release: v5.6.0 — steering-model II (Foundation + B + C)

Bundles the v5.6 work already on main into a release:
- Foundation (62d910e): active-config-reader enumerates rules/agents/output
  styles with a loadPattern/survivesCompaction/derivationConfidence triple;
  frontmatter parser reads YAML block sequences.
- B (bb647ce, 778b517): load-pattern accounting — manifest reports
  component-level sources with an always-loaded subtotal; token-hotspots tags
  each hotspot with its load pattern.
- C (e3b044a): new orchestrated OST scanner (CA-OST-001/002/003), scanner
  count 13 -> 14, all claims doc-verified.

Version synced: plugin.json 5.5.0->5.6.0, README version badge +
version-history row, CHANGELOG [5.6.0] section. Frozen v5.0.0 snapshots
preserved via strip-helpers (--json/--raw byte-stable for the original 13
scanners); only SC-5 default-output regenerated. Suite 1023 pass, self-audit
A/A (config 93, plugin 100), readmeCheck passed, mismatches [].

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
This commit is contained in:
Kjell Tore Guttormsen 2026-06-20 21:13:47 +02:00
commit 7548a627ba
3 changed files with 43 additions and 2 deletions

View file

@ -1,7 +1,7 @@
{
"name": "config-audit",
"description": "Multi-agent workflow for analyzing, reporting, and optimizing Claude Code configuration across your entire machine",
"version": "5.5.0",
"version": "5.6.0",
"author": {
"name": "Kjell Tore Guttormsen"
},

View file

@ -5,6 +5,46 @@ All notable changes to this project will be documented in this file.
The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/),
and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
## [5.6.0] - 2026-06-20
### Summary
"Steering-model II" — the per-mechanism **load-pattern** and **compaction-survival** model lands
end-to-end across enumeration, the `manifest` / `tokens` token accounting, and a new output-style
scanner. v5.5.0 shipped A+E (additive to existing scanners); this release adds the **Foundation**
those features needed, plus **B** (load-pattern accounting) and **C** (the new `CA-OST` family,
scanner count 13 → **14**). Every new claim is anchored to the live Claude Code docs
(`code.claude.com/docs`) per the project's verification duty.
### Added
- **Foundation — active-config-reader enumeration + load-pattern model.** `active-config-reader`
now enumerates **rules**, **agents**, and **output styles** (alongside the existing
CLAUDE.md / plugins / skills / hooks / MCP). Each source carries a `loadPattern`
(`always` / `on-demand` / `external`), `survivesCompaction`, and `derivationConfidence`, derived
from the published loading model. The frontmatter parser additionally reads YAML **block
sequences** (`paths:` as a `- item` list), resolving a pre-existing RUL false-positive.
- **C — output-style scanner (`CA-OST`, scanner count 13 → 14).** New orchestrated scanner:
`CA-OST-001` (MEDIUM) a user/project custom output style missing `keep-coding-instructions: true`
(defaults false) silently strips Claude Code's built-in software-engineering instructions when
active (V10); `CA-OST-002` (LOW) a **plugin** output style with `force-for-plugin: true` overrides
the user's selected `outputStyle` (V11); `CA-OST-003` (MEDIUM) a settings `outputStyle` matching
no built-in (Default / Explanatory / Learning / Proactive) nor discovered custom style is dead
config.
### Changed
- **B — load-pattern accounting in `manifest` and `tokens`.** `manifest` now reports
**component-level** token sources (the coarse plugin roll-up that double-counted its own
skills / rules / agents is gone), tags every source with the load-pattern triple, and leads with
an **always-loaded subtotal** ("≈X tokens enter context every turn before you type").
`token-hotspots` annotates each ranked hotspot with its load pattern. `manifest`'s `total` changes
(de-duplicated) — the intended correctness fix.
### Notes
- **Byte-stability.** `--json` / `--raw` stay byte-stable for the original 13 scanners. The frozen
v5.0.0 snapshots are **preserved**: B2's additive hotspot fields and C's additive OST scanner
entry are stripped at compare time (`tests/helpers/strip-hotspot-load-pattern.mjs`,
`tests/helpers/strip-added-scanner.mjs`); only the SC-5 default-output snapshots are regenerated.
Suite 1023 pass, self-audit A/A (config 93, plugin 100), readmeCheck passed.
## [5.5.0] - 2026-06-20
### Summary

