What's New

Latest changes to the VisiTrans Claude Toolkit.

v3.53.0 (2026-07-28)

Concurrency-safe SPEC-NNN allocation (SPEC-165) — spec IDs were computed by a hand scan of the current worktree, so two branches in flight allocated the same number, and a stale long-lived branch mis-numbered every spec created on it. Both are documented incidents in this repo. A new stdlib-only allocator (allocate_spec_id.py) replaces the hand scan in both spec-from-requirements and specs-from-prd: the ID is 1 + max(working tree, every local and remote ref, a stored counter), read and written back inside one fcntl.flock critical section, against a store at <git-common-dir>/vt-spec-counter — the one path identical from every worktree of a clone. The load-bearing detail is git rev-parse --path-format=absolute --git-common-dir: without --path-format=absolute git may return a relative path that resolves to the linked worktree's own .git, which silently is the bug, with no visible symptom.

The contract is that a numbering problem must never block spec creation, so every failure — no git, unwritable .git, lock timeout, git older than 2.31 — degrades to a local scan with a named warning: on stderr and still exits 0. What makes that safe under concurrency is that the real arbiter is not the counter but an O_EXCL claim marker written on every allocation, locked and degraded alike: O_EXCL creation is the only primitive atomic across both paths, and the two paths run simultaneously by construction, since the sole cause of a lock timeout is another claimant holding the lock right then. The counter is a fast floor hint. A 96-assertion suite pins it, including a --no-lock negative control that must produce duplicates (without it the race test passes with no locking at all, by accidental serialization) and region-scoped structural assertions where each positive is paired with a mutation that must make the identical check fail.

Two durable lessons, both recurrences of existing patterns. A security fix expressed only as prose in a SKILL.md is unenforced: the shell-quoting rule for the attacker-settable specs_directory field is now pinned by assertions with must-fire mutations, not just stated. And a plausibility bound applied to one input must be applied to the inputs it is compared against — bounding the counter against the scanners while leaving the scanners unbounded let one repo-tracked SPEC-<20 digits> poison every later allocation in the clone.

v3.52.0 (2026-07-24)

Proactive Open Brain Capture (SPEC-161) — a new opt-in, dormant-by-default skill (vt-c-openbrain-capture, 127 → 128 skills) captures the core facts of a session — external-stakeholder facts, decisions and their rationale, durable domain/process knowledge — to Open Brain via capture_thought, sanitized and deduplicated. It is the always-on judgment layer above SPEC-089's fixed-point capture; both write the same store so dedup sees everything. A project opts in by dropping assets/openbrain-capture.rule.md into its .claude/rules/ — security-conscious repos stay off by default. It is deliberately not a hook, because deciding what is worth capturing is a judgment task. A dedicated sanitizer strips the mechanically-detectable credential/PII classes (API keys, JWTs, bearer tokens, username-bearing paths, connection strings, internal hostnames) before anything leaves the repo, enforced by a 59-assertion seeded-secret gate. Durable lesson: a redaction self-audit must detect a superset of what it strips, or it certifies the very leaks it should catch.

v3.51.0 (2026-07-24)

Removed: the SpecKit dependency (SPEC-158) — /vt-c-2-plan branched on SpecKit detection and, when .specify/ existed, delegated to /speckit.* commands that were never registered in this repo — so every "SpecKit detected" branch evaluated true and the agent silently improvised the artifact. This release collapses that dead fork into one honest planning path: workflow-2-plan/SKILL.md shrinks 628 → 539 lines with the plan-checker loop and task breakdown now unconditional, while the SPEC-143 diet rules, .plan-gate.md, and the SPEC-146 anchors are preserved byte-for-byte. The unused vt-c-speckit-integration skill (128 → 127) and specify-and-validate command (32 → 31) are deleted with every count surface reconciled, and setup.sh's SpecKit pin/verify/restore machinery removed. The hand-authored constitution at .specify/memory/constitution.md stays untouched. Shipped as a MINOR bump under an explicit never-functional-exception waiver — the deleted artifacts were never invocable, so no live contract needed a deprecation window.

v3.50.2 (2026-07-23)

VisiMatch design-system contrast fix (BUG-003) — seven muted-text declarations in the visimatch reference kit were hardcoded #71717a (~3.88:1 on the #101216 surface), failing WCAG 2.1 SC 1.4.3 (AA). All seven now use the canonical var(--vt-text-muted-d) token (#A0A0A0, ~7.17:1 — clears AA and AAA), matching the visitrans/visifair kits. Zero #71717a remain in the design system; blast radius one file.

