CHANGELOG.md

Changelog

3.7.7 (2026-08-16)

Maintenance

• ci: bump trufflesecurity/trufflehog in the gha-patch-minor group (a59614e)
• deps: bump the pip-patch-minor group across 1 directory with 3 updates (e0b8b0e)

3.7.6 (2026-08-02)

Maintenance

• ci: bump pypa/gh-action-pypi-publish in the gha-patch-minor group (0278978)

3.7.5 (2026-07-31)

Fixes

• fix ruff format violations in refactor skill template Python code blocks (745b0f9)

Maintenance

• ci: bump actions/setup-python from 6.3.0 to 7.0.0 (55c518e)
• ci: bump the gha-patch-minor group with 2 updates (3efa7b4)
• deps: bump the pip-patch-minor group across 1 directory with 3 updates (9081f77)
• deps: bump types-pyyaml from 6.0.12.20260518 to 6.0.12.20260724 (5dfd73f)

3.7.4 (2026-07-19)

Maintenance

• ci: bump pypa/gh-action-pypi-publish in the gha-patch-minor group (5d8b0ac)
• deps: bump the pip-patch-minor group with 3 updates (74e2eb6)

3.7.3 (2026-07-13)

Maintenance

• ci: bump trufflesecurity/trufflehog in the gha-patch-minor group (ba145a3)
• deps: bump the pip-patch-minor group with 3 updates (5067fcb)

3.7.2 (2026-07-05)

Maintenance

• ci: bump trufflesecurity/trufflehog in the gha-patch-minor group (d1f7091)

3.7.1 (2026-06-29)

Maintenance

• ci: bump actions/setup-python in the gha-patch-minor group (8d4fae2)

3.7.0 (2026-06-27)

Features

• agents: add compact shared safety guardrails (0d57aa0)
• artifacts: convert reasoning to prompt type, add advise skill (120e99b)
• skills: add changedoc, lazy, and simplify workflows (a710d8e)

Documentation

• clarify vstack installation for downstream users (5c238ad)
• roadmap: add configurable skill output paths candidate (85b767c)
• skills: document changedoc ownership and usage (9e87458)

Maintenance

• generate: sync installed artifacts after template updates (99da10e)

Tests

• artifacts: sync planner and product golden fixtures (8682a87)

3.6.0 (2026-06-21)

Features

• init: add safe obsolete prune flow and stabilize hook checksum output (34818b0)
• planner: add ask/explore quick-review workflow (416fa8b)
• planner: add collaborative plan orchestration state (f6d45c6)
• skills: add ask skill and upgrade explore workflow (6525ba7)

Fixes

• artifacts: sync generated artifacts and fixtures (cda0b4c)

Refactoring

• prompt: rename code-review prompt to quick-review (7d753d8)
• templates: trim prompt/instruction text and regenerate install artifacts (89cad70)

Documentation

• roadmap: refresh status for skills, DAG, prompts, and global scope (f8db002)

Maintenance

• agents: drop pinned model defaults (1c04e07)
• ci: bump actions/checkout from 6.0.3 to 7.0.0 (cf84ed6)
• ci: bump actions/checkout from 6.0.3 to 7.0.0 (#78) (2dc3233)
• ci: bump trufflesecurity/trufflehog from 3.95.5 to 3.95.6 in the gha-patch-minor group (#77) (d4481f7)
• ci: bump trufflesecurity/trufflehog in the gha-patch-minor group (bc486cf)
• deps: bump pytest from 9.1.0 to 9.1.1 in the pip-patch-minor group across 1 directory (#80) (02991c1)
• deps: bump pytest in the pip-patch-minor group across 1 directory (b05cd26)
• deps: consistent pyyaml version (1d47155)
• deps: update locked dev dependencies (242c62b)
• docs: classify prompt scope and generalize space-setup wording (0ed162e)
• docs: updated the roadmap (d0e22d5)
• prompt: add quick-review generated artifact (9ac44d8)
• prompts: drop pinned model defaults (5d7a9cb)

