You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
The developer_instructions agent-role schema and nested hooks.json schema
emitted since v0.10.1 (#24) only exist on the Codex 0.14x generation, so
0.122.0 advertised compatibility with CLIs that reject or ignore both.
Also repairs CHANGELOG section ordering (0.10.x had been inserted mid-file
below 0.8.1, with a duplicated [Unreleased] heading).
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Copy file name to clipboardExpand all lines: CHANGELOG.md
+67-62Lines changed: 67 additions & 62 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -4,6 +4,54 @@ All notable changes to ADD are documented here. Format loosely follows [Keep a C
4
4
5
5
For commit-level detail see `git log`.
6
6
7
+
## [Unreleased]
8
+
9
+
### Fixed
10
+
11
+
-**`min_codex_version` raised 0.122.0 → 0.140.0 (#26).** Since v0.10.1 the emitted agent-role TOMLs (`developer_instructions`) and nested hooks.json schema only exist on the Codex 0.14x generation, so the old floor advertised compatibility with CLIs that reject or silently ignore both. `runtimes/codex/adapter.yaml`, the `compile.py` fallback, and the capability matrix now state the honest floor.
12
+
-**CHANGELOG ordering repaired** — the `[Unreleased]`/0.10.1/0.10.0 sections had been inserted mid-file (below 0.8.1) and `[Unreleased]` was duplicated; sections are now strictly newest-first with a single `[Unreleased]` head.
13
+
14
+
### Added
15
+
16
+
-**Codex smoke #24 regression guards** — `run-smoke.sh` now asserts the installed hooks.json is the nested ≥0.14x schema (legacy flat form fails) and every installed agent TOML uses `developer_instructions` with no `prompt_skill`.
17
+
18
+
## [0.10.1] — 2026-07-18
19
+
20
+
**Codex ≥0.14x compatibility (#24)** — found by the v0.10.0 install smoke's first live run against the re-pinned CLI 0.144.5.
21
+
22
+
### Fixed
23
+
24
+
-**Sub-agent TOMLs were silently ignored on Codex ≥0.14x** — the `prompt_skill` field no longer exists in the agent-role schema. All 5 roles (explorer, implementer, reviewer, test-writer, verify) now use the required `developer_instructions` field, instructing the spawned agent to load its role's SKILL.md — behavior stays skill-sourced. Verified accepted by CLI 0.144.5.
25
+
-**hooks.json was rejected on Codex ≥0.14x** — registration now uses the current schema (top-level `hooks` key, matcher groups, typed `command` entries) and `~/.codex/...` command paths (the old bare relative paths only resolved when the session started in `$HOME`). Verified accepted by CLI 0.144.5.
26
+
- Migration hop 0.10.0→0.10.1 tells Codex users to re-run the installer to refresh `~/.codex/agents/` and `~/.codex/hooks.json`.
27
+
28
+
### Known limitations (carried)
29
+
30
+
-**Known gap (#23, found by the first live smoke run):**`/add:init --quick` still interviews, so headless one-shot sessions exit without writing config. Smokes work around it with inline answers; a true `--defaults` path targets v0.10.1.
31
+
32
+
## [0.10.0] — 2026-07-18
33
+
34
+
**"Install path confirmed" — GA release candidate** (spec: `specs/install-path-confirmation.md`; sequencing: smoke green → marketplace submission → v1.0.0 promotion tag on approval).
35
+
36
+
### Added
37
+
38
+
-**Real install smoke in CI (GA criterion #2).**`.github/workflows/install-smoke-claude.yml` — installs the checkout via the actual marketplace path (`claude plugin marketplace add` + `claude plugin install add@add-marketplace`), asserts skill discovery, and drives a headless `/add:init --quick` asserting `.add/config.json` (agent leg skips loudly without `ANTHROPIC_API_KEY`). `.github/workflows/install-smoke-codex.yml` + `tests/smoke/codex/` — Docker image with the Codex CLI pinned from `runtimes/codex/adapter.yaml` (single source of truth via build-arg), runs `scripts/install-codex.sh` for real, asserts 27/27 skills, hooks, shared assets, version parity, the F-002 path suite, and (with `OPENAI_API_KEY`) an agent-driven `/add-init`.
39
+
-**`docs/capability-matrix.md` (GA criterion #3 / AC-027).** Per-runtime enforced vs agent-followed vs advisory truth table, appended to every release's notes by `release.sh`; `SECURITY.md` now points at it before the threat model.
40
+
-**`scripts/release-evidence.sh` (GA criterion #4 / AC-025).** Assembles `reports/release-evidence/vX.Y.Z/` — version map, capability-matrix snapshot, command catalog, install-smoke run links, and a migration-graph reachability check; `--upload` attaches the bundle to the GitHub release.