v3.50.1 (2026-07-23)

persona-select.sh reviewer silent-drop fix (BUG-004) — the deterministic reviewer selector could no longer produce kieran-python-reviewer or design-implementation-reviewer, so /vt-c-4-review's HARD non-regression gate (T3) was red on main — the exact silent-drop class T3 exists to catch. Two causes: the language block had no Python detection path at all, and design-implementation-reviewer was gated on UI_SCOPE=frontend only. Fix adds marker-based Python detection (pyproject.toml/setup.py/requirements.txt) that joins the roster additively — the TS reviewer is suppressed only when the diff is known non-TypeScript, so a mixed monorepo and an unknown diff both keep both language reviewers — plus the conservative ! $diff_known branch for the design reviewer. Companion surfaces (persona-catalog, review-skill table, orchestrator dispatch) reconciled so the selector's spec-twin cannot drift. Tests 18 → 21 green.

v3.50.0 (2026-07-23)

Definition of Ready & Definition of Done at spec definition (SPEC-160) — names and wires the toolkit's existing entry/exit bars as two consolidated, spec-carried checklists, adding no competing gate. A single canonical source (docs/concepts/definition-of-ready-and-done.md) defines both and the honest per-item split: machine-checked items (clarity/Trennschärfe and planner-readiness via the SPEC-155 birth-gate; review-gate, test-gate, change-ledger) versus author-attested/advisory ones. spec-from-requirements now renders ## Definition of Ready + ## Definition of Done into every new spec.md (never retro-mutating the ~139 legacy specs), both it and shape emit a soft split-labeled DoR: PASS/WARN line, and 5-finalize hard-verifies the mechanical DoD items while reporting the narrative ones as advisory. An anti-drift test derives the ID→classification map from the reference doc and pins all three consumers to it.

v3.49.0 (2026-07-23)

Structural-Quality Screen for Skills (SPEC-162) — a new advisory, stdlib-only skill (vt-c-skill-structural-screen, 127 → 128 skills) scores every deployed skill against the mechanically-checkable subset of Anthropic's "Checklist for effective Skills" — orthogonal to SPEC-156's empirical keep/retest/retire axis. It consumes SPEC-156's skill-audit-inventory.json rather than re-walking the manifest, and runs five mechanical checks per skill: description sharpness (behind a HARD calibration gate), SKILL.md size ≤500 lines, bounded reference-nesting depth, anchored absolute-date detection, and backslash-path hygiene. It emits a per-skill table, a library-wide ranking of the most common failures plus a testing-debt tally, and an explicit manual-review-only block for the non-mechanical items — but writes no keep/retest/retire verdict, staying strictly separate from the value axis. Deterministic, no model calls.

v3.48.2 (2026-07-23)

Unified Plan-Metadata Contract in plan.md (SPEC-146) — downstream agents navigated plan.md partly by line number instead of a stable anchor, and a plan's maturity (requirements-gathered vs. implementation-ready) was implicit with no machine-readable field. So /vt-c-2-plan now emits two readiness signals into every newly-generated plan — an artifact_readiness frontmatter field and a stable ## Goal Capsule heading — and flips readiness to implementation-ready once the plan is complete, giving agents and gates a field to read instead of a line to count. The load-bearing fix was correcting SPEC-143's frozen "no legacy plan.md may change" gate so it stops flagging the very spec that extends the plan.md contract: the gate now ignores a spec's own newly-added plan.md (via --diff-filter=MD) while still catching any real modification of a legacy file, proven by a paired must-pass/must-fail guard sharing the gate's own predicate. Existing plan.md files stay byte-identical; tests 27/27. No new skill or agent — skill count stays at 127. The durable lesson — a class-wide invariant gate must exempt the triggering spec's own new artifact — is captured as a pattern.

v3.48.1 (2026-07-22)

Test-First Enforcement in the automatic review path (SPEC-159) — the toolkit owned a tdd-compliance-reviewer agent and a test-driven-development skill, but /vt-c-4-review's deterministic selector never actually selected the reviewer — so the automatic review path silently skipped test-first checking on every code review, while the build checklist softened the bar ("tests first or alongside code") in contradiction of the skill's Iron Law. So the reviewer is now wired into the selector's code-core: it runs whenever code is a deliverable type (including on unknown diffs — conservative — and never on non-code deliverables). It is advisory by construction — findings cap at Medium, it never writes a blocking review verdict, and an inconclusive read resolves to compliant. A review pass caught that the roster change had landed only in the selector and not in its three declared companion surfaces (the persona-catalog spec-twin, the review-skill's reviewer table, and its triage-ID prefix table); all four now agree. The build checklist bar was reconciled to the enforceable same-commit bar and cross-referenced to the Iron Law as the same bar, not a softening. A HARD calibration-promotion gate keeps the reviewer advisory until it is measured against a labeled corpus with a false-positive budget. No new skill or agent artifact, so the skill count stays at 127.

v3.48.0 (2026-07-22)

