plumbbob 0.9.3 → 0.9.5

package/node_modules/checkride/CHANGELOG.md

@@ -4,6 +4,994 @@ All notable changes to this project are documented here. The format is based on
 [Keep a Changelog](https://keepachangelog.com/en/1.1.0/), and this project
 adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [0.10.2] - 2026-07-31
+
+### Added
+
+- **A gate profile, for repos where the full pipeline is too slow to run every
+  turn.** `checkride.config.json` gains a `gate` key — `only`, `skip`, `changed`
+  — that applies to the stop-gate run and nothing else:
+
+  ```json
+  { "gate": { "only": ["types", "lint", "struct"], "changed": true } }
+  ```
+
+  The flags are appended after the check script's own, so the profile wins over
+  anything the script already carried. The intended shape is a fast gate per
+  turn with the full check still binding at commit or in CI; the gate is not the
+  only place "done" can be enforced, and in a large repo it should not be the
+  expensive one.
+
+  **Every verdict a profiled gate emits says it was a profile**, in those words:
+  `checkride ✔ green in 4.1s — gate profile: only types, lint — NOT the full
+  check`. That is the price of the feature and it is deliberately not
+  configurable. A gate that runs three of eighteen slots and reports a bare
+  green has told the reader the work is done, which is the one thing it does not
+  know — the vacuous pass this tool exists to prevent, reached from the
+  comfortable direction rather than the alarming one. A narrowed red points past
+  itself for the same reason. A profile that narrows nothing is treated as no
+  profile, so the warning never appears on a run that was in fact complete.
+
+- **checkride aligns the gate to the repo's Node pin.** Before running the check
+  script, if the repo names an exact interpreter (`.nvmrc` or `.node-version`)
+  and the running Node does not satisfy it, checkride puts a matching installed
+  Node in front of the child's `PATH` — so a hook that arrived on the wrong Node
+  runs the pipeline on the right one instead of failing to run it at all.
+
+  Four rules bound it, because choosing the interpreter a repo's whole pipeline
+  runs on is not a small thing to do silently: only on an explicit pin file
+  (`engines.node` is a *range* — a compatibility declaration, not an instruction
+  to switch interpreters — and is read for diagnosis only); only when the running
+  Node does not already satisfy it; only an interpreter already installed under a
+  known layout (nvm, fnm, nodenv, asdf, volta, n — nothing is downloaded and no
+  version manager is invoked, since under a non-login shell `nvm` is a shell
+  function and not a binary); and never without a line on stderr saying what it
+  aligned to and why.
+
+  `CHECKRIDE_NODE_BIN` is the escape hatch in both directions: a directory to use
+  verbatim — the documented wrapping point for a layout checkride does not know —
+  or `off` to disable alignment entirely. When alignment cannot help, nothing
+  changes and the refusal above names the pin, the Node that ran, and the lever.
+
+- **`doctor` reports the Node a hook would get, not just this shell's.** Every
+  other row describes the terminal `doctor` was typed into, which is how it said
+  `environment ok` about a repo whose gate could not start — the bug was
+  invisible to every read-only command checkride had. The new `node pin` row asks
+  the question that *is* answerable from any shell: given the repo's pin, could
+  checkride put the right Node back if a hook arrived with the wrong one? It is
+  never required, so it flags a risk without failing a repo that works.
+
+- **`checkride hooks add <a,b>` / `checkride hooks remove <a,b>` — hook
+  management that never touches AGENTS.md.** `agent-setup` writes four things at
+  once (the `check` alias, the stanza, the hooks, the Cursor skills) with the
+  stanza guard in front of all of them, so managing a hook inherited the stanza's
+  problems: a repo whose AGENTS.md had been edited could not remove a hook *at
+  all* — the run refused and, by contract, wrote nothing — and a repo mid-upgrade
+  had its stanza rewritten by a command it had asked to touch hooks.
+
+  The new command writes only the harness config entries and the generated
+  scripts. It never reads or writes AGENTS.md, so no state of that file can block
+  it and no run of it can change that file. `--harness <a,b>` and `--dry-run`
+  both apply, and both directions are idempotent. `add` defaults to every hook;
+  `remove` requires an explicit list, because a bare command that tore out the
+  gate would be the silent un-gating checkride exists to prevent.
+
+  `agent-setup` is unchanged, flags and refusal included.
+
+### Changed
+
+- **checkride generates one file for Claude Code, not four.** `protect` is now a
+  pair of `permissions.deny` rules and `dirty` is an inline command, so
+  `.claude/hooks/checkride-protect.cjs` and `.claude/hooks/checkride-dirty.sh`
+  are gone. Both are deleted automatically on the next `agent-setup`, `init`, or
+  `hooks add`.
+
+  `protect` gains more than tidiness from the move. Claude Code evaluates a deny
+  rule **regardless of what a `PreToolUse` hook returns**, so the same paths are
+  now guarded a layer below the hook that used to guard them — and at no cost
+  per tool call, where the script spawned Node on every single edit while
+  allowing essentially all of them. The rules are also a list checkride
+  *appends* to and removes only its own entries from, so a repo can add its own
+  suppression files beside them (a `fallow.baseline`, a lint baseline) and keep
+  them across every refresh. The generated script could never offer that: it was
+  checkride-owned and overwritten wholesale on every run.
+
+  ```json
+  "permissions": {
+    "deny": ["Edit(**/checkride.baseline.json)", "Edit(**/.check/**)"]
+  }
+  ```
+
+  `Edit(...)` is the only correct spelling, and getting it wrong fails silently:
+  Claude Code checks file paths against `Edit` and `Read` rules only, and a
+  `Write(...)` or `NotebookEdit(...)` path rule is accepted, never consulted, and
+  warns at startup. An `Edit` rule covers every file-editing tool. `Read` deny
+  rules stay deliberately absent — triage reads `.check/` artifacts.
+
+  Nothing moves in the user-facing surface: `--hook protect`,
+  `--remove-hook protect`, and `checkride hooks add|remove protect` all mean what
+  they meant. **Cursor is unchanged** and still gets all three scripts; its
+  config is hooks and nothing else, with no documented file-path deny list to
+  move `protect` into.
+
+- **`checkride hooks` counts files changed, not files deleted.** Removing a hook
+  a harness expresses as configuration rewrites the config and deletes nothing,
+  and the old wording reported that as `removed 0 file(s)` — a run that did
+  exactly what was asked, reading as a no-op. The line now names the hooks and
+  counts every file it touched.
+
+- **The AGENTS.md stanza no longer prescribes an architecture.** It carried
+  checkride's own house style as if it were law — "Named exports only; no
+  classes; `.js` extensions on relative imports", plus the barrel-`index.ts`
+  rules — into every repo that ran `init` or `agent-setup`. For a repo that uses
+  classes, default exports, or bundler-style extensionless imports, that is a
+  contract file instructing the agent to write the wrong code. The stanza is
+  also the one region a repo cannot correct: editing it is what makes the next
+  refresh refuse.
+
+  The `### Module boundaries` section now names where the rules live instead of
+  what they say — the `struct` check runs whatever ast-grep rules `sgconfig.yml`
+  points at, and those files are the convention. It is emitted only when
+  `struct` is an active check; a repo without it gets no section at all. Delete
+  `rules/no-class.yml` and the stanza stays true, which is the property it was
+  missing.
