release: v0.3.0 by brettdavies · Pull Request #44 · brettdavies/agentnative-cli

brettdavies · 2026-05-01T08:32:49Z

Summary

v0.3.0 promotes 15 PRs from dev to main. Headline: scorecard schema bumps 0.3 → 0.5 (cumulative; anc.commit removed before tag), a new anc skill install <host> subcommand with hardened git clone + build-time host-map codegen, and a published agent-native badge surface (text-mode hint + JSON badge block) gated on a 80% eligibility floor. Plus PII fix on target.path, source-quality cleanup, README refresh, cross-repo sync map, and tooling-side hardening (PR template **Renamed:** subsection, sync-spec modernization, sync-skill-fixture drift gate, triple-diff release-flow check with squash-merge triage guidance).

The release-prep also surfaced four corrections that came in via the canonical PR-to-dev flow during this ship: #43 resynced the skill.json build-time fixture against upstream agentnative-site/dev (drift was blocking every open PR); #42 corrected cross-repo URLs in .github/ISSUE_TEMPLATE/ (broken since the v0.1.1 squash on main); #45 replaced the release-flow's single-direction leak check with a triple-diff plus git cherry patch-id check (the latter caught the URL drift that motivated the change); #46 added squash-merge-noise triage guidance to the git cherry step (the check produced 55 noisy + lines on first run, all expected, but the original comment didn't explain that). #47 dropped the anc.commit field from the scorecard JSON before the v0.3.0 tag, since the cargo:rerun-if-changed .git/ watches made cached builds fragile and anc.version is sufficient build identity.

Changelog

Added

anc skill install <host> subcommand for six hosts (claude_code, codex, cursor, factory, kiro, opencode) with --dry-run and --output {text,json} flags and a uniform JSON envelope across success, error, and dry-run paths (feat(skill-install): anc skill install <host> with hardened git clone + build-time host-map codegen #35).
Scorecard --output json self-describing metadata: four top-level blocks (tool, anc, run, target) + a badge block with eligible, score_pct, embed_markdown, scorecard_url, badge_url, convention_url (feat(scorecard): schema 0.4 metadata + pre-push CI hardening #34, feat(scorecard): badge embed hint after passing anc check (schema 0.5) #36).
--output text post-summary agent-native badge embed hint when the tool clears the 80% eligibility floor; "do not nag" rule below (feat(scorecard): badge embed hint after passing anc check (schema 0.5) #36).

Changed

Scorecard schema_version bumped 0.3 → 0.4 → 0.5 (cumulative; anc.commit field removed before the v0.3.0 tag, see chore(scorecard): drop anc.commit field + ANC_COMMIT computation #47) (feat(scorecard): schema 0.4 metadata + pre-push CI hardening #34, feat(scorecard): badge embed hint after passing anc check (schema 0.5) #36).
sync-spec.sh modernized: remote-first tag resolution, SPEC_REF env override removed (chore(sync-spec): modernize — remote-first, drop SPEC_REF #33).
p7-naked-println source check now exempts build.rs at any crate root (fix(source-quality): eliminate unwraps + route stdout through src/output.rs #38).
README refreshed for current state (schema 0.5, badge block, --audit-profile, basename target.path); rust-version bumped 1.87 → 1.88 (feat(scorecard): schema 0.4 metadata + pre-push CI hardening #34, docs(readme): refresh for v0.5 schema + agent-native badge; trim issue templates #40).
--output json scorecard anc block no longer includes a commit field; anc.version is the build identity (chore(scorecard): drop anc.commit field + ANC_COMMIT computation #47).

Fixed

target.path in --output json now emits the basename of the resolved target instead of the canonicalized absolute path, eliminating a home-dir / username PII leak that flowed into committed scorecards, badge URLs, and agent-posted artifacts (fix(scorecard): emit basename for target.path to stop home-dir PII leak #39).
Eliminated four .unwrap() calls on infallible paths across src/skill_install.rs and build.rs, replaced with .expect("…") naming the contract (fix(source-quality): eliminate unwraps + route stdout through src/output.rs #38).
Cross-repo URLs in .github/ISSUE_TEMPLATE/ corrected: spec → agentnative, site → agentnative-site, double-cli typo → agentnative-cli (fix(issue-templates): correct cross-repo URLs #42).

Documentation

scripts/SYNCS.md cross-repo sync map (docs(scripts): add SYNCS.md cross-repo sync map #41).
RELEASES.md § "After publish: sync dev with the release" + new sync-dev-after-release.sh script formalizing the post-publish backport convention (chore(release): add sync-dev-after-release.sh + document post-publish backport #37).
RELEASES.md § "Releasing dev to main" step 4 replaced with a triple-diff verification block (A: main→release, B: release→dev, C: dev→main) plus a git cherry patch-id check (docs(releases): replace one-way leak check with triple-diff verification #45), with squash-merge-noise triage guidance added in docs(releases): add squash-merge triage guidance to git cherry step #46.
README ## Install the skill section + [![agent-native]] badge row (feat(skill-install): anc skill install <host> with hardened git clone + build-time host-map codegen #35, docs(readme): refresh for v0.5 schema + agent-native badge; trim issue templates #40).

Type of Change

feat: New feature (non-breaking change which adds functionality)
fix: Bug fix (non-breaking change which fixes an issue)
chore: Maintenance tasks (dependencies, config, etc.)
docs: Documentation update

Related Issues/Stories

Story: v0.3.0 release: twelve PRs across two days of work post-v0.2.0 plus four release-prep PRs (fix(issue-templates): correct cross-repo URLs #42, chore(skill): refresh fixture from upstream agentnative-site #43, docs(releases): replace one-way leak check with triple-diff verification #45, docs(releases): add squash-merge triage guidance to git cherry step #46) opened during the release ceremony to fix issues caught by the new triple-diff verification, plus chore(scorecard): drop anc.commit field + ANC_COMMIT computation #47 dropping anc.commit before the tag.
Issue: n/a
Architecture: scorecard schema evolution (0.3 → 0.4 → 0.5) covered in CLAUDE.md ## Scorecard v0.5 Fields; skill-install architecture covered in CLAUDE.md ## Skill Install Verb; release ceremony in RELEASES.md.
Related PRs: chore(repo): sync PR template — add **Renamed:** subsection #30, chore(sync-spec): modernize — remote-first, drop SPEC_REF #33, feat(scorecard): schema 0.4 metadata + pre-push CI hardening #34, feat(skill-install): anc skill install <host> with hardened git clone + build-time host-map codegen #35, feat(scorecard): badge embed hint after passing anc check (schema 0.5) #36, chore(release): add sync-dev-after-release.sh + document post-publish backport #37, fix(source-quality): eliminate unwraps + route stdout through src/output.rs #38, fix(scorecard): emit basename for target.path to stop home-dir PII leak #39, docs(readme): refresh for v0.5 schema + agent-native badge; trim issue templates #40, docs(scripts): add SYNCS.md cross-repo sync map #41, fix(issue-templates): correct cross-repo URLs #42, chore(skill): refresh fixture from upstream agentnative-site #43, docs(releases): replace one-way leak check with triple-diff verification #45, docs(releases): add squash-merge triage guidance to git cherry step #46, chore(scorecard): drop anc.commit field + ANC_COMMIT computation #47; all merged to dev and cherry-picked here in chronological order.

Testing

Unit tests added/updated
Integration tests added/updated
Manual testing completed
All tests passing

Test Summary:

Unit tests: 535+ passing across all feat(scorecard): schema 0.4 metadata + pre-push CI hardening #34, feat(skill-install): anc skill install <host> with hardened git clone + build-time host-map codegen #35, feat(scorecard): badge embed hint after passing anc check (schema 0.5) #36, fix(source-quality): eliminate unwraps + route stdout through src/output.rs #38, fix(scorecard): emit basename for target.path to stop home-dir PII leak #39 PRs (counts varied as PRs landed). chore(scorecard): drop anc.commit field + ANC_COMMIT computation #47 simplified to ~520+ after dropping the anc_commit_when_present_looks_like_short_sha test.
Integration tests: full suite green at every cherry-pick step. New tests added: tests/scorecard_metadata_security.rs (red-team regressions for hostile binaries), tests/scorecard_schema_v05.rs (schema drift guard with target.path regression test), tests/skill_install.rs (10 active + 1 ignored e2e), tests/dogfood.rs (p2/p5 dogfood guards).
Coverage: pre-push hook (CI mirror) green at every step: fmt, clippy -Dwarnings, full test suite, cargo-deny, Windows compat (libc grep + cross-target clippy).
Triple-diff verification (the new step from docs(releases): replace one-way leak check with triple-diff verification #45) confirmed only docs/plans/, docs/brainstorms/, docs/ideation/ (guarded paths) and the docs/solutions symlink remain on dev. Release-prep files (CHANGELOG.md, Cargo.{toml,lock}, completions/*) will backport to dev via scripts/sync-dev-after-release.sh post-publish per the convention from chore(release): add sync-dev-after-release.sh + document post-publish backport #37. The git cherry patch-id check produced 55 + lines on first run; all audited as expected (squash-merge patch-id mismatch + conflict-resolution drift + intentional skips), zero real misses, which motivated docs(releases): add squash-merge triage guidance to git cherry step #46's triage guidance.

Files Modified

Modified:

Cargo.toml, Cargo.lock: version 0.2.0 → 0.3.0; time = "=0.3.47" added; rust-version bumped.
CHANGELOG.md: v0.3.0 release notes prepended.
README.md, AGENTS.md, CLAUDE.md: updated for schema 0.4/0.5, skill-install architecture, audit-profile, basename target.path, badge surface, anc.commit removal.
RELEASES.md: post-publish backport step (chore(release): add sync-dev-after-release.sh + document post-publish backport #37); skill-fixture sync step; step 4 replaced with triple-diff + git cherry check (docs(releases): replace one-way leak check with triple-diff verification #45); squash-merge triage guidance added (docs(releases): add squash-merge triage guidance to git cherry step #46).
build.rs: emit_skill_hosts codegen, ANC_VERSION emission (no longer Git-SHA-aware after chore(scorecard): drop anc.commit field + ANC_COMMIT computation #47).
src/build_info.rs: ANC_VERSION re-export; ANC_COMMIT and its test removed in chore(scorecard): drop anc.commit field + ANC_COMMIT computation #47.
src/main.rs, src/cli.rs, src/error.rs, src/scorecard/mod.rs, src/argv.rs: schema 0.4/0.5 metadata, skill-install dispatch, badge computation, basename helper. AncInfo shrinks to one field after chore(scorecard): drop anc.commit field + ANC_COMMIT computation #47.
src/checks/source/rust/naked_println.rs: build.rs exemption.
src/skill_install/skill.json: fixture refresh (source.commit pin and verify block removed by upstream).
scripts/sync-spec.sh: remote-first, SPEC_REF removed.
scripts/hooks/pre-push: Windows cross-clippy step.
.github/pull_request_template.md: **Renamed:** sub-header.
.github/ISSUE_TEMPLATE/{config,false-positive,feature-request,scoring-bug}.yml: corrected cross-repo URLs.
completions/anc.{bash,zsh,fish,elvish,powershell}: regenerated.