Spec-Clarity Birth Gate — /vt-c-spec-check (SPEC-155) — an under-specified or non-distinct term in a fresh spec silently mis-steers a downstream planning agent, which assumes a meaning and "turns the wrong way", with nothing catching the ambiguity at spec-creation time. So a new report-only, soft skill (always exits 0, never blocks) reads a spec for planner-readiness before it enters the workflow. Three layers: L1 reuses the existing gray-area heuristic unchanged; L2 adds a terminology watchlist with ## Begriffe glossary suppression, owned by a wrapper so Given/When/Then acceptance criteria and meta-TBD references stop firing false signals; L3 a planner-readiness rubric (misdirection risk, verdict, quote-anchored wrong-turns, proportional anchor-gaps) calibrated against a 7-spec labeled corpus as a HARD gate. It auto-hooks into /vt-c-spec-from-requirements and is surfaced via a /vt-c-dev-start nudge for the manual-workflow population that never reaches /vt-c-2-plan. Skill count 126 → 127.

v3.47.1 (2026-07-22)

Design-system control + legal-text contrast (SPEC-157 follow-up, WCAG AA) — two pre-existing contrast failures were deferred out of SPEC-157's polarity scope and landed as a quickfix. Interactive-control boundaries (.tbtn, .btn-outline) were as low as 1.22:1, below the 3:1 minimum, so a dedicated --control-border token (≈3.6:1 on dark, ≈3.24:1 on light) was added across all three theme blocks, leaving the decorative border untouched. Footer .legal text at #71717a (4.02:1) was lifted to #82828a (~5.1:1) in the visitrans and visifair kits; the visimatch label reuse is tracked separately as BUG-003.

v3.47.0 (2026-07-22)

Theme polarity is a surface property, not a brand property (SPEC-157) — the design system encoded theme as a property of the brand ("VisiMatch dark, VisiTrans/VisiFair light"), which the brand owner confirmed is wrong: every VisiTrans brand website is dark. The error had propagated out of documentation and into generation logic, so every generated VisiTrans/VisiFair prototype started in the wrong theme. So theme was re-axed to a surface→theme model across visitrans-design-system, pd-3-prototype, and kw-prototype: marketing websites, presentations, and logged-out product UI are dark; logged-in product UI is user-switchable; Word/PDF stay white. The stylesheet now ships dark as the default with light as an explicit opt-in that wins on specificity (not source order), and deliberately no prefers-color-scheme query that would leak the OS signal onto dark-only marketing surfaces. The durable lesson — a no-flash, framework-safe theme switcher — is captured as a pattern.

v3.46.0 (2026-07-21)

Skill Audit — Evaluability Inventory (SPEC-156, Wave 1) — SPEC-098 shipped the machinery to measure whether a skill earns its keep (running a task with and without the skill, comparing pass-rate and judge-score), but nothing turned those measurements into a decision, and nobody knew how much of the toolkit was even measurable. So /vt-c-skill-audit now sweeps every skill in the deploy manifest and sorts each into exactly one of four buckets: evaluated, auto-keep-private-data (it supplies knowledge the model cannot have — brand assets, internal conventions), auto-keep-toolkit-internal (plumbing), or not-evaluable. The first sweep is sobering and is the point of Wave 1: 3 evaluated, 10 private-data, 12 toolkit-internal, 101 not-evaluable of 126 skills — 2.4% eval coverage. That is the ground truth a keep/retest/retire policy needs before it can exist. Output is reproducible docs/skill-audit-inventory.md/.json plus an advisory pre-commit check; the generator always exits 0 and never gates a commit. The auto-keep predicate lives only in the generator and is pinned by 8 fixtures covering both its true and its false positives — including a binary-skip guard so a marker byte-sequence inside a PNG cannot smuggle a skill into auto-keep. Wave 2 (the decision policy and the skill-demote sweep) is deliberately unbuilt behind a stated gate of ≥20 evaluated skills across ≥3 categories — the policy would have nothing to consume today.

v3.45.0 (2026-07-06)

Cross-Project Overlap & Contradiction Detection at spec creation (SPEC-132) — New specs were authored in isolation with no automatic check for existing siblings, so overlaps (two specs touching the same surface — a missed bundling opportunity) and contradictions (a behavior another spec already defined differently — an implementation divergence) surfaced only by luck (motivating incident: a developer built a ticket detail divergently for lack of cross-ticket visibility). So /vt-c-spec-from-requirements now runs a deterministic best-effort pre-filter, sibling_scan.py, over the existing spec corpus before you approve a new spec. It ranks candidates by toolkit-native structural signals — shared depends_on, explicit SPEC-ID mentions, shared vt-c-* skill mentions, tags, and title-token Jaccard — behind a two-tier anti-wallpaper emission gate and a status denylist, emits a ranked top-5, and the skill classifies each as overlap or contradiction and offers a non-blocking prune. Survivors are written as an annotate-only ## Sibling-Candidates section on the new spec — sibling specs are never mutated; the human decides whether a relationship matters. It degrades to nothing and never gates spec creation. Scope is overlap + structural contradiction only; pure-semantic divergence is out of scope pending an embedding index. The review also surfaced and fixed a block-style-YAML frontmatter-parsing bug (docs/solutions/patterns/regex-frontmatter-block-list-swallow.md), ported to activate/scripts/shape-worthiness-score.py.

