window ?? 0,
+        nghiepLuc: progression.nghiepLuc?.window ?? 0,
+        daoHanhWindows: progression.daoHanh?.windows ?? 0,
+        overlap: progression.overlap ?? 0
+      } : null
+    }
+  };
+}
+
+export function buildStoryContext(model, options = {}) {
+  const facts = storyFacts(model, options.profile ?? {});
+  const evidenceKey = sha16(JSON.stringify({
+    storySchema: STORY_SCHEMA,
+    project: facts.project.id,
+    range: options.range ?? 'all',
+    evidence: facts.evidence
+  }));
+  return {
+    schema: STORY_CONTEXT_SCHEMA,
+    storySchema: STORY_SCHEMA,
+    evidenceKey,
+    language: resolveStoryLanguage(options.language, options.invocationText, options.conversationLanguage),
+    style: safeSlug(options.style, 'auto'),
+    focus: safeSlug(options.focus, 'balanced'),
+    policyState: model.policyState ?? 'clear',
+    canWriteChapter: model.suppressGamification !== true,
+    ...facts
+  };
+}
+
+export function writeStoryContext(root, context) {
+  if (context?.schema !== STORY_CONTEXT_SCHEMA) throw new Error(`story context must use ${STORY_CONTEXT_SCHEMA}`);
+  const paths = storyPaths(root);
+  fs.mkdirSync(paths.base, { recursive: true });
+  fs.writeFileSync(paths.context, `${JSON.stringify(context, null, 2)}\n`);
+  return paths.context;
+}
+
+function chapterFrontmatter(text) {
+  const match = String(text).match(/^---\n([\s\S]*?)\n---\n/);
+  if (!match) return null;
+  const get = (key) => match[1].match(new RegExp(`^${key}:\\s*(.+)$`, 'm'))?.[1]?.trim().replace(/^['"]|['"]$/g, '') ?? null;
+  return {
+    schema: get('schema'),
+    chapter: Number(get('chapter')),
+    title: get('title'),
+    evidenceKey: get('evidence_key')
+  };
+}
+
+export function validateStoryTree(root = process.cwd()) {
+  const paths = storyPaths(root);
+  const chapters = listChapters(root);
+  const errors = [];
+  if (chapters.length && !fs.existsSync(paths.plot)) errors.push('plot.md is required when chapters exist');
+
+  let state = null;
+  if (fs.existsSync(paths.state)) {
+    try {
+      state = JSON.parse(fs.readFileSync(paths.state, 'utf8'));
+      if (state.schema !== STORY_STATE_SCHEMA) errors.push(`story-state.json must use ${STORY_STATE_SCHEMA}`);
+    } catch {
+      errors.push('story-state.json must contain valid JSON');
+    }
+  } else if (chapters.length) {
+    errors.push('story-state.json is required when chapters exist');
+  }
+
+  const evidenceKeys = new Set();
+  for (let i = 0; i < chapters.length; i += 1) {
+    const expected = i + 1;
+    const item = chapters[i];
+    if (item.number !== expected) errors.push(`chapter sequence must be contiguous: expected ${expected}, found ${item.number}`);
+    const fm = chapterFrontmatter(fs.readFileSync(item.path, 'utf8'));
+    if (!fm) {
+      errors.push(`${item.file} is missing YAML frontmatter`);
+      continue;
+    }
+    if (fm.schema !== STORY_CHAPTER_SCHEMA) errors.push(`${item.file} must use ${STORY_CHAPTER_SCHEMA}`);
+    if (fm.chapter !== item.number) errors.push(`${item.file} frontmatter chapter must equal ${item.number}`);
+    if (!fm.title) errors.push(`${item.file} requires a title`);
+    if (!fm.evidenceKey || !/^[0-9a-f]{16}$/.test(fm.evidenceKey)) errors.push(`${item.file} requires a 16-hex evidence_key`);
+    else if (evidenceKeys.has(fm.evidenceKey)) errors.push(`${item.file} repeats evidence_key ${fm.evidenceKey}`);
+    else evidenceKeys.add(fm.evidenceKey);
+  }
+
+  if (state) {