Created:

src/output.rs, src/skill_install.rs, src/skill_install/skill.json.
tests/dogfood.rs, tests/scorecard_metadata_security.rs, tests/scorecard_schema_v05.rs, tests/skill_install.rs, tests/fixtures/hostile-{hang,nonzero-exit,stdout-flood}/probe.sh.
scripts/sync-skill-fixture.sh, scripts/sync-dev-after-release.sh, scripts/SYNCS.md.
.github/workflows/skill-fixture-drift.yml.
.github/ISSUE_TEMPLATE/00-blank.yml.

Renamed:

tests/scorecard_schema_v04.rs → tests/scorecard_schema_v05.rs (drift guard now covers badge.* keys).
tests/fixtures/skill.json → src/skill_install/skill.json (codegen needs to read from a path inside cargo's package).

Deleted:

.github/ISSUE_TEMPLATE/grade-a-cli.yml, pressure-test.yml, spec-question.yml: duplicates of the spec repo's set; routed via config.yml.
src/build_info.rs::ANC_COMMIT const (and its test): dropped before tag, see chore(scorecard): drop anc.commit field + ANC_COMMIT computation #47.

Breaking Changes

No breaking changes

The scorecard schema_version bumps (0.3 → 0.4 → 0.5) are additive within the documented 0.x pre-launch policy. Pre-0.4 consumers feature-detect the four metadata blocks; pre-0.5 consumers feature-detect the badge key. target.path value semantics changed (basename instead of absolute path); schema shape is unchanged, so consumers reading the field at all will continue to parse it. Consumers using it for cross-host correlation should already have migrated to tool.name. anc.commit was added in 0.4 but removed before the v0.3.0 tag (#47); no public consumer of the field exists pre-launch.

Deployment Notes

No special deployment steps required

Standard pipeline: tag push triggers crates.io publish (Trusted Publishing, OIDC), GitHub Release with all 5 platform archives + sha256sums, then dispatch to brettdavies/homebrew-tap for formula update. After finalize-release.yml flips make_latest: true, run ./scripts/sync-dev-after-release.sh v0.3.0 to backport Cargo.toml, Cargo.lock, CHANGELOG.md to dev (new convention from #37).

Checklist

Code follows project conventions and style guidelines
Commit messages follow Conventional Commits
Self-review of code completed
Tests added/updated and passing
No new warnings or errors introduced
Changes are backward compatible (or breaking changes documented)

## Summary Mirrors the canonical PR-template update at `~/dotfiles/stow/github/dot-config/github/pull_request_template.md` into this repo's `.github/pull_request_template.md`. The canonical template gained a `**Renamed:**` subsection under `## Files Modified` (between `**Created:**` and `**Deleted:**`) so PR authors can record file moves separately from pure deletions during repo restructures. GitHub does not follow symlinks for PR-template discovery, so each repo carries its own copy that must be synced manually whenever the canonical changes. This PR brings agentnative-cli back to zero drift against the canonical. ## Changelog  ## Type of Change - [ ] `feat`: New feature (non-breaking change which adds functionality) - [ ] `fix`: Bug fix (non-breaking change which fixes an issue) - [ ] `refactor`: Code refactoring (no functional changes) - [ ] `perf`: Performance improvement - [ ] `docs`: Documentation update - [ ] `test`: Adding or updating tests - [x] `chore`: Maintenance tasks (dependencies, config, etc.) - [ ] `ci`: CI/CD configuration changes - [ ] `style`: Code style/formatting changes - [ ] `build`: Build system changes - [ ] `BREAKING CHANGE`: Breaking API change (requires major version bump) ## Related Issues/Stories - Story: keep the canonical PR template in sync across all brettdavies repos - Issue: n/a - Architecture: `~/dotfiles/stow/github/dot-config/github/pull_request_template.md` is the SoT for PR-template structure; per-repo `.github/pull_request_template.md` files mirror it (GitHub doesn't follow symlinks for template discovery) - Related PRs: parallel sync PRs in `agentnative-skill` and `agentnative-site` ## Testing - [ ] Unit tests added/updated - [ ] Integration tests added/updated - [x] Manual testing completed - [ ] All tests passing **Test Summary:** - `diff .github/pull_request_template.md ~/.config/github/pull_request_template.md` shows zero remaining drift after the copy. ## Files Modified **Modified:** `.github/pull_request_template.md` ## Breaking Changes - [x] No breaking changes - [ ] Breaking changes described below: ## Deployment Notes - [x] No special deployment steps required - [ ] Deployment steps documented below: ## Checklist - [x] Code follows project conventions and style guidelines - [x] Commit messages follow [Conventional Commits](https://www.conventionalcommits.org/) - [x] Self-review of code completed - [ ] Tests added/updated and passing - [x] No new warnings or errors introduced - [x] Changes are backward compatible (or breaking changes documented)

## Summary Lockstep update with `brettdavies/agentnative-skill` PR #11. Both repos now share an identical `sync-spec.sh` shape; only `DEST_DIR` differs (`src/principles/spec/` here vs `spec/` in the skill repo). Two coordinated changes to `scripts/sync-spec.sh`: 1. **Drop `SPEC_REF` override entirely.** The script always vendors the latest `v*` tag; no opt-in version selection. Removes the `SPEC_REF` env var, the `SPEC_REF` default that constantly went stale (last value `v0.3.0`), and all the doc references that pointed at manual bumps. 2. **Resolve from remote first, fall back to local.** New flow: 1. `git ls-remote --tags --sort=-version:refname` against `SPEC_REMOTE_URL` (default `https://github.com/brettdavies/agentnative.git`) to discover the latest tag without a checkout. 2. Fall back to `git -C \"$SPEC_REPO\" tag --sort=-version:refname` only when the remote query fails or returns no tags. Prior order was the opposite — local-first, with remote as override. 3. Document offline use via `--from-local <path>` for full reproducibility (no network needed if the user has a checkout already). ## Changelog ### Changed - Vendoring now always tracks the latest published spec tag — `SPEC_REF` env override removed. Run `bash scripts/sync-spec.sh` to refresh; no environment configuration required. ### Documentation - `AGENTS.md` and `src/principles/spec/README.md` updated to reflect the simpler vendor flow. ## Type of Change - [x] `chore`: Maintenance tasks (dependencies, config, etc.) ## Related Issues/Stories - Lockstep with: `brettdavies/agentnative-skill` PR #11 ## Testing - [x] Manual testing completed - [x] All checks passing **Test Summary:** Pre-push hook passed (fmt, clippy `-Dwarnings`, test, cargo-deny, Windows compatibility). ## Files Modified **Modified:** - `scripts/sync-spec.sh` — remote-first resolution, SPEC_REF removed - `AGENTS.md` — vendor-flow doc updates - `src/principles/spec/README.md` — vendor-flow doc updates ## Breaking Changes - [x] No breaking changes (consumer-facing — anyone who relied on `SPEC_REF` for a non-latest tag must now use `--from-local <path-to-checkout-at-desired-tag>`). ## Deployment Notes - [x] No special deployment steps required. ## Checklist - [x] Code follows project conventions and style guidelines - [x] Commit messages follow Conventional Commits - [x] Self-review of code completed - [x] No new warnings or errors introduced - [x] Changes are backward compatible

