# Changelog

All notable changes to this project will be documented in this file.

The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/),
and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).

## [1.16.1] - 2026-06-23

KB-refresh-patch. Tre akkumulerte kunnskapsbase-oppdateringer som speiler Microsofts produkt-navngiving og modellkatalog. Ingen kommando-, agent- eller skill-endringer — kun reference docs. Hvert premiss verifisert mot Microsoft Learn FØR sveip; alle endringer review-gated på `git diff` + plugin-validering + deterministisk re-score (skills uendret, alle ≥90 %).

### Changed

- **Modellkatalog GPT-5.1 → GPT-5.5** i 3 filer: 2 kostnadsfiler (`batch-processing-cost-reduction.md`, `model-selection-price-performance.md`) + plattformfila `azure-ai-foundry.md`.
- **Foundry-navnesveip «Azure AI Foundry» → «Microsoft Foundry»** på tvers av 233 reference docs (810 forekomster) — følger Microsofts rebranding av Foundry-produktnavnet.
- **RBAC-rolle-renavn «Azure AI User» → «Foundry User»** (`foundry-workflows-visual-orchestration.md`); den eldre rollenavn-mappingen i `azure-ai-foundry-cost-governance.md` ble bevart med kontekst.

## [1.16.0] - 2026-06-22

Currency-, privat-sektor-paritets- og selvstendiggjørings-release. Adresserer devil's-advocate-audit (2026-06-18, 10 dimensjoner, 89 verifiserte funn) — `docs/devils-advocate-audit-2026-06-18.md`. Alle faktapåstander verifisert mot Microsoft Learn / EDPB / OWASP-primærkilder før skriving.

### Added

- **4 nye kommandoer (25 → 29):**
  - `/architect:businesscase` — forretningscase med NNV (netto nåverdi) + DFØ-gevinstrealisering (#7c).
  - `/architect:anskaffelse` — AI-anskaffelse: kravspesifikasjon, leverandørevaluering, terskelverdier (#7c).
  - `/architect:design` — sektor-nøytralt Solution Architecture Document (SAD): kontekst, NFR, alternativer, valgt design, risiko, veikart (#7d).
  - `/architect:vendor` — tredjeparts-/SaaS-leverandørvurdering (due diligence): dataresidens, sub-prosessorer, DPA, Schrems II, AI Act-deployer (#7d).
- **2 nye KB-filer (ms-ai-security, 60 → 62 refs):** `owasp-llm-top10-azure-mitigations.md` (LLM04/06/08/09) og `defender-threat-protection-ai-services.md` (AI threat protection — ikke i Azure Government).
- **Privat-sektor-paritet:** sektor-parametrisering i 6 kommandoer + onboarding-forgrening for privat/regulert sektor + parallell privat-bane i README/help/playground.
- **Spor C — selvstendiggjøring (planlagt deteksjon + onboarding-redesign):**
  - **Planlagt deteksjon (C1, opt-in):** automatisk sjekk om Microsoft Learn-KB har endret seg. Tier 1 (SessionStart-hook kjører deteksjon når ≥ `interval_days` siden sist) + Tier 2 (lokal OS-scheduler launchd/cron, deteksjon-only). **Claude-fri** — poller sitemaps → rapport → discovery, oppdaterer ALDRI KB selv; operatør kjører `/architect:kb-update` manuelt.
  - **Onboarding-redesign (C2):** virksomhetskontekst + scheduler-config flyttet til **bruker-eid `~/.claude/ms-ai-architect/`** (overlever plugin-reinstall; `lib/user-data.mjs` ren resolver). Ambient injeksjon av kompakt org-sammendrag ved hver sesjonsstart (ikke bare status). Valgfritt fritekst-felt (`free-context.md`). Scheduler (`enabled` + `os_scheduler_cadence`) settes i onboarding via gated CLI (backup + atomisk skriving). Privat-sektor-paritet låst med regresjonsvakt (`tests/test-onboarding-parity.sh`): privat virksomhet fullfører onboarding uten «Annet» + privat reg-sett (DORA/Finansforetaksloven/Finanstilsynets IKT-forskrift/Verdipapirhandelloven/Hvitvaskingsloven).