+
+  `init` still *scaffolds* those rules as its opinionated default — that part is
+  a starter you own and can edit, and is unchanged.
+
+- **`--add struct` scaffolds the boundary rule and stops.** It used to write
+  four ast-grep rules, three of which are style, not structure: `no-class`,
+  `no-default-export`, and `require-js-extension`. A repo that uses classes,
+  default exports, or bundler resolution went red the moment it adopted the
+  slot — for code it had always written, over a convention it never chose, which
+  reads as checkride being broken rather than as a finding. `--add struct` now
+  writes `sgconfig.yml` and `rules/no-deep-sibling-import.yml`: the rule that
+  makes `struct` the slot it is, and one whose failures mean what they say.
+
+  New-mode `init` still writes all four. That is a different bargain — it is
+  creating the package, so there is no prior decision to override — and the
+  other rules are listed in `docs/deep-modules.md` for any repo that wants them.
+
+### Fixed
+
+- **A package manager that refuses to start the check script is no longer
+  reported as a red pipeline.** In any repo pinning `engines.node`, pnpm answers
+  a Node it does not accept with `ERR_PNPM_UNSUPPORTED_ENGINE` and **exit 1** —
+  the same exit code a failing test uses. The gate read that as a verdict on the
+  code and said so: `checkride ✘ red in 265ms`, exit 2, turn blocked, every turn,
+  regardless of what was written. It then sent the reader to
+  `.check/summary.json`, which no run had written, because no check had run.
+
+  That is the vacuous gate inverted — not a silent green but a permanent red no
+  code change can clear, whose rational response is to switch the gate off. And
+  it is not one repo's problem: agent harnesses run hooks in a **non-login
+  shell**, which never sources the rc file a version manager puts its shims in,
+  so the hook gets the machine's default Node rather than the contributor's. On
+  nvm that is the norm, not the exception.
+
+  `gate` now answers a third verdict — **could not run** — for a launch that
+  never happened, naming the cause and saying plainly that nothing ran and no
+  artifact describes this turn. It still blocks, in both harnesses: an unrunnable
+  gate has never been a pass. `triage` gained the matching `could-not-start`
+  verdict, since it runs the same script and had folded the same exit into `red`,
+  confirming the gate's wrong answer to whoever came asking why.
+
+  The classification is guarded on both sides. Only pnpm's and npm's own error
+  codes are matched — npm's `EBADENGINE` *warning* deliberately is not, because
+  npm runs the script anyway unless `engine-strict` is set — and a summary
+  written by the current run vetoes the whole thing, so a check that merely
+  *printed* one of these strings can never be reclassified into an environment
+  problem.
+
+- **Upgrading no longer looks like an edit.** 0.10.1 started stamping the stanza
+  so a refresh could tell its own output from a customization — but a stanza
+  written *before* the stamp carries no evidence either way, so every upgrading
+  repo read as `unstamped`, refused, and by contract wrote **nothing**: not the
+  stanza, not the config, not the hooks. That is how 0.10.1's own gate-timeout
+  fix failed to reach the repos it was written for. The guard protecting AGENTS.md
+  prose was withholding a fix for a gate that had silently stopped gating.
+
+  checkride now recognizes the wordings it actually shipped — four distinct texts
+  across v0.1.1–v0.10.0, matched on everything but the generated
+  `Active checks in this repo:` line, so a repo's own slot list is irrelevant. A
+  pre-stamp stanza that matches one is checkride's own output, refreshes without
+  `--force`, and comes back stamped; one that matches nothing has been edited and
+  is still refused, with a message that now says so plainly instead of hedging
+  about indistinguishable wordings.
+
+  The list is closed and needs no maintenance: every release from 0.10.1 stamps
+  what it writes, so no future version can add an unstamped wording.
+
+- **The AGENTS.md stanza is package-manager-agnostic.** It hardcoded `pnpm
+  check` and `pnpm exec checkride triage` regardless of the repo's package
+  manager, while checkride detects that manager everywhere else and README
+  promises the tool is agnostic. The stanza is a list of commands an agent is
+  told to run, so in an npm repo it was an instruction that cannot succeed: the
+  agent either invents a substitute or reports the pipeline as broken. It now
+  renders `npm run check` / `npx --no-install checkride triage`, `yarn run
+  check`, or `bun run check` from the detected manager, and `pnpm check` is
+  unchanged for pnpm repos.
+
+  The Claude Code gate's `statusMessage` had the same bug from the same source
+  and is fixed with it — the spinner said `npm check`, which is not a command,
+  and `yarn check` names Yarn 1's integrity checker rather than the repo's
+  script.
+
+- **The `spell` check no longer trips over checkride's own stanza hash.** The
+  `hash=v1…` marker is 16 hex digits, so sooner or later it spells something
+  cspell does not recognize (`…fedf…`) and fails a slot for a string checkride
+  itself generated. The shipped `cspell.json` now ignores the marker.
+
+### Contract
+
+- **A gate that could not run answers "could not run", not "red"**
+  (docs/contract.md §CLI). The exit codes are unchanged and remain the promise —
+  2 while blocked under `--harness claude`, always 0 under `--harness cursor` —
+  because an unrunnable gate has always blocked. What is new is that the verdict
+  distinguishes a red pipeline from a launch that never happened, so anything
+  reading the `systemMessage` / `followup_message` body sees a cause instead of a
+  pointer to an artifact this run did not write. Additive: a hook script that
+  gates on the exit code alone is unaffected.
+
+- **`checkride.config.json` promises a `gate` key** (docs/contract.md §CLI), and
+  with it the disclosure: while a profile is active, every gate verdict names the
+  profile and states that it was not the full check.
+
+- **`CHECKRIDE_NODE_BIN`** is promised as the hook author's wrapping point: a
+  directory prepended to the check run's `PATH`, or `off` to disable checkride's
+  own Node-pin alignment.
+
+- **What a hook *is* belongs to the harness** (docs/contract.md §CLI). The three
+  hook names stay promised; whether one lands as a config entry, a permission
+  rule, or a generated script is checkride's to choose per harness and may change
+  again. What is promised about the Claude Code deny rules is the part a consumer
+  builds on: checkride appends its own and removes only those. Anyone scripting
+  against the *path* `.claude/hooks/checkride-protect.cjs` should read
+  `permissions.deny` instead.
+
+## [0.10.1] - 2026-07-31
+
+### Added
+
+- **`init` and `agent-setup` refuse to overwrite an AGENTS.md stanza that has
+  been edited.** Repos routinely need a line or two of their own in the contract
+  — a directory the `spell` check is allowed to skip, what a custom check means
+  here — and the refresh rewrote the marked region blind, taking those additions
+  with it. Idempotent, as promised, and lossy: the second run reported
+  `changed: false` precisely because the first one had already discarded the
+  edit.
+
+  The begin marker now carries a hash of the body checkride generated
+  (`<!-- checkride:begin hash=v1… -->`), so a later run can tell its own output
+  from a block someone has since changed. A changed one stops the run: exit 2, a
+  message naming the file and the two ways forward, and **nothing written at
+  all** — not the config, not the hooks — so a refused run leaves the repo
+  exactly as it found it, the rule new-mode `init` already followed for scaffold
+  collisions. `--force` accepts the loss and refreshes, and now carries that
+  meaning on `agent-setup` too, where the flag previously reached nothing.