## Summary Bumps the scorecard JSON schema from `0.3` to `0.4` (additive) by adding four top-level metadata blocks — `tool`, `anc`, `run`, `target` — so a consumer reading the artifact in isolation can answer who/what/when/where/how without cross-referencing `agentnative-site/registry.yaml`. Site-side cleanup (removing `version` and `scored_at` from `registry.yaml`) is tracked separately. The PR also bundles two pieces of CI hardening that surfaced while shipping the feature: a sweep of pre-existing `collapsible_if` warnings (so the `-Dwarnings` pre-push hook stops blocking on tech debt) and a new Windows cross-clippy step in the same hook (so cfg-gated unused-import warnings get caught locally instead of escaping to the Windows CI job). ## Changelog ### Added - Add four scorecard metadata blocks (`tool`, `anc`, `run`, `target`) to `--output json` — identifies the scored tool/version, the `anc` build that produced the scorecard, the user-typed invocation with timestamp and duration, and the resolved target (project / binary / command). - Add `time = "=0.3.47"` dependency for RFC 3339 timestamps in `run.started_at`. ### Changed - Bump scorecard `schema_version` from `"0.3"` to `"0.4"` (additive within the documented `0.x` policy — older consumers feature-detect). - Bump `rust-version` from `1.87` to `1.88` (let-chain stabilization). ### Documentation - Document the four new top-level objects in README.md, AGENTS.md, and CLAUDE.md, including the publishing-PII review reminder for `run.invocation` and `target.path`. ## Type of Change - [x] `feat`: New feature (non-breaking change which adds functionality) (Bundled supporting commits: a `refactor` sweep of `collapsible_if` warnings and a `chore(hooks)` add of Windows cross-clippy. Both are CI hardening that surfaced while shipping this feature; neither warrants splitting into a separate PR.) ## Related Issues/Stories - Plan: `docs/plans/2026-04-29-001-feat-scorecard-schema-metadata-plan.md` ## Testing - [x] Unit tests added/updated - [x] Integration tests added/updated - [x] Manual testing completed - [x] All tests passing **Test Summary:** - Unit tests: 417 passing - Integration tests: 76 passing across 4 binaries (12 build_parser, 51 integration, 6 metadata-security, 7 schema-v04) - Total: **493 passing** / 1 ignored / 0 failures - Pre-push hook: fmt, clippy `-Dwarnings`, test, deny, windows-libc-grep, **windows cross-clippy** (new) — all green - CI on PR head: every job green including the Windows check that caught the cfg-gated import miss **New tests:** - `tests/scorecard_schema_v04.rs` — 7 end-to-end shape checks across the three modes (project, binary, command), plus pre-injection invocation, RFC 3339 shape, and `CARGO_PKG_VERSION` parity. - `tests/scorecard_metadata_security.rs` + `tests/fixtures/hostile-*/` — 6 red-team regressions: 1. Self-spawn against own `anc` binary → `tool.version: null`, no recursion 2. Hostile binary flooding stdout (~2 MiB on `--version`) → bounded by runner's 1 MiB cap, no memory exhaustion 3. Hostile binary that hangs (`exec sleep 30`) → killed at 2-second `BinaryRunner` timeout 4. Binary with nonzero `--version` and `-V` exits → `tool.version: null`, scorecard still emits 5. Unknown `--command` name → preserves existing top-level error path (NOT a scorecard with null fields) 6. Project mode with no built binary → falls through to manifest `[package].version`, `tool.binary: null` - Inline `schema_v04_emits_every_documented_key` walks every documented key path, asserts always-present-null contract for `tool.version`, `tool.binary`, `target.path`, `target.command`. **Verified the new pre-push step catches the regression class it's designed for:** temporarily reverted the `Instant` cfg-gate, ran the hook, watched `cargo clippy --target x86_64-pc-windows-gnu` fail with `error: unused import: 'Instant'`. Restored the gate, hook passes again. ## Files Modified **Created:** - `src/build_info.rs` — re-exports `ANC_VERSION` / `ANC_COMMIT` from `$OUT_DIR` - `tests/scorecard_schema_v04.rs` — shape drift guard - `tests/scorecard_metadata_security.rs` — red-team regressions - `tests/fixtures/hostile-{stdout-flood,hang,nonzero-exit}/probe.sh` **Modified:** - `build.rs` — emits `ANC_VERSION` / `ANC_COMMIT` with rerun-watch on `.git/HEAD`, `.git/refs/heads/<branch>`, `.git/packed-refs` - `src/scorecard/mod.rs` — adds `ToolInfo`, `AncInfo`, `RunInfo`, `PlatformInfo`, `TargetInfo`; bumps `SCHEMA_VERSION` to `"0.4"`; introduces `RunMetadata` parameter - `src/argv.rs` — adds `format_invocation` helper with shell-safe quoting - `src/main.rs` — wires `Instant` timing, `OffsetDateTime` start stamp, argv pre-injection capture, `build_target_info` / `build_tool_info` / `probe_tool_version` / `read_manifest_version` - `Cargo.toml`, `Cargo.lock` — adds `time = "=0.3.47"`, bumps `rust-version` - `tests/integration.rs` — extends top-level-keys test with the four new blocks; updates `schema_version` assertions - `README.md`, `CLAUDE.md`, `AGENTS.md` — document the new fields - `scripts/hooks/pre-push` — adds Windows cross-clippy step (graceful skip if `mingw-w64` + `x86_64-pc-windows-gnu` target are absent, otherwise enforces `-Dwarnings` against the Windows target) - 9 source files swept for `collapsible_if` → let-chain conversion (no behavior change) ## Breaking Changes - [x] No breaking changes — additive within the `0.x` pre-launch policy ## Deployment Notes - [x] No special deployment steps required for the binary itself. - One-time local-dev setup to enable the new Windows cross-clippy step in the pre-push hook: ```sh sudo apt install -y gcc-mingw-w64-x86-64 binutils-mingw-w64-x86-64 rustup target add x86_64-pc-windows-gnu ``` Without these the step skips with a one-line install hint; CI's Windows job remains the backstop. - Cross-repo follow-up (out of scope for this PR): the `agentnative-site` repo's `scripts/regen-scorecards.sh` and `docker/score/score-anc100.sh` should switch to reading `tool.version` and `run.started_at` from the scorecard instead of maintaining `version` / `scored_at` in `registry.yaml`. Tracked separately. ## Checklist - [x] Code follows project conventions and style guidelines - [x] Commit messages follow Conventional Commits - [x] Self-review of code completed - [x] Tests added/updated and passing - [x] No new warnings or errors introduced - [x] Changes are backward compatible

…ne + build-time host-map codegen (#35) Adds `anc skill install <host>` — a single-verb subcommand that clones the [`agentnative-skill`](https://github.com/brettdavies/agentnative-skill) bundle into a host's canonical skills directory. Six hosts at v0.1 (`claude_code`, `codex`, `cursor`, `factory`, `kiro`, `opencode`); the host map is **build-time-generated** by `build.rs::emit_skill_hosts` from `src/skill_install/skill.json`, so adding or changing a host is a single-file edit (or `bash scripts/sync-skill-fixture.sh`) followed by `cargo build` — no hand-maintained Rust map. The verb closes `anc`'s own dogfood loop on P2 (`--output {text,json}`) and P5 (`--dry-run`). The `git clone` invocation runs with named-const hardening (`GIT_HARDEN_FLAGS`, `GIT_HARDEN_ENV_REMOVE`, `GIT_HARDEN_ENV_SET` — the last includes `GIT_CONFIG_GLOBAL=/dev/null` and `GIT_CONFIG_SYSTEM=/dev/null` to disable user-controlled git config). JSON envelope is uniform across success and error and across both modes. - Add `anc skill install <host>` subcommand to install the [`agentnative-skill`](https://github.com/brettdavies/agentnative-skill) bundle into a host's canonical skills directory. Six hosts: `claude_code`, `codex`, `cursor`, `factory`, `kiro`, `opencode`. - Add `--dry-run` flag (P5): prints the resolved `git clone` command without spawning. Captures cleanly via `eval $(anc skill install --dry-run <host>)`. - Add `--output {text,json}` flag (P2): JSON envelope is uniform across success and error and across dry-run / live install. Typed `reason` on error (`destination-not-empty`, `destination-is-file`, `home-not-set`, `git-not-found`, `git-clone-failed`). - Add `## Install the skill` section to README with one-line examples per host and the manual `git clone` fallback for hosts not yet in the binary's map. - [x] `feat`: New feature (non-breaking change which adds functionality) - Plan: [`docs/plans/2026-04-29-002-feat-skill-subcommand-plan.md`](docs/plans/2026-04-29-002-feat-skill-subcommand-plan.md) - Follow-up plan (queued, not in this PR): [`docs/plans/2026-04-30-001-feat-spec-output-envelope-shoulds-plan.md`](docs/plans/2026-04-30-001-feat-spec-output-envelope-shoulds-plan.md) — proposes 4 new SHOULDs to `agentnative-spec` codifying the envelope contract this PR ships. - Solutions doc: refreshed `docs/solutions/architecture-patterns/anc-cli-output-envelope-pattern-2026-04-29.md` (committed in `solutions-docs`). - Companion PR: [brettdavies/agentnative-site#53](brettdavies/agentnative-site#53) (merged) — added `factory` and `kiro` to the canonical `skill.json`. - [x] Unit tests added/updated - [x] Integration tests added/updated - [x] Manual testing completed - [x] All tests passing **Test Summary:** - Bin unit tests: 431 pass, 1 ignored - `tests/skill_install.rs` integration: 10 active + 1 `#[ignore]` (live e2e clone — passes on opt-in run) - `tests/dogfood.rs`: 2 pass (no `p2-*` / `p5-*` `fail` against this repo) - `tests/integration.rs`: 51 pass (existing P1–P7 surface, no regressions) - Other test files: 25 pass (build_parser, scorecard schema, etc.) - **Total:** 519 active passing, 2 ignored, 0 failures **Manual smoke (verified before merge):** - All 6 hosts via `--dry-run`: each prints the canonical `git clone` command for its destination. - Live install with `HOME=/tmp/anc-{claude_code,codex,factory}-smoke anc skill install <host>` → exit 0, `.git/HEAD` written, bundle files present. - Re-run on populated destination → envelope `status: error`, `reason: destination-not-empty`, exit 1 (R9 honored). - `HOME` unset → envelope `reason: home-not-set`, exit 1. - `PATH` without `git` → envelope `reason: git-not-found`, `exit_code` absent, exit 1. **Local CI parity (pre-push hook):** fmt, clippy `-Dwarnings`, full test, cargo-deny audit, Windows compat — all green. **Created:** - `src/skill_install.rs` — module skeleton, hardening tables, orchestrator, envelope (~830 LOC including tests). - `src/skill_install/skill.json` — vendored copy of `agentnative-site/src/data/skill.json`; build-time codegen input. - `build.rs` additions: `emit_skill_hosts` codegen function (parses skill.json, emits `$OUT_DIR/generated_hosts.rs`). - `scripts/sync-skill-fixture.sh` — remote-first vendor + `--check` drift mode (mirrors `sync-spec.sh`). - `.github/workflows/skill-fixture-drift.yml` — CI drift gate (runs `--check` on every PR). - `tests/skill_install.rs` — 11 integration tests. - `tests/dogfood.rs` — p2/p5 dogfood guards against `anc` itself (CRITICAL). - `docs/plans/2026-04-30-001-feat-spec-output-envelope-shoulds-plan.md` — follow-up plan. **Modified:** - `src/cli.rs` — `Commands::Skill { SkillCmd::Install }` clap surface. - `src/main.rs` — `Commands::Skill` dispatch arm. - `src/error.rs` — 6 new `AppError` variants (`MissingHome`, `GitNotFound`, `GitCloneFailed{code}`, `DestIsFile`, `DestNotEmpty`, `DestReadFailed`). - `Cargo.toml` — `tempfile` dev-dep, `serde_json` build-dep. - `README.md` — install section. - `AGENTS.md`, `CLAUDE.md` — skill-verb sections (codegen architecture, hardening surface). - `RELEASES.md` — pre-release skill-fixture sync step. - `docs/plans/2026-04-29-002-feat-skill-subcommand-plan.md` — body refreshed to as-shipped reality; added two `Document Review (... revision, 2026-04-30)` subsections capturing the manual-smoke + codegen revisions. **Renamed:** - `tests/fixtures/skill.json` → `src/skill_install/skill.json` (move + content update; `tests/` is in cargo `exclude`, blocking build.rs read). - **Build-time host-map codegen.** `build.rs::emit_skill_hosts` reads `src/skill_install/skill.json`, validates each install command tokenizes as `git clone --depth 1 <url> <dest>`, and emits `SkillHost` enum + `KNOWN_HOSTS` + `resolve_host` + `host_envelope_str` into `$OUT_DIR/generated_hosts.rs`. `cargo:rerun-if-changed` invalidates the build cache on JSON edits. Eliminates the Rust↔fixture drift class entirely (the original test 12 was deleted as provably redundant after the refactor). - **Three named-const hardening tables.** `GIT_HARDEN_FLAGS` (5 `-c` pairs), `GIT_HARDEN_ENV_REMOVE` (5 vars), `GIT_HARDEN_ENV_SET` (3 pairs including `GIT_CONFIG_GLOBAL=/dev/null` and `GIT_CONFIG_SYSTEM=/dev/null` — the actual defense against user-config `insteadOf` rewriting). Two manual-smoke bugs in the eng-review's R6c wording were caught and corrected before merge: `protocol.allow=https-only` is invalid git syntax (replaced with default-deny + per-protocol-allow); `-c url.<repo>.insteadOf=` rewrites in the wrong direction (dropped, defense routed through env-set). - **Uniform JSON envelope.** Same shape across `success`/`error` and `dry-run`/`install`. `Option` fields use `#[serde(skip_serializing_if = "Option::is_none")]` so absence is silence, not `null`. Field-presence rules: `would_succeed` (dry-run only); `exit_code` (live install only AND only when git was actually spawned); `reason` (error only). - **CI drift gate.** `.github/workflows/skill-fixture-drift.yml` runs `scripts/sync-skill-fixture.sh --check` on every PR — clones `agentnative-site` and `cmp`s the live blob against the committed fixture. Drift fails CI loudly, never users silently. - **Dogfood guards.** `tests/dogfood.rs` runs `anc check . --output json` on this repo and asserts no `fail` on `p2-*` or `p5-*`. Without these, the dogfood claim that drove the binary-verb-vs-bash-one-liner decision (Plan: Problem Frame § "Why a binary verb, not a bash one-liner?") would break silently. - **Agent-native UX.** `anc skill install --output json --dry-run claude_code` emits a parseable envelope agents can branch on without regex; live install too. - **Zero-touch host expansion.** Adding or removing a host is one JSON edit (or sync-script invocation). No Rust hand-edits, no test counter bumps for the host count, no parallel maintenance surfaces. - **Defense-in-depth supply-chain hardening.** User-controlled git config is fully neutered for the spawned process; ambient `insteadOf` cannot redirect the clone; HTTPS-only is enforced by default-deny + per-protocol-allow; credential/askpass paths are blocked; terminal prompts disabled. - **Plan-as-doc trail.** The plan body was refreshed to match the as-shipped surface; two `Document Review (revision)` subsections capture *why* the manual-smoke and codegen revisions happened, so future readers don't re-litigate or re-introduce the originals. - [x] No breaking changes - [x] No special deployment steps required The pre-release checklist in `RELEASES.md` gains one step: `bash scripts/sync-skill-fixture.sh && git diff src/skill_install/skill.json` before tagging, to surface upstream site changes since `dev` was branched. The Rust map regenerates automatically on the next `cargo build`. - [x] Code follows project conventions and style guidelines - [x] Commit messages follow [Conventional Commits](https://www.conventionalcommits.org/) - [x] Self-review of code completed - [x] Tests added/updated and passing - [x] No new warnings or errors introduced - [x] Changes are backward compatible (or breaking changes documented) - **Companion site PR already merged:** `agentnative-site#53` added `factory` and `kiro` to the canonical `skill.json`. CI's `skill-fixture-drift` workflow on this PR is green against `agentnative-site/dev`. - **Plan history:** This PR was driven by `docs/plans/2026-04-29-002-feat-skill-subcommand-plan.md`. The plan went through `/ce-doc-review`, `/plan-eng-review` (SCOPE_REDUCED), Outside-Voice review, two implementation revisions (manual-smoke fix + codegen refactor), and final synthesis. The plan body documents the as-shipped contract; the `Document Review` sections at the bottom preserve the audit trail of decisions that didn't make it to the final shipped form. - **Solutions doc:** Refreshed `architecture-patterns/anc-cli-output-envelope-pattern-2026-04-29.md` (in `solutions-docs`) to fold the manual-smoke + codegen revisions into the canonical convention doc. - **Frontmatter status flip:** plan `status: active → completed` happens at squash-merge per the ce-work shipping convention.