41
+
42
+
### Changed
43
+
44
+
-**Codex CLI re-pinned 0.122.0 → 0.144.5** (`codex_cli_version`; `min_codex_version` stays 0.122.0). Install smoke verified green in Docker against the new pin (Q-001 re-baseline).
45
+
-**`release.sh` is now release-blocking (GA criterion #1).** Refuses to tag unless HEAD is on origin/main with all CI check-runs green; `--no-verify-ci` is the loud emergency override.
46
+
47
+
### Fixed
48
+
49
+
-**`migrations.json`: v0.7.3 users were stranded** — no outgoing hop existed from 0.7.3 (same class as the v0.8.1→v0.9.3 chain break). Caught by the new reachability check; fixed with a 0.7.3→0.8.0 hop carrying the standard 0.8.0 steps.
50
+
51
+
### Known limitations
52
+
53
+
-**Telemetry emission confirmed absent (Q-MS-003/D6).**`.add/telemetry/` never populates — the spec exists, no hook writes it. Recorded as a finding; implementation deferred past v0.10.0 (does not gate the six GA criteria).
54
+
7
55
## [0.9.11] — 2026-07-16
8
56
9
57
Closes the stale-rules gap reported by Tomasz Dmitruk ([@tdmitruk](https://github.com/tdmitruk)): `/add:init` used to copy 10 ADD rules into the consumer project's `.claude/rules/`, where they auto-loaded forever at the version they were copied — never updated by plugin upgrades, and (since v0.9.9) duplicating and eventually contradicting the fresh rules the SessionStart hook injects. Copies also bypassed maturity gating entirely.
@@ -117,68 +165,6 @@ CI/release hardening + truth-pass, opening the v1.0 credibility cycle. Turns a r
117
165
-**`tests/release-tooling/test-release-verify.sh`** — behavioral regression guard for #18 (mocks git/gh/python3, asserts the script exits non-zero when no release page exists), registered in the guardrail matrix.
118
166
-**`tests/security/fixtures/benign-multibyte.json`** — regression guard for the unicode-tag-block false-positive bug; asserts dense benign multibyte content does not fire (mutation-verified to go red against the old regex).
119
167
120
-
## [0.8.1] — 2026-04-23
121
-
122
-
Hotfix. Fixes three findings from the plugin-family release-hardening review before v0.9.0 ships. The M3 feature set (agents-md, cache-discipline, secrets-handling, telemetry-jsonl, prompt-injection-defense, test-deletion-guardrail, codex-native-skills) has already merged to main; this release makes that merge actually installable and makes the test-deletion guardrail actually enforce.
123
-
124
-
### Fixed
125
-
126
-
-**Claude marketplace validation (F-001).**`.claude-plugin/marketplace.json` had `description` at the root, which the marketplace schema rejects. Moved into the `metadata` object per the validator's guidance. `claude plugin validate .` and `claude plugin validate plugins/add` both now pass. Removed the stale `"13 commands, 12 skills, 15 rules"` count string — counts drift; manifests aren't the right place for them.
127
-
-**Codex install path mismatch (F-002).** Generated Codex skills referenced `~/.codex/templates/`, `~/.codex/knowledge/`, `~/.codex/rules/`, `~/.codex/lib/`, `~/.codex/security/`, but `scripts/install-codex.sh` stages shared assets under the namespaced `~/.codex/add/` subdirectory. Every skill invocation on Codex would have failed to resolve its asset refs. Fixed by pointing the `${CLAUDE_PLUGIN_ROOT}` → Codex substitution at `~/.codex/add/` and adding a separate `${CLAUDE_PLUGIN_ROOT}/hooks` → `~/.codex/hooks` rule (hooks stay at the Codex-conventional root). `scripts/compile.py` now also ships `core/rules/` and `core/security/` into `dist/codex/`, and `scripts/install-codex.sh` stages `knowledge/`, `rules/`, `lib/`, `security/` under `$CODEX_HOME/add/` alongside the existing `templates/`. `filter-learnings.sh` is also now shipped into Codex's hooks dir as a cross-runtime utility.
128
-
-**Test-deletion guardrail bypass (F-003).**`scripts/check-test-count.py` treated `--allow-test-rewrite` as a full bypass of the same-name-replacement approval check instead of as an acknowledgment flag that still required a recorded override. The documented intent (flag **AND** override record) matched the error message but not the code. Fix: the replacement check now runs unconditionally; `--allow-test-rewrite` is required to acknowledge intent, AND either a recorded override in `.add/cycles/cycle-{N}/overrides.json` or an `[ADD-TEST-DELETE: <reason>]` commit trailer is required to pass. Regression fixture `replacement-with-flag-no-override` added — proves the flag alone is insufficient.