### Changed

- **EU AI Act-tidslinje re-baselinet mot Digital Omnibus:** Annex III høyrisiko (frittstående) utsatt til 2027-12-02, Annex I (innebygd) til 2028-08-02, Art. 50 transparens 2026-08-02. Art. 99-bøtesatser korrigert (35M €/7 %, 15M €/3 %, 7,5M €/1 %). Klargjort at EU AI Act ennå ikke er EØS-innlemmet og KI-loven uvedtatt per juni 2026.
- **Agent-orkestrering currency:** Connected Agents deprecated (pensjon 2027-03-31) → ny GA-modell Prompt/Hosted agents + Responses API som single entry point. MAF 1.0 GA + A2A v1.0.1. Prompt Flow (Foundry + AML) retirement 2027-04-20 → MAF. Computer Use Agent (CUA) GA 2026-05-07. Agentic retrieval GA-split (REST `2026-04-01` min/ekstraktiv, LLM-planning preview).
- **Kostnadslag re-baselinet:** GPT-5 $1,25/$10 input/output, konsolidert til én prissannhet i `deterministic-cost-calculation-model.md`.
- **Foundry URL-navnerom-migrering:** `ai-foundry` → `foundry` / `foundry-classic` på tvers av 141 filer.
- **Dataresidens korrigert:** Norway East — gpt-4o + gpt-4o-mini eneste Norge-residente generative modeller; modellkatalog modernisert.
- **DPIA cross-border:** EDPB Rec 01/2020 seks-stegs-TIA + CLOUD Act/FISA-restanalyse (FISA §702 til mars 2027; DPF gyldig; CLOUD Act uendret av DPF). EDPB 28/2024: anonymisering vurderes case-by-case.
- **ROS + DPIA regulatorisk currency:** NSM Grunnprinsipper v2.1, OWASP Agentic 2026 (ASI01–10), EchoLeak, DPF, EUDB.
- **Sikkerhet:** M365 E7 + Agent 365 (GA 2026-05-01) i licensing-matrix; Foundry Local air-gapped (Sovereign Private Cloud) i disconnected-scenarios.
- **KB-routing:** RAG/MLOps-KB ruting (betinget last) + forsont ROS-last-kontrakt (kjerne + betinget).
- Tellinger oppdatert: README docs-badge 387 → 389, README KB-tabell + per-skill-seksjon (ms-ai-security 60 → 62), CLAUDE.md skill-tabell (ms-ai-security 60 → 62), SKILL.md cost-optimization subdir-telling 21 → 22 (korrigert pre-eksisterende drift).

### Notes on 1.16.0

- **Verifisering:** alle currency-påstander krysssjekket mot primærkilder. Der OWASP 2025-sider returnerte 404 ble innholdet kryssverifisert mot alternative offisielle kilder.
- **Plugin API surface:** 29 kommandoer, 12 agenter, 5 skills (389 reference docs), 2 hooks, MCP-server-config. Playground v3-koden er uendret siden v1.15.0 — kun doc-stamp bumpet; screenshots i `playground/screenshots/v1.15.0/` ikke regenerert.
- **Tester:** 239 plugin-validering, kb-integrity 192/192 (220 baseline orphan-warns), kb-update 213, kb-eval 100, test-hooks 11/11, plugin-discovery 13/13, run-e2e alle suiter (security/cost/summary/ros/ai-act/**onboarding-parity 14/14** + 6 playground-suiter) 0 FAIL. gitleaks: 3 pre-eksisterende i `playground/vendor/`.

## [1.15.0] - 2026-05-16

### Changed — playground v3 project-view integration

V2 project-surface (screen-tabs + category-tabs + per-command paste-cards) erstattet av v3 project-view (sidebar + main + import-modal). Sluttproduktet av 5 sesjoner: V2-PROJECT-VIEW-SPEC, JS-foundation, renderProjectView/renderProjectArtifact/renderArtifactNav, testing (97 nye assertions), og nå integration + ship.

#### Sesjon 5: integration + ship

- `renderActive()` ruter `project`-surface til ny `renderProjectSurfaceV3()` som wrapper renderProjectView + topbar + app-shell.
- `renderProjectSurface` (152 linjer), `renderCommandSubCard` (87 linjer), `rehydratePasteImports` (15 linjer) slettet.
- `currentProjectScreen` modul-var slettet; `currentProjectTab` beholdt som zombie for `ACTIONS['project-tab']`/`ACTIONS['parse']`/`handlePasteImport` (test-back-compat).
- `ACTIONS['project-screen']` slettet.
- 5 v2-CSS-klasser slettet: `.project-tabs`, `.project-tab`, `.project-tab__count`, `.sub-zone`, `.paste-import-row`, `.project-header__*`, `.command-cards`.

#### Fingerprint-gap lukket

- `requirements.headers`: utvidet til `/^\s*#\s*(EU\s*AI\s*Act\s*[—-]\s*Krav|AI\s*Act-?krav|Krav per|Requirements)/im` (matcher "EU AI Act — Krav for høyrisiko provider+deployer").
- `license.headers`: utvidet til `/^\s*#\s*(Lisens(kart|kapabilitets|-kapabilitets)?(legging|matrise)?|License\s*Mapping)/im` (matcher "Lisens-kapabilitetsmatrise").
- `KNOWN_GAP_FIXTURES = {}` i `tests/test-playground-fingerprints.sh` (var `{ requirements: true, license: true }`).

#### Migrasjon utvidet (v2→v3) med parserFor

- `migrateDataVersion(state, archetypeFor, parserFor)` tredje arg lagt til.
- Hvis `reports[cid].parsed` mangler men `raw_markdown` finnes, kjøres `parserFor(cid)` automatisk.
- `defaultParserFor(cmdId)` resolverer `PARSERS[archetypeFor(cmdId)]`.
- Tre callsites oppdatert: cold-load, import-state, load-demo.

#### Browser-fixes funnet via dogfood

- `components-tier4-project-view.css` lagt til i `<link>`-chain (filen var vendored, men ikke loaded → modal-overlay og two-column layout virket ikke).
- `renderImportModal` setter `data-open="true"` på `.import-modal`-div (DS-kontrakt: `display: flex` aktiveres kun ved `[data-open="true"]`).