Tests

• fixtures: align golden expectations after template and prompt updates (e9993d2)

3.5.2 (2026-06-09)

Maintenance

• ci: bump the gha-patch-minor group with 2 updates (#73) (7c322ec)
• deps: bump the pip-patch-minor group with 2 updates (#72) (45801fe)

3.5.1 (2026-06-02)

Fixes

• ci: fix Homebrew token action for publish workflow (#69) (f2bd2b1)

3.5.0 (2026-06-02)

Features

• add Homebrew distribution channel for vstack (#66) (6939f31)

Fixes

• ci: harden Homebrew publish workflow auth and environment separation (#68) (3651714)

3.5.0 (2026-06-02)

Features

• ci: add homebrew private tap publish job (feature/publish_in_homebrew)

Documentation

• architecture: add ADR-030 and homebrew distribution plan
• cicd: extend workflow table and sequence diagram with homebrew tap stage
• design: update workflow.md publish.yml description
• product: add FR-8 homebrew distribution requirement; align roadmap

Tests

• ci: add publish workflow contract tests for homebrew job

3.4.2 (2026-05-28)

Maintenance

• ci: handle disabled auto-merge gracefully (ac91e78)
• ci: updated dependencies (576d27d)

3.4.1 (2026-05-19)

Maintenance

• ci: bump actions/create-github-app-token (351e2cb)
• ci: bump actions/github-script (e17ddb0)
• ci: bump googleapis/release-please-action (805e319)

3.4.0 (2026-05-14)

Features

• workflow: improve planner routing and stabilize artifact generation (0cf4bd2)

Fixes

• ci: ignore vstack metadata version-only drift in verify guard (41bac6f)
• docs: align examples and pytest temp path guidance (7d26d52)

Maintenance

• ci: bump trufflesecurity/trufflehog (722d74e)

3.3.0 (2026-05-12)

Features

• agents: add parallel delegation policy to all role prompts (8aaf8c7)
• config: add depends_on to default workflow stages (e5b7cf1)
• planner: add depends_on DAG execution model (bedae77)
• workflow: add DAG dependency support (ccfcb35)
• workflow: validate stage graph and detect cycles (165dab4)

Fixes

• cli: reject malformed workflow depends_on (3b23981)
• cli: tighten workflow dependency validation (9aec187)
• version: add nearest-tag fallback for dev checkouts (5971ad0)

Documentation

• add depends_on DAG section and planner entry-point guidance (25c37d8)
• maintenance: normalize markdown list formatting (1d0b5e3)
• product: align roadmap and workflow docs (d4346cd)
• readme: add agentic runbook and parallel troubleshooting (d51a1d3)
• roadmap: defer multi-IDE support behind VS Code stability (1fd26a3)
• roadmap: reorder roadmap chronologically by release tag (1236d38)
• workflow: document DAG and multi-agentic model (4c3e947)

Maintenance

• artifacts: refresh generated metadata for vstack 3.2.0 (d728977)

3.2.0 (2026-05-12)

Features

• config: migrate items keys and stabilize workflow defaults (0b77f68)
• hooks: add configurable baseline (951c9c1)
• hooks: add hooks ADR, design, and multi-template baseline (2d46ac2)

Fixes

• hooks: decouple retention and harden ci automation (375698f)

Maintenance

• artifacts: regenerate installed github artifacts (f5c44dd)
• deps: bump mypy and types-pyyaml (2f2e459)
• deps: refresh dependency and action baselines (2e5f0c0)
• deps: refresh poetry lockfile (e182195)
• gitignore: drop legacy tmp-test-home ignore (b031408)
• gitignore: ignore local tmp test home (4ef0cdf)
• regenerate generated artifacts (aa206ba)

3.1.1 (2026-05-10)

Fixes

• ci: install wheel dependencies in publish smoke test (8fa6502)

3.1.0 (2026-05-09)

