renma 0.16.0 → 0.18.0

package/CHANGELOG.md

@@ -6,6 +6,160 @@ This project follows the spirit of [Keep a Changelog](https://keepachangelog.com
 
 ## [Unreleased]
 
+## [0.18.0] - 2026-07-12
+
+### Added
+
+- Added the internal `renma-quality` profile family. The emitted profile
+  identifier is derived from the Renma package version as
+  `renma-quality@<package version>`. Added canonical threshold documentation
+  with units, provenance, rationale, false-positive risks, and
+  future-configurability status.
+- Added one deterministic Unicode-aware `estimated_tokens` implementation for
+  Skill, content-asset, reuse-candidate, and repeated-context analysis.
+- Added first-class `script` and `asset` artifact kinds under both supported
+  Skill roots, including original-byte hashes, sizes, text/binary
+  classification, Markdown eligibility, and catalog, graph, Trust Graph, and
+  BOM inventory.
+- Added direct, one-index-hop, deep-chain, unreachable, and missing-path static
+  support reachability for references, scripts, assets, profiles, and examples.
+- Added `renma scaffold skill --resources references,scripts,assets`; file mode
+  creates only selected empty directories, while prompt and JSON modes report
+  the selected resource contract without writing files.
+- Added BOM and Trust Graph v2 as the first supported long-term schema
+  contracts. Renma 0.18.0 does not provide a v1 compatibility mode; the
+  earlier experimental v1 surface was removed before broader adoption.
+- Added normalized ownership provenance and static local-resource relationship
+  edges across catalog, graph, readiness, BOM, and Trust Graph output.
+
+### Changed
+
+- Replaced the thin-router model with focused workflow entrypoints. Ordered
+  procedures, completion criteria, and short command examples are valid in
+  `SKILL.md`; progressive disclosure is reviewed by semantic destination.
+- Changed Skill body advisories to low above 2,000 and medium above 5,000
+  estimated tokens. Changed content advisories to Context 4,000, Reference
+  5,000, Profile 2,000, and Example 2,500 estimated tokens.
+- Changed metadata advisories to 48 frontmatter lines, 4,096 frontmatter
+  characters, and 256 characters per prose-like list item, with practical
+  exemptions for IDs, repository paths, and URLs.
+- Changed reusable Context eligibility to 60 lines or 800 estimated tokens plus
+  four reusable signals. Changed shared-reference eligibility to 80 lines or
+  1,200 estimated tokens plus three reusable headings and four reusable
+  phrases. Ordinary workflow headings and constraint words do not qualify.
+- Changed repeated headings to require three files and token shingles to 40
+  estimated tokens in three files. Exact-section, exact-code, and per-category
+  caps retain their established defaults.
+- Changed Readiness to `workflow.skills_focused`, removed the five-point
+  existence penalty for deprecated/archived assets, and reduced subjective
+  workflow advisory weights while preserving blocking graph and diagnostic
+  failures.
+- Deprecated `metadata.renma.when-to-use` and
+  `metadata.renma.when-not-to-use` for new Skill authoring. They remain
+  recognized for governance and migration preservation; portable
+  `description` is the Skill discovery source of truth.
+
+### Fixed
+
+- Stopped overcounting Japanese one character at a time in quality rules and
+  undercounting unspaced Japanese as one token in repeated-context analysis.
+- Stopped decoding images, PDFs, fonts, and other opaque assets as UTF-8
+  Markdown or exposing binary bytes in diagnostic snippets.
+- Stopped non-Markdown text scripts and assets from contributing frontmatter,
+  headings, links, fences, or repeated-context evidence.
+- Fixed nearest-Skill support ownership, nested Skill boundaries, explicit path
+  reachability, extensionless and spaced paths, and oversized-file existence
+  evidence.
+- Prevented script and asset bytes from declaring policy. Skill-local scripts
+  and assets inherit the nearest unambiguous Skill policy; text scripts may be
+  scanned under it, while binary files and ordinary output assets stay opaque.
+- Rejected files reached through leaf or ancestor symbolic links, including
+  Skill-local directory links that point elsewhere inside or outside the
+  repository.
+- Scanned non-Markdown scripts from line 1 even when they begin with `---`, and
+  added explicit local, inherited, effective, and missing-effective policy
+  inventory provenance.
+- Added balanced-parenthesis Markdown destination parsing and single-pass
+  decoding for encoded filename characters.
+- Stopped treating a command, Procedure/Steps/Setup headings, ordered workflow
+  wording, or 450/700-word counts as evidence of a bad Skill.
+- Stopped recommending Context Assets as the default destination for
+  Skill-specific procedures, variants, edge cases, scripts, and output
+  resources.
+- Stopped repeated links to the same specification or source from producing
+  maintenance findings by default.
+
+### Removed
+
+- Removed default emission of `QUAL-SHORT-DESCRIPTION`,
+  `LAYOUT-SKILL-NOT-THIN`, `LAYOUT-SKILL-EXECUTABLE-COMMAND`, and
+  `MAINT-REPEATED-LINK`.
+- Removed the Readiness `layout.skills_thin` contract and the unconditional
+  lifecycle-status penalty.
+
+### Compatibility
+
+- No public quality-threshold configuration was added to
+  `renma.config.json`. The versioned internal profile is shaped for possible
