Changelog

All notable changes to this project will be documented in this file.

[1.93.0] - 2026-07-29

✨ A shared substance-voice gate gives the launch skills a product-led, anti-hype voice. The launch skills carried scattered copy guidance that only encouraged substance, and a theme’s voice.tone: bold|playful could drift into hype. A new skills/_shared/substance-voice.md becomes the governing voice for both launch-release and launch-feature — product-led, respectful of the reader, anchored on the Ogilvy / Basecamp / Stripe axis with the direct-response / “lançamento” school as an explicit anti-reference. It forces substance instead of suggesting it: evidence is default-required (no metric → describe the concrete behavior; never fabricate a number), superlative/hype and FOMO/urgency vocabulary (EN + PT) are cut, the CTA is single and non-urgent, and tone is calibrated (bold needs evidence, playful is opt-in). A companion skills/_shared/substance-lint.sh scans generated copy for hype/FOMO terms and reports file:line — advisory by default, --strict for a CI gate in any argument position. launch-release flips its feature/benefit/evidence model to evidence-required and gains a pre-publish self-check; launch-feature’s voice.md folds its Tone/Vocabulary into the shared fragment. 🧪 test_substance_lint.sh locks the lint behavior (EN + PT, advisory/strict) and the wiring. (#219)

[1.92.2] - 2026-07-28

⚡ commit joins pr-open on the sonnet tier. Following v1.92.1, commands/commit.md now declares model: sonnet — suggesting a Conventional Commits message from the staged diff is the same light diff→text authoring, so it runs off the session’s Opus-class model. Same mechanism (the delivery transform passes the frontmatter field through; Claude Code honours it after the next octopus setup/update), and the tier assertion in test_workflow_commands.sh now loops over both authoring commands. This completes the safe authoring-family subset — pr-comments (writes code) and respond-to-review (judgement) stay on the session model. (#218)

[1.92.1] - 2026-07-28

⚡ pr-open runs on the sonnet tier. Writing a PR title and body over a diff is light, mechanical work that does not need the session’s Opus-class model, so commands/pr-open.md now declares model: sonnet. Claude Code honours a model: field on a slash command’s frontmatter, and the command-delivery transform (_deliver_cmd_file) strips only name:/cli:, so the tier flows through to .claude/commands/octopus:pr-open.md unchanged and takes effect after the next octopus setup/update (Copilot prompt-file / CLI-agent deliveries drop the field by design). This extends the RM-130 model tiering from dispatched skills to the interactive authoring command — commit is a natural follow-up, while pr-comments (writes code) and respond-to-review (judgement) deliberately stay on the session model. 🧪 test_workflow_commands.sh asserts the delivered command keeps the tier, guarding against a dropped field or a future whitelist rewrite of the strip transform. (#217)

[1.92.0] - 2026-07-27

✨ launch-feature gains email (HTML) and WhatsApp announcement channels. The skill already turned a shipped feature into a multi-channel launch kit, but its email was a markdown skeleton and it had no WhatsApp — so announcing a feature to an existing contact list with copywriter-grade email marketing meant borrowing pieces from launch-release (which is release/version-driven and themed). Rather than a third overlapping skill or merging the two, launch-feature — already feature-driven, with the copy craft and a --channels selector — is extended: a single brand-token HTML email (email.html, table-based with a CTA button, a hidden preheader, and a CAN-SPAM footer of unsubscribe + company address, links UTM-tagged) rendered from a new brand.yml, plus a short WhatsApp message. Copy follows a new embedded SaaS email framework (subject-line formulas, benefit-over-feature, “what changed / why it matters / what to do”) layered over the existing voice and the marketer role — run it scoped with --channels=email,whatsapp for a lifecycle announcement to your list. The old email-lancamento.md template is renamed to email.md, with the rename chased through the kit README, the feature doc, and the existing kit test. 🧪 A new test_launch_feature.sh locks the channels, and 📝 the public skill page (EN + pt-br) is corrected from a drifted, partly-phantom taxonomy to the real kit. (#216)

[1.91.0] - 2026-07-26

✨ A motion-promo skill turns a running app into a high-fidelity, scored promo video. It drives the real product headless against a demo environment, captures clean screens, and composites a motion-design cut over them — kinetic typography, cinematic push-ins, spotlight highlights that track the zoom, phone frames, rhythmic cuts, and a music bed — with HyperFrames + GSAP, emitting a 16:9 master and a 9:16 vertical cut. Because live navigation reads as amateur (and the browser screencast starves frames on static pages), the app is used only to produce stills and design tokens; all motion is authored and rendered deterministically to MP4. The skill is app-agnostic: everything project-specific lives in a target-repo promo.config.mjs + beats.json, it auto-extracts the target app’s design system (background, accent, fonts) so overlays match its brand, and it measures each spotlight box from a live element rect (a CSS selector per beat) so highlights are pixel-perfect with no hand-tuned coordinates. Authentication is a pluggable recipe — authInject() for token/cookie/multi-step apps, or authFlow(page) that drives an interactive SSO login (Azure AD/Entra, Okta) and snapshots the session including HttpOnly cookies. It needs no secrets (keyless render, public fonts and CC-BY music), self-provisions its dependencies, and ships in the growth bundle as the render counterpart to launch-feature’s video-roteiro.md. (#214) 📝 Curated documentation pages for the skill land on the site in English and pt-br (#215), and the roadmap records the RM-163/RM-164 Windows-installer follow-ups.

[1.90.2] - 2026-07-26

♻️ The Windows PowerShell installer stops embedding its shim (RM-019 parity). install.ps1 generated its bash-delegating shim inline via a here-string — the same drift risk RM-019 removed on the bash side, where install.sh copies bin/octopus from the release tree instead of embedding it; on Windows the embedded shim could only reach users through a full installer re-run. bin/octopus.ps1 and bin/octopus.cmd now ship as tracked files in the release tarball, and install.ps1 copies them exactly as install.sh’s install_shim does. Both delegate to the version-independent current link, so they need no per-version heal path; only a change to the delegation contract itself (bash discovery or path translation) requires re-running install.ps1, a limitation now documented in the shim. 🔧 .gitattributes pins the two Windows entrypoints to CRLF, and 🧪 test_install_ps1_invariants.sh gains coverage that the shims are shipped and copied (not embedded), delegate to current/bin/octopus, and keep the CRLF pin. (#213)

[1.90.1] - 2026-07-26

🐛 The Windows PowerShell installer (install.ps1) is repaired. It had frozen on the pre-release install mechanism — its only commit was the original #28 — while install.sh moved on to the signed release-asset contract, so irm … | iex broke on stock Windows. The immediate crash was a missing TLS 1.2: Windows PowerShell 5.1 still defaults SecurityProtocol to TLS 1.0/1.1, so the very first GitHub call failed with “Could not create SSL/TLS secure channel” — which is exactly why installing through WSL/curl (OpenSSL negotiates TLS 1.2) worked while PowerShell did not. Behind that crash the installer had drifted from the release mechanism wholesale: it fetched the bare git archive instead of the release asset — so the bundled fzf.exe that octopus setup needs was absent — and skipped SHA-256 + signature verification entirely. install.ps1 is now realigned with install.sh, the source of truth for the release contract: it forces TLS 1.2 before any web call, downloads and verifies the release asset (SHA-256 fail-closed, best-effort GPG), writes the real checksum, and heals marker-less caches left by the old installer; the WSL shim path translation is made Windows-PowerShell-5.1-safe. 🧪 A new test_install_ps1_invariants.sh locks these invariants (there is no pwsh/Windows in CI), and a cross-reference in install.sh keeps the two installers in lockstep. 📝 The doc-api Assess & Plan flow pages (EN + pt-br) and roadmap housekeeping trailing v1.90.0 also land. (#212, #211)

[1.90.0] - 2026-07-24

✨ doc-api’s --write becomes an interactive Assess & Plan flow (RM-162). The skill shipped in v1.89.0 with a binary --write: regenerate openapi.yaml and the integrator reference wholesale, behind one all-or-nothing gate. That left no middle ground between “tell me what drifted” and “rewrite everything” — a team whose hand-curated integrator reference drifted in three spots couldn’t patch just those spots without losing their prose, and bootstrapping docs for an undocumented API was stuck in an error branch. A new Assess stage now derives each artifact’s state (absent / stale / ok) from the four existing checks — no new signals — and runs in both modes. Under --write the write gate becomes a per-artifact, per-API-version plan where the maintainer picks correct (a minimal surgical patch that preserves hand-authored prose, ordering, and examples), recreate (a wholesale rebuild from the code contract), create (now a first-class action rather than an error branch when no spec exists), or skip — and only the chosen items are written. The breaking check stops being a bare report line and annotates the chosen action (🚫) with the specific change before it is applied, so nothing breaking is written silently; validate mode gains a read-only Improvement Plan preview of the same assessment. 🧪 test_doc_api.sh gains Test 9 locking the flow. (#210)

[1.89.0] - 2026-07-18

✨ A doc-api skill closes the integrator-facing contract gap (RM-161). audit-contracts answers the internal question — does this diff’s frontend agree with its backend — over a diff; nothing answered the external one: is the whole published API surface still faithful to its OpenAPI spec and the error catalog an integrator consumes. doc-api is that on-demand, full-surface check. In its default validate mode (read-only) it confronts the code against an existing OpenAPI spec and the repository’s own knowledge — ADRs, specs, CONTEXT.md, system maps — across four checks: openapi (code↔spec conformance), errors (error-catalog consistency), breaking (external breaking changes, 🚫, diffed per API version), and grounding (doc↔code business fidelity, reusing the audit-grounding source-of-truth protocol rather than reimplementing it). With --write it regenerates a canonical openapi.yaml and an integrator reference behind a confirmation gate that never touches application code and autodetects legacy doc layouts before defaulting. The skill detects the API’s versioning scheme (route-explicit /v1/, header, query, or unversioned) and scopes every check per version, understands .NET and Node stacks, and ships in the docs bundle — deliberately excluded from audit-all since it is full-surface, reasoning-tier, and can write. 📝 EN + pt-br documentation pages for the skill and command are published. (#208, #209)

[1.88.0] - 2026-06-29

✨ A council skill brings Karpathy’s LLM Council to Octopus. One high-stakes decision now runs through five ephemeral advisor lenses — Contrarian, First Principles, Expansionist, Outsider, Executor — that answer in parallel, peer-review each other’s anonymised responses (A–E, randomised so reviewers judge on merit rather than on which lens spoke), and get synthesised by a chairman into a single fixed-structure verdict: where the council agrees, where it clashes, the blind spots peer-review caught, the recommendation, and the one thing to do first. It fills a gap none of the existing skills covered — interview converges a fuzzy problem into scope, delegate dispatches work to persisted roles, and consigliere is grounded managerial memory; council diverges then converges to pressure-test a decision that’s already framed. The orchestration is reused, not reinvented: parallel fan-out via superpowers:dispatching-parallel-agents with the same sequential degradation as audit-all, and the anonymised context-threading from delegate for the review round. Advisors are ephemeral prompt-injected lenses, not roles/*.md; the skill is read-only and writes no files unless --transcript is requested. It ships in the workflow-extras bundle alongside delegate, with a thin command delegator, EN + pt-br doc pages for both skill and command, and a structural test_council.sh. (#207)

[1.87.2] - 2026-06-11

⚡ Cheap-class skills tiered off Opus (RM-130 phase 2). RM-130 moved the audit-* family to a cheaper model; the same gap remained across ten other skills whose LLM step is mechanical or narration but that declared no model:, so they ran on the session model. They now declare a tier honoured by skill_matcher.py (the daemon / octopus CLI path where cadence jobs run): knowledge-briefing, knowledge-synthesize, knowledge-hygiene, and code-metrics run on Haiku (deterministic core + thin narration — the first two say “--model haiku” outright); compress-skill, map-system, launch-release, scaffold-skill, continuous-learning, and definition-of-done run on Sonnet (light reasoning, but off Opus). debug/implement stay Opus-class for hands-on code work, and the zero-LLM skills are left alone. 🐛 The octopus release suggest-version heuristic is fixed on two fronts: emoji-prefixed squash subjects (✨ Title (#NN), no feat: prefix) are now read as features → minor, and the breaking-change check matches only a real BREAKING CHANGE: footer line instead of the phrase anywhere in prose — so a docs/refactor that merely mentions it no longer suggests a major bump. 🧪 New test_skill_tiering.sh and three test_release.sh regression cases lock both.

[1.87.1] - 2026-06-11

♻️ commit-conventions.md right-sized to commit-scoped content. The file is pulled on demand by every /octopus:commit, every implement TDD commit, and enforce-precommit — but ~half of its 142 lines weren’t about committing. Trimmed to 75 lines: dropped the orphaned Branch Naming section, cut three worked examples to one, and compacted the six-row per-assistant co-author matrix to the two lines that matter. The type table (with “when to use”), the BREAKING CHANGE: footer, references, and the co-author rule all stay — zero behaviour change, and the single canonical source is preserved (no inline duplication into commit.md). The per-commit context pull drops ~47% for all three consumers. Branch naming moves to its proper home — commands/branch-create.md, the command that names branches — now including the ticket-reference form (feat/PROJ-123-…); pr-workflow.md’s dangling link into the commit doc becomes an inline one-liner.

[1.87.0] - 2026-06-11

⚡ The review fan-out no longer pays Opus for every audit. codereview/pr-review dispatch up to ~6 sub-agents, and each ran on the session model — Opus, the single biggest cost multiplier in a review. Each audit-* skill now declares a model: tier in its SKILL.md frontmatter: the domain audits (security, money, tenant, contracts, all) run on Sonnet — capable enough to reason over money/tenant/contract logic — and the mechanical signal/config passes (grounding, verification, style, config, fleet) run on Haiku; none run on Opus. The tier is read by skill_matcher.py and honored by the dispatch (each audit is spawned as a sub-agent on its declared tier), while the adjudicating roles (architect, dba, security) stay on Opus where the judgement matters. This completes RM-130 (Cluster 23 token-cost optimization): the per-skill tiers were the missing piece — the dispatch wording shipped in v1.84-era #172 but pointed at a tier note that did not yet exist. 🐛 The opus model alias was also bumped from the stale claude-opus-4-7 to claude-opus-4-8 across both resolution maps (now the single enforcement chokepoint for tiering). 🧪 test_model_tiering.sh locks the policy and asserts the audit roster stays exhaustive; 📝 the roadmap marks Cluster 23 implemented.

[1.86.0] - 2026-06-09

✨ Octopus workflows now run from the GitHub Copilot CLI. RM-156 delivered the commands to Copilot as IDE prompt files (.github/prompts/*.prompt.md), but the Copilot CLI doesn’t read those (github/copilot-cli#618, #1113, #2829) — so a workflow like pr-open was unreachable from the terminal. A selected subset of terminal-driven commands — dev-flow, implement, debug, commit, branch-create, codereview, and the full PR loop through release — is now also rendered as Copilot custom agents (.github/agents/octopus-<name>.agent.md), invocable with copilot --agent=octopus-<name>. The set is deliberately selective (not all ~46 commands), the allowlist lives in the copilot manifest so the canonical commands/*.md stay untouched (other agents’ delivery is provably unaffected), and emission is gated on a new native_cli_agents capability per ADR-011 — a future agent enables it with one manifest line. Frontmatter is kept minimal (name + description) for cross-version robustness, and $ARGUMENTS is translated to prose since CLI agents have no ${input} token. 🧪 New test_cli_agent_commands locks the selection, the additive coexistence with IDE prompt files, and the Claude-isolation guarantee. (#202, RM-159)

🐛 octopus update no longer fails GPG verification on a clean machine. verify_signature() ran gpg --verify --no-auto-key-locate and only passed if the release public key was already in the user’s keyring — on a fresh box it isn’t, so the install/update aborted with GPG signature verification failed. The installer now self-bootstraps the key by its full fingerprint (OCTOPUS_RELEASE_FPR, fetched from OCTOPUS_GPG_KEYSERVER, default keys.openpgp.org) and verifies via --status-fd, requiring a VALIDSIG from the pinned primary key — so a foreign key in the user’s keyring can’t satisfy verification. If the key can’t be obtained (offline / unreachable keyserver) it warns and continues on checksum-only, unless OCTOPUS_REQUIRE_SIGNATURE=1 forces a hard fail; a tampered or wrongly-signed tarball always fails closed. 🧪 New auto-fetch-path tests (key-unavailable fallback, REQUIRE hard-fail, tampered-fail-closed) run without a live keyserver. (#201, RM-158)

[1.85.1] - 2026-06-09

🐛 octopus setup/update no longer aborts on a renamed or removed bundle. A .octopus.yml written by an older Octopus — e.g. listing knowledge-ops, renamed to knowledge back in v1.83.0 — made the upgrade die with error: knowledge-ops, because _load_bundle returned non-zero on a missing bundle file and setup.sh runs under set -e. Config from an earlier version could brick the very upgrade meant to fix it (and, as a knock-on, the aborted setup never regenerated agent configs — so newly-shipped surfaces like the Copilot prompt files silently failed to appear). Loading is now resilient: a shared rename alias map (knowledge-ops → knowledge; code-metrics/quality-audits/quality-signals/quality-metrics → quality) resolves known renames in both the delivery path and the interactive picker, and any other unknown bundle is warned-and-skipped rather than fatal. 🧪 New test_bundle_resilience plus an updated test_bundles lock the non-fatal contract, alias resolution, and picker parity.

[1.85.0] - 2026-06-09

✨ GitHub Copilot now gets the Octopus workflow commands. Copilot was configured with rules + MCP but never received /octopus:* — its manifest is native_commands: false, so the command files were skipped. A new capability-gated delivery path renders each commands/*.md as a Copilot prompt file under .github/prompts/octopus-<name>.prompt.md (frontmatter mode: agent, $ARGUMENTS→${input}), so an IDE (VS Code, Visual Studio, JetBrains) exposes /octopus-pr-open, /octopus-release, etc. The Copilot CLI keeps the existing octopus <name> text fallback (it has no prompt-file support yet — github/copilot-cli#618). Generated prompt files are git-ignored, like the other per-agent surfaces. Recorded as ADR-011 (delivery is gated on a manifest capability, never on the agent name). (#199, RM-156)

✨ octopus setup now lets you choose the agents. The interactive picker configured bundles, skills, hooks, commands, reviewers, and MCP — but not which assistants to set up, so enabling Copilot meant hand-editing .octopus.yml. The picker gained an agent-selection screen (fzf + bash fallback) sourced from agents/*/manifest.yml, defaulting to the agents already in your manifest; a new --agents <csv> flag covers the non-interactive path. 🧪 New coverage in test_setup_agents and test_prompt_file_commands. (#199, RM-157)

[1.84.5] - 2026-06-09

🐛 /octopus:pr-review now signs its aggregated report. The PR-posting surfaces were inconsistent — only /octopus:pr-open signed its output, while pr-review posted a substantial review report as a general PR comment with no attribution. The report now ends with the Octopus footer (--- + <sub>🐙 generated by Octopus</sub>) before it’s posted. Inline thread replies (/octopus:pr-comments, /octopus:respond-to-review) deliberately stay unsigned — a per-thread footer would clutter the conversation; only general comments and PR bodies are signed. 🧪 A new test_pr_signature.sh locks the distinction as a regression guard. (#198)

[1.84.4] - 2026-06-09

🐛 code-metrics no longer inflates magic_numbers on C#/.NET repos — a real .NET checkout reported ~39 000, almost all false positives. Two root causes, both fixed. First, pruning was shallow: machine-generated C# that lives in the source tree (EF Migrations/, *.Designer.cs, *.g.cs, *.generated.cs, AssemblyInfo.cs) was counted; it’s now excluded from every C# metric, not just this one. Second, the counter stripped comments and strings line-by-line, so any multiline construct leaked its digits — the heuristic is rewritten as a stateful, language-aware awk preprocessor that blanks block comments (/* */), C# verbatim (@"…") and raw ("""…""") strings, and TS template literals across line boundaries, then drops named-constant context: const/readonly/enum/#define and enum bodies for all stacks, plus attribute args and auto-property initializers for C# only (a leading [ stays an array literal in TypeScript). 🧪 Each false-positive scenario is locked by a regression test (suite at PASS=106), with guards keeping genuine literals — indexers and array elements — counted. (#197)

[1.84.3] - 2026-06-07

🔒 install.sh now verifies on the default GitHub path. SHA-256 + GPG verification (and OCTOPUS_REQUIRE_SIGNATURE) only ran when OCTOPUS_INSTALL_ENDPOINT was set — a plain install.sh --version vX from GitHub resolved no checksum/signature URL and skipped both silently, making OCTOPUS_REQUIRE_SIGNATURE=1 a no-op on the most common install path. Both URLs now fall back to the GitHub release asset (the .sha256/.tar.gz.asc the signing pipeline already publishes), and OCTOPUS_REQUIRE_SIGNATURE fails closed when no signature URL resolves. Verified against v1.84.2 (key present → valid; absent → fail-closed). See RM-155.

[1.84.2] - 2026-06-07

🔒 Release signing key rotated. The previous signing key’s passphrase was lost — it lived only in the CI secret (write-only, unrecoverable), leaving the key unrevocable by hand; automated signing kept working, but the maintainer could no longer operate it. Rotated to a fresh RSA-4096 key (63C35E66917CE4540CD27592C8BA059A0322F3CD, expires 2028, clean UID): new keypair, updated release secrets, public key published to keys.openpgp.org (email-verified). The code-metrics writer-Action pin (OCTOPUS_VERSION → v1.84.2, OCTOPUS_FPR → the new fingerprint) is bumped together so consumers verify the v1.84.2 tarball — the first release signed by the new key. The old key is retired, not revoked (its private half never leaked — it became inaccessible, not public). See RM-154.