Features

• agents: add missing execute/web tools to product, architect, designer, release (6ac17de)
• agents: restructure config to defaults block; add baseline artifact flag (86e1cf6)
• parser: replace hand-rolled YAML parser with PyYAML (17de97d)
• parser: support nested block YAML in object-list items (a5f2df0)
• skills: add allowed-tools field to SKILL_SCHEMA and all 44 skill configs (aa02d46)
• workflow: add workflow contract schema to .vstack/config.yaml (acc859f)

Fixes

• agents: restore _resolve_handoffs fallback; fix None guard in migrate (8f2dbaf)
• ci: add FORCE_JAVASCRIPT_ACTIONS_TO_NODE24 to all workflows; fix security.yml env (b2e6ccd)
• frontmatter: restore @staticmethod on FrontmatterParser; fix dict/list serialization (8711e3e)
• manifest: re-export removed helpers as deprecated shims (d4face3)
• review: remove dead str-fallback in _extract_defaults; sync docs with pyyaml dep (993c2fc)

Refactoring

• OOP cleanup — instance methods, inline registry, extracted utils (2d13679)

Documentation

• add install and upgrade guide with quickstart and quick upgrade paths (39ea7f1)
• adr: add ADR-023 and ADR-024; supersede ADR-004; update overview (bf199f2)
• adr: align ADR-023 schema; mark ADR-026 shipped; update migrations README (ce5fcda)
• correct runtime dependency badge and text — PyYAML is required (27d60e3)
• roadmap: correct orchestrated pipeline status from in-progress to candidate (51a4780)
• roadmap: mark workflow contract source-of-truth as shipped (e57755b)

Maintenance

• docs: apply mdformat to adr-026 and migrations readme (55ed664)
• expand PyPI keywords and classifiers for discoverability (a2bcd7e)
• install: regenerate artifacts after agent and skill tool config changes (f4c62f4)
• install: regenerate artifacts with quoted wildcard agents (b1b2024)
• install: regenerate artifacts; update manifest and changelog formatting (d1c2cf2)
• install: regenerate skills artifacts and manifest (d5c2a6e)
• regenerate poetry.lock after adding pyyaml runtime dependency (f34b181)

3.0.0 (2026-05-06)

⚠ BREAKING CHANGES

• manifest: vstack.json moves from .github/vstack.json to .vstack/vstack.json; run vstack manifest upgrade to migrate existing projects

Features

• agents: generate artifacts section from config.yaml (b47f410)
• config: implement exclude filter in .vstack/config.yaml (036b9ae)
• config: support artifacts_root override in .vstack/config.yaml (2a7de61)
• install: write .vstack/.gitignore on every install (526c6c7)
• manifest: move install manifest from .github to .vstack (3a11063)
• workflow: update skill templates, ADRs, and agent configs for genericity (db0b2f1)

Fixes

• exclude: raise ValueError when agents excluded; add ADR-021/022 to overview (3298340)
• review: address PR review comments (771ab31)

Refactoring

• config: rename artifacts_root to artifacts.root in config.yaml (e9c14b4)

Documentation

• ADR-022 selective exclude filter (56771d3)
• agents: update artifacts schema docs to reflect dir/ARTIFACTS_DOCS_ROOT design (a408468)
• document exclude filter, install vs init flow, and config.yaml schema (3296020)
• readme: add no-target variants for install and init to CLI table (9c06f5a)
• rename Option A/B to direct execution / orchestrated pipeline in ADRs 017, 018, 020, 021, 022 (56771d3)
• roadmap: rationalise candidate items and restructure roadmap (831e3e0)
• roadmap: record install target override as not planned (168f499)
• split roadmap row into selective install (shipped) and template overlays (candidate) (56771d3)

Maintenance

• cleanup: remove stale .github/vstack.json and add missing init command (99ded6b)
• install: regenerate artifacts and populate manifest (56771d3)
• lint: disable MD012 for release-please CHANGELOG double blank lines (5044cd7)
• release: add v3.0.0 release notes and mark roadmap rows as shipped (55bfb69)
• release: update reports, finalise v3.0.0 release notes for 2026-05-06 (ad641f0)