+
+  Two things are deliberately *not* edits. Reformatting: line endings and
+  trailing whitespace are normalized away before hashing, so a Prettier run over
+  AGENTS.md does not read as a customization. And anything outside the markers,
+  which stays the right home for repo-specific additions — checkride has never
+  rewritten a line out there and still does not.
+
+  One-time cost on upgrade: a stanza written by 0.10.0 or earlier carries no
+  hash, and an older version's wording is indistinguishable from an edit, so the
+  first run after upgrading refuses with its own wording of the message.
+  `--force` once stamps it; detection is automatic from then on.
+
+- **`--remove-hook <a,b>` tears an installed hook back out** — the config entry
+  and the generated script both. `--hook` only ever chose what to *write*, so
+  there was no supported way to drop the gate after the fact. It pairs with
+  `--no-hook` to remove without refreshing anything else, and removing `dirty`
+  rewrites a surviving gate unguarded, so the gate cannot silently disarm itself
+  on the way out.
+
+- **A `note` field on any check entry, and at the config root**, for commentary
+  aimed at whoever reads `checkride.config.json` next. It is validated as a
+  string and then dropped — no code path carries it onto an Adapter, so it
+  cannot reach the status line or `summary.json`. `description` keeps its
+  user-facing role; this repo's own config dogfoods the split.
+
+- **The gate states its verdict in words**, not just an exit code: the wall
+  clock and the failing slots, read back from `.check/summary.json` —
+  `checkride red in 41.7s, 2 of 15 failed: lint, test`. Under Claude Code it
+  rides in the hook body as `systemMessage`, which moves the block onto
+  `decision: "block"`, since hook JSON is parsed only on exit 0. `checkride
+  gate`'s own exit codes are unchanged: the generated script does the
+  translation and falls back to exit-2 blocking when no body comes back, so an
+  unrefreshed repo or an older checkride keeps gating either way. Cursor gets
+  the same line atop its `followup_message` on red; a green Cursor gate stays
+  silent, because its only stop-hook output field submits a new turn, and the
+  gap is recorded in docs/cursor.md rather than papered over.
+
+- **The Claude Code Stop entry carries `statusMessage` and `timeout: 900`.** The
+  spinner now names the command rather than leaving a multi-minute pipeline
+  indistinguishable from a hung model, and the timeout closes a live hole: the
+  platform default is 600s, and a hook cancelled by it exits non-zero, which
+  Claude Code reads as a broken hook and lets the turn end. Any repo whose
+  pipeline crossed ten minutes had a gate that had quietly stopped gating.
+
+### Fixed
+
+- **`triage` no longer reports an unparseable summary as a run with no
+  failures.** A repo whose gate is a homegrown script writing a checkride-shaped
+  `.check/` — same file names, no `schema_version` — made the reader announce
+  "checkride never ran, a compound script short-circuited" about a gate that had
+  run all eight of its checks and failed three. An empty slot table now reads as
+  "nothing was read", not "nothing failed": the short-circuit verdict is
+  reserved for a genuinely absent summary, `covered:` renders `unknown` rather
+  than a count nobody measured, a missing `schema_version` becomes its own
+  `foreign` state, and a new `.check/ contents` section lists the directory when
+  the summary is not an index.
+
+- **The gate ignores a summary older than its own start time.** A check script
+  shaped `tsc --build && checkride` leaves `summary.json` untouched when the
+  build fails, and trusting it would report the previous run's failing slots as
+  this run's.
+
+### Contract
+
+- **checkride owns the AGENTS.md stanza and only the stanza**, and the boundary
+  is now enforced rather than documented (docs/contract.md §CLI, locked by
+  `test/contract/flags.contract.test.ts`). The promise a consumer can build on:
+  a stanza carrying local edits is never overwritten without `--force`, and the
+  run that refuses writes nothing. Behavioural break for anyone scripting
+  `agent-setup` over a repo with a hand-edited or pre-0.10.1 stanza — that
+  invocation exited 0 and now exits 2 until it is re-run with `--force`.
+
+## [0.10.0] - 2026-07-31
+
+### Added
+
+- **Cursor support — hooks and skills.** `init` and `agent-setup` now write the
+  same three hooks (`gate`, `dirty`, `protect`) into `.cursor/hooks.json` as
+  they do into `.claude/settings.json`, and write the bundled `check` and `qa`
+  skills into `.cursor/skills/` as `checkride-check` and `checkride-qa` —
+  Cursor has no plugin system to install them from. Which harnesses get wired
+  is detected (Claude Code always, Cursor when `.cursor/` exists) and
+  overridable with `--harness <a,b>`.
+
+  The gate had to learn a second protocol to get there. Claude Code blocks a
+  turn on **exit 2** and reads stderr; Cursor treats any non-zero stop hook as a
+  *broken* hook and lets the turn end, so its verdict rides in a
+  `{"followup_message": …}` body on stdout instead. Same decision, two wire
+  formats.
+
+  Cursor's defaults would have made that gate advisory, so the entry overrides
+  three of them: `timeout` (a pipeline is minutes), `loop_limit: null` (the
+  default of 5 stops the gate replying after five turns, where Claude Code
+  re-blocks indefinitely) and `failClosed: true` (Cursor is fail-open, so a
+  crashed or timed-out gate would end the turn silently). The `dirty` and
+  `protect` guards keep the fail-open default, deliberately.
+
+- **[Cursor](docs/cursor.md).** A page for the parts that are not symmetric with
+  Claude Code — the reply-don't-block stop protocol, the three overridden
+  defaults, the third-party-configs setting, and an explicit list of the
+  assumptions Cursor's own docs leave open (chiefly: the `tool_input` path key
+  `protect` matches on is a guess, and a wrong guess fails open silently).
+
+- **`checkride gate`, `checkride triage`, `checkride qa`.** The gate's body —
+  the edit-marker check, the `check` run, the digest-or-summary choice — moved
+  out of the generated shell script into a real command, so it is testable and
+  every harness's hook script is now a thin adapter over it. `triage` and `qa`
+  promote the two bundled plugin readers to first-class commands, so a skill no
+  longer needs `${CLAUDE_PLUGIN_ROOT}` (or a hardcoded `node_modules/` path) to
+  find them.
+
+### Fixed
+
+- **The gate no longer fails open when checkride cannot run.** An uninstalled
+  or unresolvable checkride made the hook exit 1, which Claude Code reads as
+  "hook failed, carry on" — leaving a repo whose gate had silently stopped
+  gating. Any exit outside the gate's own 0/2 now blocks, naming the cause.
+  (`protect` still fails open, deliberately: a broken protect hook must not
+  become a repo where nothing can be written.)
+- **A repo wired for both harnesses no longer runs two gates per turn.** Cursor
+  loads `.claude/settings.json` hooks when third-party configs are enabled, maps
+  `Stop` onto `stop`, and runs *every* matching source — so the default wiring
+  (Claude Code is always selected) fired two full pipelines concurrently into one
+  `.check/`, racing on the artifacts the orchestrator clears per slot and on the
+  edit marker. `checkride gate --harness claude` now stands down when Cursor is
+  running it and a native Cursor gate is registered. Narrow on purpose: a stale
+  `CURSOR_PROJECT_DIR` costs a duplicate run, never the gate.