#36) ## Summary Closes the badge-discovery gap from todo `017`: after a passing `anc check .` run, the CLI now points authors at the agent-native badge embed snippet for *their* tool, instead of requiring them to land on the site, navigate to their scorecard page, and find the embed snippet there. Surface #5 of the cross-repo badge-surface design (surfaces #1–#4 shipped on the site/spec last wave). End-to-end on this repo (`agentnative-cli`, score 90%): ```text 🏆 Score: 90% — your tool qualifies for the agent-native badge. Embed in your README: [![agent-native](https://anc.dev/badge/agentnative-cli.svg)](https://anc.dev/score/agentnative-cli) Convention: https://anc.dev/badge ``` JSON consumers see the same data as a structured `badge` block — eligibility, score percent, embed snippet, scorecard/badge URLs, and the convention pointer. ## Changelog ### Added - `--output text` now appends an agent-native badge embed hint after the summary line when the tool clears the 80% eligibility floor. Below the floor, nothing badge-related is printed (the convention's "do not nag" rule). - `--output json` scorecard now includes a `badge` block (`eligible`, `score_pct`, `embed_markdown`, `scorecard_url`, `badge_url`, `convention_url`). `embed_markdown` is `null` below the floor; `scorecard_url` / `badge_url` are populated whenever a tool slug exists, since the site renders an SVG for every scored tool. ### Changed - Bumped scorecard `schema_version` from `"0.4"` to `"0.5"`. Pre-`0.5` consumers feature-detect the new `badge` key and continue to work. ## Type of Change - [x] `feat`: New feature (non-breaking change which adds functionality) - [ ] `fix`: Bug fix (non-breaking change which fixes an issue) - [ ] `refactor`: Code refactoring (no functional changes) - [ ] `perf`: Performance improvement - [ ] `docs`: Documentation update - [ ] `test`: Adding or updating tests - [ ] `chore`: Maintenance tasks (dependencies, config, etc.) - [ ] `ci`: CI/CD configuration changes - [ ] `style`: Code style/formatting changes - [ ] `build`: Build system changes - [ ] `BREAKING CHANGE`: Breaking API change (requires major version bump) ## Related Issues/Stories - Story: surface #5 of the badge-surface design (todo `017`, local-only at `.context/compound-engineering/todos/017-completed-p1-agent-native-badge-hint-on-passing-check.md`) - Issue: n/a (todo-tracked) - Architecture: `agentnative-site` `docs/plans/2026-04-23-002-feat-badge-surface-plan.md` (cross-repo coordinator for surfaces #1–#4); `agentnative-spec` `feat/badge-claim-convention` branch (spec-side claim convention) - Related PRs: surfaces #1–#4 (site/spec, already shipped) ## Testing - [x] Unit tests added/updated - [x] Integration tests added/updated - [x] Manual testing completed - [x] All tests passing **Test Summary:** - Unit tests: 443 passing (1 ignored) - Integration tests: 90 passing (1 network-gated ignored) - Coverage: no per-line coverage tool configured; pre-push hook (CI mirror) green — fmt, clippy `-Dwarnings`, full suite, cargo-deny, Windows compat Detail: - 11 new unit tests in `src/scorecard/mod.rs` cover `compute_badge` across eligible / below-floor / at-floor / Skips- excluded / no-scoring-data / empty-slug, plus `BadgeInfo::text_hint` and `format_text` integration. Full module passes 50/50. - 2 new end-to-end tests in `tests/scorecard_schema_v05.rs`: `schema_v05_badge_block_reflects_live_tool_slug` (asserts `badge.*` URLs share the live `tool.name` slug) and `schema_v05_badge_eligibility_flag_matches_score` (asserts `eligible == (score_pct >= 80)` and that `embed_markdown` is present iff `eligible`). - Schema drift guard updated end-to-end: `tests/integration.rs` `test_scorecard_json_has_stable_top_level_keys` now includes `badge` in EXPECTED, still bidirectional ("no unexpected keys" also fails on accidental additions). ## Files Modified **Modified:** - `src/scorecard/mod.rs` — `BADGE_ELIGIBILITY_FLOOR_PCT`, `BADGE_BASE_URL`, `BadgeInfo` struct, `compute_badge()`, `BadgeInfo::text_hint()`, `score_pct()` helper, `Scorecard.badge` field, `format_text` extended to accept `Option<&BadgeInfo>`. - `src/main.rs` — `derive_tool_name()` factored out of `build_tool_info` (cheap slug derivation, no version probe), used by the text-mode badge path so the hint and JSON `embed_markdown` always agree on the slug. - `tests/integration.rs`, `tests/scorecard_metadata_security.rs` — `schema_version` assertions bumped to `"0.5"`, `badge` added to the stable-keys EXPECTED set. - `AGENTS.md`, `CLAUDE.md` — documented the `0.5` `badge` block, eligibility floor, do-not-nag contract, and the text-mode hint path. **Created:** - (none — every new symbol lives inside an existing module) **Renamed:** - `tests/scorecard_schema_v04.rs` → `tests/scorecard_schema_v05.rs` (drift guard now covers `badge.*` keys). **Deleted:** - (none) ## Key Features - Single source of truth for the badge slug: text-mode and JSON both pass through `tool.name` (text-mode via the cheap `derive_tool_name`, JSON via `build_tool_info` → `metadata.tool.name`). Both call the same `compute_badge` so the printed embed snippet and the JSON `embed_markdown` cannot disagree. - Empty-slug guard: a derivable tool name is required for eligibility. Without one we can't construct the embed URL truthfully — emitting a placeholder would mislead authors. Pinned by `compute_badge_empty_slug_is_ineligible_even_at_perfect_score`. - Score formula matches the site leaderboard exactly: `pass / (pass + warn + fail)` rounded to integer percent. Skips and Errors are excluded from both sides of the ratio. Pinned by `compute_badge_skips_excluded_from_denominator`. ## Benefits - **Discovery**: a tool author who runs `anc check .` and clears the floor sees the embed snippet for *their* tool without leaving the terminal — no round-trip to the site. - **Safety by default**: below-floor runs print nothing badge-related. There is no "you're at 73%, try harder" nag. - **Consumer feature-detection**: the schema bump is additive. Pre-`0.5` consumers continue to work; new consumers can rely on `badge.*` paths being populated on every `--output json` run. - **Cross-surface consistency**: the same canonical `https://anc.dev/badge/<slug>.svg` and `/score/<slug>` URLs render in both the text hint and the JSON, derived from one tool slug, so a README link copied from either surface lands on the same scorecard. ## Breaking Changes - [x] No breaking changes - [ ] Breaking changes described below: The schema bump from `0.4` to `0.5` is additive. Pre-`0.5` consumers feature-detect the new `badge` key and continue to work. ## Deployment Notes - [x] No special deployment steps required - [ ] Deployment steps documented below: The eligibility floor (80%) is hardcoded as a named const (`BADGE_ELIGIBILITY_FLOOR_PCT`) sourced from the site's published convention (`agentnative-site/content/badge.md`). When the spec convention merges off `agentnative-spec` `feat/badge-claim-convention`, the floor will move into the vendored spec via `sync-spec` — that is a follow-up, not a blocker. ## Screenshots/Recordings Captured by self-dogfooding `cargo run -- check .` against this repo on the `feat/badge-embed-hint` HEAD. **Eligible run (text-mode tail) — score 90%, badge hint appended:** ```text 33 checks: 26 pass, 2 warn, 1 fail, 4 skip, 0 error 🏆 Score: 90% — your tool qualifies for the agent-native badge. Embed in your README: [![agent-native](https://anc.dev/badge/agentnative-cli.svg)](https://anc.dev/score/agentnative-cli) Convention: https://anc.dev/badge ``` **Eligible run (`--output json | jq '{schema_version, tool, badge}'`) — same slug, same URLs, structured fields:** ```json { "schema_version": "0.5", "tool": { "name": "agentnative-cli", "binary": "anc", "version": "0.1.0" }, "badge": { "eligible": true, "score_pct": 90, "embed_markdown": "[![agent-native](https://anc.dev/badge/agentnative-cli.svg)](https://anc.dev/score/agentnative-cli)", "scorecard_url": "https://anc.dev/score/agentnative-cli", "badge_url": "https://anc.dev/badge/agentnative-cli.svg", "convention_url": "https://anc.dev/badge" } } ``` **Below-floor run (`anc check . --principle 99 | tail -10`) — no badge hint, no nag:** ```text Code Quality [FAIL] No .unwrap() in source (code-unwrap) /home/brett/dev/agentnative-cli/build.rs:70:20 — path.file_name().unwrap().to_str().unwrap() /home/brett/dev/agentnative-cli/build.rs:70:20 — path.file_name().unwrap() /home/brett/dev/agentnative-cli/src/skill_install.rs:574:22 — v.to_possible_value().unwrap() /home/brett/dev/agentnative-cli/src/skill_install.rs:613:28 — parsed.to_possible_value().unwrap() 1 checks: 0 pass, 0 warn, 1 fail, 0 skip, 0 error ``` Confirms the do-not-nag contract: nothing badge-related appears below the eligibility floor. ## Checklist - [x] Code follows project conventions and style guidelines - [x] Commit messages follow [Conventional Commits](https://www.conventionalcommits.org/) - [x] Self-review of code completed - [x] Tests added/updated and passing - [x] No new warnings or errors introduced - [x] Changes are backward compatible (or breaking changes documented) ## Additional Context The todo flagged three open questions; this PR resolves them: - **Tool slug source** → derived from `tool.name` (project basename / command name / binary basename). A future `--tool-slug` flag can override this if registry slugs ever diverge from `tool.name`. Out of scope here. - **Eligibility floor source** → hardcoded const, sourced from the site convention. Migrates to the vendored spec once `agentnative-spec` `feat/badge-claim-convention` merges. - **Output format gating** → JSON gets the structured `badge` block on every run; text mode appends a hint only when eligible. UUIDv7 run identifier and content-addressable scorecard hash were both considered for inclusion in this schema bump and intentionally deferred — neither has a current consumer (the site doesn't archive per-run, the badge doesn't pin to a run, no signing story exists), and pre-launch additive bumps are cheap precisely so we don't have to pre-add hooks. Either is a clean additive bump when a consumer materializes.