2.2.0 (2026-05-02)

Features

• instructions: add markdown authoring conventions instruction (b4cf606)
• instructions: add security policy instruction (612d37f)
• instructions: add terraform and terragrunt coding conventions (6b82d4b)
• instructions: add typescript and java coding conventions (62f99b3)
• instructions: add universal testing conventions instruction (ec12899)
• prompts: add api-design-review, dependency-audit; improve existing prompts (e4630b7)
• prompts: add architecture-risk, incident-timeline, migration-safety, release-readiness prompts (7823539)
• skills: add conventional-commit skill (cba3f84)
• skills: add gdpr, terraform, terragrunt, cloudformation, and aws-cli skills (8b9e0eb)
• skills: add gh-issues, codeql, dependabot, and secret-scan skills (1909578)
• skills: add gh-release skill with hardened gh release workflow (bcac399)
• skills: add k8s, helm, and rancher skills and instructions (169005a)
• skills: add threat-model skill and optimize template token usage (057168c)
• skills: audit and harden all skill templates (ff968ff)

Refactoring

• agents: enforce canonical template structure (8c54d8a)
• skills: make pr and release-notes skills generic; add ADR-018 skill-agent boundary (b0b8956)
• skills: optimise 7 new skills for token efficiency (6fe6ed2)
• templates: migrate template versions to YYYYMMDDNNN (5cd239f)

Documentation

• design: update skills and instructions tables; add new skills to agent mappings (0947bc7)
• instructions: add instruction catalog to design doc and README (f9889ff)
• product: expand copilot roadmap and customization strategy (de2a364)
• skills: add official documentation references to all tool-specific skills and instructions (7fb7b3e)

Maintenance

• review: quote applyTo glob in generated frontmatter; add test/tests commit types (aa579ba)
• templates: bump code-review, architecture-risk, release-readiness prompt versions to 0.1.1 (0d1da60)
• templates: bump pr and release-notes skill versions to 1.1.0 (e4f0923)

Tests

• agents: fold artifacts-section order into canonical lint rule (a435bc5)
• frontmatter: add regression tests for applyTo quoting and version comparison (20943e9)

2.1.0 (2026-05-02)

Features

• cli: add dry-run install with type/name selector summary and conflict resolution hints (c783552)

Fixes

• ci: use job-scoped PyPI fallback token checks (267417a)
• cli: align dry-run summary guidance and tests (c11b67d)

Maintenance

• ci: add trusted publishing fallback and publish concurrency group (ef4702d)
• deps: bump cachetools to 7.1.0 and tox to 4.53.1 (5d60804)
• docs: add Development Commands and CLI Architecture to copilot-instructions (5bf4c24)
• docs: add first-install dry-run workflow and preserved-file conflict resolution (fa8ef18)
• docs: fix BaseCommand signature, model type, role assignments, and contributor workflow (45a19be)
• docs: fix maintainer role, stale paths, gate count, and tool names in ADRs 001-012 (dcf596a)

2.0.4 (2026-04-28)

Fixes

• ci: allow release manifest ahead of latest tag (6e049b9)

Documentation

• release: restore release-please style for 2.0.x (98d8ee1)

Maintenance

• ci: bump automerge action dependencies (db701d5)
• ci: tune dependabot automerge policy (ca6155c)
• ci: use app client id for release token generation (4198797)
• deps: tune dependabot cadence and PR limits (c3fe474)

2.0.3 (2026-04-28)

Maintenance

• ci: harden release workflows and normalize changelog (5a38709)
• ci: restructure pipeline with release-please and GitHub App token (8c06090)
• ci: restructure pipeline with release-please and GitHub App token (#30) (0008127)

2.0.2 (2026-04-27)

Maintenance

• ci: bump trufflesecurity/trufflehog from 3.94.3 to 3.95.2 (#25) (5724dbe)

2.0.1 (2026-04-27)

Maintenance

• ci: bump actions/download-artifact from 7 to 8 (#26) (24d5a58)

2.0.0 (2026-04-26)

CLI architecture refactor and manifest package extraction. BREAKING CHANGE — import paths have changed.

