chore(release): config-audit v5.7.0 — optimization lens + living knowledge layer

Release-cut for v5.7 Fase 1 (Chunks 1/2a/2b/3):
- best-practices register (knowledge/best-practices.json)
- CA-OPT-001 deterministic optimization-lens scanner (count 14→15)
- /config-audit optimize + optimization-lens-agent (opus, agents 6→7)
- /config-audit knowledge-refresh (commands 19→20)

plugin.json 5.6.0→5.7.0, README version badge + version-history row,
CHANGELOG [5.7.0] entry. Count badges already track filesystem
(self-audit --check-readme: passed). Suite 1091 green (hermetic HOME),
self-audit A/A (config 94, plugin 100).

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
This commit is contained in:
Kjell Tore Guttormsen 2026-06-21 20:04:08 +02:00
commit f9862b8a6d
3 changed files with 49 additions and 2 deletions

View file

@ -1,7 +1,7 @@
{
"name": "config-audit",
"description": "Multi-agent workflow for analyzing, reporting, and optimizing Claude Code configuration across your entire machine",
"version": "5.6.0",
"version": "5.7.0",
"author": {
"name": "Kjell Tore Guttormsen"
},

View file

@ -5,6 +5,52 @@ All notable changes to this project will be documented in this file.
The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/),
and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
## [5.7.0] - 2026-06-21
### Summary
"Optimization lens" — the first detector of the **«is this config optimally shaped?»** axis, on top
of the existing «is it correct?» checks, plus a **living** machine-readable knowledge layer that keeps
the lens's rules fresh. A config that *works* can still fit a better mechanism (a long CLAUDE.md
procedure that belongs in a skill, a lifecycle instruction that belongs in a hook); this release adds
a hybrid deterministic + opus motor that surfaces those as opportunities, every finding citing a
provenance-stamped best-practices register entry. Scanner count 14 → **15**, commands 18 → **20**,
agents 6 → **7**.
### Added
- **Best-practices register (knowledge layer).** `knowledge/best-practices.json` — a provenance-stamped,
schema-validated register (each entry: `id` / `claim` / `confidence` / `source` + optional
`mechanism` / `lensCheck`), the first runtime-consumed file under `knowledge/` and the source of
truth for the optimization lens. Loaded/validated by `scanners/lib/best-practices-register.mjs`.
Only **confirmed** entries are user-facing (verification duty).
- **Optimization-lens scanner (`CA-OPT`, scanner count 14 → 15).** New orchestrated scanner:
`CA-OPT-001` (LOW, *Missed opportunity*) — a CLAUDE.md procedure (≥6 consecutive numbered steps)
that would fit better as a skill, with recommendation + provenance from register entry `BP-MECH-003`.
Deterministic and conservative (no false positives on the negative corpus).
- **`/config-audit optimize` + `optimization-lens-agent` (opus, agents 6 → 7).** The prose-judgment
half of the lens, for the cases the deterministic scanner deliberately skips: lifecycle phrasing →
hook (`BP-MECH-001`), unscoped path-specific instruction → rule (`BP-MECH-002`), absolute "never"
prohibition → permission (`BP-MECH-004`). A pre-filter (`scanners/lib/lens-prefilter.mjs`,
unit-tested) does cheap recall; the opus agent is the precision gate, dropping low-confidence
candidates and citing the register id + source for each kept one. Agent-driven → deliberately not
byte-stable (own command, outside the snapshot suite).
- **`/config-audit knowledge-refresh` (commands 19 → 20).** Keeps the register current so the lens
never reads stale rules. A deterministic core (`scanners/lib/knowledge-refresh.mjs`, `assessFreshness`
with an **injected** reference date — it never reads the clock) classifies each entry fresh/stale by
the age of its `source.verified` stamp (default 90-day quarterly cadence); a read-only CLI
(`knowledge-refresh-cli.mjs`, `--reference-date` / `--stale-after` / `--dry-run`) reports staleness
without ever writing the register or hitting the network. The command layer re-verifies stale sources
(WebFetch) and polls the CC changelog + Anthropic blog (WebSearch), then applies **only
human-approved writes** (verification duty). Web/judgment-driven → deliberately not byte-stable.
### Notes
- **Byte-stability.** The new OPT scanner's additive entry is stripped at compare time
(`tests/helpers/strip-added-scanner.mjs`); the original 13-scanner `--json` / `--raw` output stays
byte-stable, and only the SC-5 default-output snapshots are regenerated (additive). The two
non-deterministic surfaces (`optimize`, `knowledge-refresh`) live outside the snapshot suite by
design. `-cli` / lib modules are not orchestrated scanners (self-audit excludes them), so the
scanner count stays **15**. Suite **1091** pass (hermetic HOME), self-audit A/A (config 94,
plugin 100), readmeCheck passed.
## [5.6.0] - 2026-06-20
### Summary

