orchestrator-workflow 0.12.0 → 0.13.0

package/CHANGELOG.md

@@ -5,6 +5,37 @@ All notable changes to `orchestrator-workflow` are documented here.
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [0.13.0] - 2026-07-18
+
+### Changed
+
+- `05-review-findings.md`'s findings-table placeholder/legend row
+  (`| low/medium/high/critical | ... | accepted/defer |`) now carries a
+  comment stating its fail-closed semantics: replace this row when
+  transferring reviewer findings (step 7), or delete it outright for a
+  genuine zero-findings review (a header row with no data rows is valid; a
+  leftover legend row next to real finding rows is also fine). `SKILL.md`'s
+  step 7 gains a matching one-sentence rule. This is the contract half of a
+  fix for a mixed-state bypass in grounding-mcp's orchestrator-workflow
+  completeness reader: the reader identifies a real finding row by its
+  Severity cell carrying a single concrete value, so the shipped slash-list
+  legend row was never counted as a finding — a run that filled the
+  `acceptance-recommendation` marker with `accept` but left this row
+  byte-for-byte as shipped read as `complete: true` with zero findings,
+  indistinguishable from a genuine zero-findings review. The runtime half
+  (the reader treating a survived, unaccompanied placeholder row as an
+  explicit format blocker instead of silently reporting zero findings) is a
+  lockstep sibling change in grounding-mcp's own release, outside this
+  package. In this package the change is docs/template/test-only: no
+  runtime behavior changes here, the completeness reader itself is not part
+  of this package, and the fail-closed enforcement only takes effect once
+  grounding-mcp ships its lockstep sibling change (agent-tasks task
+  8f173547); do not tag/publish this 0.13.0 release before that change ships
+  (release ordering). A template-markers test pins the placeholder row's
+  literal wording (mutation-checked, matching the reader's literal match) and
+  that the replace/delete rule is documented next to it. Motivated by
+  agent-tasks task fa0eca65.
+
 ## [0.12.0] - 2026-07-16
 
 ### Added

package/assets/skill/SKILL.md

@@ -118,6 +118,10 @@ directory and the subagents.
    transfer each finding from the reviewer output contract into the table's
    columns as-is, keeping the Severity and Decision headers unchanged, since
    those two are what the orchestrator-workflow completeness reader verifies.
+   Replace the shipped placeholder/legend row with the transferred findings;
+   for a genuine zero-findings review, delete that row instead of leaving it
+   in place, since the completeness reader treats an untouched placeholder
+   row with no finding rows as the template never having been filled in.
 8. **Decide acceptance.** Accept, request fixes, defer, or escalate to the
    operator. High or critical findings block acceptance until fixed or
    explicitly waived: critical findings require operator sign-off; high

package/assets/templates/05-review-findings.md

@@ -11,6 +11,7 @@
 | Severity | Category | Description | Suggested Fix | Decision |
 |---|---|---|---|---|
 | low/medium/high/critical | correctness/architecture/security/tests/maintainability/performance/docs | <!-- finding --> | <!-- fix --> | accepted/defer |
+<!-- This row is the shipped template placeholder, not a finding: the orchestrator-workflow completeness reader fails the completeness gate closed when this exact row survives untouched and no concrete finding row has been added, the same way a `TODO` marker does. During findings transfer (step 7), replace this row with each reviewer finding. For a genuine zero-findings review, delete this row instead — a header row with no data rows is a valid, complete table; leaving this row next to real finding rows is also fine. This mirrors grounding-mcp's placeholder-row detection; keep the two in sync. -->
 
 ## Missing Tests
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "orchestrator-workflow",
-  "version": "0.12.0",
+  "version": "0.13.0",
   "description": "Installer for an orchestrator-led agent workflow: .ai/ run state, an AGENTS.md policy section, and per-harness subagent definitions for Claude Code, OpenAI Codex, and opencode",
   "main": "dist/index.js",
   "type": "module",