#### Tester

- `bash tests/run-e2e.sh --playground` → **386 PASS**, 0 FAIL, 2 WARN (pre-eksisterende: `.cmd-pipeline` reservert; multiselect form-felt).
  - v3-static: 219 PASS (var 202 — la til 17 nye renderer-routing-asserts)
  - parsers: 70 PASS
  - migrations: 16 PASS
  - fingerprints: 32 PASS (var 30, 2 WARN → 32, 0 WARN)
  - project-view: 30 PASS
  - actions: 19 PASS
- `bash tests/validate-plugin.sh` → 219 PASS.

#### Screenshots regenerert til v1.15.0/

24 PNG-er (12 surfaces × 2 tema, retina, fullPage der applicable). Nye surfaces: project-overview, project-artifact-{classify, security, ros, cost, summary}, project-import-modal (viewport-only), project-search.

#### Demo-flyt verifisert i nettleser

- "Last inn demo-data" → 17 artifacts loaded + migrasjonen v2→v3 fyller `parsed`/`verdict`/`keyStats`.
- Sidebar viser alle 17 grupperte commands med severity-badges.
- Aggregate verdict (BLOKKERT) + key stats (17/17, 5/5, 2026-05-04) i header.
- Importer/Re-importer-modal åpner som overlay med backdrop.
- Per-artifact navigasjon (klikk i sidebar) → mounter riktig renderer i main-area.

### Notes on 1.15.0

- Sesjon 5 fullført i én pass — token-budsjettet (~80-100k) holdt.
- v2-mockup.local.html + V2-PROJECT-VIEW-SPEC.local.md beholdt inntil sesjon 8 ship (per scope grenser).
- Pre-eksisterende kosmetiske issues (duplisert artifact-title, "Manglende rapporter"-heading-feil) ikke fikset — utenfor scope for sesjon 5 (integration), planlagt v1.16.0.

## [1.14.0] - 2026-05-08

### Changed — playground root-cause refaktor (6 sesjoner)

Etter v1.13.0 + v1.13.1 patchet 10+ symptomatiske visuelle bugs, dokumenterte v1.14.0-arbeidet at vi brukte DS via "band-aid lokal CSS" (191 linjer, 21 fix-kommentarer) i stedet for DS-konvensjoner. Brukeren valgte root-cause-fix etter å ha lastet ned Anthropic Plugin-Playground v3 referansepakke. Resultatet er DS-konvensjon-adopsjon på tvers av 14 renderere, lokal CSS halvert, og alle reported visuelle bugs løst på rotnivå.

#### Sesjon 2: DS root-cause fix (DS v0.3.x → v0.4.0)

Tre DS-bugs som tidligere ble symptomatisk patchet i lokal CSS er nå fikset i `shared/playground-design-system/components-tier3-supplement.css` og re-syncet til `playground/vendor/`:

- **B-DS-1: `.kanban-card__name`.** `word-break: break-all` knekket midt i ord — endret til `word-break: break-word` + `overflow-wrap: anywhere`. Tilsvarende lokal override i ms-ai-architect playground slettet.
- **B-DS-2: `.expansion__title-main` + `.expansion__title-sub`.** `display: inline` gjorde at title-main og title-sub kjørte sammen på samme linje. Endret til `display: block` så de stables vertikalt. Lokal override slettet.
- **B-DS-3: `.matrix__bubble`.** Manglet `cursor: pointer`, hover-effekt og `:focus-visible` outline når bobler er klikkbare. Lagt til som en del av base-mønsteret.

#### Sesjon 3: Risk-rapporter til DS-konvensjon

`renderDpia`, `renderSecurity`, `renderRos` refaktorert til DS-summary-grid + ros-layout-mønster fra Anthropic-ref `ros-lier-kommune.html`-scenario. Matrix i hovedcell + radar i `<aside class="card">`, top-risks som `<ol class="top-risks">` inne i `<div class="card">`, findings med riktig list-only-mønster (BEM-struktur uendret). Defensive `display:block; clear:both` for `.top-risks` slettet — DS-pattern løser layout uten override.

#### Sesjon 4: Compliance/govern-rapporter til DS-konvensjon

6 renderere bytter lokal `.report-meta`-wrapper mot DS-mønstre:

- `renderAiActPyramid` — pyramide + tier-descs + `<dl class="adr-meta">` for forpliktelser
- `renderRequirements` — `<div class="findings">` med `findings__list` (master-detail riktig nå)
- `renderConformity` — kanban full bredde over, `<section class="aiact-timeline-section">` full bredde under
- `renderTransparency` — ren `<article>`-struktur uten `.report-meta`-wrapper
- `renderFria` — DPIA-lignende mønster
- `renderReview` — kanban + suppressed-panel som tydelig under-seksjon

#### Sesjon 5: Phase-rapporter til expansion-list

`renderMigrate` + `renderPoc` bytter parallell-bullet `.phase-detail`-seksjoner mot `<div class="expansion">`-list (DS-supplement) — én expansion per fase med traffic-list inne i body. `phases-summary`-tabellen beholdt over expansion-listen for tabell-sammendrag. Lokal `.phase-detail`-CSS slettet.

