super-ux 0.52.1 → 0.52.3

package/CHANGELOG.md

@@ -1,5 +1,60 @@
 # Changelog
 
+## 0.52.3 — the front matter gets read by a parser, not by a regex
+
+- **`validate_front_matter_is_yaml` parses all 30 shipped front-matter blocks with PyYAML**
+  (`B-033`): 7 `SKILL.md`, 15 commands, 8 `.mdc` mirrors. `front_matter()` reads a block line
+  by line and never asks what a YAML parser would, so a `: ` inside an unquoted scalar turns
+  the whole block into an invalid mapping and ships anyway — green here, refused by every
+  installer that parses YAML, and the hub copy freezes on the previous version. The family
+  shipped exactly that twice in twelve days (`sheleg-design` 1.37.4 and 1.58.0, both
+  `mapping values are not allowed here`), so the remedy is **ported from the sibling that
+  paid for it** rather than reinvented.
+- **The two guards are the ones that history says matter.** It fails **closed** when PyYAML
+  is missing, because a guard that discloses and passes when its tool is absent is the hole
+  the first fix left open; and it refuses an **empty walk**, because globs that all match
+  nothing is a moved directory rather than a clean tree. Both watched: `yaml` blocked at
+  import, and the three globs renamed.
+- **`YAML_SELF_TEST` is a permanent plant, not a one-off.** This gate's whole claim is that
+  it sees what `front_matter()` cannot; a parser that stopped refusing that shape would leave
+  it green on a clean tree forever, so the shape is re-checked on every run.
+- PyYAML installed in both workflows: `setup-python` puts a different interpreter on PATH
+  than the runner's system one, which is where PyYAML is preinstalled.
+
+## 0.52.2 — the evals stop being a promise, and 0.52.1's stowaways get their record
+
+- **The eval suite has dated rows instead of a vacant table** (SUX-04, family audit
+  2026-08-29). 28 blind trigger probes — one fresh subagent per query per model
+  (`haiku`, `sonnet`), each shown only the query and the 28 installed family skill
+  descriptions — scored 14/14 on both models (train 8/8, validation 6/6), with every
+  raw answer recorded. Three scenario runs in fresh scratch workspaces scored 12/12
+  expected-behavior lines, each re-verified by running the pack's own linters over
+  the agents' outputs (s01 design chain: `ux_lint.py` 0 errors; s03 rewritten copy:
+  `brand pack is clean`). `test/evals/RESULTS.md` carries the per-query receipts,
+  the scenario evidence, and a Method section that states the limits — single
+  repetition per query against a README that asks for three, model aliases rather
+  than snapshot ids, and the one non-hermetic call the s02 audit itself disclosed.
+- **Two changes shipped inside v0.52.1 without a line of record, and this is that
+  line.** The 0.52.1 commit was cut by a concurrent session from this working tree
+  while this run's edits sat uncommitted in it, so they rode along:
+  **`compatibility:` front matter in all seven skills** (SUX-02) — per-skill rather
+  than one blanket string: the five UX skills name python3 3.9+ (stdlib only) for
+  the linter this pack seeds, `ux-flows` names its optional MCPs (Figma for
+  mockups, Refero/Mobbin/Lazyweb for reference screens) and what happens when they
+  are absent, `ux-audit` states which half of the Figma check survives without the
+  MCP, and the two brand skills name `docs/brand/lint.py` — and **`$schema` in both
+  manifests** (SUX-05), the two schemastore spellings that resolve (the family also
+  carries a `claude-code-plugin.json` variant, which 404s and was not copied);
+  `claude plugin validate --strict` passes on both. Every `compatibility` value is
+  a one-line YAML plain scalar with no colon-space sequence, parsed with
+  `yaml.safe_load` before it ever reached a commit — the family shipped that exact
+  defect twice this week (sheleg-design 1.37.4 and 1.58.0), and a planted
+  colon-space here was caught by the same `mapping values are not allowed here`.
+  Budgets measured: 153–358 chars against the standard's 500; the pinned house
+  auditor returns 0 GAP on all seven. The class — a repo gate that parses shipped
+  front matter as YAML — is filed as `B-033` rather than claimed, because this
+  run's check was manual.
+
 ## 0.52.1 — a ledger row that machine-read as something else
 
 - **`B-029`'s board row carried an unescaped `|` inside a backticked span**

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "super-ux",
-  "version": "0.52.1",
+  "version": "0.52.3",
   "scripts": {
     "test": "python3 test/validate.py && python3 test/brand_lint_test.py && python3 test/ux_lint_test.py && python3 docs/ux/lint.py && python3 docs/brand/lint.py && node test/installer_test.js"
   },