[1.84.1] - 2026-06-06

🐛 The code-metrics writer-Action shipped in v1.84.0 pinned the Octopus CLI to v1.83.0’s commit — which has no --emit-baseline — so the generated baseline would have failed; the pin is corrected to v1.84.0. 🔒 A brief switch to the official installer was reverted after a security review: a version tag + mutable release assets is a weaker integrity anchor than a content-addressed commit SHA, so the writer keeps the SHA-pinned clone (now fail-closed on a non-SHA ref) until the release public key is published for real GPG verification. 📝 The public docs site gains a full per-metric reference table (EN + pt-br) — all 15 metrics with layer, direction, what each measures, per-stack tooling, and the optional .octopus.yml threshold key, plus heuristic caveats. Follow-ups recorded: RM-151 (perf_risk Allman-brace), RM-152 (publish release public key), RM-153 (setup stamps the writer pin at delivery).

[1.84.0] - 2026-06-06

✨ The code-metrics skill grows from four structural metrics into a full quality catalog. Eleven new deterministic metrics land across both C# and TypeScript: debt markers (TODO/FIXME, deprecations, marked dead code, linter/compiler suppressions), readability counters (nesting depth, average parameter count, magic numbers, lint density), documentation coverage, churn×complexity hotspots (a new git-history capability that pinpoints where decay concentrates), and an info-only static perf-risk proxy (queries/allocations inside loops, nested loops). ♻️ Under the hood the hardcoded per-metric dispatch was replaced by a data-driven registry (cm_metric_spec), so adding a metric is now one registry line plus one adapter function; the writer-Action stopped re-implementing metric logic in YAML and now produces baseline.json via octopus code-metrics --emit-baseline, eliminating drift. 🔒 That writer-Action is now pinned to an immutable Octopus CLI commit SHA — with a checkout integrity check — instead of a moving branch, closing a supply-chain vector in the contents:write CI job. All new metrics are ratchet-only by default and perf_risk never gates. (#191)

🐛 octopus setup now prunes stale skill symlinks when a manifest drops all of its skills, so a re-run no longer leaves orphaned links behind. (#190)

[1.83.0] - 2026-06-06

♻️ Bundle list slimmed (breaking). code-metrics is no longer a standalone bundle — it’s a member skill of quality (uncheck it in the picker if you don’t want it); the code-metrics skill, command, adapters, and writer-Action template are unchanged. The knowledge-ops bundle is renamed to knowledge (the skills keep their names). 🐛 octopus setup now prunes stale Octopus-owned command files on every run — a renamed or removed command (like the recent quality-metrics → code-metrics) no longer leaves an orphan octopus:*.md in your repo; user-authored, non-prefixed commands are untouched.

Migration: repos listing the code-metrics bundle → use quality; repos listing knowledge-ops → knowledge.

[1.82.0] - 2026-06-06

♻️ Quality bundle family cleaned up (breaking). The quality bundle is now scoped to the code-quality axis — exactly the union of audits + signals (security/money/tenant/contract gates + grounding/verification/style/config/refactor signals, with the architect and security roles). Knowledge-base operations moved to knowledge-ops and cross-repo audit/bootstrap to tech-lead. The quality-audits and quality-signals preset bundles are removed — quality is their union, and the two-screen setup picker fine-tunes members down (uncheck → exclude:). The measurement bundle quality-metrics is renamed to code-metrics (a different axis — numbers, not gates): the bundle, the /octopus:code-metrics command, the code_metrics: config key, and the octopus/code-metrics baseline ref all move together. 🐛 The C# code-metrics adapter no longer leaks the coverage runner’s stdout into the metric output.

Migration: repos listing quality-audits/quality-signals → use quality (uncheck unwanted members in the picker) or knowledge-ops/tech-lead; manifests or CI using quality-metrics / quality_metrics: / octopus/quality-metrics → switch to code-metrics.

[1.81.0] - 2026-06-05

⚡ The C# quality-metrics coverage metric is far faster and more meaningful. It now prefers dotnet-coverage (binary instrumentation) over coverlet’s XPlat collector, which can be pathologically slow on large, async-heavy suites — on a real .NET 8 repo a coverage run that never finished in 10 minutes now completes in ~40s, falling back to coverlet only when dotnet-coverage is absent. Two optional quality_metrics.coverage fields tune what is measured: test_filter appends a dotnet test --filter (e.g. Category!=Integration, to measure unit-only coverage and leave slow end-to-end tests as a separate CI gate), and settings points at a dotnet-coverage settings file to scope the report to production assemblies and exclude generated code such as EF migrations. Every find/lizard scan in the C# adapter now also prunes .claude/ agent worktrees and node_modules/, so a stale repo copy can neither skew the numbers nor be picked as the test project. 🔒 A security review hardened the new string config: coverage.test_filter is allowlisted against the dotnet test --filter grammar (mirroring the numeric gate), so an attacker-influenceable .octopus.yml cannot inject extra arguments into the command. 🐛 The octopus setup picker’s ESC-to-go-back no longer aborts setup under set -e (a return-code capture bug). ♻️ Stack and database choices are presented as atomic profiles rather than one-item bundles.

[1.80.1] - 2026-06-05

🐛 Fixes the octopus setup two-screen picker on two counts: the cursor now opens at the top of the list instead of the bottom, and ESC on the member screen steps back to the bundle screen (choices intact) instead of abandoning setup — Ctrl-C still cancels. 🐛 The C# quality-metrics adapter is corrected so complexity, module size, and coverage are no longer reported as zero: lizard runs with the csharp language id (not cs) and the averages are read from its table footer; coverage now prefers a test project (*.Tests.csproj) over the first .csproj on disk; and the project-reference cycle detector no longer records false self-edges. The same adapter fixes ship in the writer Action template.

[1.80.0] - 2026-06-05

✨ The interactive octopus setup picker is redesigned as a two-step flow, replacing the old flat wall-of-text list. First you pick bundles, grouped by category (Foundation / Intent / Stack / Database) so the choice reads at a glance, with each item’s full description in a side preview instead of crammed into the row. Then, if a chosen bundle carries skills/roles/rules, a second screen lists those members grouped per bundle, all checked by default — uncheck any to drop it (written to the manifest exclude:). ESC steps back from the member screen to the bundle screen with your choices intact, ENTER confirms, Ctrl-C cancels. The non-fzf terminal fallback offers the same two steps as numbered lists. 📝 The site’s manifest page documents the flow.

[1.79.1] - 2026-06-04

🐛 The interactive setup’s customize step (deselect individual members from your chosen bundles) gains two fixes. It now lists a stack/database profile’s rules alongside skills and roles, so a profile rule (e.g. the TypeScript ruleset) can be deselected too — the manifest exclude: and delivery already supported dropping a rule, only the picker hadn’t surfaced it. And the plain-terminal fallback (used when fzf isn’t installed) now offers the customize step at all — a numbered list where you enter the items to exclude — instead of skipping past it; granular deselection was previously fzf-only. 🧪 The member-deselect tests grew to cover rule inclusion, the fallback’s index→member mapping, and the rule’s end-to-end removal. 📝 The site’s manifest page documents both.

[1.79.0] - 2026-06-04

✨ This release adds quality-metrics — a new measurement axis for code quality, sibling to the audit (quality-audits) and signal (quality-signals) bundles. Where those reason about a diff semantically, this one reports numbers: how a change moves test coverage, cyclomatic complexity, module size, and dependency-graph cycles. The author runs /octopus:quality-metrics locally before opening a PR and gets a dual delta — one figure against the last-merged-to-main baseline (the long-term trend) and one against local main (this PR’s isolated impact). The numbers are always computed by the stack’s own tooling at essentially zero token cost; a low-cost model is invoked only when a metric crosses a threshold, to explain the regression and suggest a fix. Thresholds are ratchet-by-default — a metric may not regress against the baseline, so a legacy repo never starts “red” — with optional absolute targets layered per metric in .octopus.yml (resolved across the workspace → personal → project layers, the repo winning). The per-merge baseline lives on a dedicated, non-protected git ref written by an Action reacting to a push to main, so it stays fresh, conflict-free under squash-merge, and never pushes back to a protected branch. v1 ships C# and TypeScript adapters, selected by the existing stack detection; the bundle carries the orchestration skill plus the writer-Action template installed per repo. 🐛 A security review of the merge closed an awk code-injection where attacker-influenceable config and baseline values reached the metric arithmetic as program text — values are now validated numeric at the boundary and passed to awk as data, never code. 📝 The published site documents the bundle, skill, and command in English and pt-br.

[1.78.0] - 2026-06-04

⚡ This release roughly halves the per-session token cost and makes setup install only what each repo actually uses.

Token-cost optimization (⚡ ♻️): the always-loaded context dropped ~65% — the core coding guidelines were de-duplicated against rules/common, the heavy custom-exception gate and the commit/PR/task conventions now ship on-demand instead of inline, and the remaining common rules were compressed. The skill/role registry that loads every session was trimmed across ~40 descriptions. Review orchestrators (codereview/pr-review/audit-all) now route each audit only its domain files, skip empty audits, and run on the cheapest model tier, while over-broad auto-activation triggers were narrowed. A context-budget measurement harness with a CI ratchet locks the savings against regression.

✨ Stack-aware, granular setup: octopus setup now detects a repo’s language and database from its files and writes the matching profiles into .octopus.yml — a C# + SQL Server repo gets the C# rules and the SQL Server review skill, and nothing for Python, TypeScript, or the databases it doesn’t use. Intent bundles (backend/fullstack) are now stack-agnostic; per-engine database review ships as auto-selected db-* profiles. The quality bundle can be taken granularly via quality-audits, quality-signals, and knowledge-ops; map-system and delegate moved to an opt-in workflow-extras bundle. A new manifest exclude: key — and an opt-in customize step in the picker — lets you drop individual members from a bundle without abandoning it.

📝 Docs: the published site documents the two-axis bundle model (intent bundles vs stack/db profiles), the new bundles, the setup detection flags, and exclude:.

[1.77.1] - 2026-06-03

🐛 octopus update now propagates changes to the shim itself, not just the cached release. The shim (bin/octopus) is copied into ~/.local/bin, but command_update invoked the installer with --no-shim-setup, so a change to the shim — like the version command added in v1.77.0 — only reached users through a full reinstall, never through update; the shim could stay frozen across releases while the cache moved forward. Two complementary layers fix this: sync_shim in the shim refreshes the running binary from the target release via an atomic rename (safe to overwrite the executing script — the open inode survives until exit), making every future shim change self-propagating; and because old shims re-fetch install.sh fresh from main on every update, heal_stale_shim in the installer heals an already-installed stale shim on a forward-version move (never a downgrade or pinned-older backfill, never creating a stray shim), closing the gap for the installed base with no manual copy. 🧪 New regression tests lock both paths: test_shim_sync.sh (update refreshes a stale shim, second update is a no-op) and test_shim_heal.sh (forward heal, no-downgrade, no stray shim, no temp leak).

[1.77.0] - 2026-06-02

✨ The CLI-surface-hygiene cluster lands its conventional affordances, reference docs, and a real doctor. Building on the command registry (v1.76.0), octopus version / --version now prints the installed version (it used to error with “Unknown command”), octopus list emits the command names for scripting, octopus help <command> gives a one-line summary, and octopus completions [bash|zsh|fish] generates a shell-completion script — while each command keeps its own richer --help. 📝 A new bilingual CLI Reference page (EN + pt-br) documents the surface that was accepted but undocumented: the full setup flag set (--no-hooks, --no-workflow, --bundle, --stack, --reviewers), the release subcommands, and the OCTOPUS_* environment variables. ✨ octopus doctor grows from “print version + path” into a read-only health command surfacing the failure classes that actually bite: stale hook paths in settings.json, broken cache symlinks, and an available newer release. 🐛 Relatedly, octopus setup no longer leaves those stale hook paths behind: deliver_hooks deduplicated by hook id with a “skip if present” merge, so after an update the old version-pinned path stayed in settings.json (pointing at a deleted cache dir) while the refreshed entry was dropped, erroring at session start. The merge now prunes Octopus-owned hooks and re-adds them at the current path, preserving user-added hooks — so every repo self-heals on its next setup or update.

[1.76.0] - 2026-06-02

✨ The workflow CLI gains a command registry, replacing the “a command exists because a file exists” dispatch. cli/octopus.sh used to source cli/lib/<cmd>.sh with no allowlist, so every helper or implementation library in cli/lib/ (ui, audit-map, knowledge-*, consigliere-lens) was a silently-accepted command that defined functions and did nothing — and the two hand-maintained help strings drifted from the real set, so octopus --help only ever showed the five bootstrap commands. A new declarative registry, cli/lib/commands.default (pipe-delimited, mirroring knowledge-roots.default), is now the single source of truth: cli/octopus.sh generates its command list from it and rejects any unregistered name (helper libs now error with “Unknown command” instead of no-op’ing), help/-h/--help is a first-class command, and the bin/octopus shim reads the registry so octopus help lists the global and workflow commands together — ending the two-layer split. Adding a command stays one step per side: a cli/lib/<name>.sh plus one registry line. 🧪 A new test_cli_registry.sh locks the guard, the registry-to-lib integrity, and the generated help in place. Keystone of the CLI-surface-hygiene cluster; version, per-command --help, list/completions, and a richer doctor build on it next.

[1.75.0] - 2026-06-02

♻️ Breaking: the review-contracts skill is renamed to audit-contracts, bringing the cross-stack contract auditor into the audit-* family it already belonged to — it mirrors audit-money, shares the audit output/pre-pass/cache machinery, emits the same block/warn/info report, and is one of the four domain audits audit-all runs in parallel. The review- prefix was the lone outlier (the other review-* skills are PR-feedback and knowledge-loop tools, not audits), so the family is now uniform: audit-security/money/tenant/contracts alongside audit-config/fleet/grounding/verification/style and the audit-all composer. The rename is hard, with no backward-compatible alias: the skill, the /octopus:audit-contracts command, the quality and fullstack bundle entries, the audit-all dependency list, the audit map, setup.sh, and the English + pt-br documentation pages all move together (history preserved via git mv). Consumers that pinned review-contracts by name in .octopus.yml must rename it to audit-contracts; repos that enable the quality or fullstack bundle inherit the rename automatically.

[1.74.0] - 2026-06-02

✨ This release adds audit-style — the design/quality signal the “Quality, Style & Grounding” guardrail set named but never built. The syntactic block (the guardrails bundle) and the semantic grounding signal (audit-grounding) already shipped; the missing third reader is the one that judges the diff against the team’s opinionated coding rules. audit-style loads rules/common/exceptions.md (the custom-exception gate), patterns.md, coding-style.md, and the active stack rules, then surfaces two failures a formatter and the generic simplify cannot see: code that breaks a stated rule (rule-violation — a custom exception that fails the gate, a throw where a typed result is called for, a boolean parameter, a magic number, business logic leaking into a repository) and abstraction the rules call a cost (over-engineering — premature abstraction, a speculative subtype hierarchy, DRY applied before three occurrences). That over-engineering dimension is what the native simplify structurally cannot produce — it optimizes for less code and can introduce the very abstraction the rules forbid, so audit-style is the reader that knows when not to simplify. It mirrors audit-grounding’s shape — signal-only, capped at warn/info, never blocking — but points at the coding rules instead of the domain. It registers in the quality bundle and runs through the review flows (codereview/pr-review/implement); unlike its siblings it ships no Stop hook, and it stays out of audit-all (a fixed composer of the four domain code audits). Recurring findings reuse the existing continuous-learning loop so a violation the team keeps making is promoted into a rule rather than re-flagged forever. 📝 The public site documents the skill in English and pt-br.

[1.73.0] - 2026-06-02

✨ The destructive-action guard gains a strict temp-dir carve-out: a clean rm -rf confined entirely to /tmp or /var/tmp is now allowed without the bypass marker, so agents can clean up throwaway scratch (mockups, snapshots) without friction. The carve-out never exempts a command that could reach outside the temp root — because rm acts on the live filesystem, the decision rejects shell composition, expansion, and globs, then resolves every target with realpath to confirm strict containment, closing the ., glob, bare-root, and symlink escapes. It was reviewed adversarially before merge. 🔧 A broad scrub removes Octopus’s own internal development markers (roadmap IDs, cluster names, and links/pointers to Octopus’s internal ADRs, specs, and RFCs) from the three surfaces a consumer actually sees — the skills, commands, and templates that octopus setup copies into a repo, and the published documentation site — while preserving every user-facing ADR/RFC/spec/roadmap feature and the user’s own roadmap-ID convention. 🧪 Two regression guards lock this in: the site’s check-docs.sh now also flags links into Octopus’s internal design docs, and a new test_no_internal_refs.sh blocks cluster names and internal ADR citations from leaking back into the delivered skills, commands, and templates.

[1.72.0] - 2026-06-01

📝 This release closes the documentation overhaul: every public collection on the GitHub Pages site is now didactic and bilingual (EN + pt-br). 📝 All six collections — skills, commands, roles, bundles, hooks, and the new rules collection — gained hand-curated pages following a consistent template (intro → what it solves → how it works → usage/parameters), covering 31 skills, 46 commands, 11 roles, 11 bundles, 8 hooks, and a rules overview plus the seven common rules. The knowledge engines (hygiene/synthesize/briefing), the dba catalogues (mssql/postgres/mongodb/redis), the testing, architecture, intake, context-economy, and enforcement families were all documented in flowing prose with per-flag parameter tables. ✨ To keep the docs honest going forward, this release ships permanent infrastructure: scaffold-docs.sh generates idempotent, draft-gated bilingual scaffolds for skills, commands, roles, and bundles, and check-docs.sh enforces two guards in CI — an anti-leakage gate (blocks internal references like roadmap IDs, cluster names, and PR numbers from the published site) and a completeness gate (every skill/command/role/bundle must have a page). 🐛 A fix along the way repaired a Pages build break by quoting YAML descriptions and switching to MDX comments, plus a hex-color false-positive in the leakage matcher.

[1.71.1] - 2026-05-31

🐛 Fixed octopus setup silently skipping bundle members that carry inline # RM-NNN … annotations. Both hand-rolled YAML parsers in setup.sh — _load_bundle (reads bundles/*.yml) and parse_octopus_yml (reads the user-written .octopus.yml) — were appending the trailing inline comment to the skill/role name, so setup looked for a directory like consigliere-bootstrap # RM-099 — … and skipped it as “not found”. This dropped most of the consigliere and tech-lead bundle members at install time (and would have broken any hand-written .octopus.yml using inline comments, which are valid YAML). Both parsers now strip the comment consistently, with regression coverage for each. 📝 On the documentation site, the internal roadmap page was removed — the RM/cluster backlog is an internal planning artifact, not user-facing — leaving the curated Changelog as the “what’s new” surface for users (the internal docs/roadmap.md is untouched). ✨ A new deterministic docs guard (site/scripts/check-docs.sh) lands as the first enforcement slice of the site-docs-overhaul: with zero LLM involvement it fails on any published (non-draft) page that leaks implementation detail (RM-NNN, Cluster N, #NNN, “shipped in vX”) or carries an unfinished <!-- TODO --> rationale; --report lists offenders without failing. It is not wired into CI yet — it currently reports 48 leaking pages, the sweep worklist, and CI gating lands once that sweep clears.

[1.71.0] - 2026-05-31

✨ The Consigliere workspace and the team knowledge loop. This release builds out the private “chief-of-staff” workspace (Cluster 18) and the knowledge-processing engines that feed it (Cluster 19). The workspace lands first: a scaffold + dedicated bundle (RM-099), a digest-source capture skill (RM-100) that ingests heterogeneous inputs, the consigliere role itself — the lens that learns (RM-101) — a read-only context-status consult skill (RM-102), a playbook-review heuristics loop (RM-103), and a read-only connect-atlassian MCP setup (RM-104) so the lens can read Jira/Confluence without write access. On top of that, the knowledge loop (Cluster 19) closes end to end: a knowledge-root registry (RM-106) anchors where knowledge lives, a knowledge-hygiene engine (RM-107) prunes and normalizes it, knowledge-synthesize (RM-108) and knowledge-briefing (RM-109) turn raw captures into digested insight and scheduled briefings, and the consigliere-lens (RM-110) ties the whole pipeline back to the role. 🐛 A follow-up fix makes knowledge-hygiene entry-node pattern matching case-insensitive. The completion-verification guardrail arrives as audit-verification (RM-111, Cluster 20), picking up the scope deferred from RM-088 — a final check that work claimed “done” actually is. 📝 The public documentation site gets a didactic-and-complete overhaul (#136) so every new role, skill, and engine is explained for newcomers, and RM-105 is recorded on the roadmap (a planned pre-push hook that blocks release tags from being cut outside main). Each item ships with its design spec and the roadmap marks Clusters 18, 19, and 20 complete.