View file

@ -6,7 +6,7 @@
*AI-generated: all code produced by Claude Code through dialog-driven development. [Full disclosure →](../../README.md#ai-generated-code-disclosure)*
![Version](https://img.shields.io/badge/version-5.5.0-blue)
![Version](https://img.shields.io/badge/version-5.6.0-blue)
![Platform](https://img.shields.io/badge/platform-Claude_Code_Plugin-purple)
![Scanners](https://img.shields.io/badge/scanners-14-cyan)
![Commands](https://img.shields.io/badge/commands-18-green)
@ -648,6 +648,7 @@ This plugin is cautious by design — configuration files are important, and a b
| Version | Date | Highlights |
|---------|------|-----------|
| **5.6.0** | 2026-06-20 | "Steering-model II" — the load-pattern / compaction-survival model lands end-to-end. **Foundation:** `active-config-reader` now enumerates rules, agents, and output styles (alongside CLAUDE.md/plugins/skills/hooks/MCP), each tagged `loadPattern` (always / on-demand / external) + `survivesCompaction` from the published loading model; the frontmatter parser also reads YAML block sequences (`paths:` lists). **B (load-pattern accounting):** `manifest` reports component-level sources (the double-counting plugin roll-up is gone), tags every source with the load-pattern triple, and leads with an **always-loaded subtotal** ("tokens that enter context every turn"); `token-hotspots` annotates each ranked hotspot with its load pattern. **C (output styles):** new orchestrated **OST** scanner (count 13→**14**) — `CA-OST-001` a custom style stripping built-in coding instructions (missing `keep-coding-instructions: true`, V10), `CA-OST-002` a plugin style with `force-for-plugin: true` overriding the user's `outputStyle` (V11), `CA-OST-003` a settings `outputStyle` resolving to no known style (dead config). Doc-verified; frozen v5.0.0 snapshots preserved via strip-helpers, SC-5 regenerated. 1023 tests |
| **5.5.0** | 2026-06-20 | "Steering-model I" — two additive compaction-durability / dead-config findings (count stays **13**, `--json`/`--raw` byte-stable). Per the official "what survives compaction" model: RUL flags a large (>50-line) **path-scoped** rule not re-injected after compaction (LOW); CML flags a **nested** (subdir) CLAUDE.md not re-injected after compaction (LOW). PLH flags a plugin agent setting `hooks`/`mcpServers`/`permissionMode` — Claude Code ignores these for plugin subagents, so it's dead config (`permissionMode` = MEDIUM false-security, `hooks`/`mcpServers` = LOW). Known limitation: the frontmatter parser reads inline `paths:` but not YAML block sequences (deferred to v5.6 Foundation). 961 tests |
| **5.4.1** | 2026-06-20 | Scanner-correctness patch (count stays **13**, `--json`/`--raw` byte-stable). HKV: added `Setup`/`UserPromptExpansion`/`PostToolBatch` to the valid-event set (a valid hook using one was wrongly flagged "will never fire"), and **removed** `post-session` (the 2.1.169 `post-session` is a self-hosted-runner workspace-lifecycle hook, **not** a settings.json event — absent from `hooks.md`; verified 2026-06-20). RUL: globs-rule wording corrected — only `paths:` is documented, so the finding drops the unverified "deprecated/legacy" claim and steers to the documented field. PLH: optional `model`/`tools`/`name`/`allowed-tools` frontmatter no longer required; CLAUDE.md component-section required only for components the plugin actually ships. 954 tests |
| **5.4.0** | 2026-06-19 | Plugin-hygiene & settings-validation hardening. Three additive findings extend existing PLH and SET scanners (count stays **13**): PLH plugin-folder shadowing (`CA-PLH-015` — a `plugin.json` component-path key in the *replaces* set `commands`/`agents`/`outputStyles` pointing at a custom path while the default folder still exists) mirroring CC's `/doctor` & `claude plugin list` warning; PLH `skills:`-array validation (`CA-PLH-016` — each entry must resolve to a directory in the plugin root; flags `non-string`/`escapes-root`/`not-found`/`not-a-directory`) mirroring `claude plugin validate`; SET `autoMode` structure (only `environment`/`allow`/`soft_deny`/`hard_deny` string arrays) + dead-config (`autoMode` in shared `.claude/settings.json` is not read by CC). `--json`/`--raw` byte-stable. 949 tests |