+- **A gate that cannot enter the repo now reports it.** The `cd` guard was a bare
+  `exit 2`, which said nothing under Claude Code and — because Cursor reads any
+  non-zero stop hook as a broken one — ended the turn silently under Cursor. It
+  now emits the same "could not run" verdict as every other way the gate can fail
+  to start, in each harness's protocol.
+- **`protect` no longer misses paths under a symlinked repo root.** It compared
+  the harness's spelling of a path against the environment's, which on macOS
+  routinely differ (`/var/…` vs `/private/var/…`), making every in-repo path
+  look external — so an edit to `checkride.baseline.json` was allowed through.
+  Both sides are now resolved before comparison.
+
+### Contract
+
+- The command set gains `gate`, `triage` and `qa`; `init`/`agent-setup` gain
+  `--harness <a,b>`. All additive. `gate` is documented as the one command
+  outside the 0/1/2 exit split, because it answers a harness's hook protocol
+  rather than checkride's own — see `docs/contract.md` §CLI. Its one documented
+  no-op is promised there too: `--harness claude` stands down for a registered
+  native Cursor gate.
+
+## [0.9.6] - 2026-07-30
+
+### Fixed
+
+- **A slot refused for a missing tool was reported as a harness problem.** The
+  refusal carried `exit_code: -1`, which is reserved for a spawn failure or
+  timeout — so `triage` matched it and printed "it failed to spawn or timed out.
+  That is a harness problem, not a finding," telling the reader to discount the
+  one failure the pre-flight exists to make them act on, remediation and all. It
+  now exits **1**, a finding like any other. `-1` keeps meaning the harness
+  broke, and a triage test now pins the two apart.
+- **A tool installed above the repo root satisfied the pre-flight.** The upward
+  search for `node_modules/.bin/<tool>` stopped only at the filesystem root, so
+  a stray install in a home or projects directory counted — the same
+  machine-state dependence the local resolution was added to remove, reached by
+  a different route: the slot passed for whoever had that directory above their
+  clone and failed on the clean checkout. The search now stops at the repo root,
+  marked by a `.git` or a lockfile, and searches that root before stopping.
+- **A timed-out `yarn bin` probe reported the tool as missing.** Under Yarn PnP
+  `doctor` folded every probe failure into "not a dependency", so a slow package
+  manager produced a confident `missing` and told you to install a tool that was
+  already there. A timeout is now `unknown`, with a hint naming it — the
+  treatment the `--version` probe alongside it already had.
+- **`doctor` reported a healthy Yarn PnP project as broken.** Both of its
+  install questions were path tests against a `node_modules/` tree, which a PnP
+  project does not have: `install` asserted the directory and so reported
+  `lockfile only`, and each slot's tool was looked for at
+  `node_modules/.bin/<tool>` and so reported missing — on a repo where every
+  tool was installed and every check ran green. The two commands therefore
+  contradicted each other, `doctor` calling the environment broken while the
+  gate passed. `install` is now satisfied by `.pnp.cjs` plus the lockfile, and a
+  tool is resolved with `yarn bin <tool>`, whose exit code carries the answer.
+  A tool that genuinely does not resolve still reports missing — the looser
+  question must not become a softer one, or this would trade a false red for a
+  false green, which is the worse of the two. Detection is gated on yarn so a
+  `.pnp.cjs` left by a migration off Yarn cannot reroute an npm or pnpm repo.
+
+## [0.9.5] - 2026-07-30
+
+### Contract
+
+- **A slot's tool is now resolved in the local tree before the check spawns,
+  under `npx` and `bunx`.** 0.9.3 stopped those launchers *fetching* a missing
+  tool, but `--no-install` bounds the download and not the per-user cache, so
+  both still run a copy left behind by some earlier unrelated invocation. The
+  gate's verdict therefore depended on machine state nobody declared: a repo
+  whose `docs` slot was detected from `.markdownlint-cli2.jsonc` but never
+  installed `markdownlint-cli2` passed for every developer holding a cached copy
+  and failed on the clean checkout — which is the CI runner, the most expensive
+  place to find out. The tool is now looked up at `node_modules/.bin/<tool>`,
+  searched from the check's directory upward so a workspace tool hoisted to the
+  repo root still counts, and a slot whose tool is absent fails there with a
+  message naming the slot, the path searched, and the PM's own install command
+  instead of the launcher's `npx canceled due to missing packages`. **Behavior
+  change:** a slot passing only because of a cached tool now fails until that
+  tool is a declared dependency — the same trade 0.9.3 made, applied to the
+  fallback it left open, and it fails on the developer's machine rather than
+  only in CI. Scoped to the two launchers that keep such a cache: `pnpm exec`
+  and `yarn` resolve from the project tree already and are not pre-flighted,
+  which also leaves Yarn PnP — where no `node_modules/.bin` exists to find —
+  working as before. See `docs/contract.md` §Vacuous green and `docs/tools.md`
+  §Package managers.
+
+### Fixed
+
+- **`doctor` told npm, yarn and bun repos to run `pnpm install`.** The
+  remediation hint on a missing-tool row was a hardcoded string, so the one
+  actionable line on a red row named a package manager the repo does not use —
+  while `checkInstall` two functions above it had been PM-aware all along. It
+  now names the detected manager and the exact dev-dependency install.
+- **`doctor` reported a hoisted workspace tool as missing.** The probe tested
+  `<cwd>/node_modules/.bin/<tool>` and nothing above it, but pnpm and npm both
+  hoist a shared tool's bin to the workspace root — so a correctly installed
+  monorepo showed a false `missing` for every tool from any package
+  subdirectory, on exactly the repos the workspace presets generate. It now
+  walks upward like the package managers do, sharing one resolver with the run
+  path so the two cannot disagree about where a tool lives.
+
+## [0.9.4] - 2026-07-30
+
+### Fixed
+
+- **Member-scoped fallow findings now key on `<container>.<leaf>` instead of a
+  line and column.** fallow reports an unused class/enum/store member as
+  `parent_name` + `member_name`, a component binding as `component_name` +
+  `prop_name`/`input_name`/`output_name`/`emit_name`/`event_name`, and a catalog
+  entry as `catalog_name` + `entry_name` — none of which the extractor
+  recognized, so every such finding fell through to the `<path>:<line>:<col>`
+  fallback. That key moves whenever code above it does, so editing anything
+  earlier in a file re-keyed its grandfathered members and re-surfaced them as
+  new findings. They are now line-free
+  (`dead-code:unused_class_members:src/a.ts:Svc.unusedOne`) and survive the edit,
+  as every other category already did. The same pass gave the report's remaining
+  `*_name` categories a stable identity too, so they key on a symbol rather than
+  a position as well. **This changes the `dead` slot's fingerprints — re-run
+  `checkride baseline` to re-capture, or those findings will report as new
+  once.**
+- **Report arrays that fallow does not count are no longer fingerprinted.**
+  `workspace_diagnostics` carries a `path`, and the opt-in `thin_wrappers` and
+  `duplicate_prop_shapes` rules a `file`, so all three produced keys while
+  fallow's issue registry marks them `counts_in_total: false`. The extra keys
+  pushed the key count past the issue count, where the un-keyable-findings guard
+  clamped the difference to zero — so a spurious key could offset a finding that
+  genuinely had no stable identity, and the baseline masked a slot green that it
+  had never grandfathered. The guard now counts un-keyable findings directly
+  rather than inferring them from the totals, which closes that offset even if a
+  future fallow adds an uncounted array this version does not know to skip.