#### Sesjon 5b: Lavt-scope renderer-fixes

Verifikasjon av tre renderere som ikke krevde DS-refaktor men hadde subtle bugs:

- **`renderCost` key-stats.** `KEY_STATS_CONFIG['cost-distribution']` og `inferVerdict('cost-distribution')` viste "[object Object]" og returnerte alltid 'go' fordi parser-output har `p50/p90 = {monthly, yearly}`-objekter, ikke tall. Begge ekstraherer nå `.monthly` med fallback for flate fixtures.
- **`renderCompare` vinn-attribusjon.** `firstWord`-heuristikk feilet når begge subjekter delte førsteord (f.eks. "Azure AI Foundry" vs "Azure ML + AKS" ga begge fw='azure', kollapset vinn-attribusjon). Erstattet med distinctive-token-matching: full-subject-substring først, deretter ord som er unike for ett subjekt.
- **`renderUtredning` aria-pattern.** Droppet misvisende `role="tab"` / `role="tablist"` (vi rendrer ikke ekte tab-toggle, alle paneler er synlige). Beholdt `aria-current="true"` for visuell aktiv-markør. Ekte tab-toggle defer til v1.15.0.

### Removed

- Lokal `.phase-detail`-CSS (overflødig etter expansion-list-refaktor)
- Lokal `.report-meta`-wrapper-CSS (alle 6 compliance/govern-renderere bytter til DS-pattern)
- Defensive containment-overrides (top-risks/aiact-timeline/phase-detail `clear: both; display: block; width: 100%`)
- Tre lokal-overrides slettet i sesjon 2: `.kanban-card .kanban-card__name { word-break: break-word }`, `.expansion__title-main, .expansion__title-sub { display: block }`, og matrix-bubble cursor/hover-overrides

### Notes on 1.14.0

- Lokal `<style>`-blokk: 191 → 122 effektive linjer (~36% reduksjon siden v1.13.1)
- DS bumpet til v0.4.0 (delt mellom plugins, andre re-syncer på eget tempo)
- Alle 17 renderere PASS visuell QA mot demo-data i begge themes
- Plugin-validering: 219 PASS. Playground E2E: 272 PASS. Migrations: 7 PASS. Full E2E: 42 PASS.
- 24 screenshots (12 surfaces × 2 tema, retina, fullPage) regenerert til `playground/screenshots/v1.14.0/`. v1.10.0 + v1.11.0 beholdt som historisk referanse.
- Refs `V1.14.0-PLAN.local.md` + `V1.14.0-AUDIT.local.md` (slettet ved ship per plan).

## [1.13.1] - 2026-05-06

### Fixed — playground visuelle bugs (post-v1.13.0 manuell QA)

Patch-pakke som adresserer 10 visuelle bugs identifisert av maintainer i nettleser etter v1.13.0-shipped. Alle skyldtes mismatch mellom playground-rendrere og DS-konvensjoner som v1.13.0 ikke fanget opp.

- **B7: classify "Forpliktelser" indent.** `<dl>`+`<ul>` inne i `<section class="report-meta">` brukte browser-default margin/padding som ga uforutsigbare indents. Lokal `.report-meta`-reset (DL som CSS-grid `max-content + 1fr`, h4 uppercase + bold, ul med `padding-left: var(--space-5)`).
- **B8a: `requirement-expand` handler missing.** `renderRequirements` markup hadde `data-action="requirement-expand"` på hver `expansion__head`-knapp, men ingen handler var registrert i `ACTIONS`-mappen. Klikk på R-01..R-09-radene i AI Act-krav-rapporten gjorde derfor ingenting. Fix: register `ACTIONS['requirement-expand']` med samme toggle-mønster som `onboarding-toggle-group`.
- **B8b: expansion title-main + title-sub kjørte sammen.** DS-spans var inline (`display: inline`), så "dokumentertKilde: Art. 9" rendret uten linjebrytning. Lokal `.expansion__title-main, .expansion__title-sub { display: block }` så de stables vertikalt.
- **B10: kanban-card tegnknekking.** DS' `.kanban-card__name` har `word-break: break-all` som knekker midt i ord ("Tekn isk dokumen tasjon"). Lokal override `.kanban-card .kanban-card__name { word-break: break-word }`.
- **B11: DPIA matrix-bobler ikke responderer på klikk.** v1.13.0 click-handler matchet kun mot første-kolonne i Trusler-tabellen (T-001-mønster). Men DPIA-fixturer har full-tekst label i `matrix_cells`-data og T-001..T-005 i threats-tabellen — ingen match. Fix: utvid match-strategi til (Pass 1) exact first-cell, deretter (Pass 2) substring-match mot enhver celle med 40-tegn-prefiks-toleranse for å håndtere truncation.
- **B12, B13, B15: defensive layout for top-risks/suppressed-panel/phase-detail/aiact-timeline.** Eksplisitt `display: block; clear: both; width: 100%` på sibling-rapport-seksjoner som potensielt kunne lekkefra grid-elementer (`.small-multiples`, `.kanban-board`, `.mat-ladder`). `.phase-detail` får også `margin-top` + h3/h4-spacing-reset.
- **B14: Migrate "skal vel være tabell".** Lagt til phases-summary-tabell over phase-detail-seksjonene (Fase, Varighet, Milepæler-count, Suksesskriterier-count, Status). Samme tabell speilet i `renderPoc` for konsistens.