+    if (state.lastChapter !== chapters.length) errors.push(`story-state.json lastChapter must equal ${chapters.length}`);
+    const consumed = state.consumedEvidenceKeys ?? [];
+    if (!Array.isArray(consumed) || consumed.some((key) => !/^[0-9a-f]{16}$/.test(key))) {
+      errors.push('story-state.json consumedEvidenceKeys must be an array of 16-hex keys');
+    }
+    for (const key of evidenceKeys) {
+      if (!consumed.includes(key)) errors.push(`story-state.json is missing consumed evidence key ${key}`);
+    }
+  }
+
+  return {
+    ok: errors.length === 0,
+    errors,
+    chapters: chapters.length,
+    nextChapter: chapters.length + 1,
+    paths: Object.fromEntries(Object.entries(paths).map(([key, value]) => [key, path.relative(path.resolve(root), value)]))
+  };
+}
+
+const isMain = process.argv[1] && path.resolve(process.argv[1]) === fileURLToPath(import.meta.url);
+if (isMain) {
+  const command = process.argv[2] ?? 'status';
+  const root = path.resolve(process.argv[3] ?? process.cwd());
+  if (!['status', 'validate'].includes(command)) {
+    console.error('usage: story-ledger.mjs [status|validate] [repo-root]');
+    process.exit(2);
+  }
+  const result = validateStoryTree(root);
+  console.log(JSON.stringify(result, null, 2));
+  if (command === 'validate' && !result.ok) process.exit(1);
+}

package/.vibekit/skills/tutien/scripts/villains.mjs

@@ -0,0 +1,196 @@
+// Phase 3 villain engine. Evidence chooses the problem and the
+// counter-technique; a deterministic seed chooses only the villain's name and
+// wording. Nothing here can change a count, severity, evidence, or advice.
+//
+// Safety rails (all enforced, not optional):
+//  - a villain appears only when its problem confidence >= threshold (0.80);
+//  - at most one boss and two minor villains per report;
+//  - villains=off, tone=neutral, or any emergency signal -> no villains;
+//  - challenge lines are authored safe and re-checked against banned
+//    categories before emission;
+//  - origin stories use only an allowlist of sanitized context slugs — never
+//    raw prompts, secrets, names, emails, or identity-bearing paths.
+
+import crypto from 'node:crypto';
+import { normalizeTone } from './command.mjs';
+
+export const VILLAIN_THRESHOLD = 0.8;
+export const MAX_BOSS = 1;
+export const MAX_MINOR = 2;
+export const DEFAULT_COOLDOWN_WINDOWS = 2;
+
+// Defense-in-depth: challenge lines are written to avoid these, but every
+// emitted line is re-scanned so a future edit cannot slip an attack through.
+const BANNED_CATEGORY = [
+  /\b(stupid|idiot|idiotic|incompetent|dumb|moron|useless|worthless|pathetic|loser|failure of a)\b/i,
+  /\b(insane|crazy|psycho|mental|deranged|unhinged|tẩu hỏa nhập ma)\b/i,
+  /\b(retard|cripple|disabled|handicapped)\b/i,
+  /\b(sin|heretic against god|infidel|kafir|damned to hell)\b/i,
+  /\b(man up|like a girl|woman driver|too emotional for a)\b/i,
+  /\b(race|racial|ethnic slur|your people)\b/i,
+  /\b(broke|poor|can't afford|worthless salary|financial failure)\b/i,
+  /\b(kill|die|hurt you|destroy you|i will end)\b/i,
+  /\b(f[u*]ck|sh[i*]t|damn you|bastard)\b/i,
+  /\b(humiliat|shame on you|you should be ashamed|embarrass yourself)\b/i
+];
+
+export function containsBannedCategory(text) {
+  return BANNED_CATEGORY.some((re) => re.test(String(text)));
+}
+
+// Only these context fields may shape an origin story, and each must be a
+// strict slug: no slashes, dots, at-signs, spaces, or traversal — so neither
+// free text nor path-like or identity-bearing values can ride along.