[1.70.0] - 2026-05-30

✨ Cluster 16 — the tech-manager multiplier kit. A manager standardizing a team across 6+ repos can now encode Staff-level judgment once, in version control, instead of being the reviewer of last resort. Pedagogy leads: a new mentor role (RM-089) turns the gate roles’ findings into teaching units that explain the why and cite the team’s own sources; onboarding (RM-090) ramps a new engineer through standards, architecture, and workflow as a scoped, ephemeral session; definition-of-done (RM-091) makes “done” a first-class, versioned team artifact validated in code review; and standards (RM-092) answers “what’s our standard for X, and why” self-serve from ADRs, rules, and CONTEXT.md. The team knowledge loop closes with a team mode on continuous-learning (RM-093) plus a new review-log-capture Stop hook: recurring review feedback is captured automatically and aggregated fleet-wide into rule-promotion candidates that flow to the shared workspace: rules every repo inherits. Cross-repo scale arrives with audit-fleet (RM-094) — which reports each repo’s drift against its declared target (baseline + stack profile + adoption tier) — and fleet-bootstrap (RM-095), which converges a multi-stack, legacy-aware fleet onto a layered standard from one fleet.yml, dry-run by default and never force-pushing. The tech-lead bundle (RM-096) packages the whole kit as the manager’s one-stop install, deliberately excluded from the fleet baseline since it carries the cross-repo control-plane tools. Supporting this, map-system gains a complete mode (RM-098) that renders a self-contained, themed HTML deck of a repository — overview, business insights, inline-SVG diagrams, API contracts — reusing the launch-release theme system with three new presets (dark-blue, dark-jade, light-jade). 📝 Every item ships with a refined spec, structural tests, and English + pt-br documentation; ADRs 002–006 record the irreversible decisions (mentor-as-role, the map-system deck default, fleet merge policy, workspace config-template precedence, and the fleet execution model).

[1.69.0] - 2026-05-28

✨ This release adds audit-grounding (RM-088) — a signal-only audit that confronts the working diff against the project’s source of truth (CONTEXT.md, ADRs, the knowledge base) to surface the two semantic hallucinations a formatter and type checker can never catch: team conventions invented without agreement, and domain facts asserted without support. It ships with a deterministic grounding-check Stop hook that fires at every task end with a diff and queues the review to .octopus/proposals/ — never blocking, because the verdict is probabilistic. The skill joins the quality bundle alongside the existing audits, and 📝 the public site documents both the skill and the hook in English and pt-br. 🔧 Implementation plans are no longer version-controlled: docs/plans/ is now untracked and gitignored, since plans are per-feature working artifacts generated by /octopus:doc-plan rather than durable project docs.

[1.68.1] - 2026-05-28

🐛 Repaired a broken slash-command layer left behind by an incomplete rename. Seven commands that had been renamed to match their skills — money-review → audit-money, tenant-scope-audit → audit-tenant, feature-to-market → launch-feature, release-announce → launch-release, plan-backlog-hygiene → plan-backlog, cross-stack-contract → audit-contracts, and receiving-code-review → respond-to-review — were still dispatching to skill paths that no longer existed (e.g. skills/money-review/SKILL.md), so the commands were effectively dead; each now points at its real skill, and the setup.sh audit-detection case plus .octopus/schedule.yml were repointed too (including security-scan → audit-security). ♻️ The delivered command directories were rebuilt from clean source: nine orphaned legacy command files plus the example db-migration/db-reset entries were removed, the duplicate agent: code frontmatter block was stripped from ~33 source commands, and commands/, .claude/commands/, and .opencode/commands/ are now identical (38 commands each). 📝 The renames were propagated everywhere else for consistency — the documentation site (EN + pt-br), feature pages, specs, plans, research notes, the roadmap, and the launch skill templates — and six topical docs were renamed to their new names with their inbound links fixed.

[1.68.0] - 2026-05-27

✨ New frontend and fullstack bundles close the last two open roadmap items (RM-065, RM-066). The frontend-developer role had shipped without a bundle because no skills targeted UI patterns; this adds two — frontend-patterns (component composition over configuration, state at the narrowest scope, the loading/error/empty/success contract, styling conventions, and accessibility as a first-class concern rather than a polish pass) and test-component (Testing Library + Vitest, behaviour over implementation via accessible queries and user-event, MSW mocking at the network boundary, and an explicit component-test-vs-e2e line) — and wires them into bundles/frontend.yml alongside the existing test-e2e skill and the frontend-developer role. The design mirrors backend exactly: an anchor patterns skill plus a testing skill plus the developer role, category: intent with a persona question. The fullstack bundle is backend ∪ frontend ∪ audit-contracts, enumerated explicitly since bundles cannot reference one another, with test-e2e de-duplicated by the expander — it targets monorepos that hold both an API and a frontend, where the failure mode is the seam between the stacks (caught by audit-contracts) rather than either stack alone. Both bundles are auto-discovered by the setup picker; tests/test_bundles.sh gains expansion and dedup coverage for them. 📝 The docs site gains curated bundles/frontend and bundles/fullstack pages in English and pt-br, the bundle index grows from six to eight (skill count 34 → 36), the skills index lists both new skills, and the roadmap marks Cluster 12 complete.

[1.67.0] - 2026-05-27

✨ New security review role — a dedicated security specialist persona analogous to architect and dba, filling the gap where security was only a cross-cutting concern of architect plus the audit-security checklist skill. The role (roles/security.md) runs audit-security as its baseline and adds threat modeling over the diff — entry points, reachable actors, exposed assets, abuse cases (auth bypass, IDOR, injection, SSRF, privilege escalation, data exfiltration), and violated trust assumptions — emitting findings ranked BLOCKING/ADVISORY/QUESTION, each with an exploit scenario and a fix, in the same output shape as architect so the codereview report consolidates cleanly. The codereview dispatch matrix now routes auth/JWT/OAuth/secret/.env diffs to the security role instead of the audit-security skill directly, dual-gated with architect (mirroring the existing dba + architect data-layer gate). The role is registered in the quality bundle alongside architect and activated in the repo’s own .octopus.yml, so setup.sh delivers it to every configured agent (.claude/agents/, .opencode/agents/). It is triggered the same three ways as the other review roles: by the codereview router on sensitive diffs, by the pre-push audit-suggest hook, and manually via /octopus:delegate @security. 📝 The docs site gains a dedicated roles/security page in English and pt-br, the roles index grows from six to seven, and the quality bundle page lists the new role.

[1.66.1] - 2026-05-22

🐛 The session-start/load-context.sh hook no longer breaks session startup on projects whose .octopus.yml omits the knowledge_dir: key. The previous grep | awk | head -1 || true chain was fragile under set -o pipefail (SIGPIPE on early head close, silent failure on quoted values or trailing comments). It is replaced by a pure-bash regex parse that reads the file line-by-line, tolerates surrounding single/double quotes and # comment suffixes on the value, and keeps the knowledge default intact when the key is absent. Verified against four scenarios: missing key, plain value, quoted value with trailing comment, and missing .octopus.yml — all return exit 0.

[1.66.0] - 2026-05-22

✨ respond-to-review is now end-to-end: after the five rules apply the right change to each comment, the skill runs a single post-fix turn that proposes the four closing actions in one consolidated menu — a batch commit covering the review-driven edits with a suggested message, push (automatic when the branch already tracks an upstream, explicit confirmation when -u is needed), hybrid inline replies (canned Addressed in <sha>. for direct fixes, contextual phrasing for push-back or partial action), and thread resolution (closes threads that ended in a fix or a reasoned push-back, leaves Rule 5 clarifications open by design). This closes the gap where the agent stopped after applying fixes and forced the user to drive commit / reply / resolve manually or via a separate /octopus:pr-comments invocation. The relationship to pr-comments is reframed accordingly: it remains a valid alternative entry point for walking a PR’s threads from scratch, but respond-to-review no longer depends on it. Anti-patterns updated to forbid ending the skill before the post-fix loop, silent push -u to a new remote branch, and auto-resolving threads that ended in a clarification request.

[1.65.0] - 2026-05-21

✨ The templates/dotnet/editorconfig baseline now ships a richer style preset on top of the auto-format hook scaffolding introduced in v1.63.4. New defaults cover file-scoped namespaces (csharp_style_namespace_declarations = file_scoped:warning), using-directive placement and System-first sorting, var preferences across built-in/apparent/elsewhere, expression-bodied members for methods/properties/accessors, and Allman brace placement (csharp_new_line_before_open_brace = all plus else/catch/finally). Indent-size overrides for .csproj/.props/.targets/.json/.jsonc/.yml/.yaml are consolidated into a single block alongside the existing TypeScript and Makefile sections, so projects that adopt the template get a coherent .NET style baseline without layering their own preferences on top.

[1.64.0] - 2026-05-21

✨ octopus setup now auto-delivers the templates/dotnet/editorconfig baseline whenever a .NET project is detected, closing the loop on the v1.63.4 auto-format hook fix — that release shipped the template file but left installation to the user, defeating the “octopus does the work” expectation. Targeting follows the canonical .NET convention: scan for .sln files (max-depth 5, excluding node_modules/.git/bin/obj) and deliver one .editorconfig per solution directory; if no .sln is present, fall back to the common ancestor of all .csproj files. This makes the delivery work in monorepo layouts whose solution lives in a subdirectory with a nested root = true editorconfig — placing the file at the install root would be shadowed by the nested config and provide no value. Idempotent: an existing .editorconfig at any target directory is never overwritten, so projects that already chose their own conventions stay intact. Verified against four scenarios: single .sln in a subdir delivers next to it; multiple .csproj with no solution collapse to their common ancestor; existing editorconfig at a target dir is left alone; non-.NET repos are silently skipped.

[1.63.4] - 2026-05-21

🐛 The post-tool-use/auto-format.sh hook silently dropped two classes of dotnet format output, letting style violations through to commits. First, the hook ran dotnet format at its default --severity warn, which skips analyzers shipped at :suggestion even when the project’s .editorconfig explicitly enables them at that level — so common code-style rules (IDE0011 add-braces, IDE0040 explicit-accessibility, IDE0044 make-readonly) never got auto-fixed. Lowered the default to --severity info so projects that configure these at :suggestion/:info (the common case) get the auto-fix. Rules left at :silent stay untouched — the project’s .editorconfig remains authoritative. Second, when dotnet format couldn’t apply a fix (notably IDE1006 naming — NamingStyleCodeFixProvider doesn’t support Fix-All in Roslyn, by design) it printed Unable to fix IDE1006... to stdout and exited 0; run_formatter only echoed the captured output when exit code was non-zero, so the dev only saw the violation in PR review. The function now scans captured output for ^Unable to fix , : warning IDE####, and : warning CA#### lines and surfaces them to stderr regardless of exit code, so unfixable violations are visible at write time.

✨ New templates/dotnet/editorconfig baseline that projects can copy to their root to make the auto-format hook actually fix things. Without an .editorconfig configuring the relevant analyzers, dotnet format --severity info still has no rules to enforce — the default Roslyn severities for IDE0011/IDE0040/IDE0044 are :silent. The baseline sets the three at :suggestion (so the hook auto-fixes them on next Write/Edit) and pins the standard _camelCase private-field naming convention at :warning (Roslyn can’t batch-fix naming, but the hook’s new fix-failure detection makes the violation visible immediately). Minimum opinionated set — projects layer their own rules on top in the same file.

[1.63.3] - 2026-05-21

🐛 The octopus setup fzf picker rendered the ”── Features ──” and ”── Bundles ──” section labels as selectable rows because --header-lines=0 made every input line a data row — users could move the cursor onto a separator and mark it with ✓ via SPACE/TAB, even though the post-selection grep filters discarded anything that didn’t start with bundle: or feature:, leaving the visual selection without any effect on the parsed output. transform: binds (fzf >= 0.52) now substitute the toggle action with ignore (SPACE) or a plain down/up (TAB/BTAB) when the current line contains the ── box-drawing pattern; older fzf treats transform: as unknown and falls back to the previous no-op-but-visually-toggleable behaviour. The pre-select position math is also corrected — positions count every row in the list (separators included), so feature[0] sits at row 2 and bundle[0] at row N+3, not row 1 and row N+1 as the old code assumed; the “Bundle” label is renamed to “Bundles” to match its multi-select nature.

[1.63.2] - 2026-05-21

🐛 The bundles index page (docs/site/bundles/index.mdx + pt-br) had a heading reading “The six bundles” / “Os seis bundles” with only five bullets — guardrails (shipped v1.59.0) was never added to either index when the bundle landed. The mismatch became visible after v1.63.1 cleaned out the dba bullet, dropping the visible count to 5. Added the missing guardrails bullet in both languages, positioned right after quality (both are enforcement-shaped bundles), with a description matching the tone of the existing bullets — covers the bundle’s two skills (enforce-precommit, enforce-ide) and the value angle (coding style, commit-msg lint, and formatter become git-level gates instead of PR review nits).

[1.63.1] - 2026-05-21

🐛 The v1.63.0 release moved the dba role and dba-* skills into bundles/backend.yml and deleted bundles/dba.yml, but the docs site still rendered a dba bundle page at https://leocosta.github.io/octopus/bundles/dba/ because the canonical sources at docs/site/bundles/dba.mdx and docs/site/pt-br/bundles/dba.mdx weren’t removed in that commit. The synced output under site/src/content/docs/ is gitignored and regenerated from docs/site/ by site/scripts/sync-content.sh, so changes have to land in the canonical tree. Both dba bundle pages deleted; the dba bullet and the intent-bundle list entry in bundles/index.mdx (EN + pt-br) cleaned out; backend.mdx (EN + pt-br) updated to reflect the new shape — 6 skills (backend-patterns, test-e2e, dba-mssql, dba-postgres, dba-mongodb, dba-redis) and 2 roles (backend-developer, dba) — with a “Why each one is in” section covering the four engine-specific failure modes (Postgres FK columns without indexes, MSSQL ALTER COLUMN NOT NULL on hot tables, Mongo ESR-rule violations, Redis KEYS * and missing TTLs) and the dba role’s dual-gate orchestration with architect. needs_retranslation: true flipped on the pt-br backend page so the translation pipeline picks it up.

[1.63.0] - 2026-05-21

🐛 The dba bundle introduced in v1.62.0 was a packaging mistake. The role and its four engine-specific skills (dba-mssql, dba-postgres, dba-mongodb, dba-redis) are a pre-merge gate that pairs with architect and belong inside an existing intent bundle, not as a standalone selectable. bundles/dba.yml is removed; the dba role and dba-* skills move into bundles/backend.yml, whose description and persona_question now cover both backend API development and data layer review. Projects that had bundles: [dba] in their manifest will see “bundle not found” on the next setup and should swap for backend (the same skills + role land via that path).

🐛 The interactive setup picker (cli/lib/setup-picker.sh) had two related bugs that compounded across the last three releases. First, the bundle list was hardcoded as (starter docs quality growth backend) — so the guardrails bundle (v1.59.0) and dba (v1.62.0, before this release) never showed up in the picker. Anyone running octopus setup after those releases couldn’t actually select them from the menu and had to hand-edit .octopus.yml. The picker now enumerates $RELEASE_ROOT/bundles/*.yml directly via a new _picker_load_bundles function, sorting starter first (foundation) and the rest alphabetically. Second, re-running octopus setup always opened the picker with everything unchecked — the dev had to remember which bundles + features were already in the manifest and re-select them or risk losing the config. The picker now reads .octopus.yml inline via a new _picker_load_current_state function (no dependency on setup.sh’s parser to keep the picker self-contained) and pre-selects the matching items via fzf’s --bind='load:pos(N)+toggle…' (fzf 0.42+, bundled is 0.72.0). The bash fallback path shows [✓] markers next to currently-configured bundles and uses their indices as the default input — Enter without typing anything now keeps the current config instead of falling back to starter. Both new functions plus the auto-discovery loop pass all five tests/test_setup_picker.sh scenarios and the full integration test in tests/test_full_setup.sh (including RM-069 workspace rules).

[1.62.1] - 2026-05-21

🐛 The workspace: directive in .octopus.yml now expands a leading ~ to $HOME (workspace: ~/Projects/team-workspace → /home/<user>/Projects/team-workspace). Before this fix the tilde was treated as a literal character and deliver_rules() could only find the workspace directory when the manifest hardcoded /home/<username>/... — defeating the purpose of versioning the manifest in the project repo, since paths diverge across developers’ machines. The fix is a one-character change in setup.sh:354 ("$val" → "${val/#\~/$HOME}"); only the leading-tilde form is supported (~user/... is intentionally not expanded since $HOME is the practical case for shared-workspace rollouts). Pairs with RM-069 (workspace as a shared rule source) to make the team-wide guardrails rollout viable without per-dev manifest edits.

[1.62.0] - 2026-05-21

✨ New dba role and bundle act as a second pre-merge approval gate alongside architect on any PR that touches the data layer — the existing architect review dilutes database-specific heuristics (FK columns without indexes, ESR-rule violations on Mongo compound indexes, ALTER COLUMN NOT NULL on hot Postgres tables, KEYS * in Redis production code) that are exactly the failure modes that page on-call at 3am. The role detects engine(s) the diff touches via a path/extension convention (db/mssql/**, db/postgres/**, db/mongo/**, redis/**, plus content sniffing for IDENTITY, SERIAL, db.collection, Redis client usage) and dispatches per-engine skills — dba-mssql, dba-postgres, dba-mongodb, dba-redis — each shipping its own indexing, modeling, query-pattern, migration-safety, retention, capacity, security, and concurrency heuristics catalogue. Every finding is severity-tagged (BLOCKING / ADVISORY / QUESTION, matching architect) and ships with a ready-to-apply fix: CREATE INDEX CONCURRENTLY ... for the missing Postgres FK index, a split add-nullable→backfill→set-not-null plan for the MSSQL hot-table migration, a corrected db.orders.createIndex({customerId: 1, createdAt: -1}) for the ESR violation, a SET ... EX 3600 for the Redis session key that had no TTL. Mode is static by default; if connection strings (MSSQL_CONNECTION_STRING, DATABASE_URL, MONGODB_URI, REDIS_URL) are present in .env.octopus, each skill enriches its findings with EXPLAIN plans, existing-index listings, and runtime statistics — when an env var is missing, the skill emits a QUESTION pointing at it instead of silently degrading. The dual-gate rule (both dba and architect approvals required on DB PRs) is documented in core/pr-workflow.md and a new bundle page lands at https://leocosta.github.io/octopus/bundles/dba/ (pt-BR is a stub flagged for retranslation).

♻️ The review-pr skill and command are renamed to respond-to-review to fix a long-standing naming inversion: the skill actually codifies the protocol for receiving PR feedback (verify the critique, ask for evidence on generic comments, separate reasoned from preference, never make performative changes, clarify ambiguity), not for writing a review. The old name was visually indistinguishable from pr-review (which writes a review and assigns reviewers) and semantically backwards. The command file is also rewritten to fix pre-existing double frontmatter and an outdated header that still said /octopus:respond-to-review. Cross-references updated in bundles, sibling skills (implement, debug, _shared/task-routing.md), tests, the .octopus.example.yml, feature docs, and the site (EN + pt-BR). Historical specs and plans under docs/superpowers/ are left intact as a record of the previous respond-to-review → review-pr rebrand.

♻️ The codereview and pr-review slash commands become skill/role orchestrators instead of prose checklists. Both previously embedded a generic correctness/design/readability/edge-cases/security/tests bulleted list and invoked no audit skills or review roles, duplicating heuristics that already live in audit-security, audit-money, audit-tenant, audit-contracts, and the architect/dba roles. Rewritten, they detect what the diff touches, dispatch the matching skills and roles in parallel, run a minimal fallback checklist for things no skill covers (TODO/FIXME, debug statements, emoji, oversized files/functions, deep nesting), then aggregate one severity-tiered report. pr-review references codereview Phases 1–4 rather than copying them, keeping a single source of truth for the dispatch logic; the PR-specific work is fetching the diff via gh, posting the report as a PR comment, and assigning human reviewers from .octopus.yml (handled by cli/lib/pr-review.sh, unchanged). Net effect: the dual-gate rule on DB PRs actually executes when these commands run, instead of relying on a prose checklist nobody reads.

[1.61.0] - 2026-05-21

✨ Adds a Brazilian Portuguese (pt-BR) locale to the public documentation site, mirroring all 61 English pages under docs/site/pt-br/ and serving them at /octopus/pt-br/ via Starlight’s native i18n with English staying at the root. The translation pipeline is hybrid and runs locally: a PostToolUse hook (mark-stale-translation.sh) marks the corresponding pt-BR page stale on any Claude Code edit to an English source — no LLM, no CI involvement, never blocks the edit — and a batch script (scripts/translate.ts) drives the actual retranslation by piping prose segments through claude -p in headless mode while preserving code fences byte-identical via sentinel substitution. Frontmatter carries source_hash and needs_retranslation so the tooling can detect drift without a separate database. The maintainer reviews and commits the translated files; CI only builds the already-versioned pt-BR content. ✨ A translated splash hero (site/src/pages/pt-br/index.astro) covers the /octopus/pt-br/ landing route, and the language switcher labels are flag-prefixed (🇺🇸 EN / 🇧🇷 PT-BR) with the dropdown widened via a CSS override so the prefixed labels render without truncation. 🔧 Top-level Makefile targets (site-dev, site-build, site-preview, site-clean) consolidate the local validation flow into one-liners. 📝 The design is captured end-to-end in docs/specs/site-ptbr-translation.md, including the open questions deferred to follow-ups (visible staleness banner, glossary coverage validation against a random sample, RM number assignment). The glossary file docs/site/.translation-glossary.md lists the terms (skill, hook, agent, role names, hook event names, file identifiers) that must stay in English across every translation, and site/scripts/sync-content.sh was tightened to exclude dotfiles so the glossary is not picked up as a content page.