v3.44.0 (2026-07-05)

Registration check in workflow entry points (SPEC-150) — It was easy to start toolkit work on a project and forget to register it in intake/projects.yaml, and an unregistered project's learnings never reach the toolkit — /vt-c-project-sync and the default /vt-c-toolkit-review read only that registry. The existing soft "Step 0.5: Project Registration Check" had holes landing exactly on a new project's first steps: four entry points (activate, spec-from-requirements, quickfix, session-journal) had no check; the trigger only fired once CLAUDE.md/.design-state.yaml already existed, so a brand-new project was silently skipped; "Skip for now" could be dismissed forever with no escalation; and a $PWD substring match made worktrees read as unregistered and nag. So we moved all the logic into one script, check_registration.sh (single source of truth), invoked from an import-like stub in all 11 entry-point skills. The trigger no longer needs pre-existing toolkit artifacts, worktrees resolve to their registered parent via longest-prefix match, and "Skip for now" is remembered and escalates. We also reconciled a path drift where scaffold dropped proposals into a folder the sweep never scanned. The two context: fork hosts (4-review, 5-finalize) stay fork-safe — they still invoke the shared script but report instead of prompting, a pattern captured in docs/solutions/patterns/fork-safe-single-source-stub.md. 25/25 tests.

v3.43.1 (2026-07-05)

Claude Code usage monitoring (SPEC-129) — There was no way to see how Claude Code was performing for you — cache efficiency, token cost, which skills and tools you actually invoke — and the full Prometheus/Grafana stack originally envisioned is disproportionate at a ~4-developer scale. So we shipped a zero-infrastructure, on-demand local readout: python3 configs/monitoring/cc-metrics.py parses the session logs Claude Code already writes under ~/.claude/projects/ and prints the cache-read ratio (the key signal), token totals, and per-tool/per-skill counts. It reads numbers and names only — never the contents of your prompts, responses, or tool calls (enforced by a privacy test that seeds a secret and asserts it can never appear). An optional, opt-in deep-mode (otel-receiver.py + settings.otel.json.patch) captures authoritative token totals over a loopback-only OpenTelemetry receiver that strips identifying attributes before writing. The full team-aggregate stack is preserved as a demand-gated upgrade path in docs/operations/monitoring.md. See the monitoring guide.

v3.43.0 (2026-07-04)

Dev-focused discoverability (SPEC-149) — The toolkit grew to 125 skills, and the sole entry point (/vt-c-0-start) is workflow-oriented rather than persona-oriented, so Dev-persona colleagues de facto weren't using it. We added /vt-c-dev-start — an entry-point skill that surfaces six task-based skill landmaps (plus show-all) so you find the right skill by what you want to do — plus role/task getting-started docs (docs/getting-started/by-role.md, by-task.md) wired into the site nav. Empirical adoption evaluation (US-3) is deferred to 2026-08-01 before any further plugin extraction.

v3.37.1 (2026-05-18)

Supply-Chain Security Hook (SPEC-139) — New supply-chain-guard.sh PreToolUse hook intercepts 12 package-manager install patterns (npm, pnpm, yarn, pip, pip3, pipx, uv, poetry) before they execute. Each package is checked against the osv.dev CVE batch API and the OSSF Malicious Packages registry. CVE hits and OSSF matches hard-block the install and return a structured denial message to the model. Fail-closed: when both APIs are unreachable, the install is blocked (override: VTS_ALLOW_OFFLINE=1). Single-source-offline scenarios log result=partial-allow for auditable coverage tracking. Private/scoped packages bypass OSSF and log result=unchecked-private. All intercepted installs (blocked, allowed, or overridden) are appended to ~/.claude/security-hook.log in JSON-lines format suitable for ISO 27001 audit trails. Registered in hooks.json (priority 78, 30s timeout) and SHA-256-registered in configs/security/trusted-hooks.yaml. Skills /vt-c-npm-security and /vt-c-python-security updated to reference the hook. 39-test suite at tests/test-supply-chain-hook.sh (fully mocked, no network).

v3.37.0 (2026-05-15)

VMS Numbered CWP Workflow (SPEC-139 VMS) — The VMS plugin had 8 skills and 6 agents but no enforcement to prevent skipping steps. Large CWPs (88 files) required multiple sessions with no way to track per-file progress or resume. A numbered 5-step workflow now gates each transition: Step 1 (activate) initialises tracking, Step 2 (plan) writes a soft .cwp-plan-gate.yaml, Step 3 (draft) tracks per-file progress and writes .cwp-checkpoint.yaml at batch boundaries, Step 4 (review) writes a hard .cwp-review-gate.yaml, and Step 5 (complete) enforces a GO/NO-GO quality gate before marking done. The new /vt-v-draft skill (Step 3) routes between interactive interview mode and batch write mode. Session resume is script-backed: start_scanner.py now reads .cwp-checkpoint.yaml directly and surfaces it as the highest P0 action — checkpoint detection no longer depends solely on Claude following the SKILL.md instruction.