BREAKING CHANGES

• vstack.cli.commands removed. CommandService and command classes now live in dedicated modules (vstack.cli.service, vstack.cli.install, vstack.cli.verify, etc.).
• Manifest persistence classes moved to new vstack.manifest package (vstack.manifest.store).

Features

• vstack manifest upgrade --backfill: retroactively compute and write checksums for tracked manifest entries with no checksum.
• New vstack.manifest package with schema-versioned manifest read/write and content_hash utility.
• 12 focused CLI modules replacing the monolithic commands.py.
• mypy type checking added as a quality gate (106 files, 0 errors).
• 4 new ADRs: manifest schema versioning (014), conservative install defaults (015), atomic manifest writes (016), checksum backfill (017).

Fixes

• InstallCommand._version_gt no longer raises TypeError when existing version is None on first install.

Maintenance

• Full test suite restructured: per-module test files, TestClass layout, catch-all files deleted. Test count: 288 → 342.
• End-to-end integration tests consolidated into tests/vstack/test_integration.py.

1.3.6 (2026-04-22)

README and PyPI README badge/layout alignment.

Fixes

• Fixed oversized logo rendering in README-pypi.md by constraining image width.
• Fixed duplicate title/branding in README-pypi.md by removing redundant # vstack heading.
• Fixed badge ordering so badges render beneath the logo in README-pypi.md.
• Fixed PyPI version badge formatting in both README.md and README-pypi.md to show the raw version (no v prefix).
• Fixed verify/security workflow badges in both README.md and README-pypi.md by removing branch=main filter so PR-based workflows report status correctly.

1.3.5 (2026-04-22)

Changelog and PyPI packaging metadata alignment update.

Maintenance

• Corrected changelog version history from 1.3.0 onward so entries align with actual created tags and release chronology.
• Switched published long description source from README.md to README-pypi.md for PyPI-compatible rendering.
• Added PyPI-focused project metadata in pyproject.toml: keywords, classifiers, and project.urls.
• Added explicit repository guidance to keep README-pypi.md in sync with README.md.

Features

• Added a dedicated README-pypi.md with PyPI-safe links, badges, and a concise DX-first quickstart.

1.3.4 (2026-04-22)

Release build versioning fix: explicit plugin activation and full history checkout.

Fixes

• Fixed CI release builds still producing 0.0.0 artifacts by calling poetry dynamic-versioning explicitly before poetry build. Poetry reads the version once at load time — the plugin must be active and called before the build step runs.
• Fixed release build tag visibility by setting fetch-depth: 0 on the tag-pinned checkout so git describe can traverse full history.
• Fixed dynamic versioning compatibility in pyproject.toml by switching to PEP 621 dynamic versioning (project.dynamic = ["version"]) and keeping the placeholder at tool.poetry.version.
• Fixed poetry dynamic-versioning compatibility by removing unsupported tool.poetry-dynamic-versioning.fallback-version.
• Fixed release race conditions by adding workflow concurrency controls, including serialized main release execution.
• Fixed release integrity by creating the GitHub release only after PyPI publish succeeds.
• Fixed tag existence validation to check refs/tags/<version> directly instead of a generic ref lookup.
• Fixed rerun friction after failed release attempts by automatically deleting the freshly created tag when build or publish fails.
• Added post-build wheel smoke test (pip install --no-deps + vstack --help) before artifact upload to avoid network-dependent dependency resolution.
• Clarified PR workflow concurrency comments in security.yml and verify.yml to match github.ref behavior (refs/pull/<id>/merge).

1.3.3 (2026-04-22)

Release build plugin activation fix.