… backport (#37) ## Summary After every release tag publishes on `main` and `finalize-release.yml` flips the GitHub Release to `published`, three release-bookkeeping files are authoritative on `main` and need to flow back to `dev` so future builds from `dev` report the released version. Across `v0.1.0` → `v0.2.0` this didn't happen — `dev`'s `Cargo.toml` stayed at `0.1.0`, the `Cargo.lock` package version line stayed stale, and `dev`'s `CHANGELOG.md` was empty for the entire release history. This PR ships a tiny bash script (`scripts/sync-dev-after-release.sh`) that does the backport surgically and lands a new step in `RELEASES.md` after the publish-pipeline table making the convention explicit. Companion commit `abf1c6a` (already on `dev`) did the one-time backport for `v0.2.0` itself; this PR is purely the process change so the next release doesn't drift again. ## Changelog ### Added - `scripts/sync-dev-after-release.sh` — backports `Cargo.toml` `[package].version`, `Cargo.lock`, and `CHANGELOG.md` from `main` to `dev` after a release tag publishes. Surgical (preserves dev's other Cargo.toml lines), idempotent (re-runs are a no-op when dev is already in sync), and signed via the operator's normal commit signing — satisfies `protect-dev`'s `required_signatures` ruleset without needing a CI bot identity. ### Documentation - `RELEASES.md` § "After publish — sync ``dev`` with the release" documents the backport step, supersedes the prior "never back-merged" rule for these three specific files, and points operators at the script. ## Type of Change - [x] `chore`: Maintenance tasks (dependencies, config, etc.) - [x] `docs`: Documentation update ## Related Issues/Stories - Story: n/a - Issue: n/a - Architecture: ``RELEASES.md`` § "After publish — sync ``dev`` with the release" (lands in this PR; documents the new convention) - Related PRs: companion commit on dev ``abf1c6a chore(release): backport v0.2.0 artifacts to dev`` — applied the one-time backport that this script formalizes. Sibling PR #38 ships source-quality fixes that ride the same release as this one. ## Testing - [x] Manual testing completed - [x] All tests passing **Test Summary:** - Unit tests: n/a — pure shell glue, no Rust changes - Integration tests: n/a - Manual: ran the script's working-tree-clean guard on its own uncommitted state during development; correctly tripped (exit 65). Pre-push hook (fmt, clippy ``-Dwarnings``, test, cargo-deny, Windows compat) green on the branch. ## Files Modified **Modified:** - ``RELEASES.md`` — adds new ``### After publish — sync `dev` with the release`` subsection inside the Tagging and publishing section. **Created:** - ``scripts/sync-dev-after-release.sh`` (executable, +x). ~95 LOC bash. **Renamed:** - None. **Deleted:** - None. ## Breaking Changes - [x] No breaking changes ## Deployment Notes - [x] No special deployment steps required The script is invoked manually after each future release per the new RELEASES.md step. ## Checklist - [x] Code follows project conventions and style guidelines - [x] Commit messages follow Conventional Commits - [x] Self-review of code completed - [x] No new warnings or errors introduced - [x] Changes are backward compatible

…put.rs (#38) ## Summary Dogfooding `anc check .` against this repo on the v0.2.0 binary surfaced one FAIL and one multi-site WARN that together pulled the project-mode score down to 90%. This PR addresses both, taking the score to **97%** with **0 fail / 1 warn** (the remaining warn is `p2-json-output`'s known probe limitation — `--help`/`--version` short-circuit `--output` flags, so safe probes can't validate the JSON envelope; that's a check-design concern, not a real regression). Two related cleanups, plus the supporting refactor: 1. **Unwrap fail (4 sites → 0).** Three `.unwrap()` sites are infallible by upstream contract — clap's `ValueEnum::to_possible_value()` always returns `Some` for declared variants (`src/skill_install.rs:574, 613`), and `Path::file_name()` / `OsStr::to_str()` on a glob-matched ASCII filename in `build.rs` cannot fail in practice. All three are now `.expect("…")` calls naming the invariant in source so the next reader doesn't have to reconstruct the reasoning. 2. **Naked println warn (11 sites → 0).** Two distinct cases bundled here: - **build.rs (9 sites).** Cargo build scripts emit metadata via `println!("cargo:rerun-if-changed=…")` and `println!("cargo:warning=…")` directives — there's no other API. The `p7-naked-println` check now exempts `build.rs` at any crate root via a precise path-segment predicate (rejects misnamed `src/build.rs`, `tests/build.rs`, etc). - **main.rs:259 + skill_install.rs:510 (2 sites).** Both are legitimate stdout hand-offs at the orchestration boundary. New `src/output.rs` centralizes them behind `output::emit` (no trailing newline) and `output::emit_line` (with newline). The check's existing `output|display in path` exemption already covers the new module by convention — no check change needed for this case. ## Changelog ### Changed - `p7-naked-println` source check now exempts `build.rs` at any crate root. Cargo build scripts use `println!("cargo:…")` directives by protocol; flagging them produces noise without an alternative API. Misnamed `src/build.rs` or `tests/build.rs` files stay flagged. ### Fixed - Eliminated four `.unwrap()` calls on infallible operations across `src/skill_install.rs` and `build.rs`. Replaced with `.expect("…")` naming the upstream contract that guarantees `Some`/`Ok`. No behavior change — these were already infallible; the `expect` messages document why. ## Type of Change - [x] `fix`: Bug fix (non-breaking change which fixes an issue) ## Related Issues/Stories - Story: dogfooding the v0.2.0 binary against this repo to catch source-quality regressions before they reach Show HN readers. - Issue: n/a (surfaced via ``anc check .`` dogfood, not a filed issue). - Architecture: ``src/output.rs`` becomes the single stdout hand-off point for the binary; ``src/checks/source/rust/naked_println.rs`` exempts build scripts at any crate root. - Related PRs: sibling PR #37 (chore/sync-dev-after-release) — release backport script + RELEASES.md step. Both branches ride today's release together. ## Testing - [x] Unit tests added/updated - [x] All tests passing **Test Summary:** - Unit tests: 535 passing (2 new tests in ``naked_println.rs`` covering ``is_cargo_build_script`` predicate — positive cases bare/relative/absolute/Windows/case-insensitive; negative cases src/, tests/, examples/, benches/ subtrees and ``build.rs.bak`` — plus an integration check that the helper still warns at unit level while ``run()`` filters by path). - Integration tests: dogfood verification — ``anc check .`` reports 33 checks: 28 pass, 1 warn, 0 fail, 4 skip → 97% (was 90%). Binary mode unchanged at 89% (orthogonal to source-side findings). - Coverage: ``cargo fmt --check``, ``cargo clippy --release -- -Dwarnings``, full pre-push hook all green. ## Files Modified **Modified:** - ``build.rs`` — ``.unwrap().to_str().unwrap()`` chain → ``.expect("…")`` calls naming the invariant. - ``src/checks/source/rust/naked_println.rs`` — ``is_cargo_build_script`` helper exempts crate-root build scripts; doc-comment on the module updated; 2 new tests. - ``src/main.rs`` — declares the new ``output`` module; routes the final stdout hand-off through ``output::emit``. - ``src/skill_install.rs`` — two test-side ``.unwrap()`` → ``.expect()`` replacements; ``println!("{rendered}")`` → ``crate::output::emit_line(&rendered)``. **Created:** - ``src/output.rs`` — single stdout hand-off point with ``emit`` and ``emit_line`` helpers. **Renamed:** - None. **Deleted:** - None. ## Breaking Changes - [x] No breaking changes The naked-println exemption broadens what passes; no tool that previously passed will now fail. ## Deployment Notes - [x] No special deployment steps required ## Checklist - [x] Code follows project conventions and style guidelines - [x] Commit messages follow Conventional Commits - [x] Self-review of code completed - [x] Tests added/updated and passing - [x] No new warnings or errors introduced - [x] Changes are backward compatible