Review-to-Task Pipeline (SPEC-140 VMS, Phase B) — Document review in Obsidian produced gaps needing tracking (e.g., "hire a Betriebsarzt") but [!todo] callouts were lost. todo_scanner.py now scans all vault content directories for [!todo] callouts and matches them against existing aufgaben using title and quelle fields. Unlinked findings surface in the /vt-v-start session dashboard. Deduplication via <!-- aufgabe: review-YYYY-MM-DD-NNN --> comment pattern prevents double-tracking.

v3.33.0 (2026-04-22)

GitHub Issue Intake (SPEC-116) — Colleagues can now file issues on GitHub and have them flow automatically into the toolkit's intake pipeline. /vt-c-inbox-qualify gained Step 0, which fetches open GitHub issues, imports new ones into intake/inbox/, and tracks new comments on already-processed issues via comment IDs (structural diff, not heading counts). Issues are mapped to intake frontmatter by their GitHub labels: bug → workflow-defect / high, enhancement → missing-capability / medium, documentation → missing-pattern / low. Use --no-github to skip the sync for offline qualification.

Security-hardened import path — Imported GitHub content is treated as untrusted: body and comment text are wrapped in ~~~text fences so embedded SYSTEM: framing or [x] checklists cannot steer Claude downstream, filename slugs are built from an allowlist (no path traversal), issue numbers are validated as ^[0-9]+$ before shell use, YAML frontmatter values are JSON-encoded (no YAML injection), and a regex scanner redacts API keys / tokens / JWTs / bearer tokens / private keys to [REDACTED] before anything lands in intake/. Repo URL is derived from gh repo view so the skill works in any project that installs core-standards.

Renumbering: this spec started life as SPEC-050 and was renumbered to SPEC-116 to resolve a collision with the original SPEC-050 (namespace-convention, shipped 2026-03-06). Commit messages on the feature branch still reference SPEC-050.

v3.31.0 (2026-04-20)

Security baseline hardening (SPEC-114) — The security baseline grew from 5 categories / ~20 deny rules to 11 categories / ~128 deny rules. Six new categories close governance gaps that prior CLAUDE.md instructions failed to enforce: git safety (force push / hard reset / clean -f), inline code execution (python -c / node -e), database destructives (DROP / ORM reset), infrastructure teardown (terraform destroy / namespace delete), self-modification protection (global ~/.claude/ files and .git/), and agent governance (--dangerously-skip-permissions, crontab, audit-log removal).

Notable additions: - Category 2 bypass closed — Grep and Glob mirrors now block the credential-read bypass that existed when only Read(**/.env) was denied. .env variants enumerated so .env.example remains readable (EC-01). - .claudeignore now actually enforced — Claude Code does not natively honor .claudeignore; the new claudeignore-guard.sh PreToolUse hook closes that gap. - Pre-commit fail-closed — the pre-commit hook now blocks staged .env files and invokes secret-scanner.sh on every staged file, failing the commit (with install instructions) if the scanner is missing rather than silently skipping. - Scaffold and bootstrap now generate .claudeignore for all project types and .gitleaks.toml for coding/mixed projects. The gitignore-base template gained .env entries that were previously missing for knowledge and design projects.

See SECURITY-CONFIG.md for the full threat model per category.

v3.30.0 (2026-03-30)

Recursive criticism gate (SPEC-105) — New /vt-c-recursive-criticism skill runs 1–3 focused self-review passes (security, error handling, edge cases) before the multi-agent code review, plus a pre-review ritual integrated into /vt-c-3-build.

Autoresearch optimization agent (SPEC-106) — New /vt-c-autoresearch-agent skill implements Karpathy's single-metric optimization loop: measure baseline, hypothesize, implement, measure, accept (git commit) or reject (git revert), repeat with configurable iteration budget and convergence detection.

Also in this release

• Quality metrics integration (SPEC-109) — optional Step 5.8 in /vt-c-4-review auto-detects coverage tooling (nyc, c8, pytest-cov, go cover, SimpleCov), captures line/branch coverage, detects regressions over 2%, and writes results into the review gate (3.30.1)
• Build verification loop (SPEC-108) — /vt-c-3-build Step 6.5a runs an auto-detected test command up to 5 iterations until convergence; --skip-verify available (3.30.1)
• Dream + Open Brain consolidation (SPEC-107) — /vt-c-dream extends auto-memory consolidation to Open Brain persistent thoughts (3.30.1)
• Playwright E2E integration (SPEC-110) — /vt-c-4-review Step 5.9 auto-runs Playwright for ui_scope: frontend or mixed specs, captures screenshots into the spec directory, and includes results in the review gate (3.30.2)
• Phase checkpoint integration (SPEC-111) — all four phase skills auto-read on entry and auto-write on exit, enabling clean conversation clearing between phases (3.30.3)
• Auto-compound on spec completion (SPEC-112) — /vt-c-complete Step 4.6 prompts for compound knowledge capture before marking specs done; auto-skips trivial specs (3.30.4)

v3.28.0 — v3.29.0 (2026-03-27)

Memory consolidation skill (SPEC-102, 3.28.0) — New /vt-c-dream skill performs reflective consolidation of Claude Code auto-memory files: detects stale dates, dead references, contradictions, and duplicates with human confirmation for uncertain deletions.