+
+## [0.9.3] - 2026-07-29
+
+### Contract
+
+- **An empty slot selection is now a usage error.** `--only`, `--skip` or
+  `--include` given a value that names nothing after trimming (`--only ,`,
+  `--only ''`, `--only '  '`) exits **2**, naming the flag. It previously
+  parsed to an empty list, which is truthy, so `--only ,` filtered every check
+  out and exited **0** having verified nothing — the same vacuous green that
+  `--only lints` was fixed for in 0.5.0, reached by a different route. The two
+  empty spellings also disagreed: `--only ''` ran the whole pipeline. The rule
+  now holds for a programmatic caller too — `runChecks({ only: [] })` throws
+  rather than selecting nothing. See `docs/contract.md` §CLI and §Exit codes.
+- **`summary.json`'s published schema described `total_duration_ms` as a sum.**
+  It is, and has been since concurrency landed, the **wall-clock** span of the
+  run; the two diverge whenever checks overlap. No behavior changed — the
+  description in `schema/checkride.summary.schema.json` was simply wrong, and a
+  consumer implementing against it would derive the wrong run-start
+  (`timestamp - total_duration_ms`) and read stale artifacts as fresh. The
+  semantics are now pinned by a test, not just prose. See `docs/contract.md`
+  §`.check/summary.json`.
+
+### Fixed
+
+- **Tools are no longer installed from the registry mid-run under npm or bun.**
+  The exec translation emitted a bare `npx <tool>` / `bunx <tool>`, and both
+  launchers fetch a missing package and run it rather than failing — checks are
+  spawned without a TTY, which is precisely the non-interactive case where
+  neither stops to prompt. A repo missing a tool could therefore have its gate
+  silently execute an unpinned `latest`. Both now carry `--no-install`, which
+  bounds the download but not the launcher's global cache — the guarantee is
+  "nothing new is fetched mid-run". **Behavior change:** a tool that would have
+  to be downloaded now fails its slot. `pnpm exec` and `yarn` have no such cache
+  path and are unchanged.
+- **The triage reader's gate timeout could not reap what it started.** It
+  spawned without `detached` and sent a bare `SIGTERM` with no escalation, so
+  the signal reached the package-manager wrapper and left the checks themselves
+  running — which also meant `close` could wait on their inherited pipes
+  forever, hanging the reader the timeout existed to protect. It now leads its
+  own process group and escalates to `SIGKILL`, the same discipline the
+  orchestrator already applied; both share the new `killGroup` helper.
+- **`.check/` artifacts are now flushed before the rename that publishes them.**
+  The atomic write promised each file was "either the previous complete version
+  or the new complete version", but without an `fsync` a crash could leave the
+  renamed inode holding nothing — the torn read it exists to prevent, relocated.
+- **A committed baseline whose `slots` is an array is rejected instead of being
+  keyed by index.** Two of the four copies of the `isRecord` guard accepted
+  arrays (`typeof [] === 'object'`); the baseline read was one of them, so such
+  a file loaded cleanly and masked nothing. All four now share one definition.
+- **A baseline from a newer schema version is dropped rather than half-read.**
+  `schema_version` was recorded and never checked. Dropping it fails closed: the
+  run reports the diagnostics that are really there, where guessing risks
+  masking findings the author never grandfathered.
+- **AGENTS.md described a tree the repo does not have.** It named four folder
+  modules where there are seven (`artifacts/`, `qa/` and `triage/` were
+  missing), and stated a test-placement rule — colocate beside the source file —
+  that no test in the repo has ever followed. Both are corrected, and both are
+  now checked against the tree.
+- **Report columns no longer break on long check names.** Fixed widths were
+  sized for catalogue slots, so a config custom check (`typecheck-tests`, or
+  `custom:typecheck-tests` in the adapter column) shunted every later column
+  right on its own row. `doctor` and the run status lines now size each column
+  to the rows it holds.
+
+### Internal
+
+- **This repo's own gate now runs the `security` slot.** `pnpm audit` takes well
+  under a second and reports zero advisories at every level, and a package that
+  publishes to npm with provenance should be auditing its own dependency tree as
+  part of "done" rather than out of band. Note the trade-off: the gate now needs
+  the registry to be reachable, and a failure to *verify* is a failure, not a
+  pass — so a network outage turns the run red rather than quietly skipping the
+  check.
+- **The stryker break threshold moves 55 → 68.** The measured score is 73.2%
+  (up from 71.7%), so the old gate sat 18 points below reality and could not
+  have failed on anything short of deleting a suite. It now sits ~5 points
+  under — enough headroom that a mutant timing out on a loaded machine does not
+  turn the run red, which is the only reason not to set it tighter. The two
+  bundled-plugin bins are excluded from the mutate set: they are three lines
+  each, do their work at module top level, and are unreachable from the unit
+  runner stryker drives, so they reported a permanent 0% no test could move.
+  They are covered as processes by `test/e2e/plugin-readers.e2e.test.ts`.
+- Tests for the last uncovered code in the package. The two bundled-plugin
+  entry points (`dist/triage/cli.js`, `dist/qa/cli.js`) are exercised as
+  processes, which is the only way to reach a bin that works at module top
+  level; `checkride fix` gained CLI-dispatch coverage it never had; and the
+  three `qa/` extractors gained tests for their truncation caps and
+  malformed-input fallbacks — the bounded-reader behavior those modules exist
+  for. Branch coverage 84.3% → 85.5%.
+- New guards for the claims that drifted: `test/conventions.test.ts` checks
+  AGENTS.md's folder-module list and test placement against the tree, and the
+  summary contract suite now pins `total_duration_ms` behaviorally — wall-clock
+  under concurrency, equal to the summed durations when sequential. Both fail
+  when reverted, which is the point.
+- `test/e2e/defaults.e2e.test.ts` resolves a fixture repo that has the tool
+  configs but **no `checkride.config.json`**, so the shipped catalogue and the
+  detection path are exercised. This repo's own config names all twenty slots,
+  which is deliberate but meant daily runs never walked a consumer's path.
+- First tests for `src/triage/env.ts`, previously the only module in the package
+  with no coverage at all.
+- Two new single-file modules: `src/proc.ts` (process-group kill and escalation,
+  shared by both spawners) and `src/json.ts` (the one `isRecord`).
+- Long-form rationale moved out of source comments and into the docs that own
+  it: the pnpm stdout-narration investigation to `docs/tools.md` §Launcher
+  quirks, and the freshness-window derivation to `docs/plugin.md`. The comments
+  keep the "why" and point at the rest.
+
+## [0.9.2] - 2026-07-28
+
+### Changed
+
+- **`checkride init` now writes a newer toolchain into generated projects.**
+  The pinned versions a new project receives move to oxlint 1.74.0 (with
+  oxlint-tsgolint 0.25.0), fallow 3.9.1, ast-grep 0.45.0, vitest 4.1.10,
+  markdownlint-cli2 0.23.1, cspell 10.0.1, prettier 3.9.6, biome 2.5.6, jest
+  30.4.2, publint 0.3.22, attw 0.18.5, and `@types/node` 22.20.1. A freshly
+  generated project still installs and passes green out of the box. TypeScript
+  stays at 6.0.3, and the eslint and knip pins stay on their current majors —
+  all three are deliberate holds, now marked as such in the adapter registry.