129
-
130
-
### Added
131
-
132
-
-**`tests/codex-install/test-install-paths.sh`** — F-002 regression smoke. Installs the Codex adapter into a temp `CODEX_HOME`, collects every `~/.codex/...` reference from installed skill bodies, and asserts each one resolves (or is explicitly allowlisted). Runs in seconds; no Codex CLI needed.
133
-
134
-
### Known limitations (tracked for v0.8.2)
135
-
136
-
-`/add:version` reads `${CLAUDE_PLUGIN_ROOT}/.claude-plugin/plugin.json`, which has no Codex equivalent (the Codex version lives in `plugin.toml` or `VERSION`). Allowlisted in the new smoke test; cross-runtime fix deferred.
137
-
- Hotfix does not address F-004+ from the plugin-family review — adapter contracts, host-neutral kernel, runtime overlays, command catalog generator. Those remain M4 / v0.10+ scope, not v0.9.0 blockers.
138
-
139
-
## [Unreleased]
140
-
141
-
## [Unreleased]
142
-
143
-
_(Nothing yet — tracking items go here between releases.)_
144
-
145
-
## [0.10.1] — 2026-07-18
146
-
147
-
**Codex ≥0.14x compatibility (#24)** — found by the v0.10.0 install smoke's first live run against the re-pinned CLI 0.144.5.
148
-
149
-
### Fixed
150
-
151
-
-**Sub-agent TOMLs were silently ignored on Codex ≥0.14x** — the `prompt_skill` field no longer exists in the agent-role schema. All 5 roles (explorer, implementer, reviewer, test-writer, verify) now use the required `developer_instructions` field, instructing the spawned agent to load its role's SKILL.md — behavior stays skill-sourced. Verified accepted by CLI 0.144.5.
152
-
-**hooks.json was rejected on Codex ≥0.14x** — registration now uses the current schema (top-level `hooks` key, matcher groups, typed `command` entries) and `~/.codex/...` command paths (the old bare relative paths only resolved when the session started in `$HOME`). Verified accepted by CLI 0.144.5.
153
-
- Migration hop 0.10.0→0.10.1 tells Codex users to re-run the installer to refresh `~/.codex/agents/` and `~/.codex/hooks.json`.
154
-
155
-
### Known limitations (carried)
156
-
157
-
-**Known gap (#23, found by the first live smoke run):**`/add:init --quick` still interviews, so headless one-shot sessions exit without writing config. Smokes work around it with inline answers; a true `--defaults` path targets v0.10.1.
158
-
159
-
## [0.10.0] — 2026-07-18
160
-
161
-
**"Install path confirmed" — GA release candidate** (spec: `specs/install-path-confirmation.md`; sequencing: smoke green → marketplace submission → v1.0.0 promotion tag on approval).
162
-
163
-
### Added
164
-
165
-
-**Real install smoke in CI (GA criterion #2).**`.github/workflows/install-smoke-claude.yml` — installs the checkout via the actual marketplace path (`claude plugin marketplace add` + `claude plugin install add@add-marketplace`), asserts skill discovery, and drives a headless `/add:init --quick` asserting `.add/config.json` (agent leg skips loudly without `ANTHROPIC_API_KEY`). `.github/workflows/install-smoke-codex.yml` + `tests/smoke/codex/` — Docker image with the Codex CLI pinned from `runtimes/codex/adapter.yaml` (single source of truth via build-arg), runs `scripts/install-codex.sh` for real, asserts 27/27 skills, hooks, shared assets, version parity, the F-002 path suite, and (with `OPENAI_API_KEY`) an agent-driven `/add-init`.
166
-
-**`docs/capability-matrix.md` (GA criterion #3 / AC-027).** Per-runtime enforced vs agent-followed vs advisory truth table, appended to every release's notes by `release.sh`; `SECURITY.md` now points at it before the threat model.
167
-
-**`scripts/release-evidence.sh` (GA criterion #4 / AC-025).** Assembles `reports/release-evidence/vX.Y.Z/` — version map, capability-matrix snapshot, command catalog, install-smoke run links, and a migration-graph reachability check; `--upload` attaches the bundle to the GitHub release.
168
-
169
-
### Changed
170
-
171
-
-**Codex CLI re-pinned 0.122.0 → 0.144.5** (`codex_cli_version`; `min_codex_version` stays 0.122.0). Install smoke verified green in Docker against the new pin (Q-001 re-baseline).
172
-
-**`release.sh` is now release-blocking (GA criterion #1).** Refuses to tag unless HEAD is on origin/main with all CI check-runs green; `--no-verify-ci` is the loud emergency override.
173
-
174
-
### Fixed
175
-
176
-
-**`migrations.json`: v0.7.3 users were stranded** — no outgoing hop existed from 0.7.3 (same class as the v0.8.1→v0.9.3 chain break). Caught by the new reachability check; fixed with a 0.7.3→0.8.0 hop carrying the standard 0.8.0 steps.