Remotion video generation (SPEC-099, 3.29.0) — New /vt-c-remotion-video skill generates programmatic videos via Remotion using a structured interview-then-generate pattern, intended for VisiTrans product demos and explainer content.

Also in this release

• Security hardening (SPEC-103) — pinned MCP package versions in setup.sh, integrity hash verification (setup.sh --verify), Open Brain sanitization rule in CLAUDE.md, intake input validation in /inbox-qualify, SKILL.md tool-declaration audit, default npm ci --ignore-scripts, branch protection check in /repo-health, and a new security documentation set (overview, hardening, incident response) (3.29.1)
• Memory consolidation enhancement (SPEC-104) — /vt-c-dream cross-references .design-state.yaml to detect stale memory entries referencing completed specs (3.29.1)

v3.27.0 (2026-03-27)

Skill testing & benchmarking framework (SPEC-098) — New /vt-c-skill-eval skill runs YAML-based eval test cases against skills using a quality-grader agent. Ships with 15 eval cases across vt-c-2-plan, vt-c-4-review, and vt-c-spec-from-requirements, plus eval infrastructure under tests/evals/.

Also in this release

• VisiTrans design system canonical token source (SPEC-101) — five SKILL.md files and two brand_colors.py scripts now reference the canonical YAML token source instead of hardcoded values (3.27.1)
• Skill prefix corrections (SPEC-097) — intent-skill-matcher and postcompact-recovery migrated from stale vt-i-* to vt-v-*; skill linter quick_validate.py gained prefix-aware name validation (3.26.1)

v3.26.0 (2026-03-24)

Workflow gate enforcement (SPEC-095) — Persistent gates added across all four phases: /vt-c-2-plan writes plan_gate, /vt-c-3-build writes build_gate, /vt-c-4-review writes review_gate, and /vt-c-5-finalize writes finalize_gate — all into specs/[N]-feature/state.yaml as committed YAML. /vt-c-complete Step 2.5 verifies all four gates before allowing completion. Emergency bypass is available but recorded permanently in state.yaml. Backed by global CLAUDE.md Rule 16 (Workflow Gate Enforcement).

v3.25.0 (2026-03-24)

Weekly planning skill — New /vt-c-weekly-planning skill drives a structured weekly planning session via Open Brain task management MCP tools: Asana sync, grouped task dashboard, interactive review/reschedule, new task creation, decision capture, and an Obsidian weekly review summary (SPEC-094).

v3.22.0 — v3.24.0 (2026-03-24)

User manual generation pipeline (SPEC-090, SPEC-091, SPEC-092) — Three skills compose a documentation lifecycle that follows code from PRD through implementation:

• /vt-c-user-manual-generate (3.22.0) auto-generates a complete MkDocs user manual from a PRD with one page per feature, step-by-step usage, states, edge cases, and screenshot placeholders. /vt-c-pd-2-prd Step 8.5 prompts to generate after PRD completion; /vt-c-pd-6-handoff includes the link in its handoff README.
• /vt-c-user-manual-update (3.23.0) auto-generates draft updates to manual pages when a spec is completed; spec-to-docs mapping uses a docs_page field in spec state.yaml. /vt-c-complete prompts after spec completion.
• User manual build gate (3.24.0) — /vt-c-5-finalize Step 2.5 runs mkdocs build --strict against docs/user-manual/, blocks on failures, detects <!-- DRAFT --> markers, and reports documentation coverage. Same release added auto-version-bump in /vt-c-5-finalize Step 0c (MINOR/PATCH detection bumps registry.json, plugin.json, and CHANGELOG.md instead of blocking).

v3.20.0 (2026-03-23)

Bug intake pipeline (SPEC-016) — New /vt-c-bug-report and /vt-c-triage-bugs skills handle structured bug intake with auto-numbered BUG-NNN files, severity classification, and screenshot support. Promote / defer / duplicate triage uses git mv to preserve history. /vt-c-activate recognises BUG-NNN and creates fix/bug-NNN-* branches; /vt-c-complete detects those branches and updates bug state to verified. /vt-c-investigate-bug accepts a BUG-NNN argument and passes the report to the bugfix-orchestrator.

v3.19.0 (2026-03-22)

Repository evaluation safety protocol (SPEC-079) — New /vt-c-repo-evaluate skill assesses external GitHub repositories using a 4-level safety protocol: API-only analysis by default (Level 1), escalation-gated safe clone with hook inspection (Level 2), Docker sandbox and dependency audit guidance (Levels 3–4). Documented as a new section in the security governance guide.