+- **The documented fallow pin is 3.9.1.** The supported floor is unchanged:
+  fallow ≥ 3.5, JSON `schema_version` 7. Every release from 3.5.0 through 3.9.1
+  emits schema 7 with identical report layouts, so an existing baseline keeps
+  masking and no consumer has to move.
+
+### Fixed
+
+- **The bundled `check` skill quoted a markdownlint summary line that no longer
+  exists.** Its guidance on reading a failing `docs` slot cited
+  `Summary: 1 error(s)`; markdownlint-cli2 0.23 emits `Summary: 1 issue in 1
+  file`. The surrounding advice was still right — that tool puts the count on
+  stdout and the `file:line:rule` you actually need on stderr — but the quoted
+  string sent agents looking for text no run produces.
+
+### Internal
+
+- Development dependencies upgraded across the board, in separate verified
+  steps: fallow's report schema and layouts confirmed unchanged, ast-grep's
+  rules confirmed to still fire (repo *and* shipped template copies), and
+  oxlint's diagnostic text confirmed byte-identical for the baseline fixtures
+  it fingerprints.
+- Nine new oxlint errors from the 1.61 → 1.74 jump were fixed at the root
+  rather than suppressed: two genuinely unnecessary type assertions, and seven
+  test helpers hoisted out of the scopes they never captured.
+- `pnpm audit` is clean again. The `brace-expansion` override had gone stale as
+  its advisory widened, `fast-uri`, `postcss`, and a js-yaml 5.x entry were
+  added, and the `markdown-it` and js-yaml 4.x overrides were retired as
+  redundant — each verified by removal and re-audit, not by inspection.
+- Every GitHub Actions ref is now SHA-pinned with a version comment. `ci.yml`
+  alone had floated on mutable major tags, which made the workflow gating every
+  merge the one an upstream tag move could reach. CI's pnpm moves to 11.17.0,
+  verified to accept the committed lockfile unmodified.
+
+## [0.9.1] - 2026-07-28
+
+### Fixed
+
+- **The `links` check no longer flags example links inside code blocks.** A
+  `[text](target)` shown inside a fenced block or inline backticks was resolved
+  against disk like any real link, so documentation that demonstrates Markdown
+  syntax could only pass by enumerating every example target in
+  `checks.links.allowlist`. Fence state is now tracked across the file —
+  honoring CommonMark on marker length, tilde fences, and info strings — and
+  inline code spans are masked before parsing. Two limits are deliberate and
+  tested: 4-space indented blocks are still checked, since indentation is
+  ambiguous with list continuation, and code spans straddling a newline stay
+  unmatched. The check only became less strict, so a repo passing on 0.9.0
+  still passes.
+
+## [0.9.0] - 2026-07-28
+
+### Added
+
+- **A PreToolUse deny hook guards checkride's accounting files.** "Never add
+  to the baseline to make a check pass" was README advice that an agent
+  editing the file has every local incentive to ignore; it is now
+  enforcement. Edits (Edit/Write/NotebookEdit) to `checkride.baseline.json`
+  and `.check/**` are blocked with a message explaining the ratchet; reads
+  are never denied — the stanza's own triage procedure and both plugin
+  skills read `.check/` artifacts. Both paths are unambiguous, so the deny
+  is exact; module-boundary rules deliberately stay in ast-grep, where they
+  are enforced over parsed code rather than approximated by paths.
+- **The gate now skips turns that edited nothing.** A new PostToolUse hook
+  (`dirty`) touches `.check/.dirty` on every Edit/Write/NotebookEdit; the gate
+  script exits 0 immediately when the marker is absent and clears it after a
+  green run. Stop fires at the end of *every* turn, including
+  pure-conversation ones — on a real repo that was a multi-second pipeline
+  tax (plus formatter writes) for a turn that changed nothing, the single
+  best reason to disable the gate. File writes made through Bash don't set
+  the marker (a known, accepted gap — matching Bash would fire on every
+  command); the next tool-edited turn re-covers it. A `--hook gate`
+  selection without `dirty` writes an unconditional script, so the guard can
+  never disarm a gate that has no marker source.
+- **The generated gate runs `--strict --digest`.** The Stop hook is a gate,
+  and the contract says anything that gates should pass `--strict` — now
+  checkride's own generated hook does. `--digest` writes the token-bounded
+  `.check/digest.md` on red, and the guidance message points there when it
+  exists (summary.json otherwise) and names `/checkride:check` for full
+  triage. npm repos get the `--` passthrough form; pnpm/yarn/bun forward
+  flags directly.
+
+### Changed
+
+- **The Stop-hook gate moved into a checkride-owned script,
+  `.claude/hooks/checkride-gate.sh`.** The settings.json entry is now a stable
+  one-liner invoking it (`sh "${CLAUDE_PROJECT_DIR:-.}/…"`), so refreshing is
+  genuinely lossless: checkride overwrites its script freely, and consumer
+  customization has a natural home (a sibling script, or the environment)
+  instead of an inline command the next `agent-setup` would clobber. Repos
+  carrying the old inline form are migrated in place on the next
+  `agent-setup`/`init` — detected by the existing sentinel and replaced, never
+  duplicated. `init`/`agent-setup` grow `--hook <a,b>` to select which hooks
+  to write (default: all); `--no-hook` remains the write-none escape.
+
+### Fixed
+
+- **The `security` slot now gates at `--audit-level`, not at any advisory.**
+  pnpm's JSON mode exits 1 on *any* advisory regardless of `--audit-level`
+  (only table mode lets the level gate the exit code — reproduced with a
+  single-moderate lockfile: `--json` exits 1, table exits 0), so the slot
+  judged by exit code effectively gated at zero advisories of any severity
+  rather than the declared `high`. `security` is now a built-in evaluator: it
+  runs the audit with `--json`, parses `metadata.vulnerabilities`, and fails
+  only on advisories at or above the threshold parsed from the adapter's own
+  `--audit-level` arg — so a consumer override keeps meaning what it says,
+  and "audit could not run" (registry unreachable, malformed output) stays a
+  failure rather than a silent pass. Consumers who dropped `--json` to work
+  around this can return to the default args and get the
+  `.check/security.json` artifact back (`--json` is appended if an override
+  omits it).
+- **`pack` no longer fails hard under pnpm older than 10.26.** pnpm only
+  learned `pack --dry-run` in 10.26.0; every earlier pnpm — including 10.18.x
+  lines consumers actually pin — rejects the flag with
+  `Unknown option: 'dry-run'`, and the slot failed on a manager checkride
+  has promised since 0.5.0 (reported by a real consumer on 10.18.1). On that
+  rejection checkride now falls back to a real pack into a temp destination
+  outside the repo (`pnpm pack --json --pack-destination <tmp>` — same
+  npm-shaped `files[].path` JSON, verified back to 10.18.1), with lifecycle
+  scripts suppressed the same way, and deletes the tarball afterward whether
+  the check passes or not. Capability fallback, not version sniffing, so it
+  keeps working wherever the flag is missing.