…ak (#39) ## Summary `target.path` in the JSON scorecard previously emitted the canonicalized absolute path from `Project::discover` (e.g. `/home/<user>/dev/agentnative-cli`). That value flows into committed scorecards under `agentnative-site/scorecards/`, README badge URLs, Show HN comment paste-throughs, and any artifact an agent posts to a PR or issue. Three PII vectors leaked through it: - **operator username** via `/home/<user>/`, `/Users/<user>/`, `C:\Users\<user>\` - **org/employer directory structure** (e.g. `/home/<user>/work/<company>/...`) - **personal directory layout intent** (`~/dev` vs `~/code` vs `~/projects`) This PR switches `target.path` to the **basename** of the resolved target — the directory name in project mode, the file name in binary mode. That carries identical identifying signal to ``tool.name`` (the slug used by `/score/<slug>` URLs and badge embeds); anything richer was information leakage with no compensating consumer use. ``command`` mode is unchanged (always `null`). No `schema_version` bump — `target.path` stays `string | null`, always-present-null contract holds, no key changes. The `schema_version` field exists to signal *shape* changes for consumer feature-detection; this is a value-content fix on an existing key. ## Changelog ### Fixed - `target.path` in `anc check --output json` now emits the basename of the resolved target instead of the canonicalized absolute path, eliminating a home-directory / username PII leak that flowed into committed scorecards, badge URLs, and agent-posted artifacts. Project mode emits the directory name (e.g. `\"agentnative-cli\"`); binary mode emits the file name (e.g. `\"anc\"`); command mode unchanged at `null`. No schema bump — value semantics changed, schema shape did not. ## Type of Change - [x] `fix`: Bug fix (non-breaking change which fixes an issue) ## Related Issues/Stories - Story: surfaced during 2026-04-30 dogfood review when the saved scorecard JSON in `.context/dogfood/` was inspected and the absolute home-dir path stood out as obvious PII leakage. - Issue: n/a — caught by inspection, not filed. - Architecture: `src/main.rs::build_target_info` is the single derivation site for `TargetInfo`; doc-comment now names the leak-vector rationale so future readers understand why basename is non-negotiable. - Related PRs: rides the next release wave alongside #37 (release backport script) and #38 (source-quality fixes), all merged into ``dev``. ## Testing - [x] Unit tests added/updated - [x] Integration tests added/updated - [x] All tests passing **Test Summary:** - Unit tests: 535 passing (no count change — the basename helper is an internal refactor, integration tests carry the new assertions). - Integration tests: ``tests/scorecard_schema_v05.rs`` — project-mode test now pins ``parsed[\"target\"][\"path\"] == \"perfect-rust\"`` (was: just ``is_string()``); binary-mode test pins ``\"test.sh\"``; new test ``schema_v05_target_path_carries_no_separators`` rejects any forward or back slash in the value (regression guard against richer path representations creeping back in). 51 tests in this suite (was 50). - Manual / dogfood: ``cargo build --release`` green; ``anc check . --output json | jq .target.path`` returns ``\"agentnative-cli\"`` (was: ``/home/brett/dev/agentnative-cli``); binary mode returns ``\"anc\"`` (was: full path); command mode returns ``null`` (unchanged). ## Files Modified **Modified:** - ``src/main.rs`` — ``build_target_info`` now uses new ``basename_string()`` helper. Doc-comment expanded with PII-leak rationale. - ``src/scorecard/mod.rs`` — ``TargetInfo`` doc-comment specifies basename semantics + leak rationale. - ``tests/scorecard_schema_v05.rs`` — tightened project + binary mode assertions to pin literal basename values; added ``schema_v05_target_path_carries_no_separators`` regression guard. - ``CLAUDE.md`` — scorecard 0.4 ``target`` bullet updated with leak rationale + pointer to the regression-guard test. **Created:** - None. **Renamed:** - None. **Deleted:** - None. ## Breaking Changes - [x] No breaking changes The schema's contract (key presence, type) is unchanged — only the value-content shape changes. Any consumer relying on absolute-path semantics was already fragile across hosts (CI's ``/runner/work/...`` vs dev's ``/home/<user>/...``); ``tool.name`` is the right field for cross-host correlation and is unaffected. ## Deployment Notes - [x] No special deployment steps required Existing scorecards committed under ``agentnative-site/scorecards/`` retain their old absolute-path values until re-scored; the next ``anc check`` run on each tool emits the basename. Site renderers that read ``target.path`` for display will show shorter strings going forward — no consumer feature-detection needed. ## Checklist - [x] Code follows project conventions and style guidelines - [x] Commit messages follow Conventional Commits - [x] Self-review of code completed - [x] Tests added/updated and passing - [x] No new warnings or errors introduced - [x] Changes are backward compatible

…e templates (#40) Refresh `README.md` to match the post-v0.2.0 surface and add the `anc.dev` agent-native badge at the top (local TODO 019). Trim `.github/ISSUE_TEMPLATE/` to cli-scope per `CONTRIBUTING.md` routing and add a blank-issue fallback that sorts first in the chooser. `anc` scores 97% against its own spec; the badge now displays the score on the canonical README. - README refreshed for current state: schema 0.5 with `badge` block, `--audit-profile <CATEGORY>` documented under CLI Reference, `target.path` documented as basename-only (PII-safe), refreshed Example Output to match the live 33-check dogfood and the post-summary badge embed hint. - Add the `[![agent-native](https://anc.dev/badge/anc.svg)](https://anc.dev/score/anc)` badge plus crates.io and license shields at the top of `README.md`. - Trim `.github/ISSUE_TEMPLATE/` to `false-positive`, `feature-request`, `scoring-bug`, plus a new `00-blank.yml` that lets a Blank issue option sit first in the chooser ahead of the structured forms. Spec-side templates (`pressure-test`, `grade-a-cli`, `spec-question`) were duplicates of the spec repo's set from before the rename — they belong on `brettdavies/agentnative` only, and `config.yml` already redirects there. - [x] `docs`: Documentation update - [x] `chore`: Maintenance tasks (dependencies, config, etc.) - Story: n/a - Issue: n/a (resolves local TODO `.context/compound-engineering/todos/019-completed-p0-add-anc-badge-to-readme.md`) - Architecture: n/a - Related PRs: builds on #39 (basename `target.path`) and #36 (badge embed in scorecard 0.5) - [x] Manual testing completed - [x] All tests passing **Test Summary:** - Pre-push hook ran: fmt, clippy `-Dwarnings`, 445 unit + integration tests, cargo-deny, Windows libc grep + cross-target clippy — all green. - `cargo run -- check .` confirms the live 33-check dogfood reported in the README's Example Output. - `curl -sSI https://anc.dev/badge/anc.svg` and `https://anc.dev/score/anc` both `HTTP/2 200`, so the embedded badge resolves before merge. - All four remaining issue templates parse as YAML. **Modified:** - `README.md` — badge row, schema 0.5 / badge block, basename `target.path`, `--audit-profile` flag, refreshed Example Output, Contributing block fix. **Created:** - `.github/ISSUE_TEMPLATE/00-blank.yml` — blank-issue template that sorts first in the chooser. **Renamed:** - None. **Deleted:** - `.github/ISSUE_TEMPLATE/grade-a-cli.yml` — moved to spec repo only. - `.github/ISSUE_TEMPLATE/pressure-test.yml` — moved to spec repo only. - `.github/ISSUE_TEMPLATE/spec-question.yml` — moved to spec repo only. - The README's badge auto-updates from the SVG endpoint; no further maintenance once embedded. - Structured templates now match `CONTRIBUTING.md`'s cross-repo routing table — no more spec-side issues filed on the cli repo by accident. - Closes the credibility gap visible to anyone arriving from `anc.dev` or a Show HN reader checking the canonical implementation. - Reduces template-vocabulary drift between the cli repo and the spec repo (the duplicated templates were byte-identical at branch time, but would have drifted on the next spec-side edit). - [x] No breaking changes - [x] No special deployment steps required - [x] Code follows project conventions and style guidelines - [x] Commit messages follow [Conventional Commits](https://www.conventionalcommits.org/) - [x] Self-review of code completed - [x] Tests added/updated and passing - [x] No new warnings or errors introduced - [x] Changes are backward compatible (or breaking changes documented)