Also in this release

• Removed unsupported allowed-tools frontmatter field from 20 SKILL.md files
• Optional from: field added to externalRelationships for C4 container view (overrides default last-declared-container routing)

v3.18.0 (2026-03-19)

Pre-PR simplify ritual (SPEC-081) — Added a /simplify reference guide with focused-mode syntax, a pre-PR ritual, and skip conditions. The code-simplicity-reviewer agent now respects the "What NOT to Change" sections added to four CLAUDE.md templates so protected patterns are not flagged. Advisory tips for the simplify ritual now appear in /vt-c-4-review PASS output and /vt-c-5-finalize GO output.

v3.17.0 (2026-03-19)

Intent engineering for skills and agents (SPEC-080) — Added an intent engineering checklist (references/intent-engineering-checklist.md) and applied Intent Boundaries sections to all six active orchestrators and three template agents (toolkit-developer, ims-writer, docs-pipeline). Five fork-context skills (workflow-4-review, workflow-5-finalize, pd-4-validate, mermaid-to-images, container-logistics-ux-expert) gained Intent Constraints sections. The audit-skill workflow now includes an intent engineering audit step.

v3.16.0 (2026-03-18)

Advanced diagram generation (SPEC-077) — Two new capabilities for diagram workflows:

• Format auto-selection: vt-c-mermaid-diagrams-branded now counts diagram elements and warns when Mermaid's Dagre layout may struggle. Under 10 elements: proceed; 10–15: ask user; over 15: recommend PlantUML.
• C4 from YAML (/vt-c-c4-diagram): Generate branded C4 context and container diagrams directly from c4: YAML frontmatter in system notes — no manual Mermaid authoring. Supports actors, containers, external systems, and typed relationships. VisiTrans brand colors applied automatically.

v3.15.0 (2026-03-18)

Strategic mentor review agent (SPEC-075) — Added strategic-mentor agent that provides VIABLE / NEEDS REVISION / FLAWED verdicts on plans and specs before build begins. Dispatched in parallel with plan-checker in /vt-c-2-plan Step 4.5 (informational, non-gating).

v3.9.0 (2026-03-08)

Hook security audit (SPEC-053) — Repo audit had no way to detect tampered, unauthorized, or rogue hook scripts. Added checksum verification, unknown hook detection, network call scanning, and permission checks against a trusted hooks manifest (configs/security/trusted-hooks.yaml) with SHA-256 checksums for all 23 hook scripts.

Also in this release

• Wave-based dependency execution (SPEC-054) — parallel wave scheduling in /vt-c-activate and /vt-c-3-build
• Visual reference enforcement (SPEC-056) — design implementation verification
• Security review pipeline (SPEC-028) — structured security review workflow
• /vt-c-complete skill split from /vt-c-activate --complete for dedicated spec completion
• Deploy→finalize rename across all active files

v3.8.0 (2026-03-06)

Namespace convention (SPEC-050) — Skills, commands, agents, and hooks from the toolkit collided with identically-named artifacts from external plugins (compound-engineering). Applied vt-{p}-{name} namespace to all 102 skills, 37 commands, 54 agents, and 7 hooks. Created agent symlink manifest and manifest-based deployment in setup.sh.

Documentation refresh (SPEC-048) — Documentation had drifted from actual toolkit state across five gap categories. Updated component counts, completed all symlink manifests, added missing guides (security governance, composable skills, contributing), created plugin READMEs, and integrated architecture docs into the MkDocs site.

Also in this release

• Worktree-aware phase transitions (SPEC-040) — workflow skills detect and switch to correct worktrees
• Plan-checker validation loop (SPEC-042) — automated plan validation up to 3 iterations in /vt-c-2-plan
• Adopted 3 orphaned hooks into governed plugin manifests
• Cleaned up 8 orphaned agent files and 6 orphaned skill artifacts from ~/.claude/

v3.7.0 (2026-03-04)

GSD wave execution (SPEC-036) — Added wave-grouped dashboard to /vt-c-activate, parallel opportunity detection in /vt-c-3-build, and pre-plan /vt-c-shape skill for dependency-aware execution.

Agent architecture patterns (SPEC-044) — Created reference documentation for CC 2.1 patterns (skill hooks, policy islands, fork semantics, orchestrators) with examples and pitfall guidance.

Configuration drift audit (SPEC-046) — Extended /vt-c-repo-health to detect security configuration drift from baseline snapshots, flagging weakened deny rules and MCP server sprawl.