+const CONTEXT_ALLOWLIST = ['projectType', 'primaryLanguage', 'fileCategory', 'validationLabel', 'metricCategory'];
+const SLUG = /^[a-z0-9][a-z0-9_-]{0,39}$/i;
+
+export function sanitizeContext(ctx = {}) {
+  const out = {};
+  for (const key of CONTEXT_ALLOWLIST) {
+    const v = ctx[key];
+    if (typeof v === 'string' && SLUG.test(v)) out[key] = v;
+  }
+  return out;
+}
+
+// Two authored variants per tone per archetype. The seed picks the index, so
+// changing the seed changes wording only. The serene/spirited vocabulary is
+// local to this coding-reflection game and always targets the workflow pattern,
+// never the person or any unrelated support/companion persona.
+const LINES = {
+  'repeated-failure': {
+    serene: [
+      { vi: 'Giữa làn sương mỏng, Luân Hồi Ma Ảnh hiện bóng khi lỗi cũ quay thêm một vòng.', en: 'In the thin mountain mist, the Error-Cycle Wraith appears as the old error completes another circle.' },
+      { vi: 'Một lần thử giống hệt khẽ lay chuông, gọi Luân Hồi Ma Ảnh trở lại đạo lộ.', en: 'One unchanged retry stirs the bell that calls the Error-Cycle Wraith back to the path.' }
+    ],
+    spirited: [
+      { vi: 'Luân Hồi Ma Ảnh lại gõ chuông: “Không đổi giả thuyết, sao đổi được kết cục?”', en: 'The Error-Cycle Wraith rings its bell again: “Without a new hypothesis, what new ending could appear?”' },
+      { vi: 'Vòng lặp cũ vừa khép, Luân Hồi Ma Ảnh đã bày sẵn bàn trà chờ vòng kế tiếp.', en: 'The old loop has barely closed, and the Error-Cycle Wraith has already set tea for the next.' }
+    ]
+  },
+  'too-many-prompts': {
+    serene: [
+      { vi: 'Cửu Hoàn Tâm Ma dệt một nhiệm vụ thành nhiều vòng sương khi cột mốc chưa hiện rõ.', en: 'The Ninefold Loop Heart-Shadow weaves one task into rings of mist when its checkpoints remain unclear.' },
+      { vi: 'Nơi ranh giới nhiệm vụ nhạt dần, Cửu Hoàn Tâm Ma lặng lẽ nối thêm một vòng.', en: 'Where a task boundary fades, the Ninefold Loop Heart-Shadow quietly adds another circle.' }
+    ],
+    spirited: [
+      { vi: 'Cửu Hoàn Tâm Ma đếm lượt yêu cầu thay cột mốc; đã đến lúc đổi chiếc vòng kế tiếp thành một tiêu chí hoàn thành.', en: 'The Ninefold Loop Heart-Shadow is counting prompts instead of checkpoints; turn the next circle into a done-criterion.' },
+      { vi: 'Lượt yêu cầu càng tản như lá thu, Cửu Hoàn Tâm Ma càng dễ giấu mất lối ra.', en: 'The more prompts scatter like autumn leaves, the easier the Ninefold Loop Heart-Shadow hides the exit.' }
+    ]
+  },
+  'conflicting-instructions': {
+    serene: [
+      { vi: 'Nghịch Lệnh Ma Quân hiện giữa hai đạo lệnh không thể cùng đứng vững.', en: 'The Lord of Clashing Edicts appears between two instructions that cannot stand together.' },
+      { vi: 'Hai đạo lệnh ngược chiều làm mặt hồ dậy sóng, và Nghịch Lệnh Ma Quân bước ra.', en: 'Two opposing edicts ripple the still lake, and the Lord of Clashing Edicts steps forth.' }
+    ],
+    spirited: [
+      { vi: 'Nghịch Lệnh Ma Quân giơ hai cuộn lệnh và hỏi: “Cuộn nào mới thật sự dẫn đường?”', en: 'The Lord of Clashing Edicts raises two scrolls and asks: “Which one truly leads the way?”' },
+      { vi: 'Hai lệnh cùng tranh ngôi; Nghịch Lệnh Ma Quân chỉ cần ta chưa lập thứ tự ưu tiên.', en: 'Two edicts contest the throne; the Lord of Clashing Edicts needs only an absent precedence rule.' }
+    ]