[1.60.0] - 2026-05-21

✨ Introduces a strict custom-exception discipline as a new common rule (rules/common/exceptions.md). The point is not “prefer custom exceptions” — that framing causes the harness to mint throw-once classes for every domain check. Instead, a custom exception is treated as a contract owed to caller and operator, and only earns the type when at least one gate is met: a real disambiguating catch site (G1), structured fields with a real operational consumer (G2), or a trust-boundary wrap that preserves cause and adds G2 fields (G3). A forbidden table calls out seven antipatterns explicitly, per-stack bad/good examples cover C#, Python, and TypeScript, and a counter-example demonstrates that fields and a nice name do not earn the type on their own. A four-question self-check seals the rule before class XException lands. Shallow mentions in rules/common/coding-style.md (Catch-and-ignore antipattern) and rules/common/patterns.md (Result pattern) now route the agent to the strict rule so it is discoverable from the surface bullets.

[1.59.0] - 2026-05-21

✨ New guardrails intent bundle closes the three deterministic-enforcement gaps that the existing loop-level hooks (auto-format, typecheck, block-no-verify, detect-secrets, destructive-guard, format-check, git-push-reminder, console-log-warn) cannot reach by themselves: Copilot edits, direct human edits, and --no-verify from a human all bypass the Claude Code tool loop, so a team that adopts Octopus as the foundation of a versioned workspace still has to wire pre-commit, CI quality enforcement, and IDE configs by hand. The bundle ships two new skills and pairs with one new CI template to give a single opt-in path for end-to-end defense-in-depth. 📝 The new artifacts: bundles/guardrails.yml as an intent bundle (parity with quality and docs) composing the two new skills, with a persona question framing the choice as “do you want deterministic enforcement that catches Copilot and human edits the same way it catches Claude?”; skills/enforce-precommit/SKILL.md with a five-step protocol that detects active stacks via file extensions and canonical manifests (package.json, pyproject.toml, *.csproj, go.mod, Cargo.toml), picks a framework (default pre-commit.com for polyglot coverage; lefthook and husky documented as alternatives), generates or merges .pre-commit-config.yaml idempotently with conservative merge semantics (never overwrites a user-set hook, appends rather than reorders, never auto-runs pre-commit autoupdate), and surfaces local overrides from enforce-precommit.local.md; skills/enforce-ide/SKILL.md intentionally narrow — .editorconfig always (universal baseline plus per-stack overrides for Python’s 4-space indent, Go’s tabs, Makefile’s tabs), .vscode/ opt-in via enforce_ide_vscode: true to avoid the IDE-fragmentation political surface, and explicitly forbids writing personal-preference keys (font, theme, terminal, keybindings, telemetry) — the goal is project consistency, not personal-preference override; templates/github-actions/quality.yml as a structural quality gate paritary with the existing claude.yml template (activated by qualityWorkflow: true in .octopus.yml, mirroring the githubAction: flag), running pre-commit/action plus Conventional Commits PR-title lint via amannn/action-semantic-pull-request plus a stack-detecting test job that runs npm test / pytest / go test / dotnet test / cargo test based on which manifest is present. 📝 docs/rfcs/2026-05-20-team-workspace-guardrails.md captures the full design rationale: three alternatives considered (team fork of Octopus, per-team external bundle consumed via URL, document-the-gap-don’t-ship — all rejected for compounding the same problem N times across teams), trade-offs (gain end-to-end opinion on enforcement; give up neutrality on pre-commit framework choice and add a maintenance surface that audit-config will need to track), and five open questions for upstream review (default pre-commit framework, enforce-ide scope, CI flag naming, bundle category, and hooks: true collision semantics between manifest root and bundle-level declaration). 🎯 Same rule set, three surfaces — rules/common/* is now the single source of truth that feeds loop-level hooks, the pre-commit config generated by enforce-precommit, and the CI workflow generated from the new template; drift between the three is now an audit-config concern rather than a hand-maintained alignment problem.

[1.58.1] - 2026-05-20

🔧 Repair 12 broken internal links surfaced after the granularity-driven Skills section landed in v1.57.0. The Phase 2 bundles and roles pages (v1.53.0) and the Phase 1 get-started pages (v1.52.0) were authored under the assumption that every skill and every command would land at its own URL — but the granularity rule applied to Phases 3-5 means table-only skills (backend-patterns, compress-skill, content-images, delegate, dotnet, interview, map-system, review-pr, test-tdd) and skills now covered on a command page (review-pr → /commands/pr-comments/, delegate → /commands/delegate/) don’t have a /skills/<slug>/ URL. Three fixes applied: rename /skills/feature-lifecycle/ to /skills/doc-lifecycle/ (the v1.57.0 rename); redirect review-pr and delegate callers to their command pages where the discipline actually lives; strip the link entirely from the 9 table-only references and keep the identifier as inline code. Quickstart’s /architecture/troubleshooting/ pointer is redirected to /architecture/ as the fallback — the troubleshooting page never existed. Audit pass: every absolute /octopus/ link in docs/site/ now returns 200 (12 → 0 broken).

[1.58.0] - 2026-05-20

✨ Final Phase 6 of the docs site lands at https://leocosta.github.io/octopus/architecture/ — the Architecture section with 5 hand-written MDX pages. Entirely new content; docs/features/ has no architecture material so this isn’t a backfill from existing prose but a from-scratch articulation of how Octopus works under the hood. The Architecture sidebar entry is uncommented in astro.config.mjs; the site now exposes every section the v1.52.0 plan committed to (Get Started, Bundles, Skills, Commands, Hooks, Roles, Architecture, Roadmap & Specs). 📝 The 5 pages: index (Octopus’s single job — manifest in, generated config out — three non-negotiable properties: manifest is single source of truth, agents are interchangeable consumers, bundles are the unit of opinion; the four primitives — rule / skill / hook / command — plus the two composites — bundle / role — with always-loaded semantics per primitive); manifest (why generation instead of templates, the two content modes — template-rendered for Claude Code’s CLAUDE.md, concatenated for the four other agents — the full pipeline from .octopus.yml through bundle expansion and dependency resolution to per-agent delivery, the human-only manifest rule with the octopus update exception); agents (the full capability matrix table with output-file / content-mode / rules / skills / hooks / commands / roles / knowledge / MCP rows per agent, the three patterns that repeat across rows — native-support→file-delivery, no-native→inlined, no-native-fallback-impossible→quality-rules — why Claude Code is the reference target, what “inlined” means in practice and its context-budget cost, the four-step add-a-new-agent flow); bundles (anatomy of a bundle file, expansion to flat lists with dedup, transitive dependencies via depends_on: frontmatter, the no-loose-skills rule and why, composition of multiple bundles, Quick mode vs Full mode); layout (the canonical Octopus repo tree with one directory per primitive and one subdirectory per instance, the three navigation rules — category-in-path, instance-in-path, no-cross-category — what gets generated into user projects vs what stays in the catalog). 🎯 This closes the documentation backfill arc that started with Phase 2 in v1.53.0: all eight sidebar sections now have hand-curated rationale where it matters, no section is a 404, no section is a thin auto-sync.

[1.57.0] - 2026-05-20

✨ Phase 5 of the docs site lands at https://leocosta.github.io/octopus/skills/ — the Skills section with 19 hand-curated MDX pages (overview + 18 detail) replacing the auto-synced placeholders from docs/features/. Same granularity rule: 35 skills total, the ones with non-trivial design decisions get a detail page; thin wrappers and stack-specific patterns (e.g. dotnet, backend-patterns, batch, content-images, test-tdd, test-e2e) are listed in the overview tables with one-liners. Overview groups by intent — audits / workflows / refactoring / doc lifecycle / knowledge & planning / launches / skill authoring / stack patterns / receiving review — and links to either the skill page or to the command page that already covers the discipline (review-pr → /commands/pr-comments/, scaffold-skill → /commands/scaffold-skill/). 📝 The 18 detail pages: implement (the five practices and why a default skill rather than a rule), debug (six-step loop and why structure beats vibes), prototype (terminal vs UI variations and what “throwaway” actually means), audit-all (composer-not-monolith rationale and what it adds beyond serial), audit-security (four axes covering the recurring carelessness that produces real incidents), audit-money (seven checks codifying the failure modes that recur across codebases — types, rounding, cents-not-round tests, env drift, idempotency, webhook signatures, fee-disclosure coupling), audit-tenant (five checks plus blast-radius rationale and EF Core convention pairing), audit-config (RM-087 five-check freshness audit and why no auto-fix), audit-contracts (six axes targeting drift that breaks runtime behaviour while ignoring intentional divergence), refactor-deepen (why consolidation helps AI navigation, CONTEXT.md and ADR signal sources), doc-lifecycle (the two-question route between RFC/Spec/ADR/Knowledge), doc-adr (when ADR vs Spec, four sections with Consequences as the undervalued one, supersession discipline), doc-plan (TDD-sized tasks vs feature-sized, enriched-plan frontmatter, parallel DAG via depends_on), doc-subcontext (RM-085 inherit-don’t-duplicate, 50-100 line target, when not to write one), plan-backlog (six finding types and why —fix only handles archives), continuous-learning (lifecycle of a learning from capture to promotion or retirement, multi-agent-ready design), launch-feature (why a skill instead of marketer-writes-it, voice per channel, approval-gated by tools allowlist), launch-release (themed nine-channel kit and theme synthesis). 🔧 site/scripts/sync-content.sh no longer auto-syncs docs/features/ for any of the three sections — Hooks, Commands, and Skills are all hand-curated MDX. Architecture stays commented in the sidebar; ships in Phase 6.

[1.56.0] - 2026-05-20

✨ Phase 4 of the docs site lands at https://leocosta.github.io/octopus/commands/ — the Commands section with 13 hand-curated MDX pages (overview + 12 detail) replacing the auto-synced placeholder from docs/features/. Granularity follows the same “rationale-worthy only” rule as Hooks: 40 commands total, ~28 are listed in the overview table grouped by the phase of work they support (PR lifecycle, doc lifecycle, audits, implementation, orchestration, launches, skill-authoring, meta) and link either to their owning skill page (for thin command-as-skill-wrapper) or to a detail page (for commands with their own design decisions). 📝 The 12 detail pages: branch-create (prefix discipline anchors the release-bump chain, format validation refuses underscores/camelCase, default base picks release/* when active), commit (four-step language resolution from language.local.md → .octopus.yml → git log detection → English default, AI co-authored trailer rule, refusal of --no-verify / secrets-looking files / mixed-concern diffs), pr-open (why prose lives in the agent and mechanics live in octopus.sh — bash can’t summarise a diff, the agent has the conversation context — emoji-by-prefix map, body template), pr-review (six-axis self-review checklist — correctness/design/readability/edge-cases/security/tests — and why it’s narrower than codereview), pr-comments (verify / ask-for-evidence / disagree-with-reasoning triage against the two failure modes of feedback handling: performative compliance and defensive pushback), pr-merge (squash-as-default rationale — PR is the unit of review — no --force flag is deliberate, refusal conditions including the chore(release) version-mismatch catch), dev-flow (orchestration with explicit human pauses between phases, phase table, three cases where individual commands beat the orchestrator), delegate (single-role dispatch and multi-step pipelines via sequencing language — “after”, “once”, “then” sequential, “and” parallel — full role-alias table), release (the six-step bundle rationale, semver heuristic from commit types, CHANGELOG narrative voice over bullet lists, README badge sync via regex), scaffold-skill (why scaffolded vs freeform — frontmatter description / triggers / bundle membership all have to be right for engagement to work — bundle-assignment rule preventing orphans), doc-research (the roadmap-first vs spec-first paths, the five-step interview shape, RM status lifecycle), review-proposals (four dispositions — promote / partial / archive / discard — and why promotion routes through the owning skill so each target’s voice is preserved). 🔧 site/scripts/sync-content.sh no longer auto-syncs docs/features/commands.md; like Hooks, the section is now hand-curated MDX. Skills section still auto-syncs the remaining per-skill rationale pages until Phase 5.

[1.55.0] - 2026-05-20

✨ Phase 3 of the docs site lands at https://leocosta.github.io/octopus/hooks/ — the Hooks section with 6 hand-curated MDX pages replacing the auto-synced placeholder from docs/features/. Granularity follows the “rationale-worthy only” rule that pairs the docs-site voice with the actual decisions in the hooks layer: twelve hooks that are one-liners are listed in the overview table without their own page; five hooks with non-trivial design decisions ship as detail pages. The overview (hooks/index.mdx) explains why hooks live below skills (runtime enforcement vs. prompt advice — the layer where Octopus guarantees hold whether the agent is Claude Code in bypassPermissions, Copilot, Codex, Gemini, or OpenCode), tables the 9 Claude Code lifecycle phases with their stop-on-non-zero semantics, lists all 17 installed hooks with phase + one-liner, and documents two-level opt-out (hooks: false vs. destructiveGuard: false) plus the agent-coverage story (rules-inlined fallback for non-Claude agents). 📝 The five detail pages: destructive-guard (patterns blocked, inline # destructive-guard-ok: <reason> marker rationale — visibility/per-command/audit-friendly — opt-out, known regex-bypass limit), detect-secrets (provider grammars covering AWS / Stripe / SendGrid / Slack / GitHub / OpenAI / JWT / private-key blocks, deliberate no-bypass-by-design, pairing with audit-security as PreToolUse-gate vs. audit-pass), auto-format (why post-tool not pre-tool — agents reason in iterations, formatters normalise rather than reject — full formatter map keyed by extension, never-fail-on-formatter-error policy, the “formatter overrides agent intent” failure mode, typecheck inline with cold-start cost note), propose-knowledge-update (the three RM-086 signals — corrections / re-reads / re-greps — and why each separately rather than collapsed into one metric, proposal-not-auto-update discipline, graceful degradation when jq or transcript_path is absent), pre-push-audit-suggest (advisory-not-blocking rationale — audits are heavy and per-push cost would breed --no-verify workarounds — diff-to-audit pattern map for the five audits, env-var opt-out). 🔧 site/scripts/sync-content.sh no longer auto-syncs docs/features/hooks.md and destructive-action-guard.md — the section is now hand-curated MDX, not a derived view. Architecture section stays commented in the sidebar pending a later phase.

[1.54.1] - 2026-05-20

🔧 The docs-site sidebar listed Roadmap and Changelog entries pointing at /roadmap/ and /changelog/, but both routes 404’d — no MDX pages existed for them. site/scripts/sync-content.sh now generates the pages at sync time from the canonical sources (docs/roadmap.md maintained by /octopus:doc-research, CHANGELOG.md maintained by the release flow), prepending Starlight frontmatter and stripping the source H1. Pages ship as .md rather than .mdx because the raw content contains curly braces and HTML-like fragments that MDX tries to parse as JSX. The next push to CHANGELOG.md already triggers the docs-site rebuild, so future releases will land on /changelog/ automatically without further wiring.

[1.54.0] - 2026-05-20

✨ Brand identity refresh. The previous logo and cover were realistic 3D-rendered octopi clutching third-party AI assistant logos (Claude, GPT, Gemini, Copilot) on a baked-in dark background — visually busy, didn’t scale to favicon size, didn’t adapt to light mode, and pulled focus toward the third-party marks rather than Octopus itself. The new mark is a clean geometric octopus head with eight tentacles radiating outward into glowing terminal nodes — a literal “one source orchestrating many endpoints” metaphor matching what the tool actually does. Each asset ships in two transparent-PNG variants: electric cyan (*-dark.png, glowing strokes for dark surfaces) and deep indigo (*-light.png, solid strokes for light surfaces). Starlight’s logo config is rewired from a single src: to light: + dark:, so the docs site top-nav mark follows the user’s color scheme automatically. The README hero uses a <picture> element with prefers-color-scheme for the same behavior on GitHub. scripts/generate-brand.mjs is checked in so the asset set is reproducible: reads the OpenAI API key from a sibling project’s .env, calls gpt-image-1 with background: transparent, writes all four variants in one run. 🔧 site/scripts/sync-content.sh now copies all six brand PNGs into site/public/ at build (vs. just two), and .gitignore grows the matching synced-asset entries — images/ stays the source of truth, site/public/* stays generated. New site/src/pages/brand-preview.astro route renders every variant on light, dark, and transparency-checker tiles side by side so brand changes can be eyeballed locally at /brand-preview before promotion. 📝 README compacted from 427 lines to 78. The previous README had grown into a second handbook duplicating Quick Start, the full octopus control TUI walkthrough, the octopus run pipeline, the octopus ask streaming docs, and the entire .octopus.yml reference — all of which now live at https://leocosta.github.io/octopus/. The new shape is an overview-only card: <picture> hero, one-sentence pitch, what-you-get bullets, install one-liners, then a prominent CTA funneling readers into the docs site for the deep content. Architecture and contributing pointers were updated to link into the docs site instead of stale relative paths under docs/features/.

[1.53.1] - 2026-05-20

🎨 Use a dedicated logo asset for the docs site top-nav. The previous logo was images/cover.png — the wide cover image with the “AI Agents Orchestrator” tagline baked in — which worked as a hero but was too busy for the small top-nav slot on every doc page. New asset images/logo.png is a cleaner branded logo with the “OCTOPUS” wordmark on a light background; Starlight is configured with replacesTitle: true since the wordmark is in the image. cover.png stays as the landing-page hero referenced from site/src/pages/index.astro — different image for different surfaces. Sync script copies both into site/public/ at build time; both are gitignored under the synced-asset rule.

[1.53.0] - 2026-05-20

✨ Phase 2 of the docs site lands at https://leocosta.github.io/octopus/ — 11 hand-written rationale pages (plus 2 section index pages) covering every bundle and role Octopus ships. Each bundle page documents the team archetype it targets, the workflow it enables, the rationale for each included skill, the explicit exclusions (why certain skills did not make it in), and which other bundles compose with it. The 5 bundle pages: starter (foundation, 11 skills, no opt-out), quality (audit composer + architect role), docs (full doc lifecycle, 11 skills + writer role), backend (stack-aware patterns + backend-developer role), growth (multi-channel launch kits + marketer role). 📝 The 6 role pages document persona, frontmatter (model + color + tools allowlist where applicable), scope and boundaries (what the role owns vs does NOT own — explicit refusals), how the role behaves differently from the default agent, the workflow phases, and when to delegate vs when not to. The roles: architect (senior reviewer, BLOCKING/ADVISORY/QUESTION discipline, opus model), backend-developer (stack-aware implementer with fixed layer order), frontend-developer (UX / a11y / performance gates), marketer (approval-gated publishing, code-modification forbidden by tools allowlist), product-manager (SaaS metrics, problem-first, no code), writer (docs as product, RFC → Spec → ADR → Knowledge chain). Both section index pages (bundles/index.mdx, roles/index.mdx) frame the concept itself — how to pick a bundle, when to author a new one, role vs skill distinction, delegate mechanics. Site sidebar autogenerate picks up the new directories without config changes. Build verified: 19 pages, 1829 words indexed in Pagefind search.

[1.52.0] - 2026-05-20

✨ Phase 1 of the Octopus docs site lands at https://leocosta.github.io/octopus/. The site is built with Astro Starlight 0.32.6 (picked over Docusaurus, Jekyll, mdBook, and VitePress for being docs-native, MDX-native, Pagefind-search-native, and lighter than the React stacks) and deploys via a GitHub Actions workflow on every change to site/**, docs/site/**, images/cover.png, README.md, or CHANGELOG.md. Source-of-truth lives in docs/site/ (versioned alongside the code); site/ is just the renderer that reads from there. A site/scripts/sync-content.sh script hard-copies (not symlinks — they break Vite’s import resolution for @astrojs/starlight/components inside MDX) docs/site/* into site/src/content/docs/* at build time. 📝 Four hand-written Get Started pages (~700 lines of product-narrative content): What is Octopus frames the configuration-sprawl problem and Octopus’s role as the layer above Claude Code / Codex / Copilot / Gemini / OpenCode; Installation covers the one-liner installers, update flow, version pinning, source builds, and uninstall; Quick Start is a six-step walkthrough from octopus update through first-skill engagement, discovery commands, customisation, and optional daemon mode; Mental Model documents the five primitives (Bundle / Skill / Command / Hook / Role) with concrete examples and explicit non-primitives (rules, knowledge, MCP, meta-bundles). 🔧 site/STYLE.md locks the voice and page anatomy for the 90+ rationale pages landing in Phases 2–5. 🔧 Custom 404 page; sitemap and search index built automatically by Starlight; site title, social links, and edit-on-GitHub links wired to the leocosta/octopus repo. Reference / bundles / skills / commands / hooks / roles sections are stubbed in the sidebar but unimplemented in this phase — they ship in v1.53.0 through v1.56.0 per the plan in the v1.52.0 commit message.

[1.51.1] - 2026-05-20

📝 Roadmap status backfill — the ten Cluster 14 RMs (RM-075..084) shipped across v1.45.0 → v1.49.0 but were still listed as proposed in docs/roadmap.md. Each entry’s status now reflects its actual release: RM-075/076/077/079/080/081/082 shipped in v1.45.0, RM-078 shipped skill in v1.45.0 and command in v1.46.0, RM-083 shipped skill in v1.45.0 and command in v1.48.0, RM-084 shipped in v1.47.0. The In-Progress footer is rewritten to say “All clusters complete through RM-087; Cluster 14 shipped across v1.45.0 → v1.49.0; Cluster 15 shipped across v1.50.0 → v1.51.0”. This is exactly the kind of configuration drift that audit-config (RM-087) was designed to catch — running /octopus:audit-config would now flag any similar staleness in future commits.