### Notes on 1.13.1

- B9 (transparensnotis spacing) var visuell preferanse, ikke konkret bug — utsatt.
- Smoke-test 23/23 PASS (`/private/tmp/claude-smoke-msarch-v1131.mjs`).
- Plugin-validering 219 PASS, KB-update 42 PASS, playground E2E 271/271 PASS.
- Patch berører kun lokal CSS i `<style>`-blokk, `ACTIONS`-handler-registrering, click-handler-utvidelse, og to renderer-funksjoner. Ingen modifisering av `playground/vendor/`. Vendored DS' `.kanban-card__name { word-break: break-all }` står — overstyres lokalt.

## [1.13.0] - 2026-05-06

### Fixed — playground visuelle DS-bugs

Fix-pakke som speiler llm-security v7.6.1 (commit `f9b555a`). Samme klasse av visuelle bugs identifisert i ms-ai-architect playground via parallell DS-analyse. Verifisert i 22 smoke-test-asserts + full E2E-regresjon.

- **B1: `renderFindingsBlock` + `renderRequirements` outer-wrapper.** DS' `.findings` er `display: grid; grid-template-columns: 360px 1fr` (list+detail-panel). Playground bruker bare list-kolonnen, så outer `<div class="findings">` klemte indre struktur til 360px og forlot 1fr-kolonnen tom. Erstattet med `<section class="report-meta">`-wrapper. Indre `findings__list > findings__group > findings__group-header + findings__items` BEM-struktur uendret.
- **B2: `.report-table` lokal CSS.** Brukt i 6+ rapporter (Trusler, Kostnadsoversikt, TCO, Risiko-tabell, Key Metrics) men ikke definert i vendored DS — rendret som ren ustylet tekst-grid. Lokal styling speilet fra llm-security v7.6.1: 100%-bredde, border-collapse, `bg-soft` th-bakgrunn med uppercase-overskrift, hover-rad, mono-formatert `<code>`-inline.
- **B3: ROS-matrise klikkbare bobler.** `<span class="matrix__bubble">` byttet til `<button type="button" data-threat-id="…" aria-label="Trussel: …">`. Document-level click-handler matcher `.matrix__bubble[data-threat-id]`, scroller smooth til tilsvarende rad i Trusler-tabellen og highlighter raden i 1.6 sek. Lokal CSS for `cursor:pointer`, `transform: scale(1.15)` på hover, `:focus-visible` outline.
- **B4: `renderRadarSvg` label-overlap ved 6+ akser.** Bumpe SVG fra 300×300 til 380×380, R fra 100 til 125, label-offset fra `R+25` til `R+28`. Dynamisk `text-anchor` basert på horisontal-posisjon (`Math.abs(dx) < 0.2 ? 'middle' : (dx > 0 ? 'start' : 'end')`) for å unngå at bottom-labels overlapper hverandre — typisk for ROS-rapporten med 7 risiko-dimensjoner.
- **B5: `recommendation-card__body` overflow-wrap.** Lange single-line tekster (URLer, owner-tags, datoer) skubbet ut av viewport i grid-cellen `auto + 1fr`. Lokal CSS `overflow-wrap: anywhere; word-break: break-word;`.

### Changed

- `tests/test-playground-v3.sh`: DS-klasse-assertion oppdatert fra `.findings` til `.findings__list` (BEM-list er fortsatt i bruk; outer grid-container bevisst fjernet i B1).

### Notes on 1.13.0

- Bugfix-only release. Ingen scanner-/agent-/knowledge-endringer. Ingen modifisering av `playground/vendor/` (DS-endringer der må gå via `shared/playground-design-system/` + re-sync).
- Playground v3-arkitektur uendret. Alle 17 rapport-renderers og parser-routing-tabell uendret.
- Smoke-test: 22/22 PASS (`/private/tmp/claude-smoke-msarch-v1130.mjs`). E2E playground: 272/272 PASS (201 statisk-struktur etter test-oppdatering + 70 parser-fixtures + 1 verdict-pill). Plugin-validering: 219 PASS. KB-update: 42 PASS.

## [1.12.0] - 2026-05-05

### Added — Manuell KB-refresh-arbeidsflyt

- **`commands/kb-update.md`** — ny `/architect:kb-update` slash-kommando som driver hele KB-oppdaterings-løypen fra en aktiv Claude Code-sesjon: `run-weekly-update.mjs --force --discover` → `report-changes.mjs` → per-fil `microsoft_docs_fetch` → `Edit`-baserte oppdateringer → git commit. Argumenter: `--skip-discover`, `--priorities <list>`, `--dry-run`, `--single-commit`. Default-prioritet: `critical,high`. Schedulering er eksplisitt utenfor scope og overlatt til brukeren.

