paqad-ai 1.75.2 → 1.75.4

package/CHANGELOG.md

@@ -1,5 +1,28 @@
 # paqad-ai
 
+## 1.75.4
+
+### Patch Changes
+
+- 92b4710: fix(#205): never count generated `.paqad/` artifacts as changed code in verification
+
+  When the runtime self-hosts, its generated artifacts land under a nested
+  `.paqad/` home (`runtime/base/.paqad/`) that the root-only managed gitignore does
+  not cover, so they leak into the working tree. The change-evidence classifier
+  treated anything under `runtime/` as code, so the change-completeness gate demanded
+  test evidence and doc updates for generated logs and evidence JSON. `isCodeFile`
+  now excludes every `.paqad/` home (root or nested) via the new
+  `isPaqadArtifactPath` predicate, and the verification changed-file scan strips
+  `.paqad/` artifacts entirely, so they never reach `code_changed`, the test-evidence
+  preview, the quality ratchet, or scope drift. (The invisible Stop-hook loop and the
+  silent exit-2 from the original report were already resolved by #303/#368.)
+
+## 1.75.3
+
+### Patch Changes
+
+- dc6976f: Reframe the security workflow copy to remove two overclaims (#206). User-facing text no longer calls the security pass a "full OWASP pentest" with "full OWASP coverage" or claims it proves code is "safe"; it is now described as an OWASP WSTG-structured security self-review that hardens code before a certified pentest, it does not replace one. Copy-only: workflow ids, routing patterns, the `pentest` invocation alias, and all code are unchanged.
+
 ## 1.75.2
 
 ### Patch Changes

package/README.md

@@ -57,7 +57,7 @@ No account, no API key, no subscription. Prefer not to install anything? Run `np
 | **One setup, every tool**    | Configure Claude, Cursor, Copilot, Gemini, and the rest from one source of truth       |
 | **Workflows, not prompts**   | Your team's process runs the same way every time, instead of being re-typed            |
 | **Proof, not promises**      | Automatic checks confirm tests, specs, docs, and security before "done" counts         |
-| **Security as a workflow**   | A full OWASP pentest pass, with retests, built in                                      |
+| **Security as a workflow**   | An OWASP WSTG-structured security self-review, with retests, built in                  |
 | **Design as a workflow**     | Your UI audited against your own design system                                         |
 | **Docs that stay current**   | The framework keeps your documentation in sync with the code                           |
 | **Fewer tokens, on purpose** | Loads a lean resident slice, not the whole repo. Measured 49-61% smaller resident load |
@@ -228,7 +228,7 @@ paqad-ai can turn the plain rules in your `docs/instructions/rules/` into small
 
 Most tools treat security as a separate scanner you remember to run. paqad-ai treats it as part of the work.
 
-**Security workflow.** A resumable pentest pass with full OWASP coverage, timed to the moment the industry is formalizing security for AI agents.
+**Security workflow.** A resumable, OWASP WSTG-structured security self-review that hardens code before a certified pentest, timed to the moment the industry is formalizing security for AI agents.
 
 | Standard                    | Coverage         |
 | --------------------------- | ---------------- |
@@ -259,7 +259,7 @@ It writes a local `curl` playbook to prove each finding (it never runs attacks f
 
 </details>
 
-**Design workflow.** The same rigor, pointed at the front end. The design-test pass audits your UI against your own design system, covering tokens, components, accessibility, responsive behavior, and motion, and design-retest replays the findings after you fix them. Pentest checks that the code is safe. Design-test checks that the interface is consistent.
+**Design workflow.** The same rigor, pointed at the front end. The design-test pass audits your UI against your own design system, covering tokens, components, accessibility, responsive behavior, and motion, and design-retest replays the findings after you fix them. The security self-review hardens the code. Design-test checks that the interface is consistent.
 
 ## Documentation that stays current
 

package/dist/cli/index.js

@@ -35093,7 +35093,7 @@ init_cancelled_error();
 init_events();
 
 // src/index.ts
-var VERSION = "1.75.2";
+var VERSION = "1.75.4";
 
 // src/cli/commands/audit.ts
 init_esm_shims();