katalyst-forge 5.4.0__tar.gz → 5.4.1__tar.gz

{katalyst_forge-5.4.0 → katalyst_forge-5.4.1}/CHANGELOG.md

@@ -16,6 +16,22 @@ PyPI package version. A breaking node-type/model change bumps `schema_version`.
 
 ---
 
+## [5.4.1] -- 2026-08-09
+
+### Fixed
+
+- **The practice resolver reads the schema the taxonomy actually authors** (RIC-1532). It instructed agents to read three things that do not exist: `spec.practice.applicableTo`, a `skill_ref` on a practice, and an enforcement ladder of required/recommended/optional. Two TODO blocks admitted the schema was unresolved and asked callers not to depend on the paths, which left the practice-compliance gate documented against a contract no taxonomy can honour. Resolved by reading the shipped `wings/practices.py` and probing a real taxonomy rather than the docs example, which turns out not to match what is authored: `practice` is a real kind, no applicability field exists on it or on `practice_area` so context can only scope which areas are in play, `enforcement` lives on the `standard` node valued automated/review/advisory, and pillars live at `spec.pillars`. The graph cannot serve any of it, because `kata tax show --format json` reduces a `practice_area` spec to the generic envelope, so identity now comes from the probe and content from the source file the probe reports. The fail-loud probe contract from #41 is intact and gains one case: no resolved source is inconclusive, not a clean zero.
+- **The auditor and reporter agree on what blocks** (RIC-1532). Both consumers of the resolver were corrected in the same change, because leaving them would have had the resolver grade every finding advisory while the reporter printed "Non-compliant (required)" and "Blocks: Yes" for that same finding. Blocking now originates only from a standard with `enforcement: automated` or from an NFR, and an inconclusive probe can no longer surface as a pass.
+- **`kata-code-reviewer` no longer installs with unrestricted shell and dispatch** (RIC-1648). The agent shipped in `agents/` and did install globally, because `install-opencode.mjs` enumerates that directory rather than reading `opencode.json`, but it was absent from `opencode.json`'s agent map entirely. That absence was not cosmetic: `opencode.json` is the only place the per-agent permission blocks live in full, and the installer mirrors `permission` from it so an installed agent is no more privileged than its in-repo counterpart. With no entry to mirror, the installed reviewer carried only the `external_directory` rule from its own frontmatter, leaving `tools.bash` and `tools.task` true with no corresponding `permission` blocks, the one agent in the installed set with unbounded shell and unbounded sub-agent dispatch. It now carries an entry bounded to what its prompt does: `permission.task` names only `kata-forge-architect` and `kata-forge-security`, and `bash` is an allowlist over a `"*": "deny"` floor. NFR-023 recorded this agent as the live example of its fourth caller state, absent from the agent map, and the same NFR fails closed for unbounded callers until each carries an explicit entry, so a bounded entry satisfies the gate rather than widening it. Unbounded callers drop from three to two.
+
+### Changed
+
+- The fourth caller state in the NFR-023 differential gate is still tested, now built from a synthetic caller name instead of asserting that a real shipped agent is broken, which is what made that assertion fail the moment the agent was fixed.
+- `kata-code-reviewer` is counted where it had been uncounted: `validate.sh`'s agent list, and a new `review` family in `openpackage.yml` rather than the `forge` family, since it is a standalone reviewer and not a Forge stage agent.
+- Patch rather than minor: both changes correct a contract that was already published, and neither touches `src/` or `schemas/`, so the PyPI wheel and the JSON Schemas are unchanged from 5.4.0 and the bundle `schema_version` stays put. What moves is agent, skill and configuration content.
+
+---
+
 ## [5.4.0] -- 2026-08-09
 
 ### Added

{katalyst_forge-5.4.0 → katalyst_forge-5.4.1}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: katalyst-forge
-Version: 5.4.0
+Version: 5.4.1
 Summary: Katalyst Forge: the delivery-lifecycle bundle (node kinds, wings, agents, templates, schemas)
 Author: eSimplicity
 License: Proprietary

{katalyst_forge-5.4.0 → katalyst_forge-5.4.1}/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "katalyst-forge"
-version = "5.4.0"
+version = "5.4.1"
 description = "Katalyst Forge: the delivery-lifecycle bundle (node kinds, wings, agents, templates, schemas)"
 license = { text = "Proprietary" }
 requires-python = ">=3.12"