### Removed — launchd/cron-arkitektur (Wave 3-5 reversert)

Etter ToS-gjennomgang (Anthropic Consumer Terms § 3 — automated access only via API key or where explicitly permitted) ble den autonome cron-arkitekturen vurdert som unødvendig kompleks for en solo-fork-and-own-plugin. Apply-fasen krever LLM-resonnering uansett, så manuell trigger fra en aktiv Claude Code-sesjon er både enklere og holder pluginen klart innenfor ToS.

- `scripts/install-kb-cron.mjs` (~400 linjer) — cross-OS cron-installer (launchd/systemd/Windows Task Scheduler)
- `scripts/kb-update/weekly-kb-cron.mjs` (~600 linjer) — cron-orkestrator med pre-flight, lock, backup, claude -p subprocess, post-run verify, rollback
- `scripts/kb-update/templates/` — 4 scheduler-templates (`com.fromaitochitta.ms-ai-architect.kb-update.plist`, `ms-ai-architect-kb-update.{service,timer,ps1}`) + README
- `scripts/kb-update/lib/auth-mode.mjs` (~100 linjer) — `detectAuthMode` + `validateAuthForCron` (kun cron-spesifikk validering)
- `scripts/kb-update/lib/lock-file.mjs` (~120 linjer) — PID+mtime stale-detection (kun for cron-kollisjons-vern)
- `scripts/kb-update/lib/cost-estimat.mjs` (~80 linjer) — pre-flight budget-cap-logikk (kun for api-key cron-kjøringer)
- `tests/kb-update/test-{auth-mode,lock-file,cost-estimat,install-cron,session-start-status,template-generation,weekly-kb-cron-flags}.test.mjs` — 7 testmoduler for slettet kode (~68 testtilfeller)
- `tests/test-kb-update.sh` — Wave 5 Bash-3.2-shim, erstattet av direkte `node --test`-kall i `run-e2e.sh`
- `hooks/scripts/session-start-context.mjs`: `kb-update-status.json`-overvåking (Wave 3 Step 10) + ubrukt `getCacheDir`-import fjernet

Total: ~1500+ linjer kode + 7 testmoduler ut. Beholdte utilities (`atomic-write`, `backup`, `cross-platform-paths`, `log-rotate`) er fortsatt brukbare av `run-weekly-update`-scriptet og kan gjenbrukes i fremtidige skripts.

### Changed

- `tests/run-e2e.sh --kb-update` kaller nå `node --test tests/kb-update/*.test.mjs` direkte (4 testmoduler, 42 tester) i stedet for `bash tests/test-kb-update.sh`-shim
- `README.md` — "Knowledge Base Maintenance"-seksjonen rewriter for manuell modell, scheduling-disclaimer lagt til
- `CLAUDE.md` — KB-ferskhet-seksjonen oppdatert, `/architect:kb-update` lagt til i kommando-tabellen

### Notes on 1.12.0

- ToS-vurdering: kjøring fra aktiv Claude Code-sesjon faller innenfor "Claude Code CLI is exempted from the prohibition on automated access" per [Anthropic auth-docs](https://code.claude.com/docs/en/authentication) og Consumer Terms § 3. Apply-fasen kan ikke automatiseres innenfor pluginens scope — eventuell schedulering er forkers eget ansvar
- Forbruk: én manuell kjøring (default `--priorities critical,high`) henter ~80 Microsoft Learn-sider via `microsoft_docs_fetch` og oppdaterer 9-53 filer. Kvote-bruk avhenger av abonnementets rate-limits — typisk innenfor en daglig Pro/Max-allowance
- 42/42 KB-update-utility-tester PASS. 271/271 playground-tester uendret
- `data/change-report.json` blir værende på disk for diagnose etter hver kjøring

## [1.11.0] - 2026-05-04

### Added — Design-system 100%-adoption + visual upgrade

The playground now consumes the shared `playground-design-system` v0.3.0 end-to-end. Plugin contract (24 commands, 12 agents, 5 skills, 2 hooks, MCP) is unchanged — playground-internal release.