[1.51.0] - 2026-05-19

✨ Ship RM-086 — Stop hook for CLAUDE.md / knowledge update proposals — closing Cluster 15. The Claude Code Stop-hook viability check confirmed that hooks receive transcript_path on stdin JSON, pointing at a JSONL file with full user + assistant turns and tool calls. The new hook hooks/stop/propose-knowledge-update.sh parses that transcript with jq and writes a proposal to .octopus/proposals/<timestamp>.md when any of three signals exceeds threshold: corrections (user messages starting with no, não, don't, stop, wrong, actually, instead, remove — strict start-of-message pattern reduces false positives), re-reads (same file Read’d 3+ times — threshold of 3 skips the normal edit cycle of read → edit → review), and re-greps (same pattern grep’d 3+ times — recurring searches usually mean the answer belongs in CONTEXT.md or a skill description). The hook is read-only on the project tree and writes only to .octopus/proposals/ (gitignored). Empty proposals are never written. Promotion to CLAUDE.md / knowledge/ / rules/ happens via the new /octopus:review-proposals command under human review — four dispositions (promote, partial, archive, discard) route promote/partial through the owning skill (continuous-learning, doc-adr, doc-subcontext) so discipline applies. Smoke-tested against a real Octopus session transcript: detected 3 Portuguese corrections and 10 files re-read 3+ times (one file 48× — clear knowledge-gap signal). 🔧 Graceful degradation: if jq is missing or transcript_path is absent (older Claude Code or other agents), the hook exits 0 silently. 📝 Roadmap marks Cluster 15 complete.

[1.50.0] - 2026-05-19

✨ Ship two of the three Cluster 15 gaps identified against Anthropic’s “How Claude Code Works in Large Codebases” article. RM-086 (Stop hook for knowledge update proposals) is deferred pending a Claude Code Stop-hook viability check. RM-085 — doc-subcontext skill + /octopus:doc-subcontext command closes the article’s top scaling gap: per-module CLAUDE.md files in monorepos. The skill reads the parent chain first to avoid duplication, asks only about conventions unique to the chosen subdirectory, writes lean (target 50–100 lines), and cross-references the parent with “inherits from ../CLAUDE.md” instead of copying — registered in the docs bundle next to doc-adr and doc-lifecycle. RM-087 — audit-config skill + /octopus:audit-config command closes the article’s 3–6 month freshness audit gap. Five checks run over rules/, skills/, hooks/, commands/, bundles/: (a) model-specific assumptions like “Opus 3” or “Claude 3.5”; (b) stale date references older than 9 months without a successor; (c) phantom skills with no triggers: and no routing cue in the description; (d) hooks untouched since the last model-family change (heuristic); (e) commands referencing deprecated paths — the canonical example is the docs/superpowers/plans/ cleanup from v1.49.x. Severity-tiered report (⛔ block / ⚠ warn / ℹ info) in the same shape as audit-all. Read-only — never auto-fixes; the user applies fixes as separate commits. Has triggers: frontmatter for auto-engagement on configuration-surface edits, and is registered in the quality bundle next to audit-all and refactor-deepen. 🧪 Tests in test_bundles.sh updated for the new quality skill (Test 7 union expected list, Test 9 expansion count 17 → 18). 📝 Roadmap marks RM-085 and RM-087 as shipped (v1.50.0); RM-086 remains proposed.

[1.49.3] - 2026-05-19

📝 Add Cluster 15 to docs/roadmap.md based on a gap analysis against Anthropic’s “How Claude Code Works in Large Codebases — Best Practices and Where to Start” blog post. Octopus already covers most of the article’s recommendations (skills, hooks, subagents, MCP templates, plan-before-code, codebase maps via map-system, plugin/marketplace distribution via bundles, restart/handoff via context-handoff, continuous learning). Three gaps were identified and roadmapped: RM-085 (🟠 High) — subdirectory CLAUDE.md tooling, the article’s top scaling practice that Octopus does not currently support beyond the root file; RM-086 (🟡 Medium) — Stop hook for CLAUDE.md / knowledge update proposals, automating what continuous-learning does manually today; RM-087 (🟡 Medium) — configuration freshness audit, scanning rules/skills/hooks/commands/bundles for model-specific assumptions, stale dates, deprecated paths, and skills without triggers. LSP integration is acknowledged as a Tier B gap but parked pending explicit demand. This release is report-only — no skills, commands, or hooks implemented; the cluster awaits prioritisation.

[1.49.2] - 2026-05-19

📝 Complete the docs/superpowers/plans/ purge started in v1.49.1. The directory contents were untracked there; this release removes the path from the active codebase — skills/plan-backlog/SKILL.md no longer autodetects it, commands/plan-backlog.md and docs/features/plan-backlog.md drop it from the scan paths, commands/doc-design.md and docs/specs/doc-design-command.md point at existing docs/plans/ instead of the external pattern source, and docs/specs/doc-plan-command.md rephrases the two contrast mentions to “external plan-storage convention” instead of naming the directory. Plugin references (superpowers:brainstorming, superpowers:writing-plans, superpowers:systematic-debugging, etc.) are deliberately kept — they document real integration with the externally-installed superpowers plugin (routing between overlapping skills, hand-off to more appropriate siblings, historical motivation for Octopus skills).

[1.49.1] - 2026-05-19

🔧 Stop tracking docs/superpowers/ contents. The 8 plan and spec files under that directory were committed before /docs/superpowers was added to .gitignore; git ignores .gitignore entries for already-tracked files, so they remained in the index. Untracked via git rm --cached (files stay on the user’s disk locally so superpowers workflows continue to work), and /.superpowers/ added to .gitignore so the root-level plugin cache is explicitly ignored too. References to the docs/superpowers/plans/ path in plan-backlog, doc-design, doc-plan, and related skills/commands are unchanged — those are directory-scan conventions, not file links, and remain valid even when the directory is untracked.

[1.49.0] - 2026-05-19

✨ Adds triggers: frontmatter to three Cluster 14 skills that have real, non-ambiguous routing signals, matching the pattern already used by audit-money (keywords), compress-skill (paths), and plan-backlog (paths). triage-issues engages on .github/ISSUE_TEMPLATE/** and .out-of-scope/** paths plus the state-transition vocabulary (triage, wontfix, needs-info, ready-for-agent, out-of-scope) — editing those paths or using that language IS triage work. prototype engages on **/__prototype__/**, **/LOGIC.md, and **/UI.md paths plus the keywords prototype, throwaway, sanity-check — re-engaging when the user opens an existing prototype directory or one of the skill’s canonical artifacts is the highest-signal moment to resurface its discipline. scaffold-skill engages on keywords only (new skill, create skill, scaffold skill, author skill, scaffold-skill) because the skill creates files that do not exist yet, making path-based engagement impossible. The other seven Cluster 14 skills (doc-align, test-tdd, refactor-deepen, map-system, doc-prd, context-handoff, interview) are deliberately left without triggers: — they are workflow-initiated or manual-invocation-only by design, and adding file-reactive triggers would either fire on every edit (noise) or violate the skill’s own discipline (in the case of map-system).

[1.48.0] - 2026-05-19

🔧 Cluster 14 cleanup release fixing one blocker and two self-consistency bugs found in an audit pass, plus one coverage gap closed. 🐛 The bundle-assertion tests (tests/test_bundles.sh tests 5, 7, 9) hardcoded expected skill lists from before Cluster 14 expanded starter by 4 skills (test-tdd, map-system, prototype, context-handoff) and quality by 1 (refactor-deepen) — the tests would have failed on the next CI run; the expected lists and the bundle-expansion count assertion (12 → 17) are now updated. 📝 The scaffold-skill REFERENCE.md mandated a capability + "Use when …" shape for skill descriptions, but zero existing Octopus skills follow that shape (debug, implement, delegate, audit-money, compress-skill, plan-backlog, doc-lifecycle all use capability + integration cues like “Active by default on every bug-triage task; pairs with implement”); the rule is now softened to “capability + integration cues (pairs / active by default / family / triggers)”, the Good description example is replaced with the actual audit-money description, and a note about the triggers: frontmatter field (used by audit-money, compress-skill, plan-backlog) is added. 📝 interview’s description was the only skill following the old (incorrect) mandate after v1.47.1; it is now normalised to the Octopus shape — “pairs with doc-research” replaces the “Use when …” sentence, with no information loss (the boundary cue is preserved in When to Engage and Integration with Other Skills). ✨ New /octopus:scaffold-skill slash command for parity with the other Cluster 14 commands (/octopus:doc-prd, /octopus:triage-issues, /octopus:prototype, /octopus:context-handoff, /octopus:map-system, /octopus:interview) — scaffold-skill is an explicit user-facing entry point (“I want to create a new skill”) and deserves a canonical invocation; follows the exact pattern of commands/map-system.md.

[1.47.1] - 2026-05-19

📝 Clarify the boundary between /octopus:interview and /octopus:doc-research in the agent-facing descriptions and the When to Engage / Purpose sections. Both surfaces ask “one question at a time” and can be triggered by phrases like “let’s think about X”, so the picker needs a clean differentiator: interview scopes one feature or problem into concrete intent, doc-research explores an area and generates multiple backlog items. The integration section in skills/interview/SKILL.md now documents the natural sequencing doc-research → picks RM-NNN → interview → doc-align → doc-prd → implement.

[1.47.0] - 2026-05-19

✨ New interview skill + /octopus:interview slash command (RM-084) close the gap missed in the initial Cluster 14 batch. The skill is the greenfield counterpart to doc-align — it runs when the user has an idea but no plan yet, with no dependency on CONTEXT.md or docs/adr/. It walks the decision tree one question at a time (never batched, never “and also…” hedges), prefers open-ended over yes/no questions, recaps the established branches every 3–5 turns in the same format used by triage-issues needs-info notes, and recognises tree resolution to stop without padding. The output is a confirmed intent summary ready to hand off to doc-align (validate against docs), doc-prd (package as a ticket), or implement (start immediately). This establishes the natural flow interview → doc-align → doc-prd → implement (establish → validate → package → execute). Registered in the docs bundle next to its siblings doc-align, doc-prd, triage-issues, and scaffold-skill. 📝 Roadmap updated with RM-084 in Cluster 14.

[1.46.0] - 2026-05-19

✨ New /octopus:map-system slash command. The map-system skill (added in v1.45.0) is manual-invocation only by design — agents must not engage it autonomously from task signals — so until now the only trigger was natural-language phrasing like “zoom out” or “map this”. The new command makes the invocation canonical and discoverable through the slash-command list alongside the other engineering process commands (/octopus:doc-prd, /octopus:triage-issues, /octopus:prototype, /octopus:context-handoff).

[1.45.0] - 2026-05-19

✨ Nine new engineering process skills land under Cluster 14 (RM-075..083), adding the individual-developer process layer that frames how a developer — or an agent acting as one — makes decisions inside a single session. The starter bundle gains test-tdd (standalone red-green-refactor loop with an explicit ban on horizontal slicing), map-system (manual-invocation system map in domain vocabulary), prototype (throwaway code with a strict logic-vs-UI bifurcation gate and no persistence by default), and context-handoff (session compaction saved to the OS tmp dir, never the workspace, with mandatory secret redaction and a prescriptive “suggested next skills” section). The docs bundle gains doc-align (plan grilling against CONTEXT.md and docs/adr/ with the ADR triple-gate enforced), doc-prd (synthesises the current conversation into a tracker-ready PRD without re-interviewing, forbidding file paths and code snippets in the body except for prototype-derived ones), triage-issues (state-machine triage with a mandatory AI disclaimer on every generated comment and rejected enhancements recorded in .out-of-scope/), and scaffold-skill (creates new skills end-to-end and registers them into a bundle as part of the same flow — no skill ships loose). The quality bundle gains refactor-deepen, which finds shallow-module deepening opportunities through the deletion test and a canonical Module/Seam/Adapter vocabulary. Four skills also ship explicit slash commands (/octopus:doc-prd, /octopus:triage-issues, /octopus:prototype, /octopus:context-handoff) and three skills (refactor-deepen, prototype, scaffold-skill) split distinct lookup sub-domains into REFERENCE.md next to the main SKILL.md. 📝 docs/roadmap.md adds Cluster 14 documenting all nine items with bundle assignment and the design pillars behind each one.

[1.44.0] - 2026-05-16

✨ New rules/typescript/ui-conventions.md rule template for frontend projects. Codifies input mask conventions (CPF, CNPJ, phone, CEP, date, currency) so AI assistants always use the designated mask component and formatter helpers instead of generating raw <input> elements. Teams override with .octopus/rules/typescript/ui-conventions.local.md to supply their actual component names, mask patterns, import paths, and Zod schemas — delivered automatically via the existing .local.md symlink mechanism.

[1.43.0] - 2026-05-16

✨ The typecheck.sh hook now injects type/build errors back into Claude’s context so it self-corrects without manual intervention. Previously it only printed errors to the hooks panel (invisible to Claude). It now returns {"decision": "block", "reason": "<errors>"} — Claude Code feeds the reason back to Claude in the same turn, which then fixes the code automatically. Covers TypeScript (tsc), Python (mypy/pyright), and C# (dotnet build).

[1.42.5] - 2026-05-16

🐛 Fixed typecheck.sh not running dotnet build in .NET projects — the hook was calling dotnet build from the wrong directory, failing with MSB1003 (no project file found). Now applies the same .sln/.csproj walk-up discovery used in auto-format.sh. Claude Code will now see compilation errors (e.g., void Foo() without a body) after each edit and self-correct.

[1.42.4] - 2026-05-16

🐛 Fixed PostToolUse formatter hooks never running. The hooks were reading file_path from the top-level JSON, but Claude Code sends it inside tool_input — so the path was always empty and the hook exited silently without formatting anything. Also fixed dotnet format --include silently ignoring absolute paths when a project directory is specified; the hook now cds into the project root and passes a relative path. Affected: auto-format.sh, console-log-warn.sh, typecheck.sh.

[1.42.3] - 2026-05-16

🐛 Fixed Stop hook error (“Failed with non-blocking status code”) in projects that are not git repositories. console-log-check.sh called git diff inside a set -euo pipefail subshell — git exits 128 outside a repo, propagating as 129. Now exits 0 cleanly when no git repo is detected.

[1.42.2] - 2026-05-16

🐛 Fixed dotnet format not running in projects that have a .csproj but no .sln. The auto-format.sh project discovery used compgen -G with two patterns in one call — compgen only accepts one pattern, so .csproj files were never found. Now uses separate compgen -G calls for .sln and .csproj.

[1.42.1] - 2026-05-16

🐛 Fixed hooks and workflow not being enabled after running octopus setup --reconfigure with the fzf picker. Default-on features were reset to false before parsing fzf output — since fzf multi-select is opt-in, not toggling an item means “keep the default”, not “disable it”. Hooks and workflow now stay enabled unless explicitly toggled off.

📝 README pipeline examples updated to English only.

[1.42.0] - 2026-05-16

✨ The delegate skill now supports multi-step role pipelines. A single message with multiple @role: mentions and sequencing language (PT-BR or EN: após, then, after, ao final, etc.) automatically enters pipeline mode. Octopus shows a plan preview, validates all roles before starting, executes each step with the previous outputs as context, and asks for confirmation at each gate. Roles joined by “e”/“and” are dispatched in parallel in a single turn. The --auto flag (or “rode tudo de uma vez”) runs all steps without stopping. A role alias table resolves shorthands (pm, staff-engineer, frontend-specialist, backend, etc.) to their canonical names. Pre-flight validation reports missing roles with installation hints before any dispatch runs.

[1.41.4] - 2026-05-16

🎨 All slash command descriptions now carry an (Octopus) prefix, making them easy to distinguish from other plugins in the Claude Code / menu.

[1.41.3] - 2026-05-16

🐛 Fixed slash commands showing no description in the / menu. The setup script was stripping the YAML frontmatter from command files before writing them — removing the description: field that Claude Code reads to populate the menu. Commands now include their full frontmatter.

[1.41.2] - 2026-05-16

🐛 Fixed SPACE not toggling items in the fzf picker — it was documented as a toggle key but never bound, so fzf used its default (cursor-down). SPACE and TAB now both toggle selection; TAB also advances the cursor and shift-TAB goes back. Removed an incorrect --nth=1 flag that was limiting search scope. Picker height increased to 80% for better readability.

[1.41.1] - 2026-05-16

🐛 Fixed octopus update not installing bundled fzf binaries. The installer was downloading the bare git archive (archive/refs/tags/) which contains only source files, not the fzf binaries built by CI. It now downloads the release asset (releases/download/) which includes bin/fzf/ for all platforms. The release tarball is also restructured to include a versioned root directory (octopus-<tag>/) so the installer’s extraction logic works correctly. After running octopus update, the fzf picker will appear automatically during octopus setup.

[1.41.0] - 2026-05-16

✨ The setup picker now supports multi-bundle selection. In the bash fallback, entering 1, 3 or 1 2 3 selects multiple bundles; invalid numbers trigger a re-prompt with a clear error instead of silently defaulting to starter. The fzf picker (available after updating to v1.40.0+) collects all TAB-selected bundles rather than discarding extras. The --bundle= CLI flag also accepts comma-separated values (--bundle=starter,docs) for non-interactive setups. The generated .octopus.yml lists each selected bundle as a separate entry under bundles:.

[1.40.0] - 2026-05-16

✨ This release delivers Cluster 13 — Rules override consistency & formatter hooks, a complete overhaul of how Octopus manages coding rules across assistants, teams, and developer environments.

✨ Rules now support a four-layer override hierarchy: Octopus defaults → workspace shared repo → personal ~/.octopus/rules/ → project .octopus/rules/. A new workspace: key in .octopus.yml lets teams point to a shared repository so organisation-wide standards propagate automatically to every project. Personal overrides in ~/.octopus/rules/ apply across all projects without committing anything to the repo.

✨ The symlink delivery mode now picks up .local.md overrides immediately — no octopus update required after creating an override file. For agents using concatenate mode (Gemini), post-merge and post-checkout git hooks detect .local.md changes after a pull or branch switch and re-run setup automatically.

✨ Copilot and Codex manifests were updated to native_rules: true. Copilot rules are now symlinked to .github/instructions/ as .instructions.md files; Codex rules land in .codex/rules/. Both agents also receive an auto-generated “Coding Rules” section in their main config file pointing to the correct paths, matching the behaviour Claude already had via template injection.

✨ A new rules/csharp/coding-style.md preset ships with Octopus, covering the Allman brace convention, var usage, null handling, and expression bodies. All rule files in rules/csharp/ and rules/common/ now carry an Override: or Extend-only: header so teams know exactly what they can customise.

🔧 Formatter hooks are now bundle-aware: deliver_hooks filters hooks tagged with a stacks field against OCTOPUS_RULES, so TypeScript-only hooks like console-log-warn are not injected for C#-only projects. Teams can override any default formatter by providing .octopus/hooks/hooks.local.json. The auto-format.sh dotnet handler was also improved to discover the nearest .sln/.csproj and pass --no-restore.

📝 The roadmap was updated to record all eight RM entries (RM-067–074) as completed.

[1.39.0] - 2026-05-12

✨ This release replaces the TUI setup wizard with setup-picker.sh, a single-screen selector that uses fzf (now bundled in the release tarball) or a plain bash fallback — no whiptail, no dialog, no ncurses windows. octopus setup is now flag-first: --bundle, --scope, --stack, --no-hooks, and --no-workflow deliver everything without interaction; non-interactive environments (CI/pipe) fall back to silent defaults.

♻️ Bundles have been reorganized by team intent instead of tech stack. The new docs, quality, and backend bundles replace documentation, saas-quality, quality-leadership, dotnet-api, node-api, and fullstack. Stack-specific content (.NET, TypeScript) moved to the --stack flag. The setup.sh delivery output was also compacted: one ✓ line per group instead of banners and KV tables.

🚀 fzf binaries are now downloaded at release build time for linux-amd64, linux-arm64, darwin-amd64, darwin-arm64, and windows-amd64, ensuring the picker works without external dependencies.

📝 RM-065 (frontend bundle) and RM-066 (fullstack bundle) added to the roadmap for future tracking.

[1.38.1] - 2026-05-10

🐛 Fixed the SessionStart hook (load-context.sh) silently exiting with a non-zero code on every session start. The script used set -euo pipefail, causing grep to abort the script when .octopus.yml had no knowledge_dir: key or the knowledge INDEX.md had no active modules — both common conditions. The -e flag has been removed and || true added to the affected pipelines. A secondary bug in dotnet detection ([[ -f "*.sln" ]] never matches globs) was also fixed.

[1.38.0] - 2026-05-10

✨ This release introduces the delegate skill — a new way to dispatch tasks to Octopus roles without leaving the active harness session. Typing @backend-developer: add endpoint X in any conversation causes the orchestrating agent to forward the task to that role and return the result inline with attribution (» <role> respondeu:). The same flow is available as a slash command via /octopus:delegate @<role> <task>.

🐛 Two refinement passes followed the initial implementation: an overly broad @-keyword trigger that fired on emails, GitHub handles, and decorators was removed from the skill’s frontmatter, and harness detection was rewritten to check Agent tool availability rather than harness name — making the skill genuinely harness-agnostic. The command file’s Instructions section was also corrected to follow the “The skill owns the full workflow — do not reinterpret it here” pattern used by peer commands, eliminating duplicated parsing logic.

🔧 The delegate skill has been added to the starter bundle so new and existing projects receive it automatically on the next setup.sh run.

[1.37.0] - 2026-04-27

✨ A new content-images skill generalizes the image generation pattern into a reusable Octopus capability. The skill generates brand-consistent images for blog covers (OG 1200×630), Instagram feed posts (1080×1080), and carousels using Google Gemini Imagen — with Pollinations.ai as a free fallback when no API key is available. Brand context is read from a per-project .octopus/content-images.json preset; the GEMINI_API_KEY is resolved from .env.octopus. Generation is cached by output file path and respects a --force flag for regeneration. The social-media agent gains a Phase 4.5 (Image Asset Protocol) that prompts the user to generate visual assets at the end of every content session. The skill is added to the growth bundle alongside launch-feature and launch-release.