Also in this release

• Document placement strategy (SPEC-038) — docs-only changes stay on current branch, eliminating visibility gaps
• Beads activation (SPEC-034) — distributed issue tracker replaces file-todos for persistent work-item tracking

v3.6.0 (2026-03-03)

Security hardening (SPEC-035) — Established security baseline configs for Claude Code settings with deny rules and MCP whitelisting audit integration into /vt-c-repo-health.

CWP pre-PR checks (SPEC-037) — Automated pre-PR validation for CWP lifecycle with must-pass checks (MkDocs build, YAML frontmatter, no broken wikilinks) integrated into /vt-v-cwp.

Also in this release

• UFI country enrichment pipeline (SPEC-039) — added country enrichment to /vt-u-sync for contacts and companies with confidence scoring

v3.5.0 (2026-03-02)

Skill permission governance (SPEC-029) — Addressed approval fatigue in long sessions by adding skill-to-agent permission binding, autonomy hooks for continuation decisions, and pre-authorized agent templates.

Skill quality assurance (SPEC-031) — Added pressure-test validation to skill-creator and spec-compliance review as a prerequisite to code quality checks, preventing untested and spec-drifted implementations.

v3.4.0 (2026-03-01)

Intelligent skill activation (SPEC-030) — Skills were forgotten after context compaction, hook matchers couldn't filter by file path, and there was no intent-based skill suggestion. Added three-layer skill amnesia mitigation (CLAUDE.md inventory, PreCompact hook, post-compaction recovery), a reusable path-match.sh utility for file-path filtering in hook scripts, and a UserPromptSubmit intent matcher that suggests relevant skills based on user input keywords.

Agent worktree isolation (SPEC-032) — Write-capable agents running concurrently could cause branch contamination. Audited all 58 agents and added isolation: worktree to 9 qualified agents. Updated agent creation guidelines with a 4-question isolation decision checklist.

Also in this release

• Fixed vault-write-guard.sh to read from stdin JSON (was using unimplemented $CLAUDE_TOOL_INPUT)
• Deployed path-match.sh symlink to ~/.claude/hooks/ for hook script reuse
• Skill inventory (67 skills) added to user-global CLAUDE.md (Part 5)
• Skill amnesia mitigation pattern documented at docs/solutions/patterns/

v3.3.0 (2026-02-27)

Finalize gate version enforcement (SPEC-023) — Releases could proceed without version bumps or changelog entries, causing silent drift between what was finalized and what documentation reflected. Added check-finalize-versions.sh that blocks /vt-c-5-finalize when version bump or changelog entry is missing for changed plugins.

Session start notifications (SPEC-022) — Users had no visibility into plugin version changes between sessions. Added a startup hook that compares registry versions against last-seen state and shows version diffs with top changelog entries for context.

Review auto-fix loop (SPEC-024) — Code reviews often returned findings that were mechanically fixable, adding friction. Added auto-fix loop to /vt-c-4-review that classifies findings as [AUTO-FIXABLE] or [HUMAN-REQUIRED] and applies mechanical fixes up to 2 iterations before surfacing remaining issues.

Documentation sync skill — Created /vt-c-doc-sync to audit documentation against actual toolkit state. Checks component counts, terminology, version references, and macros. Maintains a change ledger capturing the "why" behind each change.

Also in this release

• Plugin versioning guide at docs/guides/plugin-versioning.md
• CHANGELOG.md requirement in creating-plugins guide
• Change ledger (docs/change-ledger.md) with entries for SPEC-020 through SPEC-024

v3.1.0 (2026-02-25)

IMS plugin extraction (SPEC-021) — The core-standards plugin had grown to include IMS agents and skills only relevant to compliance workflows. Extracted 6 agents and 6 skills into an independent ims plugin with its own metadata and changelog.

v3.0.0 (2026-02-14)

Multi-plugin architecture — The monolithic plugin structure couldn't support department-specific tooling. Introduced per-plugin .claude-plugin/ directories, plugins/registry.json as version authority, and setup.sh --plugins flag for selective installation.

Two-workflow architecture — Harmonized from three-workflow to two-workflow per constitution v1.0.0: Unified Product Development and Knowledge Work.

Also in this release

• Finance department plugin as separate optional plugin
• --list-plugins command for plugin discovery
• /vt-c-content-evaluate skill for deep knowledge gap analysis
• 13 legacy docs files removed (superseded by MkDocs site)

v2.1.0 (2026-02-12)

• Product Design workflow (/vt-c-pd-0-start through /vt-c-pd-6-handoff)
• Knowledge Work workflow (/vt-c-kw-0-start through /vt-c-kw-4-publish)
• Research ingestion system (/vt-c-research-ingest, /vt-c-research-implement)

v2.0.0 (2026-02-10)

• Numbered workflow sequence /vt-c-0-start through /vt-c-6-operate
• Session journal and session consolidator for continuous knowledge capture
• Production-ready components: incident response, continuous learning, quality infrastructure

---

Full changelog | Change ledger