## Summary Add `scripts/SYNCS.md` as the single navigable map of every inbound and outbound data edge between this repo and its siblings (`agentnative-spec`, `agentnative-site`, `homebrew-tap`, `crates.io`). Operators currently have to read four script headers + three prose docs (`RELEASES.md`, `CLAUDE.md`, `AGENTS.md`) and assemble the picture in their head; this file makes the system legible at a glance. ## Changelog ### Documentation - Add `scripts/SYNCS.md` — cross-repo sync map covering every spec/skill/coverage/release data flow with mechanism, payload, trigger, and drift check per edge. Includes a flowchart of inbound/outbound edges, a release-pipeline sequence diagram, and a cadence summary table reducing the system to "automatic vs manual" per sync point. ## Type of Change - [x] `docs`: Documentation update ## Related Issues/Stories - Story: n/a - Issue: n/a - Architecture: anchors back on `docs/solutions/architecture-patterns/cross-repo-artifact-sync-commit-over-fetch-20260420.md` (the "commit-over-fetch" decision) and `docs/solutions/best-practices/cross-repo-artifact-consumption-static-sites-2026-04-21.md` (the consumer-side pattern). - Related PRs: none. Complements (not blocked by) #40. ## Testing - [x] Manual testing completed - [x] All tests passing **Test Summary:** - Pre-push hook ran: fmt, clippy `-Dwarnings`, full test suite, cargo-deny, Windows libc grep + cross-target clippy — all green. - `markdownlint-cli2` fired via the auto-format hook on every save — no warnings. - Verified Mermaid blocks parse with the GitHub renderer (flowchart + sequence diagram). - Cross-checked every sync edge against the actual scripts (`scripts/sync-spec.sh`, `scripts/sync-skill-fixture.sh`, `scripts/sync-dev-after-release.sh`) and against `.github/workflows/release.yml` / `finalize-release.yml` / `skill-fixture-drift.yml` so the document matches the wired-up automation. ## Files Modified **Modified:** - None. **Created:** - `scripts/SYNCS.md` — 151 lines, cross-repo sync map. **Renamed:** - None. **Deleted:** - None. ## Key Features - One page that names every sync edge: spec → cli (`sync-spec.sh`), site → cli (`sync-skill-fixture.sh`), main → dev (`sync-dev-after-release.sh`), cli → site (coverage matrix + scorecards), cli → homebrew-tap (formula + bottles), cli → crates.io, and the inverse `finalize-release` dispatch. - For every edge: mechanism, payload, trigger/cadence, and drift check. - Two clustering events that drive the system — "new spec tag upstream" and "new anc release downstream" — each spelled out as a manual + automatic step list. - A "what's automatic vs manual" cadence summary so an operator can see at a glance which edges still need a human in the loop. ## Benefits - Operators stop reverse-engineering the sync graph from script headers when prepping a release. - Drift checks are explicit per edge, so adding a new sync surface comes with a paired drift question instead of a quiet skip. - Documents the "commit-over-fetch" pattern in a navigable form so future cross-repo consumers find the precedent before reinventing it. ## Breaking Changes - [x] No breaking changes ## Deployment Notes - [x] No special deployment steps required ## Checklist - [x] Code follows project conventions and style guidelines - [x] Commit messages follow [Conventional Commits](https://www.conventionalcommits.org/) - [x] Self-review of code completed - [x] Tests added/updated and passing - [x] No new warnings or errors introduced - [x] Changes are backward compatible (or breaking changes documented)

## Summary Picks up two upstream changes from `agentnative-site/dev` (`3a7b9b9`) discovered when `skill-fixture-drift` CI started failing on every open PR: - Removed `source.commit` SHA pin - Removed entire `verify` block (the pinned-SHA freshness probe) Both indicate an upstream design shift away from pinned-SHA verification to floating-tip skill installs. The Rust host map regenerates automatically on the next `cargo build` via `build.rs::emit_skill_hosts` — no hand-edits to `src/skill_install.rs` required. Required for the v0.3.0 release ship: the `skill-fixture-drift` CI workflow blocks every PR until this lands. ## Changelog  ## Type of Change - [x] `chore`: Maintenance tasks (dependencies, config, etc.) ## Related Issues/Stories - Story: `skill-fixture-drift` CI workflow surfaced upstream drift mid-session while preparing the v0.3.0 release. Without this sync, every PR is blocked from merging. - Issue: n/a — caught by CI, not filed. - Architecture: `src/skill_install/skill.json` is build-time codegen input (`build.rs::emit_skill_hosts`); `scripts/sync-skill-fixture.sh` is the canonical entry point referenced by `RELEASES.md`. - Related PRs: blocks PR #42 (URL fix); both must land before the v0.3.0 release branch can ship. ## Testing - [ ] Unit tests added/updated - [ ] Integration tests added/updated - [x] Manual testing completed - [x] All tests passing **Test Summary:** - Unit tests: n/a — fixture-only change. The Rust map regenerates at build time. - Integration tests: n/a — same. Pre-push hook green (fmt, clippy `-Dwarnings`, full test suite, cargo-deny, Windows compat). - Coverage: n/a. Manual: `bash scripts/sync-skill-fixture.sh --check` exits 0 against upstream `dev` HEAD `3a7b9b9` after this commit. ## Files Modified **Modified:** - `src/skill_install/skill.json` — dropped `source.commit` SHA pin and the entire `verify` block, mirroring upstream. **Created:** - None. **Renamed:** - None. **Deleted:** - None. ## Breaking Changes - [x] No breaking changes The Rust host map (`SkillHost` enum, `KNOWN_HOSTS`, `resolve_host`, `host_envelope_str`) regenerates from this JSON unchanged — six hosts, same install commands, same envelope shape. ## Deployment Notes - [x] No special deployment steps required ## Checklist - [x] Code follows project conventions and style guidelines - [x] Commit messages follow [Conventional Commits](https://www.conventionalcommits.org/) - [x] Self-review of code completed - [x] Tests added/updated and passing - [x] No new warnings or errors introduced - [x] Changes are backward compatible (or breaking changes documented)

## Summary Three classes of broken URLs across `.github/ISSUE_TEMPLATE/` introduced by the v0.1.1 squash never reached `main` correctly. Discovered while preparing the v0.3.0 release: dev's pre-this-PR state (and main) had typo'd URLs that 404 contact-link clicks and route agent gh-search guidance at the wrong repo. Companion direct-push commit `70fc42c revert(issue-templates): restore broken URLs on dev to match main` brought dev's state in sync with main so this PR can apply the correction through the canonical PR-to-dev flow. Three corrections applied: - Spec repo: `agentnative-cli` → `agentnative` - Site repo: `agentnative-cli-site` → `agentnative-site` - Double-`cli` typo: `agentnative-cli-cli` → `agentnative-cli` ## Changelog ### Fixed - Corrected cross-repo URLs in `.github/ISSUE_TEMPLATE/` so contact links and agent-filing instructions point at the right repos. Spec repo references switched from `agentnative-cli` to `agentnative`; site repo references switched from `agentnative-cli-site` to `agentnative-site`; the `agentnative-cli-cli` double-suffix typo in agent gh-search guidance was corrected to `agentnative-cli`. Affects `config.yml`, `false-positive.yml`, `feature-request.yml`, `scoring-bug.yml`. ## Type of Change - [x] `fix`: Bug fix (non-breaking change which fixes an issue) ## Related Issues/Stories - Story: discovered during v0.3.0 release prep when triple-diff between main, dev, and the release branch surfaced URL drift in 4 issue templates that wasn't reachable through any prior commit on dev (only via the v0.1.1 squash on main). - Issue: n/a — caught by inspection during release ceremony. - Architecture: n/a — string-only URL corrections in form metadata. - Related PRs: companion direct-push `70fc42c revert(issue-templates): restore broken URLs on dev to match main` (on dev, no PR — explicit prep step). The v0.3.0 release will cherry-pick this PR's merge commit so the changelog references it via `(#NN)`. ## Testing - [ ] Unit tests added/updated - [ ] Integration tests added/updated - [x] Manual testing completed - [x] All tests passing **Test Summary:** - Unit tests: n/a — issue-template YAML changes only, no code paths - Integration tests: n/a — same - Coverage: n/a — same. Pre-push hook green (fmt, clippy `-Dwarnings`, full test suite, cargo-deny, Windows compat). All four templates parse as YAML. The three corrected URLs each resolve `HTTP/2 200` against the live GitHub repos. ## Files Modified **Modified:** - `.github/ISSUE_TEMPLATE/config.yml` — `contact_links` URLs. - `.github/ISSUE_TEMPLATE/false-positive.yml` — agent filing instructions. - `.github/ISSUE_TEMPLATE/feature-request.yml` — agent filing instructions. - `.github/ISSUE_TEMPLATE/scoring-bug.yml` — agent filing instructions. **Created:** - None. **Renamed:** - None. **Deleted:** - None. ## Breaking Changes - [x] No breaking changes ## Deployment Notes - [x] No special deployment steps required ## Checklist - [x] Code follows project conventions and style guidelines - [x] Commit messages follow [Conventional Commits](https://www.conventionalcommits.org/) - [x] Self-review of code completed - [x] Tests added/updated and passing - [x] No new warnings or errors introduced - [x] Changes are backward compatible (or breaking changes documented)

…ion (#45) ## Summary Hardens the release-prep flow against missed cherry-picks by replacing a single-direction `git diff origin/main --stat` (which only catches docs leaking IN) with a proper triple-diff plus a patch-id-aware `git cherry` check (which catches commits that should ship but were missed). The new step 4 runs three diffs (A: main→release, B: release→dev, C: dev→main), re-confirms no guarded paths leaked, and finally runs `git cherry HEAD origin/dev | grep '^+'` to surface any commits on `dev` that have no patch-id equivalent on the release branch — a class the file-level diff in B misses when the same content happens to land via a different commit. Discovered during v0.3.0 prep: the triple-diff caught 4 `.github/ISSUE_TEMPLATE/*.yml` files that had drifted on `main` since the v0.1.1 squash but were correct on `dev` — they would have shipped broken otherwise. Sibling repos in this family have hit the same class of miss before; codifying the check here so it doesn't depend on operator memory. ## Changelog  ## Type of Change - [x] `docs`: Documentation update ## Related Issues/Stories - Story: discovered during v0.3.0 release prep when an ad-hoc triple-diff surfaced 4-file URL drift on `.github/ISSUE_TEMPLATE/` that the prior single-direction check would have missed entirely. The `git cherry` augmentation was added after a follow-up review surfaced the patch-id blind spot in pure file-level diffs. - Issue: n/a — caught during release ceremony. - Architecture: `RELEASES.md` § "Releasing dev to main" step 4 — operator-facing flow, not runtime behavior. Same edit applied to all sibling brettdavies repos with a `RELEASES.md` (agentnative-skill, xurl-rs, bird, agentnative-spec, agentnative-site, agent-skills/agentnative, agent-skills/github-repo-setup) — those land via separate per-repo PRs. - Related PRs: this release (v0.3.0) cherry-picks this PR after merge so the new convention ships in the same release that exposed the gap. ## Testing - [ ] Unit tests added/updated - [ ] Integration tests added/updated - [x] Manual testing completed - [x] All tests passing **Test Summary:** - Unit tests: n/a — operator-facing markdown only - Integration tests: n/a - Coverage: n/a. Manual: every diff command in the new step was run live during v0.3.0 release prep and produced the documented outcomes (A: 54 files / 4948 insertions; B: empty pre-bump, then `CHANGELOG.md` + `Cargo.toml` + `Cargo.lock` + `completions/` post-bump; C: cherry-pick-SHA phantoms only). The `git cherry HEAD origin/dev | grep '^+'` invocation was tested locally against the v0.3.0 release branch; output is the expected docs/plans commits (intentional skips), confirming the check distinguishes "missed cherry-pick" from "intentionally not picked" through operator review of each '+' line. ## Files Modified **Modified:** - `RELEASES.md` — step 4 replaced with the triple-diff verification block; `git cherry` patch-id check added below the guarded-paths recheck. **Created:** - None. **Renamed:** - None. **Deleted:** - None. ## Breaking Changes - [x] No breaking changes Operator process change. The pre-existing single-direction check is subsumed by the new triple-diff; anyone following the old flow still catches what they used to catch — just more. ## Deployment Notes - [x] No special deployment steps required ## Checklist - [x] Code follows project conventions and style guidelines - [x] Commit messages follow [Conventional Commits](https://www.conventionalcommits.org/) - [x] Self-review of code completed - [x] Tests added/updated and passing - [x] No new warnings or errors introduced - [x] Changes are backward compatible (or breaking changes documented)

