Repository navigation
Conversation
Back-merges release/1.0.0 and release/1.0.1 changes (PyPI publishing pipeline, antigravity harness parity CI, mypy --strict fix, Windows lock metadata fix) into develop per AGENTS.md git-flow policy (release branches merge into master and back into develop).
docs: expand improvements backlog with high/medium items
Pins pytest/pytest-cov/mypy/ruff so Dependabot's pip ecosystem has real versions to track, and adds an E9+F ruff selection scoped to what already passes today (broader rule sets are a follow-up). Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Clears the codebase for the new lint CI job added in a later task. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01TAZPZwzSutmru6kSCEogu6
Records the audit findings (repo public since 2026-08-29 with v1.0.1 released but zero branch protection, develop/master release drift, missing label taxonomy/dependabot/issue forms/lint job) and the NOW-tier implementation plan those findings led to. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01TAZPZwzSutmru6kSCEogu6
type:/area:/priority:/size: labels plus needs-triage and blocked, synced from .github/labels.yml by EndBug/label-sync on push to develop or manual dispatch. Keeps existing default labels rather than deleting them. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01TAZPZwzSutmru6kSCEogu6
…iage Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01TAZPZwzSutmru6kSCEogu6
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Lint is scoped to E9+F (already clean, prior commit); broader ruff rule sets are a follow-up, not bundled here. Dependency audit installs the pinned dev toolchain directly, not this project's own unpublished package (pip-audit's --strict and --skip-editable can never coexist, so the audited environment simply never includes anything editable), and upgrades pip first to clear pip's own known CVEs. pytest==8.4.2 carries a real CVE (CVE-2025-71176 / PYSEC-2026-1845, local /tmp directory hijack) whose fix requires pytest>=9.0.3, which in turn requires Python>=3.10. Decided (human call, project has no users yet) to drop Python 3.9 support rather than carry a permanent ignore-vuln exception: requires-python, classifiers, ruff target-version, and the CI matrix all move to 3.10 as the floor. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01TAZPZwzSutmru6kSCEogu6
The dependency-audit job can't install via `.[dev]` (it must not install this project's own unpublished package -- see the existing comment), so its pytest/pytest-cov/mypy/ruff versions are a manual copy of pyproject.toml's dev extra. Dependabot only updates the extra, not this workflow file, so flag the duplication for whoever bumps one and not the other. Also verified the full CI pytest invocation (with --cov-fail-under=85) under the pytest==9.1.1 pin, not just the bare test run from the prior commit's verification. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01TAZPZwzSutmru6kSCEogu6
…iew) Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Cline CLI installs skills via the open Agent Skills standard (SKILL.md), so the adapter is README-only - no manifest. Documents `cline skill add SHcommit/ADR-toolkit` plus a manual symlink fallback. Manually verified against Cline CLI 3.0.61: discovery, install, and the installed script layer (preflight/init/validate) all return ok:true. Closes #19
The public transition happened 2026-08-29 with v1.0.0/v1.0.1 already released, but branch protection was never applied -- update the docs to reflect actual re-verified state instead of the old plan. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01TAZPZwzSutmru6kSCEogu6
feat(adapters): add Cline CLI adapter
§4/§8/§9 already state the repo has been public since 2026-08-29 with branch protection still missing; §2's "확인된 사실" bullets still said the repo "is private" and that PR template doesn't exist, directly contradicting those sections. The missing-branch-protection fact itself was still accurate and is kept -- only the private-repo framing and the now-false "no PR template" claim needed correcting. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01TAZPZwzSutmru6kSCEogu6
# Conflicts: # changelog.md # handoff.md # improvements.md
chore: sync develop with v1.0.1 release work
…ance-hardening # Conflicts: # changelog.md # handoff.md # improvements.md
…ance-hardening # Conflicts: # changelog.md # handoff.md
feat(github): add OSS repository governance & supply-chain hardening
…decision (ADR-0017)
docs: add ADR-0017 for OSS governance & supply-chain hardening
… backlog item The Cline adapter (adapters/cline/) is manually verified against Cline CLI 3.0.61 only. Unlike the Codex, Gemini, and Antigravity adapters, it is not exercised by the harness-parity CI job on push/PR, so Cline/ClinePass version drift goes undetected. Cline CLI is npm-installable, so the precondition (public package registry) is already met; this change records the gap and prerequisite checks (npm package name/version pin, install-path verification, preflight/init/validate ok:true) in improvements.md and project-roadmap.md, and notes it in changelog.md and handoff.md. No code or CI workflow changes; ruff/mypy unaffected. test_cline_adapter.py assertions re-run with Python 3.13 (stdlib-only) and pass. Closes the follow-up backlog item identified while reviewing the Cline adapter install state.
docs(backlog): log Cline CLI harness-parity CI coverage gap as Medium backlog item
Cline joins Codex/Claude/Gemini as a listed harness with a thin entry file that delegates to AGENTS.md, matching the existing CODEX.md / CLAUDE.md / GEMINI.md shape. AGENTS.md's harness enumeration (line 4) and the Harness entry files paragraph (line 69) now both name Cline. The entry file also records an empirical finding: an isolated Cline run (CLI 3.0.61, model cline-pass/glm-5.2) showed Cline auto-injects the repo-root AGENTS.md into workspace context at session start — the reasoning trace explicitly says the full content of AGENTS.md was provided in the workspace context. So AGENTS.md already reaches every model routed through ClinePass (DeepSeek, GLM, Kimi, Qwen, ...) without extra plumbing. To make the harness-vs-model distinction explicit, AGENTS.md also states that per-model entry files (DEEPSEEK.md, GLM.md, KIMI.md, QWEN.md) are intentionally not created: those are model/API providers reached through a harness (Cline, Cursor, Aider, ...), not harnesses themselves, so the harness entry file already covers them. This preempts the recurring false question of whether each new model needs its own .md. Tests: added test_cline_entry_file_is_thin_pointer_to_agents_md and test_agents_md_lists_cline_among_harnesses to tests/unit/test_cline_adapter.py. All 5 cases re-run with Python 3.13 standalone (stdlib-only) and pass. ruff/mypy scope: test_cline_adapter.py only.