Fixes

• Fixed CI release builds producing 0.0.0 artifacts by installing poetry-dynamic-versioning as a Poetry plugin via pipx inject in the release build job.
• Fixed release build reproducibility by pinning the Poetry CLI version (POETRY_VERSION) in workflow environment configuration.
• Fixed CI drift by aligning Poetry installation to the same pinned version across release.yml, qa.yml, verify.yml, and security.yml.

1.3.2 (2026-04-22)

Release build version-guard fix.

Fixes

• Fixed release build determinism by checking out refs/tags/<version> in the build job instead of building from a moving branch ref.
• Fixed accidental 0.0.0 package publishing by validating that HEAD is pinned to the expected release tag before build and that produced artifacts include the expected version.

1.3.1 (2026-04-22)

Release workflow and test isolation fixes.

Fixes

• Fixed release workflow trigger: switched from pull_request: closed to push: branches: [main] so the workflow runs under refs/heads/main and satisfies the PyPI environment deployment branch protection rule.
• Fixed build job checkout configuration so poetry-dynamic-versioning can read git tags during the build.
• Fixed download-artifact version mismatch (v5 → v7) to align with upload-artifact@v7.

1.3.0 (2026-04-22)

DX, onboarding, and PyPI publishing release.

Features

• Added GitHub Discussion templates for onboarding and adoption feedback:
  • onboarding-feedback
  • first-run-report
  • model-cost-feedback
• Added team setup guidance in README.md with project-first install flow and expected outcomes.
• Added explicit expected output examples for first install validation in README.md.
• Added a troubleshooting decision flowchart in README.md.

Maintenance

• Restructured README.md for faster onboarding with clearer quick paths, role usage guidance, and troubleshooting navigation.
• Updated architect and product agent template model ordering and regenerated installed agent artifacts.
• Updated generated artifact metadata and aligned generation tests with current template output.
• Added PyPI publish job to release workflow using OIDC trusted publishing (no API tokens required).

Fixes

• Fixed test_install_and_verify_exits_zero writing generated artifacts into the repository root instead of an isolated tmp_path.

1.2.5 (2026-04-21)

CI dependency maintenance release.

Maintenance

• GitHub Actions: bumped actions/checkout from v5 to v6.

1.2.4 (2026-04-21)

CI dependency maintenance release.

Maintenance

• GitHub Actions: bumped actions/upload-artifact from v4 to v7.

1.2.3 (2026-04-21)

Release workflow dependency maintenance.

Maintenance

• GitHub Actions: bumped softprops/action-gh-release from v2 to v3.

1.2.2 (2026-04-21)

Security workflow dependency maintenance.

Maintenance

• GitHub Actions: bumped trufflesecurity/trufflehog from 3.88.2 to 3.94.3.

1.2.1 (2026-04-21)

README rendering fix release.

Fixes

• Fixed Mermaid flowchart syntax in README.md so GitHub renders the role-flow diagram correctly.

1.2.0 (2026-04-21)

CLI provenance verification and documentation system alignment.

Features

• CLI artifact provenance verification against the install manifest.

Maintenance

• Refactored CLI parser flow into a CommandLineParser class and simplified install and verify control flow.
• Refactored frontmatter serialization internals (instance-method serializer, naming cleanup, and reduced nested parse/validation flow).
• Aligned hand-authored Markdown docs toward Mermaid-first diagram usage, with ASCII as fallback where needed.
• Updated skill template guidance and regenerated installed skill artifacts to adopt the Mermaid-first diagram convention.
• README branding/header refreshed with centered logo and badges plus light/dark logo switching.
• Centralized commit and branch policy in cchk.toml and wired local pre-commit hooks for commit-message and pre-push branch validation.
• Removed hard CI scope allowlist enforcement; commit scopes are now guidance-level in documentation rather than a strict gate.
• Fixed multiple documentation link paths under docs/design/ so relative Markdown links resolve correctly on GitHub.
• Updated CONTRIBUTING.md commit-policy wording to match the current cchk.toml enforcement model.
• Strengthened generated skill footer tests to assert the AUTO-GENERATED and VSTACK-META footer structure at end-of-file.