+  },
+  'unrecovered-failure': {
+    serene: [
+      { vi: 'Vô Nghiệm Ảnh Quân ẩn sau một thất bại chưa được soi lại bằng lần kiểm chứng mới.', en: 'The Unverified Trial Wraith rests behind a failure that has not yet met a fresh validation.' },
+      { vi: 'Một lỗi bị bỏ lại làm bóng Vô Nghiệm Ảnh Quân dài thêm trên bậc đá.', en: 'A failure left behind lengthens the Unverified Trial Wraith’s shadow across the stone steps.' }
+    ],
+    spirited: [
+      { vi: 'Vô Nghiệm Ảnh Quân phủi bụi trên ghế đá: một lần kiểm chứng thành công là đủ để mời nó rời đi.', en: 'The Unverified Trial Wraith dusts its stone seat; one passing validation is enough to send it on its way.' },
+      { vi: 'Chưa có lần chạy lại, Vô Nghiệm Ảnh Quân vẫn ung dung giữ chỗ bên cổng hoàn thành.', en: 'Without a rerun, the Unverified Trial Wraith calmly keeps its seat beside the completion gate.' }
+    ]
+  },
+  'work-without-proof': {
+    serene: [
+      { vi: 'Vô Chứng Đan Ảnh lảng vảng bên lò luyện khi lời tuyên bố hoàn thành chưa có bằng chứng đi cùng.', en: 'The Proofless Elixir Shade lingers by the furnace when a claim of completion carries no evidence.' },
+      { vi: 'Một bản ghi Git thiếu kết quả kiểm chứng để lại làn khói mỏng cho Vô Chứng Đan Ảnh nương thân.', en: 'A commit without validation leaves a thread of smoke where the Proofless Elixir Shade can dwell.' }
+    ],
+    spirited: [
+      { vi: 'Vô Chứng Đan Ảnh nâng chén trà bên viên đan chưa thử; một dòng kiểm chứng sẽ làm màn khói tan ngay.', en: 'The Proofless Elixir Shade raises tea beside an untested pill; one validation line will clear the smoke.' },
+      { vi: 'Không có biên nhận kiểm chứng, Vô Chứng Đan Ảnh cứ ngỡ lò luyện thuộc về mình.', en: 'Without a validation receipt, the Proofless Elixir Shade starts to think the furnace is its own.' }
+    ]
+  }
+};
+
+// Roll the villain cooldown forward one reporting window. Villains shown this
+// run reset to a full cooldown; villains from prior runs that were not shown
+// decrement and drop at zero. Feeds the next run's `priorVillains`.
+export function advanceVillainState(prevState = [], shownVillains = []) {
+  const next = new Map();
+  for (const p of prevState) {
+    const remaining = Math.max(0, (p.windowsRemaining ?? 0) - 1);
+    if (remaining > 0) next.set(p.problemId, { problemId: p.problemId, windowsRemaining: remaining, priority: p.priority });
+  }
+  for (const v of shownVillains) {
+    next.set(v.problemId, { problemId: v.problemId, windowsRemaining: v.cooldownWindows ?? DEFAULT_COOLDOWN_WINDOWS, priority: v.priorityAtShow ?? v.priority ?? 0 });
+  }
+  return [...next.values()].sort((a, b) => a.problemId.localeCompare(b.problemId));
+}
+
+export function villainSeed({ projectId = 'repo', window = 'all', schemaVersion = 1 } = {}) {
+  return crypto.createHash('sha256').update(`${projectId}${window}${schemaVersion}`).digest('hex');
+}
+
+// Deterministic non-negative index from the seed and a per-villain salt.
+function seedIndex(seed, salt, n) {
+  if (n <= 1) return 0;
+  const h = crypto.createHash('sha256').update(`${seed}${salt}`).digest();
+  return h[0] % n;
+}
+
+// problems: the raw output of detectProblems(analysis).
+// options: { tone, villains, threshold, emergency, seedInputs, context,
+//            priorVillains: [{ problemId, windowsRemaining, priority }] }.
