model-orchestrator 1.0.7 → 1.0.8

package/AGENTS.md

@@ -25,14 +25,19 @@ When using the Claude Code plugin, follow [plugin/README.md](plugin/README.md).
 
 ## Change this repository
 
-- **Read first:** `CONTRIBUTING.md`, `src/README.md` and `docs/security-review-history.md`.
+- **Read first:** `CONTRIBUTING.md`, `src/README.md`, `SECURITY.md` (security scope) and `docs/security-review-history.md`.
 - **Catalog:** when adding an AI or companion, edit `src/catalog.js`; keep templates free of logic.
 - **Templates:** when changing installed instructions, edit `templates/`. Use public terms: task brief, context file, acceptance checks, definition of done and result.
-- **Generated files:** run `npm run gen:catalog` after catalog changes and `npm run gen:plugin` after plugin-template changes. `test/plugin.test.js` checks the committed bundle.
+- **Generated files:** run `npm run gen:catalog` after catalog changes and `npm run gen:plugin` after plugin-template changes. `plugin/` is generated from `templates/`; only `plugin/README.md` and `plugin/hooks/hooks.json` are hand-owned. `test/plugin.test.js` fails on drift. Before a release, `claude plugin validate --strict plugin` must pass.
 - **Plugin safety:** hooks may only read and emit context. No network, file writes, subprocesses or credential access.
-- **Installer safety:** writes remain inside `--dir` and `--project`; preserve user edits according to manifest hashes and explicit flags. Run no third-party installer.
-- **Runner safety:** preserve exit codes and the log schema. Before changing an output judge, add a failing case in `test/judges.test.js`.
+- **Installer safety:** `bin/cli.js` writes only inside `--dir` and `--project`, refuses home-level agent configuration and runs no third-party installer or vendor script.
+- **Installer ownership:** existing documents stay unless `--force` replaces them or `--update-docs` verifies their recorded hash. Machine-owned configuration refreshes, unchanged managed runtime files upgrade, and `--upgrade-runtime` explicitly replaces runtime files. Project activation merges supported entries with backups. Preserve these rules; `test/install.test.js` and `test/cli.test.js` check them.
+- **Runner safety:** preserve exit codes and the log schema. `bin/cli-run.mjs` exits non-zero when a lane produced nothing. Every judge has a red case in `test/judges.test.js`; add one before changing a judge.
+- **Systemd:** when touching `templates/advanced/vm/jobs/`, run `test/systemd/run-on-ubuntu.sh` by hand on a Linux host with systemd to check `TimeoutStartSec` and `KillMode`. This check sits outside `npm test`; follow `test/systemd/README.md`.
+- **Fixtures:** `test/fixtures/` is real vendor output. When a vendor upgrade changes a shape, capture again at the new version and update `manifest.json` and the README compatibility table together.
 - **Secrets:** use environment-variable names only. Never add a credential value to code, examples or tests.
 - **Proof:** measure through `proof/scripts/`, store results in `proof/results.json` and regenerate the proof page. An expired entry warns and is re-measured; it never blocks tests or releases.
-- **Verify:** run `npm test` and report tests, pass, fail, skipped and exit code. The suite prints current counts. Use `npm pack --dry-run` to inspect publication contents.
+- **Verify:** before proposing a change, run `npm test` and report tests, pass, fail, skipped and exit code. The suite prints current counts. Use `npm pack --dry-run` to inspect publication contents.
 - **Style:** use short condition-to-action instructions and no em dashes. `test/prose.test.js` checks public vocabulary and examples.
+
+Each rule is the fix for a failure that reached an audit or CI. `CHANGELOG.md` names the issue behind each.

package/CHANGELOG.md

@@ -4,6 +4,14 @@ All notable changes to this project are documented here. The format follows [Kee
 
 ## [Unreleased]
 
+## [1.0.8] - 2026-09-30
+
+### Changed
+
+- AGENTS.md is the single source of agent instructions. CLAUDE.md imports it so Claude Code loads the same rules as every other agent.
+- Merge the contributor rules that had diverged between AGENTS.md and CLAUDE.md.
+- The feature request form asks for an observable success check.
+
 ## [1.0.7] - 2026-09-30
 
 ### Fixed
@@ -587,7 +595,8 @@ First release.
 - Tests: a case per fix, judges proven to go red, mutation checks; `npm test` prints the current count.
 - Adversarial audit: two Codex rounds plus a two-engine review (Codex, Antigravity); findings and fixes in `docs/audit-brief.md`. After the review: subagents go to the project root (`--project`), snippet paths computed from `--dir`, lane sections rendered from the selection, a primary agent required, level 3 asks for API keys separately from CLIs, images and CLI installs pinned, an activation summary at the end of every install.
 
-[Unreleased]: https://github.com/aunysillyme/model-orchestrator/compare/v1.0.7...HEAD
+[Unreleased]: https://github.com/aunysillyme/model-orchestrator/compare/v1.0.8...HEAD
+[1.0.8]: https://github.com/aunysillyme/model-orchestrator/compare/v1.0.7...v1.0.8
 [1.0.7]: https://github.com/aunysillyme/model-orchestrator/compare/v1.0.6...v1.0.7
 [1.0.6]: https://github.com/aunysillyme/model-orchestrator/compare/v1.0.5...v1.0.6
 [1.0.5]: https://github.com/aunysillyme/model-orchestrator/compare/v1.0.4...v1.0.5

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "model-orchestrator",
-  "version": "1.0.7",
+  "version": "1.0.8",
   "description": "Model router for AI coding agents: installs routing rules, 8 subagents, hooks and a CLI runner so your AI picks model and effort per task and saves tokens",
   "type": "module",
   "bin": {