177
-
178
-
### Known limitations
179
-
180
-
-**Telemetry emission confirmed absent (Q-MS-003/D6).**`.add/telemetry/` never populates — the spec exists, no hook writes it. Recorded as a finding; implementation deferred past v0.10.0 (does not gate the six GA criteria).
181
-
182
168
## [0.9.5] — 2026-04-22
183
169
184
170
**Hygiene + truth pass.** Doc-only release. Removes the smokescreen between what the docs claim and what's actually shipped, so the v1.0 credibility cycle (v0.9.6 → v1.0.0) starts from honest ground. No consumer config or plugin-runtime changes.
@@ -338,6 +324,25 @@ Seven feature specs planned together, built in parallel by worktree-isolated age
338
324
- Cross-tool memory schema for `~/.claude/add/`
339
325
- Governance maturity bands tied to autonomy ceilings
340
326
327
+
## [0.8.1] — 2026-04-23
328
+
329
+
Hotfix. Fixes three findings from the plugin-family release-hardening review before v0.9.0 ships. The M3 feature set (agents-md, cache-discipline, secrets-handling, telemetry-jsonl, prompt-injection-defense, test-deletion-guardrail, codex-native-skills) has already merged to main; this release makes that merge actually installable and makes the test-deletion guardrail actually enforce.
330
+
331
+
### Fixed
332
+
333
+
-**Claude marketplace validation (F-001).**`.claude-plugin/marketplace.json` had `description` at the root, which the marketplace schema rejects. Moved into the `metadata` object per the validator's guidance. `claude plugin validate .` and `claude plugin validate plugins/add` both now pass. Removed the stale `"13 commands, 12 skills, 15 rules"` count string — counts drift; manifests aren't the right place for them.
334
+
-**Codex install path mismatch (F-002).** Generated Codex skills referenced `~/.codex/templates/`, `~/.codex/knowledge/`, `~/.codex/rules/`, `~/.codex/lib/`, `~/.codex/security/`, but `scripts/install-codex.sh` stages shared assets under the namespaced `~/.codex/add/` subdirectory. Every skill invocation on Codex would have failed to resolve its asset refs. Fixed by pointing the `${CLAUDE_PLUGIN_ROOT}` → Codex substitution at `~/.codex/add/` and adding a separate `${CLAUDE_PLUGIN_ROOT}/hooks` → `~/.codex/hooks` rule (hooks stay at the Codex-conventional root). `scripts/compile.py` now also ships `core/rules/` and `core/security/` into `dist/codex/`, and `scripts/install-codex.sh` stages `knowledge/`, `rules/`, `lib/`, `security/` under `$CODEX_HOME/add/` alongside the existing `templates/`. `filter-learnings.sh` is also now shipped into Codex's hooks dir as a cross-runtime utility.
335
+
-**Test-deletion guardrail bypass (F-003).**`scripts/check-test-count.py` treated `--allow-test-rewrite` as a full bypass of the same-name-replacement approval check instead of as an acknowledgment flag that still required a recorded override. The documented intent (flag **AND** override record) matched the error message but not the code. Fix: the replacement check now runs unconditionally; `--allow-test-rewrite` is required to acknowledge intent, AND either a recorded override in `.add/cycles/cycle-{N}/overrides.json` or an `[ADD-TEST-DELETE: <reason>]` commit trailer is required to pass. Regression fixture `replacement-with-flag-no-override` added — proves the flag alone is insufficient.
336
+
337
+
### Added
338
+
339
+
-**`tests/codex-install/test-install-paths.sh`** — F-002 regression smoke. Installs the Codex adapter into a temp `CODEX_HOME`, collects every `~/.codex/...` reference from installed skill bodies, and asserts each one resolves (or is explicitly allowlisted). Runs in seconds; no Codex CLI needed.
340
+
341
+
### Known limitations (tracked for v0.8.2)
342
+
343
+
-`/add:version` reads `${CLAUDE_PLUGIN_ROOT}/.claude-plugin/plugin.json`, which has no Codex equivalent (the Codex version lives in `plugin.toml` or `VERSION`). Allowlisted in the new smoke test; cross-runtime fix deferred.
344
+
- Hotfix does not address F-004+ from the plugin-family review — adapter contracts, host-neutral kernel, runtime overlays, command catalog generator. Those remain M4 / v0.10+ scope, not v0.9.0 blockers.
345
+
341
346
## [0.8.0] — 2026-04-22
342
347
343
348
Pre-filtered active learning views. Moves filtering work out of the LLM context window and into a `jq`-based hook, cutting autoload context cost by 62-82% as learnings accumulate. Community contribution from @tdmitruk via #7.
0 commit comments