+export function buildVillains(problems, options = {}) {
+  const tone = normalizeTone(options.tone);
+  if (options.villains === 'off') return { villains: [], suppressed: 'villains-off' };
+  if (tone === 'neutral' || options.emergency) return { villains: [], suppressed: 'neutral-context' };
+
+  const threshold = options.threshold ?? VILLAIN_THRESHOLD;
+  const seed = villainSeed(options.seedInputs);
+  const context = sanitizeContext(options.context);
+  const prior = new Map((options.priorVillains ?? []).map((p) => [p.problemId, p]));
+
+  const eligible = problems
+    .filter((p) => p.confidence >= threshold && LINES[p.problemId])
+    .sort((a, b) => b.priority - a.priority || a.problemId.localeCompare(b.problemId));
+
+  const cards = [];
+  let bosses = 0;
+  let minors = 0;
+  for (const p of eligible) {
+    // Cooldown: skip a villain still cooling down unless its problem worsened.
+    const was = prior.get(p.problemId);
+    if (was && was.windowsRemaining > 0 && p.priority <= was.priority) continue;
+
+    let role;
+    if (bosses < MAX_BOSS) { role = 'boss'; bosses += 1; }
+    else if (minors < MAX_MINOR) { role = 'minor'; minors += 1; }
+    else break;
+
+    const toneLines = LINES[p.problemId][tone] ?? LINES[p.problemId].serene;
+    const idx = seedIndex(seed, p.problemId, toneLines.length);
+    const challenge = toneLines[idx];
+
+    if (containsBannedCategory(challenge.vi) || containsBannedCategory(challenge.en)) {
+      // Fail safe: drop the theatrics, keep the finding (rendered plainly).
+      continue;
+    }
+
+    cards.push({
+      problemId: p.problemId,
+      role,
+      priority: p.priority,
+      archetype: p.meta.villain,
+      tone,
+      challenge,
+      originSignals: [`metric:${p.meta.problemType}`, ...Object.values(context)],
+      evidenceRefs: p.evidence.eventIds ?? [],
+      confidence: p.confidence,
+      rebuttal: p.meta.counterTechnique,
+      microQuest: p.meta.microQuest,
+      victory: p.meta.victory,
+      cooldownWindows: DEFAULT_COOLDOWN_WINDOWS,
+      safetyFlags: ['failure-mode-not-person', 'evidence-bound']
+    });
+  }
+  return { villains: cards, suppressed: null };
+}

package/CHANGELOG.md

@@ -1,5 +1,56 @@
 # Changelog
 
+## 0.5.1 — 2026-07-22
+
+### Added
+
+- Added a `/tutien` living chronicle that turns each repository's approved aggregate Git, token, classification, and progression evidence into an open-ended agent-authored xianxia serial. Each project keeps a local `plot.md`, continuity state, aggregate-only context, and one ordered chapter file per distinct evidence window under the git-ignored `.vibekit/reports/tutien/story/` directory.
+- Added equal chronicle support for Vietnamese, English, and Simplified Chinese, including language-native xianxia naming, honorifics, dialogue cadence, humor, chapter titles, and safely sarcastic antagonists whose malice targets workflow weaknesses rather than people.
+- Added `story-ledger.mjs` and deterministic tests for multilingual filenames, aggregate-only context, contiguous chapters, duplicate evidence rejection, and story transaction validation.
+
+### Changed
+
+- Reframed `/tutien` story writing as an evidence-plus-agent hybrid: deterministic scripts preserve facts and privacy, while agents create project-specific plots, characters, sects, realms, techniques, and dialogue without relying on fixed story sentences.
+- Replaced the fixed report-shaped default response with an aggregate-only `latest-brief.json` handoff. It detects safe project anchors from known manifests, recommends real repository validation commands, and leaves structure, pacing, scene, dialogue, and closing imagery to the agent; `output=ledger` preserves the deterministic audit view.
+- Expanded the cultural reference notes into a verified, genre-level writing palette covering path/learning metaphors, classical journey traditions, modern web-serial progression, daily-life cultivation, clan/sect epics, and cultivation-game procedural structure without imitating named living authors.
+
+### Security and privacy
+
+- Living-chronicle context persists only project slugs and aggregate metrics. Raw prompts, event IDs, commit subjects, contributor identities, URLs, secrets, and source-file contents remain excluded from context, state, plot, and chapters.
+
+### Validation
+
+- Expanded `/tutien` coverage to **158 deterministic, offline checks**, including project-profile privacy, response-brief composition, living-chronicle, preference sanitization, manifest-bound approval, optional ledger output, and on/off suppression.
