promptwheel 0.7.4 → 0.7.5

package/package.json

@@ -1,17 +1,15 @@
 {
   "name": "promptwheel",
-  "version": "0.7.4",
+  "version": "0.7.5",
   "description": "A deterministic, zero-LLM check for your coding loop. It proves every change earned its win by re-running the result from the agent's source edits alone, so a green that came from editing the test reads GAMED. Runs in CI or a Claude Code hook, or import { check } in process.",
   "type": "module",
   "bin": {
-    "promptwheel": "bin/promptwheel.mjs",
-    "pw": "bin/promptwheel.mjs"
+    "promptwheel": "bin/promptwheel.mjs"
   },
   "exports": {
     ".": "./bin/promptwheel.mjs",
     "./bin/promptwheel.mjs": "./bin/promptwheel.mjs",
-    "./package.json": "./package.json",
-    "./packs/*": "./packs/*"
+    "./package.json": "./package.json"
   },
   "files": [
     "bin",

package/packs/security/README.md

@@ -46,7 +46,7 @@ Each pattern ships with its own false-positive guards (the `exclude` regexes).
 
 This is the **regex-portable** slice. The other ~75 recommended invariants
 (auth-enforcement, authz-revocation, tenant-isolation, dataflow-tainted sinks)
-need the AST + dataflow engine and are the follow-up - see the decant note in
-`explorations/`. The point of v0.1 is the architecture: security invariants are
+need an AST + dataflow engine and are a possible follow-up, not part of this
+pack. The point of v0.1 is the architecture: security invariants are
 now a first-class, un-gameable PromptWheel metric. Zero dependencies; the scanner
 is one file (`scan.mjs`).