) ## Summary The `git cherry HEAD origin/dev` check added in #45 is noisier than its comment implied. In a squash-merge workflow, every historical commit ever consolidated into a release squash shows as `+` forever — the squash commit's patch-id never matches the individual dev commits it absorbed. During v0.3.0 release prep this check produced **55 `+` lines**. All audited; zero real misses. Sources: - **Historical squash patch-id mismatch** — pre-v0.2.0 commits squashed into prior release tags - **Conflict-resolution drift** — e.g. `#35`'s cherry-pick stripped `docs/plans` files; same intent, different patch-id - **Intentional skips** — docs-only commits, the `abf1c6a` v0.2.0 backport, the `70fc42c` URL-revert prep step This PR expands the comment to (a) name the three expected noise sources, (b) define what a real miss actually looks like, and (c) give the two-command triage recipe (`git show --stat <sha>` then `git diff origin/main..HEAD -- <those-files>`). The check is now correctly framed as "review me, don't autoblock." Same edit applied to all 7 sibling brettdavies repos with `RELEASES.md` (working-tree only, no commits) — those land via separate per-repo PRs. ## Changelog ### Documentation - `RELEASES.md` § "Releasing dev to main" step 4 — expanded the `git cherry` patch-id check comment with squash-merge triage guidance (three expected noise sources, what a real miss looks like, and a two-command triage recipe). Discovered during v0.3.0 prep when the check produced 55 noisy `+` lines that all turned out to be expected; the original comment didn't explain that this is normal in a squash-merge workflow. ## Type of Change - [x] `docs`: Documentation update ## Related Issues/Stories - Story: discovered immediately after merging #45 — the new `git cherry` step produced 55 `+` lines on the v0.3.0 release branch, all of which audited as expected (squash-merge patch-id mismatch, conflict-resolution drift, intentional skips). The original comment didn't make this clear, so a future operator could read the output as a release-blocker when it isn't. - Issue: n/a — caught during release ceremony. - Architecture: `RELEASES.md` § "Releasing dev to main" step 4 — operator-facing flow, not runtime behavior. - Related PRs: builds on #45 (which introduced the `git cherry` check). This release (v0.3.0) cherry-picks this PR after merge so both the check and its triage guidance ship together. ## Testing - [ ] Unit tests added/updated - [ ] Integration tests added/updated - [x] Manual testing completed - [x] All tests passing **Test Summary:** - Unit tests: n/a — operator-facing markdown only - Integration tests: n/a - Coverage: n/a. Manual: ran `git cherry HEAD origin/dev | grep '^+'` against the v0.3.0 release branch live; output produced exactly the noise classes described in the new comment (historical squash + conflict-resolution + intentional skips). The triage recipe (`git show --stat <sha>` + `git diff origin/main..HEAD -- <files>`) was used to validate every flagged line; zero real misses. ## Files Modified **Modified:** - `RELEASES.md` — `git cherry` patch-id check comment expanded with squash-merge triage guidance. **Created:** - None. **Renamed:** - None. **Deleted:** - None. ## Breaking Changes - [x] No breaking changes Pure comment-prose expansion; the command is unchanged. ## Deployment Notes - [x] No special deployment steps required ## Checklist - [x] Code follows project conventions and style guidelines - [x] Commit messages follow [Conventional Commits](https://www.conventionalcommits.org/) - [x] Self-review of code completed - [x] Tests added/updated and passing - [x] No new warnings or errors introduced - [x] Changes are backward compatible (or breaking changes documented)

## Summary Removes per-build Git SHA capture from `build.rs` and the corresponding `anc.commit` field from the scorecard JSON. The version pin in `anc.version` is sufficient build identity for scorecard consumers, and the `cargo:rerun-if-changed` watches on `.git/HEAD`, `.git/refs/heads/<branch>`, `.git/packed-refs` made cached-build SHAs fragile across local commits without solving the underlying staleness problem cleanly. **Schema impact**: `anc.commit` was added in scorecard 0.4 (v0.2.0). Schema 0.5 (the `badge` block, on dev now) has not yet tagged to `main` — the v0.3.0 tag will ship 0.5 without `anc.commit` baked in. No public consumer of the field exists pre-launch. Net change: 6 files, +19/-101 lines. Code path simpler; one less moving part in the build. ## Changelog ### Changed - `--output json` scorecard `anc` block no longer includes a `commit` field. `anc.version` (the crate version pin) remains as the build identity. Removed because the per-build Git SHA capture made cached builds fragile (stale SHAs across local commits) without solving any consumer-facing problem — `anc.version` already identifies the released binary unambiguously, and pre-launch no public consumer of `anc.commit` exists. ## Type of Change - [x] `chore`: Maintenance tasks (dependencies, config, etc.) ## Related Issues/Stories - Story: removed during v0.3.0 release prep — the SHA capture was added in 0.4 but the value was never consumed downstream (site doesn't archive per-run, leaderboard pins `tool.version` not `anc.commit`), and the `.git/`-watching `cargo:rerun-if-changed` directives made cached `cargo build` outputs embed stale SHAs unless the operator did a full rebuild after every commit. The version pin is enough. - Issue: n/a — pre-launch cleanup. - Architecture: `build.rs::emit_build_info` simplified (drops the git rev-parse branch, the three `cargo:rerun-if-changed` watches, and the `std::process::Command` import). `src/scorecard/mod.rs::AncInfo` now has just the `version` field. CLAUDE.md `## Scorecard v0.5 Fields` updated to document the removal. - Related PRs: rides the v0.3.0 release alongside #45 (triple-diff RELEASES.md edit) and #46 (cherry-triage guidance) — all merged to `dev`, all cherry-picked into `release/v0.3.0`. ## Testing - [ ] Unit tests added/updated - [ ] Integration tests added/updated - [x] Manual testing completed - [x] All tests passing **Test Summary:** - Unit tests: 535+ passing — `cargo test --quiet` green across all 80 test binaries. - Integration tests: 51 passing in `tests/integration.rs`; 10/11 (1 ignored) in `tests/skill_install.rs`; 51 schema-drift tests in `tests/scorecard_schema_v05.rs` (one less than before — `anc.commit` removed from the key-existence assertion list); 6 in `tests/scorecard_metadata_security.rs`. - Coverage: `cargo clippy --all-targets -- -Dwarnings` green; `cargo test` green. - Removed tests: `anc_commit_when_present_looks_like_short_sha` (no longer applicable — `ANC_COMMIT` doesn't exist). ## Files Modified **Modified:** - `build.rs` — `emit_build_info` simplified to write only `ANC_VERSION`. Drops the git `rev-parse --short HEAD` branch, three `cargo:rerun-if-changed` directives on `.git/`, and the `std::process::Command` import (now unused). - `src/build_info.rs` — module doc updated; dropped the `anc_commit_when_present_looks_like_short_sha` test. - `src/main.rs` — drops `ANC_COMMIT` import and the `commit: ANC_COMMIT` initializer in the `AncInfo` literal. - `src/scorecard/mod.rs` — `AncInfo` shrinks to just `version: &'static str`. Test fixtures and the `schema_v05_emits_every_documented_key` assertion list drop `anc.commit`. - `tests/scorecard_schema_v05.rs` — same drop from this binary's key list. - `CLAUDE.md` — `## Scorecard v0.5 Fields` `anc` bullet rewritten to describe the simpler shape and reference the removal rationale. **Created:** - None. **Renamed:** - None. **Deleted:** - None (no files removed; only fields/code/tests/doc lines). ## Breaking Changes - [x] No breaking changes `anc.commit` shipped first in scorecard 0.4 (v0.2.0). Schema 0.5 (with `badge`) is on `dev` but has not been tagged to `main` — the v0.3.0 tag will ship 0.5 without `anc.commit`. There is no public consumer of the field today (the `agentnative-site` registry doesn't reference it; the site's leaderboard pins `tool.version`). Pre-launch field removal is within the documented `0.x` flexibility. ## Deployment Notes - [x] No special deployment steps required ## Checklist - [x] Code follows project conventions and style guidelines - [x] Commit messages follow [Conventional Commits](https://www.conventionalcommits.org/) - [x] Self-review of code completed - [x] Tests added/updated and passing - [x] No new warnings or errors introduced - [x] Changes are backward compatible (or breaking changes documented)

brettdavies added 13 commits May 1, 2026 03:06

brettdavies force-pushed the release/v0.3.0 branch from 506c2b9 to 69ad6b0 Compare May 1, 2026 08:53

brettdavies force-pushed the release/v0.3.0 branch from 69ad6b0 to 0508474 Compare May 1, 2026 09:12

brettdavies added 4 commits May 1, 2026 04:21

chore: bump version to 0.3.0

86bff2b

chore: regenerate shell completions

5a691e0

docs: update CHANGELOG.md for v0.3.0

5858f52

brettdavies force-pushed the release/v0.3.0 branch from 0508474 to 5858f52 Compare May 1, 2026 09:22

brettdavies merged commit 8789d09 into main May 1, 2026
10 checks passed

brettdavies deleted the release/v0.3.0 branch May 1, 2026 09:25

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

release: v0.3.0 - #44

release: v0.3.0#44
brettdavies merged 18 commits into
mainfrom
release/v0.3.0

brettdavies commented May 1, 2026 •

edited

Loading

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Conversation

brettdavies commented May 1, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

Changelog

Added

Changed

Fixed

Documentation

Type of Change

Related Issues/Stories

Testing

Files Modified

Breaking Changes

Deployment Notes

Checklist

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

brettdavies commented May 1, 2026 •

edited

Loading