+- Synchronized the release version to `0.5.1` in `package.json`, `.codex-plugin/plugin.json`, and all three README badges.
+
+## 0.5.0 — 2026-07-20
+
+### Added
+
+- Added `/claim <request>` across Claude Code, Cursor, Codex, and Grok. It validates official sources, rejects unsafe or misleading URLs, checks new ideas against `backbone.yml` and existing repository conventions, stops for decisions when approval is required, and integrates only the smallest reviewed change with an evidence ledger.
+- Added `/tutien`, a private, user-invoked xianxia coding-classification game built from Git history and explicitly supplied conversation exports. It provides deterministic vi/en reports, ten cultivation realms, evidence-bound workflow coaching, optional aggregate snapshots, progress comparisons, and opt-in antagonists that challenge workflow patterns rather than the person.
+- Added `/tutien classify` with independent Dao faction, affiliation, and technical-path axes; a cultivation-knowledge taxonomy linked to real kit skills; and seven deterministic, token-independent progression metrics.
+- Added complete Simplified Chinese documentation (`docs/README.zh-CN.md`) alongside English and Vietnamese, with synchronized language navigation and npm package inclusion.
+
+### Changed
+
+- Refined `/tutien` with the cross-model namespace `tutien-coding-cultivation-v1`, calm `serene`/`spirited` narration, plain evidence beneath the lore, and reliable English/Vietnamese stop requests that restore the kit's normal writing style. Legacy `gentle`/`spicy` tone values remain compatible.
+- Centralized skill distribution in `.vibekit/skills/skills-manifest.json`, keeping canonical skills, tool mirrors, installer registries, validator registries, package contents, documentation, and per-profile tests synchronized.
+- Strengthened `/claim` with canonical redirect validation, HTTPS-only remote evidence, private-host and confusable-domain rejection, untrusted-content handling, explicit approval states, separate approval for integration-time execution, and a complete distribution checklist.
+- Strengthened `/tutien` with one fail-closed policy state shared by rendering and persistence, idempotent event progression, boundary-aware path matching, metadata-only classification scope, and explicit authorization handling for legitimate dual-use security work.
+
+### Security and privacy
+
+- `/tutien` remains offline and read-only during analysis. Raw prompts, secrets, author names, email addresses, and commit subjects do not enter reports or snapshots; stored history uses salted digests and aggregate evidence.
+- Ambiguous, unauthorized, or declared-stop classifications suppress scores, realms, villains, recommendations, and positive progression. The game evaluates workflow evidence—not a person's identity, worth, health, or wellbeing—and stays isolated from unrelated support or companion modes.
+- `/claim` treats fetched pages as untrusted data and never runs remote installers, lifecycle scripts, or source-provided commands during research.
+
+### Validation
+
+- Expanded `/tutien` coverage to **133 deterministic, offline checks**, including adversarial privacy, token-integrity, policy-state, replay-idempotency, namespace-isolation, natural stop-request, and end-to-end approval-boundary cases.
+- `pack-dry-run.mjs` now parses `npm pack --dry-run --json` and fails with the exact missing path when an on-disk skill file is absent from the package.
+- Synchronized the release version to `0.5.0` in `package.json`, `.codex-plugin/plugin.json`, and both README badges.
+
 ## 0.4.2 — 2026-07-18
 
 - Added a Grok Build (Grok CLI) surface across the kit: `.grok/rules/` (always-on, every `*.md` loaded), `.grok/skills/` (all 13 kit skills, user-invocable as `/<skill-name>`), `.grok/README.md`, and project-scoped `[permission]` deny rules in `.grok/config.toml` mirroring the kit's dangerous-command deny list; `config.example.toml` documents the user-level `~/.grok/config.toml` settings. Added a `grok` install/update profile to `mvck.mjs` (included in `all`) and registered Grok everywhere Claude/Cursor/Codex already were: `validate-kit.mjs`, npm package files, `backbone.yml` `agent_surfaces`, `AGENTS.md`, the AgentShield probe, both READMEs, `INSTALL.md`, `BACKBONE_REFERENCE.md`, `CONTEXT_TEMPLATE.md`, `FIRST_TIME_INIT.md`, and `vibekit-init`.