+- **The default concurrency no longer collapses to 1 on a 2-core CI runner.**
+  `defaultConcurrency` reserved a core to keep the machine responsive — sound
+  on a laptop, inapplicable on a hosted runner with no human at it. A
+  standard GitHub-hosted runner reports 2 CPUs, so the pool was 1 and a
+  wave-scheduled config executed fully sequentially (measured on a real
+  consumer: 27.4s wall against 27.4s of summed check time — 1.00x), on
+  exactly the machine class the docs say to gate on. With `CI` set (every
+  provider sets it) no core is reserved, so that runner now gets a pool of 2.
+  The cap of 4, the `--concurrency` override, and `--bail`'s sequential
+  behavior are unchanged. How much a 2-wide pool on 2 cores buys depends on
+  the mix: checks dominated by process startup and file discovery overlap
+  well; two CPU-bound tools may be closer to a wash. It is never slower than
+  the serialized pool it replaces, and `order` waves now schedule as
+  documented. docs/ci.md explains the runner-size effect and how to read
+  `total_duration_ms` against the per-check sum.
+- **The AGENTS.md stanza reports the configured gate, not the detected one.**
+  `init` and `agent-setup` derived the stanza's "Active checks in this repo"
+  line from the adoption inventory, which has detection semantics and never
+  reads `checkride.config.json` — so opt-in slots a config entry opts in
+  (`format`, `build`, …) and non-catalogue custom checks were silently missing
+  from the agent-facing contract while the gate ran them. The stanza now
+  derives from the same selection a default run makes (the pattern `doctor`
+  already used), so what it names and what `pnpm check` runs agree.
+
+### Internal
+
+- The design record for this release is
+  [docs/spec-agent-setup-upgrade.md](./docs/spec-agent-setup-upgrade.md): two
+  consumers' reports validated against source, with the measured pnpm version
+  boundaries. docs/getting-started.md's hard-gate section was rewritten for
+  the three-hook suite.
+
+## [0.8.1] - 2026-07-28
+
+### Fixed
+
+- **A package-manager banner on stdout no longer fails the JSON-reading slots.**
+  pnpm verifies dependencies before `exec`/`run` and narrates it on **stdout**
+  (`Already up to date`, `Done in Xms using pnpm vN`) whenever no outer pnpm
+  process has already done so. That preamble landed ahead of the tool's own
+  JSON, so `checkride` invoked directly — `node dist/cli.js`, which is what the
+  bundled triage reader and any non-pnpm-wrapped call does — failed `dead`,
+  `dupes` and `health` with "fallow did not emit valid JSON" while the tools
+  themselves exited 0, and silently cost `lint`, `struct` and `attw` their JSON
+  artifacts. The same gate under `pnpm run check` passed, which is what made it
+  hard to see. Fixed at both ends: checkride now passes
+  `--config.verify-deps-before-run=false` ahead of `exec`/`run` under pnpm (the
+  only form that works — `--silent` does not suppress it, and after `exec` pnpm
+  reads it as the tool's argument), and every stdout-JSON parse tolerates up to
+  ten leading non-JSON lines, because a consumer's launcher is not checkride's
+  to pin. The `<slot>.json` artifact is written from the first JSON character
+  on, so it parses on its own; nothing inside the tool's output is altered.
+- **`summary.json`'s `output_file` no longer names files that were never
+  written.** It was copied from the adapter's declaration, so any run where a
+  JSON-declaring tool emitted something else — a warning first, a crash, or the
+  banner above — left the summary pointing at a `<slot>.json` that did not
+  exist while the real bytes sat in `<slot>.stdout.txt` beside it. It is now
+  what the run actually wrote, and `null` when that is nothing (including for a
+  skipped check, which writes nothing at all). This is the field's documented
+  meaning; see [docs/contract.md](./docs/contract.md).
+
+## [0.8.0] - 2026-07-28
+
+### Added
+
+- **A bundled Claude Code plugin, shipped from the package root.** The published
+  package now carries `.claude-plugin/plugin.json` and a `skills/` directory, so
+  `checkride` installs as a plugin from the same npm tarball you already depend
+  on (`/plugin marketplace add robmclarty/agent-tools`, then
+  `/plugin install checkride@robmclarty`). It is bundled rather than published
+  separately so the readers version in lockstep with the `.check/` contract they
+  parse; a test asserts the manifest's version equals `package.json`'s. Nothing
+  about the CLI, the exit codes or the `.check/` contract changes, installed or
+  not. See [docs/plugin.md](./docs/plugin.md).
+- **`/checkride:check` — triage a red gate.** Runs the repo's own `check` script
+  (the definition of done, which may carry deliberate `--only`/`--skip`), branches
+  on the promised 0/1/2 exit split, and names one root cause plus what it is
+  deliberately not reading. It covers the contract corners a hand-read of
+  `summary.json` gets wrong — exit 2 versus exit 1, vacuous green, a narrow run's
+  green, `baselined` counts, `skipped` slots, `exit_code: -1`, an unexpected
+  `schema_version`, stale artifacts, and a red gate whose compound `check` script
+  died before checkride ran — then opens exactly one raw file. Artifacts are
+  measured, never opened: a green 17-slot run renders in about 2 kB.
+- **`/checkride:qa` — read the quality signal.** Folds `mutation.json`,
+  `dead.json`, `dupes.json` and `health.json` into a report under 8 kB (2.2 MB of
+  mutation data becomes a ranked page), runs nothing at all, and opens with a
+  present / stale / not-opted-in ledger naming the command or config entry that
+  would produce each missing artifact — three of the four come from opt-in slots,
+  so partial data is the normal case.
+- **Two dependency-free readers behind those skills**, shipped prebuilt in
+  `dist/` so a plugin install needs no build step, and runnable without Claude
+  Code: `node node_modules/checkride/dist/triage/cli.js` and
+  `node node_modules/checkride/dist/qa/cli.js`, each taking an optional repo
+  path. Both use `node:` builtins only. Every artifact read is bounded, dated
+  against the run that claims it (an artifact older than the run's start is
+  labelled stale with its age, never silently dropped), and resolved by the
+  documented `output_file` → `<slot>.json` → `<slot>.stdout.txt`/`.stderr.txt`
+  convention, which matters because `output_file` is null for 8 of this repo's
+  17 slots — `test` among them.
+- **`examples/` — eight runnable projects, each demonstrating one thing.** They
+  are standalone packages rather than workspace members, so you `cd` in, install,
+  and run one without the rest of the repo: `agent-loop` (what an agent reads
+  when the gate is red), `existing-repo-baseline` (adopting checkride on a repo
+  that already has findings), `custom-checks` (the escape hatch — a bespoke
+  formatter ahead of the built-ins, `detect`-gated checks that stand down),
+  `shared-preset` (org-wide policy as one versioned package), `polyglot` (a
+  Python repo where the TypeScript built-ins stand down and ast-grep enforces
+  boundaries in Python), and `module-boundaries` / `dal-boundaries` /
+  `dal-boundaries-declarative` for boundary enforcement — the last expressing a
+  data-access policy with fallow zones and ast-grep rules alone, no custom script.
+  Each declares the exit code it expects and `test/e2e/examples.e2e.test.ts`
+  asserts it on every push, so an example that stops behaving as its README
+  claims fails CI.
+
+### Changed
+
+- **The AGENTS.md stanza written by `checkride init` and `checkride agent-setup`
+  names `/checkride:check`.** Exactly one added line; the prose procedure is
+  unchanged and still works standalone in a repo that never installs the plugin.
+
+### Internal
+
+- `/version` now folds an existing `## [Unreleased]` changelog section into the
+  new release heading instead of inserting above it.