- **Hoisted to shared DS (v0.3.0)** — 13 generic components moved from inline `<style>` to `shared/playground-design-system/components-tier3-supplement.css`: `.eyebrow`, `.page__*`, `.key-stats`/`.key-stat`, `.verdict-pill-lg` (5-band), `.tab-list`/`.tab`/`.tab-panel`, `.top-risks`/`.top-risk[data-severity]`, `.recommendation-card`, `.card__*` subcomponents, `.card--severity-{level}`, form-patterns (`.field-row`, `.field-label`, `.field-help`, `.multi-select`, `.checkbox-row`, `.required-mark`), `.stack-lg/-md/-sm`, `.pyramide-tier-detail`, `.scenario-card-grid`/`.scenario-card[data-status="winner"]`, `.app-shell` variants. 567 new lines, 107 new selectors. Re-synced to vendored DS via `scripts/sync-design-system.mjs ms-ai-architect`.
- **PARALLEL CSS migration** — all 6 plugin-local naming groups renamed to DS conventions: `.topbar* → .app-header*`, `.residual-pair* → .pair-before-after*`, `.command-card* / .catalog-card* → .card + .card__*`, `.screen-tabs/-tab/screen → .tab-list/.tab/.tab-panel`, `.pyramide-desc* → .pyramide-tier-detail*`. Includes markup restructure for tab-component (`data-active="..."` → `[hidden]`-attr) and pair-before-after (`data-severity` → BEM modifier). ~50 markup occurrences updated.
- **Inline `<style>` trim** — block reduced 202 → 127 lines (~37%). `renderPageShell` + `renderKeyStatsGrid` refactored to DS markup (`.page__header-main` + `.page__header-aside` + `h1.page__title`; `.key-stat--{level}` BEM modifier).
- **Visual upgrade (benchmarked against showcase)** — AI Act pyramid width fix (min-width 480px, font-size-md, responsive @media), severity-coded left-border on report-cards in project surface based on `parsed.verdict`, app-header restructure (brand + breadcrumb + spacer + actions), eyebrow-label "PROSJEKTER · X av X" on home, `.stack-lg` vertical rhythm on home/project/catalog body.
- **Demo state rename** — `Acme AS` → `Acme Kommune` and `Demosystem` → `Acme Kunde-chatbot` consistently across all 17 fixtures (39 Acme occurrences). `build-demo-state.mjs` updated: `organization.name` = "Acme Kommune", `projects[0].id` = "acme-kunde-chatbot", `projects[0].name` = "Acme: Kunde-chatbot".
- **`playground/screenshots/v1.11.0/`** — 24 regenerated PNGs (~27 MB total) reflecting the visual upgrade. v1.10.0 set preserved as historical reference.
- **`tests/screenshot/run.mjs`** — `OUT_DIR` + comments bumped to v1.11.0.

### Plugin-local survivors (intentional)

Components kept inline because they are semantically distinct from DS counterparts:

- `.verdict-pill` (domain go/block semantics, distinct from DS `.verdict-pill-lg` severity bands)
- `.scenario-card[data-status="met/partial/missing"]` (DS only ships "winner")
- `.read-more-block` + `.suppressed-panel` (native `<details>`; DS uses JS-toggled `aria-expanded`)
- Surface-specific layouts: `.onboarding-*`, `.home-*`, `.project-*`, `.modal*`, `.command-form*`, `.catalog-cards`-container

### Notes on 1.11.0

- 3-session rollout (commits `40631c0` Fase 1-3 + `31aed40` Fase 4-6 + `7ffaa82` Fase 7-9). Session 1+2 committed with `[skip-docs]` because user-facing docs are bundled with the release commit.
- Tests: 201 static + 70 parser-fixture + 7 migration = 278 PASS playground-suite, 0 FAIL. Pre-existing `tests/test-ros-output.sh` fixture-missing failure is unchanged.
- DS bump is purely additive — other vendor consumers (okr, llm-security, ultraplan-local, config-audit) do not need to re-sync to remain green.

---

## [1.10.1] - 2026-05-04

### Added — Demo system + screenshot gallery

The playground now ships with a one-click demo and committed screenshots so forkers can see what the plugin produces without running anything.

- **`<script type="application/json" id="demo-state-v1">` inline block** — built by `scripts/build-demo-state.mjs` from `playground/test-fixtures/*.md`. Contains a complete state: 18 onboarding fields prefilled for "Demo kommune", one demo project with all 17 reports as `raw_markdown`. ~37 KB inline, file://-safe (no fetch).
- **"Last inn demo-data" button** on the onboarding action-bar. Clicking it replaces all state with the demo and navigates to the project surface.
- **`raw_markdown` persistence** — `handlePasteImport` now writes `markdown` to `project.reports[id].raw_markdown` (with equal-value guard to prevent render loops). Survives page reload.
- **`rehydratePasteImports()`** — on project surface mount, fills textareas from `raw_markdown` and re-renders visualizations. Hooked via `queueMicrotask` after `innerHTML` commit.
- **`tests/screenshot/` tooling** — standalone Playwright runner (its own `package.json`, gitignored `node_modules`). Captures 24 PNGs per release (12 surfaces × 2 themes) at `deviceScaleFactor: 2` retina, `fullPage: true`.
- **`playground/screenshots/v1.10.0/`** — 24 committed screenshots (~28 MB total) covering onboarding, home, catalog, project surface (rapporter × 5 tabs, oversikt, kontekst, eksport).

### Notes on 1.10.1

- v1.10.0 was tagged earlier on 2026-05-04 with the foundation refactor. v1.10.1 ships the demo + screenshots without changing any v1.10.0 behavior — purely additive: one inline JSON block, one button, two new functions, one tooling directory.
- Plugin contract (24 commands, 12 agents, 5 skills, 2 hooks, MCP) remains unchanged.
- Tests: 215 plugin-validation + 201 + 70 + 7 = 493 PASS. Pre-existing `tests/test-ros-output.sh` fixture-missing failure is unchanged.

---

## [1.10.0] - 2026-05-04

### Added — Playground v3 felles grunnskjelett (foundation refactor)

All 17 report renderers now share a unified visual signature through `renderPageShell()`. The plugin contract (24 commands, 12 agents, 5 skills, 2 hooks, MCP) is unchanged — this release is playground-internal.