1.1.0 (2026-04-20)

Runtime response-style control via the new concise skill.

Features

• New concise skill — runtime response-style toggle with three density modes:
  • concise normal — full, explicit explanation depth.
  • concise compact — shorter prose, unchanged technical accuracy (default for most roles).
  • concise ultra — maximum brevity; narrative filler removed, technical correctness preserved.
  • concise status — reports active mode, session override, agent default, and auto-clarity override state.
  • Aliases: concise on → compact, concise off → normal.
• Per-role default concise modes wired into all 6 agent templates: product=compact, architect=normal, designer=compact, engineer=compact, tester=ultra, release=compact.
• Auto-clarity override: security warnings, destructive actions, and multi-step sequences always force normal regardless of active mode.

Maintenance

• All 6 role agent templates now reference @#concise in their ## skills you use section.
• EXPECTED_CANONICAL_NAMES in tests/conftest.py now imports from vstack.cli.constants instead of duplicating the list.
• README.md updated with concise commands, per-role defaults table column, and verbosity control tips.
• docs/design/skills.md updated with concise row in the skills table.
• All six role agents (product, architect, designer, engineer, tester, release) now follow a shared structure:
  • responsibilities and scope
  • principles
  • communication style
  • gate moments and handoffs
  • how you work
  • deliverables and success criteria
  • failure and escalation rules
  • skills you use
• Added shared agent-skill boundary partial and wired it across all agents.
• Moved procedural detail out of agents into skills to keep agents outcome-focused and reduce template size.
• Release flow clarified: release-notes now explicitly owns both docs/releases/{date}.md and CHANGELOG.md; pr remains responsible for push/PR creation.
• Release and tester gating now treat performance baseline and observability evidence as required-for-scope artifacts rather than unconditional requirements.
• Added explicit Deliverable and artifact policy sections where needed across architecture/design/verification/release-related skills.
• Added explicit observability checks in verification flows (inspect and verify) for logs, metrics, traces, and alert/runbook evidence.
• Regenerated .github installed artifacts to match updated templates and policies.

1.0.5 (2026-04-19)

Workflow hardening and release-manifest refresh.

Fixes

• GitHub Actions workflows now declare explicit permissions to satisfy policy checks and follow least-privilege defaults.

Maintenance

• release.yml now defaults to read-only workflow permissions and scopes contents: write to the version-and-release job only.
• qa.yml, security.yml, and verify.yml now declare explicit workflow-level permissions.
• verify.yml normalized to use on: (unquoted) for style consistency with other workflows.
• .github/vstack.json refreshed via install to record the latest generated artifact manifest metadata.

1.0.4 (2026-04-19)

Skill expansion and documentation alignment update.

Features

• Six new skills: migrate, openapi, refactor, onboard, dependency, incident.
  • migrate — database migration review: zero-downtime analysis, expand/contract, rollback plans, index safety, batched backfills.
  • openapi — OpenAPI 3.1 spec writing and review: resource naming, HTTP semantics, status codes, error conventions, pagination, security schemes, versioning.
  • refactor — structured refactoring without behavior change: smell identification, incremental plan, step-by-step execution with test verification at each step.
  • onboard — contributor onboarding guide generation: prerequisites, setup, test commands, env vars, architecture overview, good first issues → CONTRIBUTING.md.
  • dependency — full dependency health audit: vulnerability scanning, outdated packages, licence compliance, transitive risk, pinning policy, supply chain hygiene.
  • incident — incident analysis and blameless post-mortem writing: timeline reconstruction, 5-Whys root cause, contributing factors matrix, action items → docs/postmortems/YYYY-MM-DD-*.md.