docs(harness): add CLINE.md thin pointer and list Cline in AGENTS.md
…elease Cut release v1.1.0 from develop. The 31 commits accumulated since v1.0.1 include six feat: commits (Cline CLI adapter, GitHub label taxonomy / labeler / dependabot / Issue Forms / auto-triage), so SemVer requires a MINOR bump; no breaking changes were identified. sync_version.py propagated the bump across: - skills/adr-toolkit/VERSION - skills/adr-toolkit/SKILL.md (frontmatter version line) - .claude-plugin/plugin.json - adapters/gemini-cli/gemini-extension.json - adapters/antigravity/plugin.json (adapters/codex/.codex-plugin/plugin.json carries description only; no version field to sync.) changelog.md moves the Unreleased block under a new ## v1.1.0 (2026-09-06) heading summarizing the 31 commits. handoff.md describes the release flow per AGENTS.md: release/v1.1.0 merges into master, then back-merges into develop, then v1.1.0 is tagged from master. Verification: scripts/sync_version.py --check passes (no drift, no untracked manifests).
SHcommit
changed the title
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary\n\nCut release v1.1.0. The 31 commits accumulated since v1.0.1 include six
feat:commits (Cline CLI adapter, GitHub label taxonomy / labeler / dependabot / Issue Forms / auto-triage), so SemVer requires a MINOR bump; no breaking changes were identified, so MAJOR is not warranted and PATCH would understate the surface change.\n\n## SemVer rationale\n\n| Category | Count | Bump type |\n|---|---|---|\n| feat: | 6 | MINOR |\n| fix: | 2 | PATCH |\n| docs/ci/chore: | 23 | — |\n\n→ Result: 1.0.1 → 1.1.0 (MINOR)\n\n## Version sync (scripts/sync_version.py)\n\nPropagated the 1.0.1 → 1.1.0 bump across:\n\n-skills/adr-toolkit/VERSION(source of truth)\n-skills/adr-toolkit/SKILL.mdfrontmatterversion:line\n-.claude-plugin/plugin.jsonversion\n-adapters/gemini-cli/gemini-extension.jsonversion\n-adapters/antigravity/plugin.jsonversion\n\nadapters/codex/.codex-plugin/plugin.jsoncarries description only — no version field to sync.scripts/sync_version.py --checkpasses (no drift, no untracked manifests).\n\n## Notable changes shipped in v1.1.0\n\n- Cline CLI adapter (adapters/cline/) — README-only, no manifest; verified against Cline CLI 3.0.61.\n-CLINE.mdharness entry pointer +AGENTS.mdharness-list / per-model-file policy update. Empirically verified Cline auto-injects the repo-rootAGENTS.mdinto workspace context (modelcline-pass/glm-5.2)).\n- GitHub governance hardening: structured Issue Forms, source-controlled label taxonomy, path-based PR labels, new-issue triage, weekly grouped Dependabot updates targetingdevelop, dormant CODEOWNERS draft.\n- CI supply-chain hardening: ruff + strict dependency-audit gates, Python floor raised to 3.10, Antigravity installer replaced with a versioned SHA-512-verified artifact, release Actions pinned to commit SHAs, PR-title shell expression injection removed.\n- ADR-0017: OSS repository governance & supply-chain hardening decision recorded.\n- Backlog items: ReDoS cross-platform safety,supersede2-phase atomic rollback, ADR overlap/similarity Eval, weekly maintenance workflows, PR significance bot,adr lint --fix, interactive HTML graph viewer, code drift detection, plus the Medium-priority item to fold Cline into theharness-parityCI job.\n\n## Release flow (per AGENTS.md)\n\n1. This PR (release/v1.1.0→master) merges.\n2. Back-mergemaster→develop(follow-up PR).\n3. Tagv1.1.0frommasterand push —.github/workflows/release.ymlruns pytest + sync_version --check + tag == VERSION, then publishes a GitHub Release with the skill tarball + sha256 + Python wheel/sdist, and publishes to PyPI via Trusted Publisher (continue-on-error: true, tracked in improvements.md).\n4. Delete the short-livedrelease/v1.1.0branch.\n\n## Verification\n\n-scripts/sync_version.py --check: passes (no drift, no untracked manifests).\n-git diff --stat: 7 files, +91/-50 — all version metadata, changelog, handoff. No source code underskills/adr-toolkit/scripts/touched, so the existing pytest matrix coverage applies unchanged.\n- Once merged andv1.1.0is tagged, therelease.ymlworkflow will run the full test suite + manifest-version-vs-tag check before publishing.\n\n## Examples Impact\n\n- [x] N/A — release-wrap PR (chore(release):), noexamples/change required per PR template.\n\n## ADR Impact\n\n- [x] N/A — records ADR-0017 (already merged in develop via PR #35) in the v1.1.0 release notes; no architectural decision changed in this PR.\n