paqad-ai 1.56.0 → 1.58.0

package/CHANGELOG.md

@@ -1,5 +1,27 @@
 # paqad-ai
 
+## 1.58.0
+
+### Minor Changes
+
+- ee46d89: New routed workflow #10 **codebase-health** (backed by **health-retest**): a project health check-up on demand, at the same tier as pentest and design-test. Say "check my project's health" and paqad scans for six kinds of junk — dead code, unused packages, outdated or risky packages, leaked secrets, stale docs, and copy-paste AI slop — and lands every finding in one report with proof (real tool output, never an AI opinion), a plain-words reason it matters, and what to do about it.
+
+  Detection is a single deterministic verb, `paqad-ai health run`, that costs zero model tokens: it reuses the code-knowledge index (dead code, unused deps), the 9-ecosystem dependency inventory, OSV/native-audit vulnerability data, registry deprecation metadata, and the chunk-similarity index, shelling out to `osv-scanner`, `gitleaks`, `jscpd`, and `knip` when they are on PATH and degrading gracefully (labelled fallbacks or `blocked_checks`) when they are not. Findings carry stable content-addressed `HL-` ids, split honestly into a "Proven" section (deterministic) and a "Needs judgment" section (ai-judged, confidence-scored), and never expose secret bytes — only a file:line + rule + fingerprint.
+
+  Finding fingerprints use SHA-256 (a stable content-addressed dedup key, not a security primitive; secret bytes never reach it). All scanners are invoked from Node, so the workflow is cross-platform (Windows included). A baseline ratchet marks findings `new-since-baseline` vs `pre-existing` so a legacy project isn't drowned, `--offline` skips the network categories, and `paqad-ai health retest` re-runs the evidence and reclassifies each finding `fixed | still-open | needs-manual-verification` by its stable id. The workflow is classifier-routed (health phrasings route to codebase-health; pentest phrasings still route to pentest), surfaces in the dashboard, and its run summaries flow to the SIEM export.
+
+## 1.57.0
+
+### Minor Changes
+
+- f76f2dd: Per-feature evidence report (issue #371): a feature's whole on-disk record — plan, frozen spec, every stage with real durations, the rules that ran, what retrieval found, the verification receipt, the AI-BOM, the commit trail, and the review — is now rendered into one self-contained, human-readable `report.html` by a pure script (no LLM, no network), saved next to the JSON it came from and byte-for-byte identical on every provider. A normal person can read it, it prints cleanly to PDF for an auditor, it stays local and git-ignored, and it makes zero external requests.
+
+  Every section communicates gracefully when its data is absent: a missing plan, an unrun retrieval, or (on a non-enterprise install) an absent verification receipt and AI-BOM each render an explicit plain-English note instead of a blank gap. The verification receipt honestly says whether its hash-chain integrity recomputes, and a failed gate is shown as plainly and prominently as a passing one.
+
+  New: `paqad-ai feature report [ref] [--out <file>] [--open] [--quiet]`. The report is regenerated automatically at end-of-change (covering Claude Code, Codex, and Gemini through the one verification backstop) and after every commit/merge (covering advisory hosts through the git hooks), always best-effort so it can never disrupt the feature-development stages or the verification verdict. Two config flags: `feature_report` (default on) and `feature_report_auto_open` (default off; sandbox-aware, skips CI/SSH/remote/headless).
+
+  The page is laid out like a dashboard: a `▸ paqad` header, an at-a-glance overview of stat tiles (verdict, stages, duration, rules, retrieval, receipt, AI-BOM, delivery) with colored indicators, and a CSS-only submenu that drills into each section's detail — so the first glance is the summary and every detail is one click deeper, all still zero-JS and self-contained.
+
 ## 1.56.0
 
 ### Minor Changes