Fixes

• refactor skill: removed outer ```bash fences wrapping {{RUN_TESTS}} partial (which already includes its own fence).
• onboard skill: fixed nested fence issues in step 5 CONTRIBUTING.md example and step 6 README snippet.

Maintenance

• engineer, designer, tester, product agent templates updated with skill references for all new skills.
• docs/design/skills.md updated with full skill table including all new skills and their primary roles.
• README.md role–skill table updated to reflect new primary skills per role.
• README.md project structure diagram updated to include instructions/ and prompts/ template directories and the correct docs/ subdirectory layout.
• .github/copilot-instructions.md updated: system structure diagram now includes all four template artifact types (skills, agents, instructions, prompts); hand-authored .github/ exceptions listed explicitly; install table extended with instructions and prompts rows.

1.0.3 (2026-04-19)

Community health and release workflow update.

Features

• CODEOWNERS file.
• GitHub issue templates: bug_report.yml, feature_request.yml, config.yml.
• Pull request template (.github/pull_request_template.md).
• CODE_OF_CONDUCT.md, CONTRIBUTING.md, SECURITY.md community health files.

Maintenance

• Release workflow title format updated to Release vX.Y.Z (YYYY-MM-DD).

1.0.2 (2026-04-17)

Release workflow fix.

Fixes

• Release workflow: corrected Poetry setup order and opted in to Node 24 to resolve runner deprecation warnings.

1.0.1 (2026-04-17)

Tooling and release hygiene update focused on making local and CI verification match.

Features

• Repo-local .python-version for consistent pyenv interpreter resolution.
• Tox-based multi-version test execution across Python 3.11, 3.12, 3.13, and 3.14.
• Pre-commit hooks expanded: trailing-whitespace, end-of-file-fixer, check-toml, check-yaml, ruff, ruff-format.

Maintenance

• pyproject.toml migrated from [tool.poetry] to PEP 621 [project] form; version = "0.0.0" is a build-time placeholder overwritten by poetry-dynamic-versioning.
• Python support metadata is now explicitly bounded to 3.11–3.14.
• QA workflow now runs a Python test matrix across all supported runtimes.
• Local developer workflow now documents pyenv as the standard multi-version setup.
• Coverage gate raised back to 100%.
• make test now exercises every supported Python version when interpreters are installed.

Fixes

• CI workflows: pipx install poetry now runs before actions/setup-python so the cache: poetry lookup always succeeds.
• CI workflows: bumped actions/checkout@v4 -> v5 and actions/setup-python@v5 -> v6 to resolve Node.js 20 deprecation warnings.

1.0.0 (2026-04-01)

Initial public baseline for the VS Code-native vstack system.

Features

• Python package layout under src/vstack/ with runtime entrypoints:
  • vstack CLI
  • python -m vstack
• Generic artifact generation system:
  • GenericArtifactGenerator
  • ArtifactTypeConfig
  • manifest tracking via vstack.json
• Frontmatter system:
  • parser, schema validation, and builder
  • support for str, bool, list, object-list, and raw
• Agent templates and generation for six fixed roles:
  • product, architect, designer, engineer, tester, release
• Canonical skill set and generation pipeline based on source templates.
• Repository docs set:
  • architecture/design/workflow/skills docs
  • ADR set under docs/architecture/adr/
• Test suite for artifacts, frontmatter, CLI, agents, and skills.

Maintenance

• Migrated to VS Code Agent artifacts and install-time generation model.
• Skill metadata model moved to per-skill config.yaml; template.md is body-only.
• Skills now follow a documented minimum body contract.
• Skill frontmatter output aligned to supported fields:
  • version kept in source config for install/version tracking, not emitted in generated SKILL.md
  • allowed-tools not emitted due to inconsistent support
• Placeholder governance moved to explicit registry mapping.
• Legacy generator scripts and template/registry structure from earlier layout.
• Deprecated skill aliases and stale references (including freeze/unfreeze flow remnants).
• Full suite passing at release cut.
• Coverage at 100%.