Changelog

All notable changes to this project will be documented in this file.

The format is based on Keep a Changelog, and this project adheres to Semantic Versioning.

[Unreleased]

Dogfood swarm wave 2 (2026-05-15) landed cross-cutting hardening.

41 new test cases under test/ (tests grew from 5 to 46): four new suites — test/gen-lock.test.mjs (determinism + lockfile drift), test/validate.test.mjs (schema + invariant negative paths), test/hash-file.test.mjs (hashing utility), test/_paths.test.mjs (path-traversal guards). See README Testing section for the current per-suite breakdown.
CI: Dependabot config (.github/dependabot.yml) for automated dependency updates.
CI: CodeQL workflow (.github/workflows/codeql.yml) for code scanning on every push and PR.
CI: minimal-permissions block on GitHub Actions workflows.
Repo ownership: .github/CODEOWNERS.
Scripts: marketing/scripts/_paths.mjs shared-paths module (single source of truth for repo path resolution across scripts).
Scripts: marketing/scripts/new-tool.mjs — scaffold script for adding new tool entries (npm run new-tool -- <id>).
Scripts: marketing/scripts/graduation-report.mjs — overdue aspirational claim report (npm run graduation).
Examples: examples/consume.mjs — reference consumer demonstrating how to fetch, verify, and walk the marketing IR.
Docs: top-level README Testing section.

Marketing-data contract: dead URLs and unverified PyPI claims downgraded to aspirational.
Validator hardening: validate.mjs enforces hash-verified evidence; gen-lock.mjs is fully deterministic; AJV runs in strict mode.
Error envelopes: scripts wrap failures in friendly try/catch envelopes (full Structured Error Shape with code/hint/retryable is planned for v1.1).
Docs accuracy: README script names match package.json.
SCORECARD methodology: now reports honest revised scores (42/50) alongside the original self-score (50/50) — see SCORECARD.md "Why scores were revised down."
SHIP_GATE: gate rows annotated with explicit verification dates ((YYYY-MM-DD)).

SECURITY.md disclosure address switched to GitHub's private vulnerability advisory (GHSA URL).

verify umbrella script (composing validate + lock:check + test) — planned for v1.1. Today the equivalent is the explicit npm run validate && npm run lock:check && npm test chain that CI runs.
Full Structured Error Shape (code / message / hint / cause? / retryable?) — planned for v1.1. Wave 2 shipped basic try/catch envelopes only.