[1.36.1] - 2026-04-26

🐛 Fixed the Octopus Control dispatch UX. The fragile double-click detection (timing guard via Textual’s RowHighlighted + RowSelected events) that never worked reliably has been removed. Pressing [a] now pre-fills the command bar with @<role>: when an agent row is highlighted — delivering the intended UX without mouse event complexity. The on_input_changed toaster that interrupted typing by showing “Pipeline mode: press [p]” whenever the user typed @ has also been removed.

[1.36.0] - 2026-04-25

✨ A new /octopus:commit slash command is now available, providing a lightweight way to commit changes without following the full development workflow. The command reads the staged diff, resolves language configuration the same way pr-open does, detects tracker references (RM-NNN, Jira IDs, GitHub issues) and includes them in the commit footer, and warns when the diff spans multiple unrelated logical contexts. Every generated commit automatically includes a Co-authored-by: octopus[bot] trailer to mark tool participation. The commit conventions documentation was updated to document this new trailer and clarify its distinction from AI assistant trailers.

[1.35.0] - 2026-04-25

✨ octopus update now automatically re-runs octopus setup after installing a new release, so agent configs (commands, skills, rules) are always regenerated to reflect the new version. If setup fails — for example when downgrading to an older release that predates the setup command — a warning is printed and the update still succeeds. If no .octopus.yml is found in the project tree, setup is skipped with a clear message. A new commands/update.md template was added so the /octopus:update slash command is properly delivered by setup going forward.

[1.34.0] - 2026-04-25

♻️ This release delivers a complete rebranding of all roles, skills, and bundles to eliminate naming inconsistencies and clarify the boundaries between who an agent is (roles) and what it does (skills).

Roles now use short job titles: backend-specialist → backend-developer, frontend-specialist → frontend-developer, tech-writer → writer, social-media → marketer, staff-engineer → architect. A new architect role covers system design review and quality gates.

Skills were reorganized under category prefixes: the audit-* group covers pre-merge quality checks (audit-money, audit-security, audit-tenant); doc-* groups documentation skills (doc-adr, doc-lifecycle, doc-design, doc-plan); review-* covers code review processes (review-pr, audit-contracts); and launch-* covers go-to-market publishing (launch-feature, launch-release). Several skills also received shorter names: debug → debug, plan-backlog → plan-backlog, e2e-testing → test-e2e.

Bundles were renamed to plain-English team situations: quality-gates → saas-quality, docs-discipline → documentation, cross-stack → fullstack. A new quality-leadership bundle was added for the architect role. All bundle YAML files, the setup wizard, README, and .octopus.example.yml were updated accordingly. 📝

This release also includes 🐛 two control panel fixes: the known roles list now reloads on every poll cycle (fixing the missing agent issue), and double-click in the agent roster now opens the command bar pre-filled with the selected role.

[1.33.3] - 2026-04-25

🐛 Fixed double-click on agent — definitive fix after three failed attempts.

Root cause (two layers): (1) Textual’s DataTable._on_click calls event.stop(), so Click events never reach the App-level on_click handler — all three previous attempts were targeting an event that simply never arrived. (2) _refresh_roster() calls table.clear() every 0.3s, resetting DataTable’s internal state so RowSelected never fires via mouse (only via Enter key).

Fix: Double-click is now detected by timing two consecutive RowHighlighted events for the same role within 400ms. A _refreshing_roster flag prevents the programmatic cursor restore inside _refresh_roster() from triggering false positives. Extracted _open_command_for_role() helper is shared between the double-click handler and action_add_task.

[1.33.2] - 2026-04-25

🐛 Fixed crash on double-click in the agents roster. Textual uses event.chain (not event.count) for click repetition count — the v1.33.1 fix crashed on the first click. Now reads chain with a fallback to count for forward compatibility.

[1.33.1] - 2026-04-25

🐛 Two fixes in this patch.

Double-click on agent now works — the previous implementation used DataTable.RowSelected, which only fires on Enter, not on mouse double-click. Replaced with on_click + event.count >= 2 for proper double-click detection.

octopus update always fetches the latest installer — the update shim was reusing the cached version’s install.sh (which could have the old banner or other outdated behavior). It now fetches install.sh fresh from GitHub main before each update, falling back to the cached copy only if the network request fails.

[1.33.0] - 2026-04-25

Three polish improvements across the installer and octopus control.

✨ Double-click to delegate — double-clicking (or pressing Enter) on any agent in the roster now opens the command bar pre-filled with @role: , ready to type a task. This mirrors the a keybind but is more discoverable for mouse users.

🎨 Installer banner removed — the large ASCII art octopus at the start of install.sh has been replaced with a clean 🐙 OCTOPUS CLI Installer one-liner. Faster to read, friendlier in narrow terminals and CI logs.

🐛 Agents panel wider — the roster column grew from 38 to 52 characters wide (minimum 38), eliminating the horizontal scrollbar that appeared when agent status lines were long.

[1.32.0] - 2026-04-25

✨ Natural language pipeline builder — the biggest addition this release. Press [p] in octopus control to open an interactive pipeline builder directly in the TUI. Define multi-agent workflows visually: each step shows the agent, a wait toggle, and the task prompt. Navigate with j/k, add steps with a, delete with d, toggle approval gates with w, and confirm the pipeline with p.

✨ NL pre-fill from @mentions — type a description with @role-name mentions in the command bar before pressing [p] and the builder opens pre-populated. The parser detects review verbs (review, valide, approve, aprova…) and automatically sets wait=true on those steps, infers parallel tiers from connectors like e, and, em paralelo, and flags ambiguous steps in yellow for manual correction.

✨ @system steps — pipelines can now include @system steps that execute shell scripts instead of launching a Claude Code agent. The built-in merge_to_develop action is available out of the box; custom actions can be defined in .octopus/system_actions.yml. Undefined actions raise an error before execution; failed system steps pause the pipeline with a clear message.

✨ staff-engineer role — new role for architecture review and senior code review. Uses the opus model by default. Classifies findings as BLOCKING, ADVISORY, or QUESTION, validates against ADRs, and only approves when correctness, security, architecture, and test coverage all pass.

📝 The spec for the natural language pipeline builder is documented in docs/specs/nl-pipeline-builder.md. ♻️ Minor cleanup: inline imports in app.py moved to module level.

[1.31.0] - 2026-04-25

This release closes the seven items in Cluster 11 — Control reliability & ergonomics. ✨

Cancel and retry tasks directly in the TUI — two new keybindings make queue management frictionless: x cancels a selected queued task before it runs, and e re-enqueues a failed or done task without leaving the dashboard.

Terminal bell + desktop notification on agent completion — when an agent finishes or fails, octopus control now emits a terminal bell (\a) and attempts a desktop notification via notify-send (Linux) or osascript (macOS), so you can step away while tasks run.

--model flag in the TUI command bar — any inline command now accepts --model opus|sonnet|haiku (or a full model ID). The flag is stripped before routing to the skill matcher and applies to both new tasks and session replies (↩ role:).

octopus ask --reply — continue an existing agent session from the CLI without opening the TUI: octopus ask tech-writer --reply "yes, proceed". Streams the response live, identical to a fresh octopus ask.

✨ Per-task log files — agent logs are now named <role>-<task-id>.log with a <role>.log symlink pointing to the latest, so historical task output is no longer overwritten when a role is reused.

Daemon mode — octopus control --daemon start runs the dispatch loop headlessly (no Textual UI), enabling CI pipelines and long overnight runs. --daemon stop sends SIGTERM via .octopus/daemon.pid; --daemon status checks liveness.

[1.30.0] - 2026-04-24

You can now dispatch multiple tasks to the same agent. ✨

Multi-task queue per agent — pressing a on any agent (busy or idle) now prefills @role: in the command bar, making it frictionless to queue additional tasks while one is already running. The dispatch engine already executed tasks sequentially; only the UX was missing.

+N queued badge in roster — agents with pending tasks show a dim badge (e.g. +2 queued) next to their status in the roster, so you can see the backlog at a glance without opening the queue panel.

[1.29.1] - 2026-04-24

🐛 Fixed spinner continuing to run after an agent finishes. Completed claude processes were becoming zombies — os.kill(pid, 0) on a zombie succeeds, so the TUI incorrectly treated them as still running. The reap check now calls proc.poll() first, which triggers waitpid() and properly reaps the zombie, returning the exit code. os.kill is only used as a fallback for adopted orphan processes.

[1.29.0] - 2026-04-24

Two improvements to the agent reply experience in octopus control. ✨

Reply visible in Output panel — when you send a reply to an agent via r, your message now appears in the log before the agent’s response, formatted as ── you ── / ── agent ── separators. Previously only the agent’s output was recorded.

“Awaiting reply” status in roster — agents that have finished and are waiting for user input now show ↩ awaiting reply in amber instead of continuing to spin. The roster now has three distinct states: spinner for actively running agents, amber ↩ awaiting reply for agents with an open session, and dim ○ idle for free agents.

[1.28.3] - 2026-04-24

🐛 The Output panel now occupies half the screen height instead of a fixed 12 lines. Previously the queue took two-thirds of the right column while the log viewer was too small to be useful. Queue and schedule now split their area equally, and the Output panel grows with the terminal size.

[1.28.2] - 2026-04-24

🐛 Fixed flag name for skipping permission prompts in agent launches — --dangerouslySkipPermissions (camelCase) was corrected to --dangerously-skip-permissions (kebab-case), which is the actual flag accepted by the Claude CLI.

[1.28.1] - 2026-04-24

🐛 Agents launched by octopus control and octopus ask no longer prompt for permission before writing files. Running non-interactively via --print, these dialogs had no way to be approved through the normal UI — agents would stall and output instructions asking the user to manually approve each write. The --dangerouslySkipPermissions flag is now passed at launch time; the destructive-guard hook remains as the safety layer for genuinely dangerous operations.

[1.28.0] - 2026-04-24

This release improves the octopus control dashboard with animated feedback and several usability fixes. ✨

Animated queue spinner — running tasks in the queue panel now display an animated braille spinner (⠋⠙⠹…) instead of a static ●, making it immediately clear that an agent is actively working. A dedicated 0.3s timer drives the animation independently from the 2s poll that handles log reads and process checks, so the TUI stays responsive without extra I/O overhead.

🐛 Output panel stays pinned to selected agent — clicking between agents in the roster now correctly updates the Output panel to the selected agent’s log. Previously, the 0.3s roster refresh was clearing and rebuilding the DataTable, losing the cursor position and resetting the output to whichever agent landed on row 0.

🐛 Reply input no longer selects prefilled text — pressing r to reply to an agent prefills the command bar with ↩ role:, but focus processing was causing the text to appear selected, so the first keystroke would erase it. The prefill is now applied after focus completes, so you can type immediately without losing the prefix.

[1.27.1] - 2026-04-24

This patch release fixes two octopus control reliability issues. 🐛

Stuck “running” tasks — tasks whose processes had died were left indefinitely in the queue with a “running” status, making Ctrl+D cleanup ineffective. The TUI now reconciles process state against the queue on startup and before every cleanup sweep, so stale entries are correctly transitioned to “done” or “failed”.

Empty agents roster — opening octopus control showed no agents unless at least one was already running. The roster now loads all roles configured in .claude/agents/ at startup and displays them as idle, giving you the full picture from the moment the dashboard opens.

[1.27.0] - 2026-04-24

✨ Agent reply — bidirectional interaction via session resume

Agents launched by octopus control and octopus ask can now be replied to, enabling multi-turn conversations without restarting a task.

Under the hood, agents now run with --output-format=stream-json --verbose. A background parser thread reads the JSONL output, extracts the session_id from the first event, and writes it to .octopus/sessions/<role>.session. Plain text is still written to the log as before, so streaming and the Output panel are unaffected.

A new [r]eply keybinding in the TUI opens the command bar pre-filled with ↩ <role>: when the selected agent has a resumable session. Submitting the reply calls launch_resume(), which runs claude --resume <session_id> --print "<reply>" and appends the new turn to the existing log with a ── reply ── separator. The Output panel streams the resumed session live. Multiple back-and-forth turns are supported — each turn captures a new session_id. Agents with a resumable session show a subtle ↩ indicator in the roster.

octopus ask prints the session file path at the end of every run so users know a TUI reply is available without opening the dashboard.

[1.26.0] - 2026-04-24

✨ Control & Run UX overhaul — octopus ask, @role: delegation, mini-feed, pipeline progress

The octopus control and octopus run experience is now significantly more usable with six targeted UX improvements.

A new octopus ask <role> "task" command provides terminal-first delegation: it launches a specific agent and streams its log to stdout in real time, printing timestamps on each output line and a ✓ done / ✗ failed summary with elapsed time at the end. Ctrl+C during streaming prompts [k]ill [d]etach [c]ancel so agents can be detached to run in the background and later picked up by octopus control.

The TUI command bar now understands @role: prefix syntax — typing @tech-writer: write the ADR routes the task to the correct agent regardless of cursor position. Selecting an idle agent in the roster and pressing a (or Enter) pre-fills @<role>: in the command bar so delegation is a single gesture. The agents roster now shows the last line of each agent’s log inline, dimmed, so users can monitor all parallel agents at a glance without switching the output panel. Navigating the agents table with arrow keys now updates the Output panel to that agent’s full log in real time.

✨ pipeline.py now emits structured progress lines throughout execution — → id agent body on task start, ✓/✗ id agent Ns on completion, and a final ✓/✗ pipeline done Ns summary — so octopus run gives live per-task feedback instead of silence.

🔧 A named constant _LOG_WAIT_POLL was extracted and a missing-log guard was added to ask.py to handle the case where an agent fails to start.

[1.25.0] - 2026-04-23

✨ Pipeline runner — octopus run, DAG executor, and control UI overhaul

The centerpiece of this release is the end-to-end pipeline runner: starting from a requirement in any form (free text, GitHub issue, or existing spec), Octopus now orchestrates multiple agents in parallel all the way to an automatically opened PR. The new octopus run command serves as a unified entry point, chaining doc-research → doc-plan → execution → review gate → PR without manual intervention between steps.

The execution core lives in cli/control/pipeline.py, which reads the new enriched plan format — a pipeline: YAML frontmatter block with per-task agent and depends_on fields — and builds a dependency graph (DAG). Tasks with no shared dependencies run in parallel in isolated git worktrees; dependent tasks wait for their predecessors to finish. Plan checkboxes are ticked in real time as tasks complete, and a reviewer agent is dispatched automatically when review_skill is configured. The octopus control --plan <file> flag exposes the runner non-interactively with --dry-run support.

/octopus:doc-plan gained a Step 3b that auto-generates the pipeline frontmatter, inferring the responsible agent from task keywords (migration/endpoint/API → backend-specialist, component/UI/form → frontend-specialist, doc/README/ADR → tech-writer, review/audit → reviewer) and the dependency chain between tasks. The plan-skeleton.md template was updated to include the pipeline: block by default.

🎨 The octopus control TUI received a full visual overhaul: the PID column was replaced by elapsed time with a spinner (e.g. ⠙ 2m34s); all panel borders now show dynamic titles (Agents, Queue 2 running · 1 waiting, Output · backend-specialist · live); layout proportions were corrected (queue 2fr, schedule 1fr); background darkened to #080c14 with visible but subtle borders; the 🐙 emoji was added to the window title. 🐛 The redundant ID column was removed from the Schedule panel.

🔧 .worktrees/ was added to .gitignore to support the worktree isolation system.

[1.24.0] - 2026-04-23

✨ This release completes the octopus control TUI dashboard with the UX and correctness gaps identified during first real use (RM-045 to RM-052).

The log panel now uses a scrollable RichLog widget that streams all agent output in real time — replacing the single-line Label that showed only the last line. The agent roster gains an animated spinner to visually confirm that a process is alive. Selecting a completed or failed task in the queue list loads its full log from disk into the same panel, making post-run inspection straightforward.

Skill discovery in the command bar is now driven by SuggestFromList typeahead: typing / filters available skills inline. Ambiguous natural-language matches surface a warning instead of silently dispatching to the wrong skill; single-match NL hits show the resolved skill in the input for confirmation before enqueue.

On the correctness side, ProcessManager now stores Popen objects and exposes exit_code() via poll(). Dead agents are marked done or failed based on their actual exit code rather than always assumed successful. The Scheduler thread — previously defined but never instantiated — is now wired into on_mount and dispatches tasks whenever a .octopus/schedule.yml entry fires. Queue cleanup lands as TaskQueue.cleanup(keep_last), running automatically every 30 polling ticks and exposed as Ctrl+D for manual use. The worktrees/ directory that ProcessManager created at startup but never used is now backed by working create_worktree / remove_worktree helpers; launch(isolate=True) runs agents in a dedicated git worktree and cleans it up on reap.

📝 The gap analysis that prompted these changes is documented in docs/research/2026-04-23-octopus-control-gaps.md.

[1.23.3] - 2026-04-22

🐛 Fixes slash commands in octopus control being sent with the wrong format. _build_prompt was reading key "raw_prompt" (which doesn’t exist in the queue JSON) instead of "prompt", and was building /audit-security instead of /octopus:audit-security — the namespace Claude Code uses for installed Octopus commands. Both bugs meant queued skill tasks ran without the skill context.

[1.23.2] - 2026-04-22

🐛 Fixes three bugs that made octopus control non-functional after opening:

Tasks submitted via the command bar were enqueued but never executed — the TUI had no dispatch loop connecting the queue to ProcessManager.launch(). A _poll() method now runs every 2 seconds, dispatching the next queued task per role, reaping finished PIDs, and refreshing the roster and queue panels automatically.

The async log tailer had no await asyncio.sleep(), causing it to busy-loop and block Textual’s event loop entirely. The replacement _stream_log() coroutine waits 200 ms between empty reads and stops tailing once the agent process exits.

SkillMatcher was pointed at .octopus/skills/ (which does not exist) instead of .claude/skills/ where Octopus installs skills. Slash commands still work without this fix, but natural-language keyword matching was silently producing an empty catalog.

[1.23.1] - 2026-04-22

🐛 Fixes octopus control failing with No module named 'cli' when invoked outside the repository root. The fix sets PYTHONPATH to the parent of CLI_DIR before launching python3 -m cli.control.app, so module resolution works correctly regardless of the current working directory.

[1.23.0] - 2026-04-22

✨ This release delivers RM-044 — octopus control, a self-contained TUI dashboard (Python/textual) that lets a single developer orchestrate multiple Claude Code agent sessions locally without external infrastructure.

The new octopus control subcommand opens a four-panel terminal UI: an AgentRoster that polls running agent PIDs every second and adopts orphaned sessions on startup; a TaskQueue backed by JSON files under .octopus/queue/ with nanosecond-precision IDs for collision-free concurrent writes; a SchedulePanel driven by a background cron thread that reads .octopus/schedule.yml and fires tasks on daily HH:MM or weekday rules; and an OutputPanel that tails agent log files asynchronously. A command bar (bound to a) accepts both slash commands (/audit-security src/auth/) and natural-language prompts, resolved to a skill and model by the new SkillMatcher — which reads skill frontmatter and respects per-skill model overrides over the role default. Pressing q with agents running prompts a stop / detach / cancel choice so sessions are never silently killed. The UI is styled with the Octopus palette (#7B2FBE accent, #00B4D8 ocean, #1a1a2e background) and panel focus borders.

The process manager launches Claude Code as a subprocess in an isolated git worktree under .octopus/worktrees/<role>/, writes a PID file, and streams output to a per-role log. Fifteen new tests cover the full stack: bash tests/test_control.sh exercises CLI routing and the integration path for adopt_orphans; pytest covers launch/kill, queue ops, cron firing, and all skill-matcher branches including ambiguous NL input and empty strings.

🐛 The hook delivery system was hardened: deliver_hooks() now merges by hook id instead of replacing the full array, so re-running octopus setup no longer clobbers manually added hooks. ✨ Eight additional skills (audit-all, backend-patterns, batch, compress-skill, continuous-learning, launch-feature, plan-backlog, launch-release) gained triggers: frontmatter, completing lazy activation coverage. 🔧 A --dry-run mode was added to octopus setup — every deliver_*() function checks OCTOPUS_DRY_RUN and prints what it would do without touching the filesystem, backed by 16 test cases.

[1.22.0] - 2026-04-22

✨ This release closes three roadmap items that together make Octopus audits faster and more automatic.

The audit pipeline gains a content-keyed output cache (RM-026): each run hashes the scoped diff against the skill’s own SKILL.md, stores the result under .octopus/cache/<skill>/<key>.md, and replays it instantly on re-runs without calling the LLM. The shared protocol lives in skills/_shared/audit-cache.md and is referenced by all four audit skills. A .gitignore guard is applied automatically so cache files are never committed.

The Full-mode setup wizard now shows a skill impact table before the user confirms their selection (RM-027): the new _skill_impact_table() helper in setup-wizard.sh reads wc -l from each skill’s SKILL.md and displays lines and an estimated token count (~4 tokens/line), making the cost of a selection visible upfront.

✨ A new advisory pre-push git hook (RM-029) rounds out the release. cli/lib/audit-map.sh is a pure bash library that parses the patterns.md cascade for each audit skill — path tokens tested against changed file paths, content regexes tested against added/removed lines — and emits the matched audit names in criticality order. hooks/git/pre-push-audit-suggest.sh uses this library to print a suggestion blocklet before every push, listing which Octopus audits the diff is likely to need. The hook is installed by octopus setup when workflow: true and at least one audit skill is present; it is advisory only, never blocks, and can be skipped with OCTOPUS_SKIP_AUDIT_HOOK=1 or disabled repo-wide with postMergeAuditHook: false in .octopus.yml. Chain-mode preserves any pre-existing pre-push hook. The patterns.md files for audit-money, audit-tenant, and the newly created audit-security were migrated to the standard ## Path tokens / ## Content regex schema the library expects.