+
+## [0.7.0] - 2026-07-22
+
+### Changed
+
+- **checkride is now licensed [Apache-2.0](./LICENSE), previously MIT.** No code
+  or API changed; the terms you receive it under did. Apache-2.0 adds an express
+  patent grant and, via section 5, makes contributions inbound under the same
+  license without a CLA — the reason for the switch, ahead of accepting outside
+  contributions. Consumers redistributing checkride should note the section 4
+  conditions (include the license, mark modified files); there is deliberately
+  no `NOTICE` file, so nothing to propagate. `checkride init --license` still
+  defaults to `MIT` for scaffolded projects — that remains the user's choice and
+  is unaffected.
+
+### Internal
+
+- `CONTRIBUTING.md` gains a licensing section: how section 5 works, why an
+  employer may own contributions written on their time, and DCO sign-off via
+  `git commit -s`.
+
+## [0.6.0] - 2026-07-21
+
+### Added
+
+- **`optIn` override to configure a slot without opting it into the default
+  run.** A slot entry (both the `{ use }` and custom `{ command }` forms) now
+  takes `optIn?: boolean`: `true` configures the slot but keeps it reachable
+  only via `--all`/`--include` (so giving `attw` a profile no longer drags
+  `attw`/`build`/`pack`/`smoke` into a plain `checkride` run), and `false`
+  forces a slot into the default run. Resolution-side only, so selection, the
+  vacuous-green warning, and `doctor` all adjust automatically.
+- **Config-driven `exclude` and `allowlist` for the built-in `links` check.**
+  `exclude` adds directory names to skip on top of the built-in set, and
+  `allowlist` takes regex sources whose matching link targets count as valid
+  (for generated or illustrative markdown that never resolves on disk).
+  Patterns are compiled and validated at config load, so a bad one is a
+  friendly exit-2 error rather than a mid-run crash. Both are declared in the
+  JSON schema.
+- **`profile` shortcut for the `attw` slot.** A `profile` string on the config
+  entry appends `--profile <name>` to attw's invocation instead of re-typing
+  the full args array (a no-op on other slots; a non-string is a friendly
+  config error).
+
+### Changed
+
+- **`publint` and `attw` stand down when their tool isn't installed.** Both
+  were always-available and hard-failed an `--all` run with "Command not found"
+  on a repo that never installed them; they now gate on their package
+  (`publint`, `@arethetypeswrong/cli`) and skip cleanly when absent, matching
+  checkride's skip-not-fail principle for opt-in slots. Naming one explicitly
+  in config still forces it to run.
+
+### Fixed
+
+- **A single duplicate fingerprint no longer disables baselining for a whole
+  fallow slot.** The baseline gate guarded against un-fingerprintable findings by
+  comparing the deduplicated key count to the raw issue count, but that
+  comparison could not tell a finding that produced *no* key apart from two
+  findings that produced the *same* key. One key collision (two `<arrow>`
+  functions in a file, or two symbol-less `unused_class_members`) made the slot
+  look untracked, so `checkride baseline` followed by `checkride` stayed red
+  forever. The gate now tracks an explicit un-keyed count instead, so a collision
+  merely coarsens the baseline (grandfathering one finding grandfathers its twin)
+  rather than disabling it, while a genuinely un-keyable finding still holds the
+  slot red.
+- **Colliding fallow fingerprints are now disambiguated.** Anonymous health
+  functions (`<arrow>`, `<anonymous>`) and symbol-less dead-code findings
+  (`unused_class_members`) append their line and column, so a real sibling
+  finding can no longer be masked by a baseline captured for a different one.
+  Named functions and symbol-bearing findings keep their line-free keys.
+
+  This changes the fingerprint strings for the `dead` and `health` slots, which
+  **invalidates existing `checkride.baseline.json` entries for those slots**.
+  Re-run `checkride baseline` to recapture them.
+
+### Internal
+
+- **Cleared all `pnpm audit` advisories** via `pnpm-workspace.yaml` overrides:
+  `brace-expansion` (GHSA-3jxr-9vmj-r5cp) and `js-yaml` (GHSA-52cp-r559-cp3m)
+  were high, `qs` (GHSA-q8mj-m7cp-5q26) and `markdown-it` (GHSA-6v5v-wf23-fmfq)
+  moderate. Each is a transitive **dev** dependency (of stryker and
+  markdownlint-cli2), so none reached the published package; each override is
+  scoped to its advisory's vulnerable range and capped to the compatible major.
+- Docs: added a deep-modules guide and a fleet-presets guide for org-wide
+  rollout, reframed swappable module boundaries as the default, dropped the
+  "TypeScript-only" framing from the README, homepage, and npm package
+  description, clarified the README for first-time readers, and pointed
+  `package.json` `homepage` at the GitHub Pages site.
+
+## [0.5.3] - 2026-07-19
+
+### Internal
+
+- **Docs: `docs/ordering-in-practice.md`** — a worked guide to `order`
+  scheduling waves, now with a second example where waves encode a *dependency*
+  (`build` produces `dist/`; the publish bundle — `publint`, `attw`, `pack`,
+  `smoke`, `snippets-dist` — consumes it) rather than just a duration tier.
+- Adopt explicit ordering waves in checkride's own `checkride.config.json`, so
+  the gate config states its execution plan instead of leaning on adapter
+  defaults and pool arithmetic.
+- CI: bump `upload-pages-artifact` to v5 and drop the Node 20 pages runtime.
+- Expand the `cspell` dictionary with words the docs introduced.
+
 ## [0.5.2] - 2026-07-19
 
 ### Internal
@@ -465,6 +1453,21 @@ The first real release. (`0.0.0` was a name-claim placeholder.)
 - Flags: `--only`, `--skip`, `--bail`, `--json`, `--changed`, `--all`,
   `--include`.
 
+[0.10.2]: https://www.npmjs.com/package/checkride/v/0.10.2
+[0.10.1]: https://www.npmjs.com/package/checkride/v/0.10.1
+[0.10.0]: https://www.npmjs.com/package/checkride/v/0.10.0
+[0.9.6]: https://www.npmjs.com/package/checkride/v/0.9.6
+[0.9.5]: https://www.npmjs.com/package/checkride/v/0.9.5
+[0.9.4]: https://www.npmjs.com/package/checkride/v/0.9.4
+[0.9.3]: https://www.npmjs.com/package/checkride/v/0.9.3
+[0.9.2]: https://www.npmjs.com/package/checkride/v/0.9.2
+[0.9.1]: https://www.npmjs.com/package/checkride/v/0.9.1
+[0.9.0]: https://www.npmjs.com/package/checkride/v/0.9.0
+[0.8.1]: https://www.npmjs.com/package/checkride/v/0.8.1
+[0.8.0]: https://www.npmjs.com/package/checkride/v/0.8.0
+[0.7.0]: https://www.npmjs.com/package/checkride/v/0.7.0
+[0.6.0]: https://www.npmjs.com/package/checkride/v/0.6.0
+[0.5.3]: https://www.npmjs.com/package/checkride/v/0.5.3
 [0.5.2]: https://www.npmjs.com/package/checkride/v/0.5.2
 [0.5.1]: https://www.npmjs.com/package/checkride/v/0.5.1
 [0.5.0]: https://www.npmjs.com/package/checkride/v/0.5.0