View file

@ -6,7 +6,7 @@
*AI-generated: all code produced by Claude Code through dialog-driven development. [Full disclosure →](../../README.md#ai-generated-code-disclosure)*
![Version](https://img.shields.io/badge/version-5.6.0-blue)
![Version](https://img.shields.io/badge/version-5.7.0-blue)
![Platform](https://img.shields.io/badge/platform-Claude_Code_Plugin-purple)
![Scanners](https://img.shields.io/badge/scanners-15-cyan)
![Commands](https://img.shields.io/badge/commands-20-green)
@ -660,6 +660,7 @@ This plugin is cautious by design — configuration files are important, and a b
| Version | Date | Highlights |
|---------|------|-----------|
| **5.7.0** | 2026-06-21 | "Optimization lens" — first detector of the «optimally shaped?» axis (vs «correct?»), plus a living knowledge layer. **Register:** `knowledge/best-practices.json`, a provenance-stamped, schema-validated best-practices register (first runtime-consumed `knowledge/` file). **OPT scanner (count 14→15):** `CA-OPT-001` (LOW) a ≥6-step CLAUDE.md procedure that would fit better as a skill, citing register entry `BP-MECH-003`. **`/config-audit optimize` + `optimization-lens-agent` (opus, agents 6→7):** prose-judgment lens for lifecycle→hook (`BP-MECH-001`), unscoped path→rule (`BP-MECH-002`), "never"→permission (`BP-MECH-004`); pre-filter recall + opus precision gate. **`/config-audit knowledge-refresh` (commands 19→20):** deterministic stale-check (injected reference date, 90-day cadence) + web re-verify/poll, human-approved writes only. Last two are agent/web-driven (not byte-stable). 1091 tests |
| **5.6.0** | 2026-06-20 | "Steering-model II" — the load-pattern / compaction-survival model lands end-to-end. **Foundation:** `active-config-reader` now enumerates rules, agents, and output styles (alongside CLAUDE.md/plugins/skills/hooks/MCP), each tagged `loadPattern` (always / on-demand / external) + `survivesCompaction` from the published loading model; the frontmatter parser also reads YAML block sequences (`paths:` lists). **B (load-pattern accounting):** `manifest` reports component-level sources (the double-counting plugin roll-up is gone), tags every source with the load-pattern triple, and leads with an **always-loaded subtotal** ("tokens that enter context every turn"); `token-hotspots` annotates each ranked hotspot with its load pattern. **C (output styles):** new orchestrated **OST** scanner (count 13→**14**) — `CA-OST-001` a custom style stripping built-in coding instructions (missing `keep-coding-instructions: true`, V10), `CA-OST-002` a plugin style with `force-for-plugin: true` overriding the user's `outputStyle` (V11), `CA-OST-003` a settings `outputStyle` resolving to no known style (dead config). Doc-verified; frozen v5.0.0 snapshots preserved via strip-helpers, SC-5 regenerated. 1023 tests |
| **5.5.0** | 2026-06-20 | "Steering-model I" — two additive compaction-durability / dead-config findings (count stays **13**, `--json`/`--raw` byte-stable). Per the official "what survives compaction" model: RUL flags a large (>50-line) **path-scoped** rule not re-injected after compaction (LOW); CML flags a **nested** (subdir) CLAUDE.md not re-injected after compaction (LOW). PLH flags a plugin agent setting `hooks`/`mcpServers`/`permissionMode` — Claude Code ignores these for plugin subagents, so it's dead config (`permissionMode` = MEDIUM false-security, `hooks`/`mcpServers` = LOW). Known limitation: the frontmatter parser reads inline `paths:` but not YAML block sequences (deferred to v5.6 Foundation). 961 tests |
| **5.4.1** | 2026-06-20 | Scanner-correctness patch (count stays **13**, `--json`/`--raw` byte-stable). HKV: added `Setup`/`UserPromptExpansion`/`PostToolBatch` to the valid-event set (a valid hook using one was wrongly flagged "will never fire"), and **removed** `post-session` (the 2.1.169 `post-session` is a self-hosted-runner workspace-lifecycle hook, **not** a settings.json event — absent from `hooks.md`; verified 2026-06-20). RUL: globs-rule wording corrected — only `paths:` is documented, so the finding drops the unverified "deprecated/legacy" claim and steers to the documented field. PLH: optional `model`/`tools`/`name`/`allowed-tools` frontmatter no longer required; CLAUDE.md component-section required only for components the plugin actually ships. 954 tests |