[1.21.0] - 2026-04-22

✨ This release ships RM-025 — Pre-LLM Audit Pass, completing the token-reduction arc started in v1.20.0. All four audit skills (audit-money, audit-security, audit-contracts, audit-tenant) now run a deterministic grep phase before handing the diff to the LLM. A new shared fragment skills/_shared/audit-pre-pass.md defines the four-step protocol: filter candidate files from git diff --name-only, exit early if none match, apply an optional line-level filter, and produce a scoped diff containing only relevant files.

Each skill declares its domain patterns via a new pre_pass: frontmatter block alongside triggers:. On PRs with no relevant files the skill exits immediately with “no changes detected”, avoiding any LLM call. 📝 The spec was published separately in PR #73 before implementation, following the doc-design → doc-plan → implement workflow.

[1.20.0] - 2026-04-22

✨ This release ships RM-022 — Lazy Skill Activation, the first item from Cluster 1 (Reduce tokens loaded per session). A new triggers: frontmatter block in SKILL.md lets each skill declare when it is relevant — by file paths, keywords, or manifest tools. When octopus setup generates a concatenated agent output (Copilot, Codex, Gemini, OpenCode), skills whose triggers don’t match the project are replaced with a compact 3-line stub instead of their full content. Skills without a triggers: block are always included in full, preserving complete backward compatibility.

Six domain-specific skills ship with trigger annotations out of the box: e2e-testing, dotnet, and audit-contracts activate on file paths (spec files, .csproj, OpenAPI docs); audit-security, audit-money, and audit-tenant activate on keywords in README and project metadata. Dog-food against this repo (bash/markdown, no framework code) measured −1,326 lines saved across the 6 guarded skills, exceeding the RM-022 target of ≥ 40% reduction in output size for typical projects.

📝 A completed design spec for RM-022 was added to docs/specs/ via /octopus:doc-design.

[1.19.0] - 2026-04-21

This release completes Cluster 5, bringing the full spec-design → plan → execute workflow natively into Octopus — no external superpowers plugin required for the design loop.

✨ Three new slash commands land in this release. /octopus:doc-design opens an interactive spec-design session that walks through Design, Implementation Plan, Testing Strategy, and adaptive sections (Non-Goals, Risks, Migration) via a one-question-at-a-time conversation, finishing with a self-review pass and an automatic docs-only branch commit. /octopus:doc-plan reads a completed spec and writes a docs/plans/<slug>.md plan file using bite-sized, TDD-style tasks with adaptive decomposition heuristics (“too big” and “too small” guards) and a 15-task split warning. /octopus:implement gains a --plan PATH walker mode that executes a plan file task-by-task: it dispatches the existing single-task TDD loop per task, flips each task’s checkboxes in place after the commit (strategy documented in docs/adr/001-plan-walker-checkbox-commit.md), and pauses for human review between tasks with a Continue / stop / redo-current prompt. A --resume-from TaskN flag allows picking up an interrupted session. HARD-GATE: the walker never pushes, never opens PRs, never creates branches.

🐛 A fix to /octopus:doc-design clarifies the HARD-GATE wording (docs-only branches are explicitly permitted) and adds automatic docs-only branch creation when the session starts on main or master, preventing accidental spec commits directly to the main branch.

📝 Design sessions produced specs for two upcoming Cluster 3 items: bundle-diff-preview (RM-027, wizard impact annotations) and post-merge-audit-hook (RM-029, post-push audit suggestions) — both spec-only, no implementation yet.

🔧 The install banner was trimmed from 19 to 12 rows for a less intrusive first-run experience.

[1.18.0] - 2026-04-20

✨ /octopus:pr-open gained three polish items on top of the earlier redesign. Every section heading now carries an emoji for scanability — 📦 What, 💡 Why, ✅ Test plan, 🔗 References, 📂 Files changed. The agent scans branch names, commits, and diffs for roadmap IDs (RM-NNN), Jira-style trackers ([A-Z]{2,}-\d+ with a deny-list for HTTP codes and ISO standards), Notion and GitHub URLs, and local docs/specs/*.md / docs/adr/*.md paths, surfacing hits in a new conditional 🔗 References section. The CLI now accepts --title <string>; when the agent supplies a human-friendly title prefixed with a type emoji (🐛 Fix: …, ✨ Feat: …, …), it replaces the old branch-derived feat: foo title.

🐛 octopus update without flags now prefers the latest remote release instead of re-installing whatever is already cached. The previous resolver fell back to metadata.json — which records the currently installed version, not the update target — so the command silently became a no-op. The new resolve_update_target() keeps lockfile pinning as the top priority but skips metadata, going straight to the GitHub API and falling back only to git describe. The "Resolving latest version…" banner now prints only on the remote path; lockfile resolution says so explicitly.

[1.17.0] - 2026-04-20

✨ PR descriptions are now written by the agent, not scraped by shell. /octopus:pr-open drives the agent to synthesise a three-section body — What / Why / Test plan — with the file list collapsed and a fixed 🐙 generated by Octopus footer. The previous generate_pr_body heuristic (which dumped every commit, listed every file, and surfaced nonsense “Key Changes” from regex-matched identifier names) is gone. cli/lib/pr-open.sh shrank to ~40 lines of mechanics and now requires --body-file.

♻️ Manifest schema correction: in .octopus.yml, commit messages and PR descriptions move from language.docs to language.code. docs scope is now restricted to prose artefacts (specs, ADRs, RFCs, README). Field names are unchanged — only the semantic boundary moves. Teams using the short form language: <code> are unaffected.

✨ octopus release commit-changelog gained a fourth README sync pattern: --version vX.Y.Z install examples are now updated automatically alongside the version badge and manual-update snippets.

[1.16.0] - 2026-04-20

✨ New /octopus:compress-skill command — shrinks a SKILL.md by ~25% without changing its meaning. A deterministic cleanup pass runs first (collapses blank runs, strips meta prose, shortens example lists); the LLM rewrite pass only fires when the target is not met. Invariants are enforced after each step: frontmatter stays byte-identical, every string the skill’s test file greps for is preserved, headings are untouched, and fenced code blocks are copied verbatim. Dry-run is the default; --apply writes the result. Registered in the docs-discipline bundle and the setup wizard.

♻️ Refactored the three pre-merge audit skills (audit-money, audit-tenant, audit-contracts) to share conventions via skills/_shared/audit-output-format.md. Severity format, override cascade, --write-report frontmatter, and common errors now live in one file; each SKILL.md keeps only its skill-specific content. Tests were updated to look for conventions across both the skill file and the shared fragment.

[1.15.0] - 2026-04-20

✨ The auto-format PostToolUse hook gained lint-fix capabilities alongside formatting — TS/JS now runs biome check --write, which also organizes imports and applies safe lint fixes, with a fallback to eslint --fix + prettier. On the .NET side, the hook now prefers CSharpier when available and falls back to dotnet format --include as before. Formatter failures are surfaced as a single-line message on stderr without blocking the hook. File-extension coverage was expanded to include mjs, cjs, jsonc, and csx.

✨ The launch-release skill received a Cagan-style refinement covering intent, FBE, and narrative.

[1.14.5] - 2026-04-20

🎨 Install banner now renders a filled-silhouette octopus in coral (ANSI 210) — round head with two eye holes, geometric smile, two side arms and a fringe of bottom tentacles. 19 rows × 50 cols of M-pixel art, every row centered on col 24.5.

[1.14.4] - 2026-04-20

🎨 Install banner now uses a reddish palette: coral head with bright-yellow eyes and a white smile on top, tentacles fading from dark red to deep red as they curl outward, and a bold-coral OCTOPUS title below. Uses 256-color ANSI escapes (terminals that lack 256-color support render the glyphs in the default foreground — still a recognizable octopus).

[1.14.3] - 2026-04-20

✨ New ASCII-art banner for install.sh. The previous design (tiny head + stacked | lines as tentacles) read more like a broom than an octopus. Replaced with a recognizable octopus — domed head with eyes and mouth, three curling tentacles on each side — kept in green via the existing color scheme. Rendering switched from seven echo -e calls to a cat <<'BANNER' heredoc wrapped in printf '%b' for the color codes, so the literal art is easier to read and edit in source.

[1.14.2] - 2026-04-20

🐛 Fixes missing descriptions for 10 slash commands in Claude Code’s / list: /octopus:implement, /octopus:debug, /octopus:respond-to-review, /octopus:audit-all, /octopus:audit-contracts, /octopus:audit-money, /octopus:audit-tenant, /octopus:plan-backlog, /octopus:launch-feature, /octopus:launch-release. The command templates should ship with two frontmatter blocks — an outer Octopus metadata block (stripped at delivery) and an inner Claude-readable block (description: + agent:, preserved). The newer commands were authored with only the outer block, so strip_frontmatter removed the entire header and the delivered files had no description for Claude Code to render.

🧪 New Test 1b in tests/test_workflow_commands.sh asserts every delivered command starts with a frontmatter block containing a description: line, preventing this drift on future command additions.

[1.14.1] - 2026-04-20

🐛 Fixes a silent install regression where octopus install --latest and octopus update --latest would stamp the new version’s name over the current RELEASE_ROOT via a symlink — so ~/.octopus-cli/cache/v1.14.0 could end up pointing to a v1.8.0 tree, and octopus setup would silently deliver the old command/skill set. The shim’s install_release now detects the mismatch: when RELEASE_ROOT’s git tag doesn’t match the requested version, it delegates to install.sh (either the one bundled in the release tree or a fresh copy fetched from GitHub) with a new --no-shim-setup flag that runs the download/extract path without touching the running shim. Self-install bootstrap (the dev-checkout case where RELEASE_ROOT == target) still works as before.

🧪 New tests/test_install_release.sh covers both paths: (a) when the requested version can’t be fetched, no bogus symlink is left behind; (b) the self-install bootstrap still succeeds and writes metadata.

Upgrade note: users whose cache contains symlinked version dirs (e.g. v1.14.0 -> v1.8.0) should delete the broken entry and reinstall: rm ~/.octopus-cli/cache/v1.14.0 && curl -fsSL https://github.com/leocosta/octopus/releases/latest/download/install.sh | bash -s -- --version v1.14.0 --force. Once on v1.14.1, the bug can’t recur.

[1.14.0] - 2026-04-20

🧭 Task routing matrix (RM-034) lands as a canonical markdown fragment at skills/_shared/task-routing.md, embedded byte-identically in the three starter workflow skills (implement, debug, respond-to-review). Four signal categories — Stack/language (paths, stack traces), Domain-audit (billing keywords, multi-tenant queries, cross-stack diffs, secrets), Cross-workflow (feature vs. bug vs. review handoffs), Risk-profile (large-scale change, migration, release) — map observable task signals to the companion skills worth consulting. Graceful degradation: when a companion skill isn’t installed, the main workflow continues and surfaces a one-line hint rather than blocking.

🔄 Replaces the RM-034 stub paragraph in all three skills; the ## Task Routing heading stays in place, so the section-level structural tests are unaffected. Per-skill tests (test_implement.sh, test_debugging.sh, test_receiving_code_review.sh) now check for the <!-- BEGIN task-routing --> marker instead of the RM-034 placeholder string.

🧪 New tests/test_task_routing.sh enforces byte-identical sync between the canonical fragment and the three SKILL.md embeds via awk block extraction and diff, so any future drift fails CI with a 20-line diff preview. skills/_shared/ is deliberately outside the skills/*/SKILL.md discovery glob, so the fragment is an authoring-only artifact — never delivered as a skill.

[1.13.0] - 2026-04-20

🔒 New destructive-action guard hook intercepts dangerous Bash commands before the agent runs them. hooks/pre-tool-use/destructive-guard.sh is a PreToolUse/Bash hook that matches a curated blocklist (rm -rf, git push --force, git reset --hard, git checkout --, git clean -f, DROP TABLE, DROP DATABASE, TRUNCATE, DELETE FROM without WHERE, chmod -R 777, find ... -delete, npm uninstall -g, curl | bash) and blocks with exit code 2 plus a stderr message that explains the rule and how to bypass. The bypass is a # destructive-guard-ok: <reason> marker in the command text itself — the reason must be non-empty and surfaces in command history and code review, so the override is visible rather than silent. A legitimate DELETE FROM t WHERE expired < now(); is not blocked; the guard only trips when the WHERE clause is absent.

🔧 Integration with the existing Octopus hooks pipeline: the script ships in hooks/pre-tool-use/, registers in hooks/hooks.json under PreToolUse/Bash, and is delivered automatically by the installer’s deliver_hooks when hooks: true is set in .octopus.yml (the default for the quality-gates bundle and common in starter). Opt-out via a new manifest field destructiveGuard: false, which routes through the existing OCTOPUS_DISABLED_HOOKS filter so the hook is absent from the rendered settings.json without disabling the rest of the hooks layer. Claude Code sees exit code 2 as “block this tool call and surface the message to the model”, so the agent gets the block reason and can retry with a justified marker.

🐛 Also fixes a pre-existing bug in the deliver_hooks python filter: the previous code compared id at the matcher-entry level when id actually lives one level deeper (inside each entry’s hooks array). The filter never removed anything. Now filters at both levels and drops matcher entries whose hooks array becomes empty. The OCTOPUS_DISABLED_HOOKS env var therefore works as documented for the first time.

📝 Ships with tutorial at docs/features/destructive-action-guard.md, new row in docs/features/hooks.md, destructiveGuard: entry added to the README .octopus.yml snippet, roadmap transition (RM-033 moves to Completed), and a 7-test structural suite covering script existence + executability, 14 destructive patterns each blocked, 5 safe commands each pass, non-Bash payloads exit 0, exit code 2 on blocks, hooks.json registration, and the injection + opt-out behavior through the full deliver_hooks path.

[1.12.0] - 2026-04-19

✨ New respond-to-review skill codifies the PR-feedback discipline — verify the critique against the code, ask for evidence on generic comments, separate reasoned feedback from preference, never make performative changes, ask for clarification on ambiguity. Active by default on every PR feedback loop, the skill joins the starter foundation bundle as the third workflow skill alongside implement (features) and debug (bugs). The starter bundle now covers the three common working states: writing new code, fixing broken code, responding to feedback on code. Rule 1 requires reading the code the reviewer pointed at before accepting the critique — a reviewer who is wrong wants to know, not to be agreed with. Rule 2 refuses to infer the intent of generic comments (“this is ugly”) — ask for specificity. Rule 3 separates technical reasoning from personal preference and negotiates preference honestly rather than treating it as an instruction. Rule 4 forbids changing code just to close a thread without understanding the concern. Rule 5 asks for clarification when a comment allows multiple readings.

🎨 Stack-neutral by design. The skill describes discipline, not a specific review tool or platform. When the superpowers:* plugin is installed, superpowers:receiving-code-review wins per rule on the practices it already covers; this skill still owns Octopus-native integration with /octopus:pr-comments and the handoffs to implement and debug. Section ## Task Routing reserves the same extension hook RM-034 will wire into all three starter-workflow skills.

📝 Ships with tutorial at docs/features/respond-to-review.md, wizard registration, README + skills.md updates, roadmap transition (RM-032 moves to Completed), and 9 structural tests. tests/test_bundles.sh bumps to reflect the starter bundle growing to 6 skills (Test 5) and the full bundle expansion reaching 11 skills (Test 9).

[1.11.0] - 2026-04-19

✨ New debug skill codifies the universal bug-fix workflow — reproduce deterministically, isolate, fix with a regression test first, document non-obvious cause. Active by default on every bug-triage task, the skill joins the starter foundation bundle alongside implement, so every repo running octopus setup now has symmetric coverage: implement for features, debug for bugs. The body documents four phases in a fixed order. Phase 1 requires a deterministic reproduction before proposing a cause — “works on my machine” and “sometimes happens” are symptoms of missing context. Phase 2 isolates via git bisect (for regressions) or hypothesis → test → refute (for everything else); logs confirm hypotheses but do not substitute for isolation. Phase 3 writes the failing regression test before the fix, reusing implement’s TDD loop with the red step sourced from the bug. Phase 4 documents non-obvious causes in the commit message, an ADR, or a continuous-learning entry, so the same bug does not recur under a different symptom months later.

🎨 Stack-neutral by design. The skill describes a protocol, not specific debuggers or languages. When the superpowers:* plugin is installed, superpowers:systematic-debugging wins per phase on the practices it already covers; debug still owns Phase 4 (Octopus-native integration with continuous-learning and ADRs). Section ## Task Routing reserves the same extension hook RM-034 will wire into implement, so both skills share one routing edit when RM-034 lands.

📝 Ships with tutorial at docs/features/debug.md, wizard registration, README + skills.md updates, roadmap transition (RM-031 moves to Completed), and 9 structural tests covering frontmatter, all six required sections, the four phase headers, Task Routing mentioning RM-034, Anti-Patterns naming core violations, slash command, bundle membership, wizard wiring, and tutorial presence. tests/test_bundles.sh bumps to reflect the starter bundle growing to 5 skills (Test 5 fixture) and the full bundle expansion reaching 10 skills (Test 9).

[1.10.0] - 2026-04-19

✨ New implement skill codifies the universal implementation workflow. Active by default on every code-editing task — the skill joins the starter foundation bundle so every repo running octopus setup picks it up automatically. The body documents five practices in a fixed order: (1) TDD loop (red → green → refactor → commit for observable behavior); (2) plan-before-code gate (present a short plan on tasks touching > 2 files or with ambiguous approach); (3) verification-before-completion (run the project’s test/typecheck/format and attach output before declaring work done); (4) simplify pass (re-read changed code with the simplifier lens before committing); (5) commit cadence (one commit per logical step, hooks must pass, never --no-verify).

🎨 Stack-neutral by design. The skill does not duplicate rules/common/* (static rules) or compete with language-specific skills (dotnet, backend-patterns, e2e-testing). When the user has the superpowers:* plugin installed, composition rule is “the more specific skill wins per practice” — superpowers drives TDD / systematic debugging / verification when active; implement fills the other gaps. Section ## Task Routing reserves an extension hook for RM-034, which will auto-dispatch to the right sub-skill or role per task (backend / frontend / infra / data / refactor / bug).

📝 Ships with tutorial at docs/features/implement.md, wizard registration, README + skills.md updates, roadmap transition (RM-030 moves to Completed), and 9 structural tests covering frontmatter, all six required sections, the five practice headers, Task Routing mentioning RM-034, Anti-Patterns naming core violations, slash command, bundle membership, wizard wiring, and tutorial presence.

[1.9.0] - 2026-04-19

✨ New audit-all composer skill runs audit-security, audit-money, audit-tenant, and audit-contracts in parallel against one ref with shared file discovery and a consolidated severity report. Instead of four sequential invocations (each duplicating ref resolution, diff computation, file classification), audit-all does the discovery work once, partitions touched files by domain (money / tenant / webhook / auth / api-contract / frontend-consumer / secrets / config), dispatches four subagents via superpowers:dispatching-parallel-agents, then merges the four reports into one output with a cross-audit hotspots table — files flagged by ≥ 2 audits surface at the top for triage. Every sub-report keeps its own 🚫/⚠/ℹ + confidence footer so reviewers can paste an audit’s section into a PR thread.

🔧 New depends_on: skill-frontmatter mechanism. A skill can declare depends_on: [skill-a, skill-b] in its frontmatter; expand_bundles() walks the list after bundle expansion, pulls each dependency, loops until stable, warns on missing deps, aborts on cycles or excessive depth (5 passes). This lets audit-all declare its four audit dependencies in one place — bundles/quality-gates.yml now lists only audit-all, the four individual audits arrive automatically. Individual audits remain first-class and invocable directly via /octopus:audit-security, /octopus:audit-money, etc.

🎨 Graceful degradation: audit-all adapts to what’s installed. A missing dependency skips that audit with a warning; the summary line reports “{N} of 4 audits ran; install {list} to enable the rest”. When superpowers:dispatching-parallel-agents is unavailable (non-Claude-Code agents), execution falls back to sequential with a one-line notice; output shape is identical. v1 always exits 0 (guidance, not gate).

📝 Ships with tutorial at docs/features/audit-all.md, updates to README / skills.md / bundles.md tables, closes RM-028 in the roadmap. 13 structural tests (7 for the skill itself + 4 new depends_on scenarios in test_bundles.sh covering happy path, missing-dep warning, cycle detection, no-deps skills).

[1.8.2] - 2026-04-19

📝 Every slash-command tutorial heading now shows the fully-qualified /octopus:<name> form. Before, the level-1 heading in commands/*.md rendered as # /<name>, which made the octopus: namespace look like a typo to new users who saw only the tutorial. Fixed across all 10 user-invoked commands: audit-contracts, doc-adr, doc-research, doc-rfc, doc-spec, launch-feature, audit-money, plan-backlog, launch-release, audit-tenant.

🐛 docs/features/bundles.md also gains launch-release in the growth bundle row — v1.8.0 added the skill to the bundle YAML but the tutorial table missed it, so readers browsing the bundle catalog thought growth still shipped only launch-feature.