+  later overrides after usage evidence.
+- `ArtifactKind`, catalog entries, graph nodes, Trust Graph asset properties,
+  and Repository Context BOM assets add `script`/`asset` and binary-safety
+  evidence. Consumers that exhaustively match kinds or exact-normalize these
+  schemas must update for 0.18.0.
+- Scaffold file, prompt, and JSON contracts add selected resource directories;
+  existing invocations without `--resources` create no extra directories.
+- Agent Skills specification errors remain separate from Renma advisories:
+  `description` is required, a string, and 1-1,024 characters; 150 characters
+  is not an Agent Skills minimum.
+
+### Migration
+
+- `LAYOUT-SKILL-NOT-THIN` -> `QUAL-SKILL-MIXED-RESPONSIBILITY` when reusable
+  knowledge evidence exists, otherwise no finding.
+- `LAYOUT-SKILL-EXECUTABLE-COMMAND` -> no layout finding; security,
+  unresolved-helper, path-escape, and large-inline-implementation checks remain.
+- `QUAL-SHORT-DESCRIPTION` -> Agent Skills description validity plus
+  `RN-SKILL-DESCRIPTION-MISSING-CAPABILITY`,
+  `RN-SKILL-DESCRIPTION-MISSING-USAGE-BOUNDARY`, and
+  `RN-SKILL-DESCRIPTION-OMITS-SELECTION-BOUNDARY` where applicable.
+- `MAINT-REPEATED-LINK` -> no maintenance finding by default.
+- Readiness `layout.skills_thin` -> `workflow.skills_focused`.
+- Rebaseline exact catalog, graph, Trust Graph, BOM, Readiness, scaffold JSON,
+  and package-content fixtures against the 0.18.0 schemas before release.
+
+## [0.17.0] - 2026-07-11
+
+### Added
+
+- Added platform-neutral, Skill-specific next steps to scaffold file and prompt output, including the authoring-review, scan, fix, rerun, and human-review loop.
+- Added Skill-specific `suggest-metadata` prompt guidance that separates whole-Skill authoring review from metadata or one-way migration suggestions and keeps blocked migrations conservative.
+- Added a documentation index with reading paths for workflows, format contracts, governance references, product design, architecture, and roadmap material.
+- Added the interactive-placeholder onboarding example and package-content verification for version-matched README documentation and examples.
+
+### Changed
+
+- Clarified that platform-native guidance owns general Skill design while Renma complements it with repository-specific governance and validation.
+- Consolidated the README around product identity, boundaries, primary workflows, quick start, command orientation, a canonical example, and documentation navigation.
+- Made the authoring guide the canonical new-Skill and existing-Skill workflow, including safe generator boundaries and an optional Codex `skill-creator` example.
+- Reworked the user manual and compatibility guide around actual CLI behavior, review responsibilities, scan/fix/rerun validation, and blocked migration recovery.
+- Rewrote the roadmap around the shipped 0.16.0 baseline, the 0.17.0 usability release, and proposed 0.18.0 graph-based Skill discovery; removed stale release sequencing from architecture and design.
+- Made canonical nested Skills under both `skills/**` and `.agents/skills/**` participate consistently in Readiness, thin-Skill, graph, support, and parent-Skill checks.
+- Allowed valid Skill-local Agent Skills support directories without path-only disallowed-layout findings; reusable Context and shared-helper promotion remains evidence-based and human-reviewed.
+- Normalized expected CLI target and option errors, enforced command-specific options and positional arity, and rejected partial positive-integer values.
+- Retained `layout.tool_namespace` and `layout.workflow_aliases` as validated compatibility-only input; they no longer force path-only migration of valid Skill-local support.
+
+### Fixed
+
+- Corrected Readiness false-positive `ready` results for nested Skills with missing workflow guidance.
+- Updated the Context Lens example to current 0.17.0 quality with conservative local policy, complete workflow guidance, and clean scan/readiness output.
+- Included README-linked architecture, design, roadmap, documentation, and examples in the npm package.
+- Stopped treating documented Skill-local support paths as stale and resolved `scripts/**` helper commands against an unambiguous owning Skill using repository snapshot evidence.
+
+### Compatibility
+
+- Preserved scaffold and `suggest-metadata` JSON field shapes, stdout-only prompt behavior, and non-editing metadata suggestions.
+- Kept Skill-specific guidance out of Context Asset and Context Lens scaffold and suggestion output.
+
 ## [0.16.0] - 2026-07-11
 
 ### Added
@@ -310,7 +464,9 @@ Tag-only release. No GitHub Release entry was published for this version.
 - Added metadata governance, advisory diagnostics, local path checks, and semantic split suggestions.
 - Added the initial project documentation, architecture notes, package metadata, tests, and license.
 
-[Unreleased]: https://github.com/KazuCocoa/renma/compare/v0.16.0...HEAD
+[Unreleased]: https://github.com/KazuCocoa/renma/compare/v0.18.0...HEAD
+[0.18.0]: https://github.com/KazuCocoa/renma/compare/v0.17.0...v0.18.0
+[0.17.0]: https://github.com/KazuCocoa/renma/compare/v0.16.0...v0.17.0
 [0.16.0]: https://github.com/KazuCocoa/renma/compare/v0.15.2...v0.16.0
 [0.15.2]: https://github.com/KazuCocoa/renma/compare/v0.15.1...v0.15.2
 [0.15.1]: https://github.com/KazuCocoa/renma/compare/v0.15.0...v0.15.1