[1.8.1] - 2026-04-19

🐛 install.sh reused any existing cache/v<version>/ directory without verifying its contents — so a dir created by an aborted download, a manually-copied staging snapshot, or an older installer that packaged stale content under a newer label would be silently reused. Result: the current symlink pointed at a directory labeled v1.8.0 that actually shipped v1.5.0 code, leading to octopus setup regenerating .claude/settings.json with the pre-v1.5.1 bugs (relative hook paths, invalid PostToolUseFailure event, unsupported top-level keys). Fix: on successful extraction the installer now writes the verified tarball SHA256 to <cache-dir>/.cache-sha256 as an integrity marker. On subsequent runs, when the cache dir exists, the installer fetches the release’s checksum file and compares it against the marker; mismatch or missing marker triggers a fresh re-extract, while a match reuses the cache. When no checksum endpoint is available (offline install or custom mirror), the installer falls back to the legacy “dir exists → reuse” behavior so offline flows keep working. --force continues to unconditionally re-download.

🧪 tests/test_installer.sh gains four assertions covering the full contract: marker is written after a fresh extract, a corrupted cache is purged and re-extracted on the next run (detected via a canary file that survives only if the dir was NOT wiped), a healthy cache is reused without redundant download, and --force always re-downloads even when the cache is healthy.

[1.8.0] - 2026-04-19

✨ New launch-release skill turns one or more refs (tags, tag ranges, RM IDs) into a themed release announcement kit aimed at existing users — a distinct job from launch-feature, which handles acquisition and external audiences. Inputs can be a single version (v1.7.0), a range (v1.5.0..v1.7.0), or an RM ID (RM-008); default is since the last tagged release. Output is two-tiered: canonical artifacts (index.html themed landing page, notes.md plain fallback, theme.yml snapshot for reproducibility) plus paste-ready channel messages under channels/ for email, Slack, Discord, in-app banner, status page, X/Twitter thread, WhatsApp, and an autocontained slide deck with keyboard nav and print-to-PDF.

🎨 Nine preset themes ship in v1 — classic (neutral newsletter default), jade (calm green), dark (modern high-contrast), bold (vibrant with oversized display), newsletter (text-heavy serif), sunset (warm orange/pink), ocean (cool blues), terminal (green mono-on-black dev aesthetic), and paper (editorial cream/browns). Each theme is a YAML file declaring palette, typography, layout (hero / grouping / density), and voice (tone / persona) tokens. Users pick via .octopus.yml theme: or per-run --theme=<name>. --channels=<list> controls the channel subset; default email,slack,in-app-banner. --audience=<user|developer|executive> tunes copy voice.

🔧 --design-from="<prompt>" optionally invokes the frontend-design skill to synthesize a custom theme YAML on the fly (e.g. --design-from="retro arcade synthwave"). The generated theme is persisted to docs/launch-release/themes/<slug>.yml and reusable via --theme=<slug> in subsequent runs. Default path stays deterministic — frontend-design is invoked only via --design-from, never for plain rendering.

📝 Slides template ships with ≤40 lines of vanilla JS (keyboard →/←/Space/PageUp/PageDown, touch swipe, URL hash persistence, print-to-PDF via @page landscape), inline CSS, no external assets. Email template uses bulletproof patterns (inline CSS, <table> layout, no <script>/<style> in body). The skill joins the growth bundle next to launch-feature, covers acquisition + retention in one bundle. 12 structural tests guard skill content, theme shape, template tokens, slides JS budget, and wizard / bundle / README / skills.md integration.

[1.7.0] - 2026-04-19

✨ Introduces bundles as the primary setup path. The wizard’s Quick mode (default) now asks 4–6 yes/no persona questions (“Is this a SaaS product for external customers?”, “Does your team produce marketing content?”, “Primary backend is .NET?”) and maps each positive answer to a curated bundle of skills + roles + rules. Seven bundles ship in v1: starter (foundation — adr, feature-lifecycle, context-budget; always included), four intent bundles (quality-gates → audit-security + audit-money + audit-tenant + backend-specialist role; growth → launch-feature + social-media role; docs-discipline → plan-backlog + continuous-learning + tech-writer role; cross-stack → audit-contracts + backend + frontend specialists), and two stack bundles (dotnet-api, node-api). Users can declare bundles: [...] in .octopus.yml and the expansion happens at setup time — a new user never needs to memorize the 13-skill catalog to get a sensible config. Power users still pick Full mode or mix explicit skills: / roles: on top of bundles; all user-explicit entries are additive (bundles never remove selections).

🔧 Implementation: new OCTOPUS_BUNDLES array parsed by parse_octopus_yml, _load_bundle reads a single YAML via python3, expand_bundles unions components across bundles with _dedupe_array preserving first-seen order. The expansion runs before any delivery function, so deliver_skills / deliver_roles / deliver_mcp stay oblivious to bundles — the feature is purely a preprocessing layer. New _wizard_sub_bundles() reads each bundle’s persona_question and asks y/n; the Quick-mode flow now takes three grouped steps (Agents → Bundles → Workflow) instead of a one-shot 3-question form. The manifest writer emits bundles: when the wizard picked any, and skips emitting expanded skills: / roles: lists in that case.

📝 Docs: new docs/features/bundles.md tutorial covers Enable / Combining / Authoring / the new-skill convention. docs/features/skills.md gains a Bundle column showing membership for every skill. README intro, Quick Start, and Features table all surface bundles as the primary path. templates/spec.md gains a required Bundle: field in the “Context for Agents” section, enforcing the convention that every future skill declares bundle membership in its spec — no loose skills drift into the catalog without users discovering them.

🧪 New tests/test_bundles.sh runs nine assertions: bundle metadata presence, persona-question coverage for intent/stack, parser recognizes bundles:, loader populates component arrays, unknown bundle aborts loudly, union across multiple bundles, de-duplication of overlapping contributions, preservation of user-explicit entries, and full manifest round-trip (bundles-only YAML expands to the expected 6 skills + roles).

[1.6.0] - 2026-04-19

✨ New audit-tenant skill catches the systemic data-leak risk in multi-tenant SaaS codebases: a query without a tenant filter returns rows from every tenant. Given a branch or PR, the skill resolves the diff against a base, reads the optional .octopus.yml tenantScope: config (fields field / filter / context / entities, with defaults TenantId / AppQueryFilter / AppDbContext), identifies tenant-relevant files via path tokens (Controller, Service, DbContext, Queries, …) and content heuristics, and runs six inspection checks. T1 (query-without-filter) blocks on IgnoreQueryFilters() calls without a preceding // tenant-override: <reason> marker; T2 (dbcontext-missing-filter) blocks on new DbSet<X> entries lacking HasQueryFilter configuration; T3 (raw-sql-no-filter) blocks on FromSqlRaw / ExecuteSqlRaw / Database.SqlQuery whose SQL literal does not restrict by the tenant field. T4 (id-from-route-no-ownership) warns when a controller action accepts an id from the route and calls .FindAsync(id) on a tenant-scoped DbSet without a known ownership helper; T5 (join-to-unfiltered-table) warns on LINQ joins into a global table without tenant restriction; T6 (cross-tenant-admin-endpoint) warns on [AllowAnonymous] / [Authorize(Roles = "Admin")] methods that touch tenant-scoped data without a // across-tenants: <reason> marker.

🎨 Every finding carries a confidence label (high / medium / low) for triage parity with audit-contracts. The report format matches the existing audit-money / audit-contracts / audit-security output (🚫 Block / ⚠ Warn / ℹ Info) plus a one-line config trailer showing which tenant field / filter / context were in effect. --write-report persists to docs/reviews/YYYY-MM-DD-tenant-<slug>.md; --only=<checks> runs a subset; --base=<branch> overrides the default main.

📝 Ships with default regex tokens for EF raw-SQL helpers, admin role markers, and override-marker comment grammar. Override cascade at docs/audit-tenant/patterns.md. Tutorial at docs/features/audit-tenant.md documents the tenant-override: and across-tenants: comment contracts. 8 structural tests, wizard + README + skills.md descriptions-table row integration. All four audit skills (audit-security, audit-money, audit-contracts, audit-tenant) now share one output format, so a combined PR comment concatenates without extra formatting.

[1.5.1] - 2026-04-19

🐛 Three bugs in .claude/settings.json generation that could prevent Claude Code from loading the file. First, hook commands were emitted as relative paths (octopus/hooks/pre-tool-use/block-no-verify.sh) that do not resolve from the project’s working directory — Claude Code would try to run a non-existent script. deliver_hooks in setup.sh now rewrites the octopus/hooks/ prefix to the absolute Octopus install root ($OCTOPUS_DIR/hooks/), so every hook command is an absolute path that executes regardless of CWD. Second, hooks/hooks.json shipped a PostToolUseFailure event that is not part of Claude Code’s documented hook schema; its presence could invalidate the settings.json on strict validation. The event and its companion mcp-health hook are removed. Third, deliver_boris_settings wrote experimental keys (worktree, autoMemory, autoDream, sandbox) at the top of settings.json plus permissionMode: "auto", none of which are accepted values in Claude Code’s schema. The function now whitelists only the schema-documented keys (permissionMode, outputStyle) and normalizes permissionMode=auto to default. The related features still ship (the dream subagent is delivered as a Claude agent file, the batch skill is an independent skill, etc.) — they just do not pollute settings.json with unrecognized keys.

🧪 New tests/test_hooks_injection.sh guards the three invariants: every hook command starts with /, no invalid events land in settings.json, and Boris-tip passthroughs are filtered + normalized correctly.

[1.5.0] - 2026-04-19

✨ New plan-backlog skill keeps the planning surface honest over time. Repos that lean on the feature-lifecycle accumulate plans, specs, and research docs faster than teams archive them — Tatame’s plans/ has grown past 50 files. The skill walks the planning directory (autodetected as plans/, docs/plans/, or docs/superpowers/plans/, or overridden via the new .octopus.yml plansDir: field), parses docs/roadmap.md, and cross-references the two. Six hygiene checks land in v1: orphan plans with no RM/PR/issue/spec reference (H1, Info), plans for already-completed RMs still sitting outside archive/ (H2, Warn — auto-fixable), duplicate plans for the same RM-NNN (H3, Warn), broken internal links to missing specs/research/ADRs (H4, Warn), roadmap RMs in progress without a matching plan file (H5, Info), and plans unchanged longer than --stale-days (H6, Info, default 90).

🔧 --fix applies a single reversible action: for H2 matches, move the plan to <plansDir>/archive/YYYY-MM/<filename> using git mv so history is preserved. The move is staged but not committed, so git restore --staged undoes cleanly. A clean working tree is required. Other checks are never auto-fixed — H1/H3/H4/H5/H6 all need human judgment. --write-report persists the report to docs/reviews/YYYY-MM-DD-hygiene.md; --only=<checks> runs a subset; --stale-days=<n> tunes H6.

📝 Output format matches audit-money and audit-contracts so a monthly “hygiene digest” PR can concatenate all three reports into one comment. Ships with default regex for RM/PR/issue/internal-link detection, roadmap status parsing (recognizes completed, in progress, proposed, blocked), an archive convention, tutorial at docs/features/plan-backlog.md, 8 structural tests, and wizard + README integration. Pairs naturally with the schedule skill for monthly cron runs.

[1.4.0] - 2026-04-19

✨ New audit-contracts skill detects API-vs-frontend contract drift in multi-stack monorepos — the silent bugs that only surface at integration runtime when a DTO field renamed on the .NET side is never updated on the React or Astro twin. Given a branch or PR, the skill partitions the diff by stack (via .octopus.yml stacks: map or autodetection over api/, apps/api/, backend/, server/ for the API and conventional paths for React/Vue/Angular and Astro/Next landing pages), extracts contract intent tokens from the API diff (endpoint paths, DTO/record names, enum names, route attributes, auth annotations, param lists), and grep-matches them against frontend usage. Seven drift classes land in v1: endpoint additions without a consumer (C1, Info), endpoint removals/renames still called by a frontend (C2, Block), DTO field drift (C3, Warn), enum member desync (C4, Warn), response status code changes (C5, Info), authorization rule changes (C6, Warn always), and path/query param shifts that break live call sites (C7, Warn).

🎨 Every finding carries a confidence label (high/medium/low) so reviewers can triage heuristic matches quickly. The output format is the same three-heading severity markdown emitted by audit-money and audit-security, so three audits can be concatenated into a single PR comment without extra formatting work. --write-report persists the report to docs/reviews/YYYY-MM-DD-contract-<slug>.md with frontmatter listing the stacks compared and the summary counts. --stacks=<list> restricts the comparison; --only=<checks> runs a subset of C1–C7.

📝 Ships with default endpoint/DTO/consumer patterns for .NET (ASP.NET Controllers, Minimal API), Node (Express, Fastify, Hono, NestJS, Astro file routes), React / Vue / Angular / Astro frontends, and frontend consumer idioms (fetch/axios/ky, React Query/SWR, generated SDKs). Override cascade at docs/audit-contracts/patterns.md. Tutorial at docs/features/audit-contracts.md, 8 structural tests, wizard + README integration.

[1.3.0] - 2026-04-19

✨ New audit-money skill audits money-touching code before merge. It resolves a branch or PR against a base, isolates money-touched files via filename and regex heuristics (tokens like billing, payment, split, asaas, pix, webhook, fee), and runs seven inspection families: numeric type safety (T1 — flag float/double/number for currency), explicit rounding strategy (T2), cents coverage in tests (T3 — require non-round literals like 0.01, 199.99), env-var consistency across sandbox and production (T4 — block when a new *_PERCENT/*_FEE/*_RATE exists in one environment but not the other), payment-call idempotency (T5 — flag POST calls lacking Idempotency-Key or externalReference), webhook signature verification (T6 — block new /webhook endpoints without a verifier helper), and fee/tax disclosure coupling (T7 — warn when a fee change lands without a spec mentioning disclosure).

🎨 Output is a severity-tiered markdown report (🚫 Block / ⚠ Warn / ℹ Info) designed to paste into a PR comment as-is. With --write-report, the same content is persisted to docs/reviews/YYYY-MM-DD-money-<slug>.md with frontmatter for traceability. The --only=<families> flag restricts the scan to a subset; --base=<branch> overrides the default main.

📝 Ships with embedded default patterns (skills/audit-money/templates/patterns.md), provider idioms for Asaas / Stripe / Mercado Pago (templates/providers.md), a three-level override cascade (docs/audit-money/patterns.md → docs/MONEY_REVIEW_PATTERNS.md → embedded), a tutorial at docs/features/audit-money.md, and 8 structural tests guarding skill / command / wizard integration. Composes with the existing audit-security skill — run both on any billing PR.

[1.2.0] - 2026-04-19

✨ New launch-feature skill turns a completed feature (RM-NNN, spec path, research path, or PR) into a versioned multi-channel launch kit under docs/marketing/launches/YYYY-MM-DD-<slug>/. The kit bundles Instagram, LinkedIn and X posts, a launch email, landing-page copy, a commercial changelog entry, and a 30–60s video script — each rendered from per-channel templates with placeholders populated from the resolved feature context. Invocation is a single slash command (/octopus:launch-feature <ref>) with flags for channel selection, dry-run, forced angle, and regeneration. Brand and voice pull from a three-level override cascade: docs/marketing/<name>.md (canonical) → docs/<NAME>.md (uppercase compat with repos that already keep these files at the docs root) → embedded defaults shipped with the skill.

🎨 Optional image generation stays free by default: GEMINI_API_KEY (free tier at aistudio.google.com) is the preferred provider, with Pollinations.ai as a zero-setup fallback and graceful degradation to prompts-only when neither is available. Brand palette and logo constraints from brand.md are injected into every prompt; aspect ratios are pre-tuned per channel (1:1 IG, 1.91:1 LI, 16:9 X card, 16:9 LP hero).

📝 Tutorial lands at docs/features/launch-feature.md, README skills list and the setup wizard (cli/lib/setup-wizard.sh) gain the new entry, and 13 structural tests guard file layout, frontmatter, documented sections, and wizard registration.

[1.1.1] - 2026-04-18

🔧 Cleanup delivery closing RM-019, RM-020 and RM-021. install.sh no longer embeds a HEREDOC copy of the bin/octopus shim — the installer now copies the shim straight from the extracted release tree, removing 307 lines and eliminating the drift risk between the two sources. The release pipeline in .github/workflows/build-release.yml signs the published tarball with GPG and uploads octopus-<tag>.tar.gz.asc alongside the existing .sha256, closing the loop on RM-009’s consumer-side verification (requires OCTOPUS_RELEASE_GPG_KEY and OCTOPUS_RELEASE_GPG_PASSPHRASE to be provisioned as repo secrets — see docs/specs/release-signing-pipeline.md).

🧪 Four tests that had been waved through as “pre-existing failures” since before v1.0.0 are now fixed. They referenced functions renamed during earlier refactors (generate_claude, inject_mcp_servers), missed a pipeline step (collect_gitignore_entries), or used assertions that the current delivery contract outgrew. The full test suite now reports 19/19 green on a clean checkout.

[1.1.0] - 2026-04-18

Consolidated delivery of RM-011 through RM-018.

✨ Seven new manifest fields expose Boris Cherny’s Claude Code tips as first-class Octopus configuration. worktree, memory, dream, sandbox and permissionMode/outputStyle flow through to .claude/settings.json as passthroughs. githubAction: true idempotently scaffolds .github/workflows/claude.yml for automated PR review. The new batch skill documents a fan-out pattern for applying the same prompt across many targets in isolated git worktrees, and a dream subagent (Haiku, Read/Write only) ships to consolidate and prune stale memory entries.

✨ Install scopes land as RM-018. A new --scope=repo|user flag (plus OCTOPUS_SCOPE env var, scope: manifest field, and a wizard pre-flight question) lets teams install a shared base configuration at ~/.claude/ and layer per-repo overrides on top — every agent already merges user-level with project-level config at read time. User-scope manifests live at ~/.config/octopus/.octopus.yml following XDG; secrets go to ~/.config/octopus/.env.octopus with chmod 600. Fields that don’t make sense at user scope (mcp, workflow, reviewers, githubAction, knowledge) warn and are ignored; .gitignore updates and CI scaffolds are skipped.

🎨 The setup wizard was reorganized from 12 sequential steps into 5 grouped steps (Basics, What the AI knows and does, Integrations, Team workflow, Advanced Claude settings) with sub-question headers inside each group. A new pre-flight Quick/Full mode lets users opt for a 3-question fast path or walk the full flow. Reconfigure mode suppresses long descriptions and hints unless OCTOPUS_WIZARD_VERBOSE=1. The Advanced step is skipped entirely when Claude is not in the agent list.

📝 Eight new specs document the delivery: worktree-isolation, auto-mode, memory-dream, sandbox, output-styles, github-action, batch-skill, install-scopes. Roadmap reconciled with RM-011 through RM-018 in Completed.

[1.0.0] - 2026-04-18

Marks the first stable release, consolidating RM-005 through RM-009 in a single delivery.

✨ The global CLI installer now verifies detached GPG signatures alongside the existing SHA256 check — configurable via OCTOPUS_GPG_KEYRING, OCTOPUS_GPG_IMPORT_KEY, OCTOPUS_REQUIRE_SIGNATURE, and OCTOPUS_SKIP_SIGNATURE, closing the remaining supply-chain gap on compromised mirrors. Installer hardening continues with new --bin-dir / --cache-root flags, OCTOPUS_INSTALL_ENDPOINT support for file:// mirrors, and real SHA256 capture in metadata.json.

✨ Setup UX was unified across install.sh, the interactive wizard, and setup.sh. A new cli/lib/ui.sh module provides shared vocabulary that groups per-agent delivery under a single step line. Every wizard prompt now dispatches to the active TUI backend (fzf / whiptail / dialog / bash), and each of the eleven wizard steps gained a contextual explanation plus per-item hints.

📝 Role templates can now declare a tools: frontmatter field that is preserved for Claude Code and stripped for every other target. Language rules specs were promoted to Implemented alongside the behavioral detection rule and the project-override mechanism.

⚠️ BREAKING CHANGE: submodule mode is no longer supported. cli/lib/update.sh, commands/update.md, tests/test_update.sh, the submodule branch in setup.sh PROJECT_ROOT resolution, OCTOPUS_CLI_REL, and every submodule/legacy-shim reference across README, commands, and feature docs were removed. Existing submodule installs must switch to the global CLI (install.sh) and re-run octopus setup; the manifest is preserved. RM-010 (octopus migrate helper) was rejected as a consequence.

[0.16.1] - 2026-04-06

Fixed a syntax error in the _select_one bash fallback function that was causing issues in the setup process. 🐛

[0.16.0] - 2026-04-06

Added an interactive TUI setup wizard (octopus setup) that guides users through configuring .octopus.yml with multi-backend support (fzf/whiptail/dialog/bash) and full Windows/Git Bash compatibility. ✨

[0.15.10] - 2026-04-05

Fixed the CLI setup for PROJECT_ROOT and added interactive scaffolding features. 🐛

[0.15.9] - 2026-04-05

Fixed the CLI setup command by adding the missing setup command to cli/octopus.sh 🐛

[0.15.8] - 2026-04-05

Added contents: write permission for GitHub release upload in CI workflow. 🐛

[0.15.7] - 2026-04-05

Fixed a CI issue where the tar archive was causing self-modification errors by writing it to /tmp instead. 🐛

[0.15.6] - 2026-04-05

🐛 Replaced softprops action with gh CLI and upgraded checkout to v6 in CI workflows.

[0.15.5] - 2026-04-05

🔁 Set FORCE_JAVASCRIPT_ACTIONS_TO_NODE24=true on the release job so all JavaScript actions (including actions/checkout@v4) run under Node.js 24. The v4.x line bundles Node.js 20 internally regardless of the pinned version tag, causing a deprecation warning that surfaced as a runtime failure on the updated GitHub runners.