- **Foundation helpers:** `renderPageShell()`, `renderVerdictPill()`, `renderKeyStatsGrid()`, `inferVerdict()`, `inferKeyStats()`, `KEY_STATS_CONFIG` — provide eyebrow + h1 + optional 5-band verdict-pill + optional 3-5 key-stats-grid that every renderer wraps around its archetype-specific body.
- **Schema v1→v2 migration:** Eager `MIGRATIONS` pipeline at cold-load and import time, idempotent via `dataVersion=2` guard. Backfills `verdict` and `keyStats` on existing reports without disrupting user state. `tests/test-playground-migrations.sh` (7 PASS) validates idempotency.
- **Tier 3 supplement components integrated:** kanban (conformity, review), mat-ladder (migrate, poc), screen-tabs (utredning, project surface), scenario-card-grid (license, compare), residual-pair (dpia, ros), top-risks (ros), recommendation-card (security, ros), suppressed-panel (review), critique-card (adr), read-more (utredning, summary), traffic-light (poc).
- **Parser extensions (R15 forward-compat):**
  - `parsePhasedPlan` — `phases[].status` (planned/active/done) + `currentPhaseIndex` + `pocVerdict`
  - `parseComparison` — `winner` field from `## Vinner: <id>`-line
  - `parseMatrixRisk` — `_consumer` discriminator (Strategy A) for shared dpia + ros usage
- **Onboarding redesign:** Exactly 4 structured fields (select / multiSelect for sector, regulations, license, scenarios) + 14 free-text fields with placeholder hints. Improves prefill flexibility while keeping enum-driven fields where they matter.

### Added — Light theme tokens

- `[data-theme="light"]`-block in `shared/playground-design-system/tokens.css` (re-synced to `playground/vendor/`) with verbatim Aksel values. Both themes meet WCAG 2.2 AA contrast.
- Theme-bootstrap-script in `<head>` reads saved `localStorage('ms-ai-architect-theme')` before stylesheets parse — no flash-of-wrong-theme.

### Added — v1.10.0 fixtures and validation

- `tests/test-playground-migrations.sh` — new 7 PASS suite for v1→v2 idempotency.
- `tests/fixtures/playground/state-v1-snapshot.json` — pre-migration state fixture.
- `tests/test-playground-v3.sh` extended to 201 PASS — new asserts on per-renderer `renderPageShell` usage, Tier 3-bruk (kanban / mat-ladder / screen-tabs / scenario-cards), onboarding field-distribution (4 strukturerte / 14 fritekst), `_consumer`-strategi A.
- Regenerated fixtures: `migrate.md`, `poc.md` (per-phase Status + POC-Verdict), `compare.md` (`## Vinner:`-line).
- `playground/A11Y-RAPPORT.md` — populated with code-based static assessment of all 4 surfaces and 17 renderers (was: skeleton). Browser-axe-core run still pending per `MANUAL-CHECKLIST.md` section 10.

### Changed

- `playground/ms-ai-architect-playground.html` — all 17 renderers wrap output via `renderPageShell()`. Inline CSS additions (e.g. `.pyramide-desc`, `.scenario-card-grid`, `.residual-pair`, `.read-more-block`, `.top-risks`, `.recommendation-card`, `.suppressed-panel`) are flagged as v1.11.0 candidates for hoisting to `shared/playground-design-system/components-tier3-supplement.css`.
- Plugin README — refreshed v1.10.0 section with foundation-helpers, Tier 3 adoption list, parser extensions, schema migration, theme-tokens.
- Plugin CLAUDE.md — Playground (v3) section now reflects v1.10.0 architecture, validation counts (201 + 70 + 7), and inline-CSS hoisting candidates.
- Marketplace root README — bumped ms-ai-architect to v1.10.0 with felles grunnskjelett summary.

### Notes

- **Plugin API surface unchanged.** All 24 commands, 12 agents, 5 skills (387 reference docs), 2 hooks, and MCP server configuration remain identical to v1.9.0. v1.10.0 is a minor bump per SemVer because the playground state schema change is auto-migrated and backward-compatible.
- **6-session implementation** per `.claude/projects/2026-05-03-ms-ai-architect-v1-10-playground/plan.md`:
  - Session 1: Foundation (theme tokens, helpers, MIGRATIONS, v1-snapshot fixture)
  - Session 2: Onboarding redesign + surface page-headers + screen-tabs
  - Session 3: Sub-batch A renderers (regulatory 6) — aiact-pyramid, requirements, transparency, frimpact, conformity, dpia
  - Session 4: Sub-batch B renderers (security 3) — security, ros, review (REFERENCE STANDARD)
  - Session 5: Sub-batch C renderers (econ + dokumentasjon 8) — cost, license, migrate, adr, summary, poc, utredning, compare
  - Session 6: Visual QA + A11Y-rapport + dokumentasjon-overhaul + version bump (this commit)
- **Pre-existing test pollution:** `tests/run-e2e.sh` references `tests/test-ros-output.sh` which expects a fixture that has never existed in git (`tests/fixtures/ros-analysis/fixture.md`). Reports as 1 suite failure but is unrelated to v1.10.0 — predates this work and is unchanged here.
- **Session 4 commit `645f016` (B.1 bundling):** That commit message was bundled with ultraplan-local work due to hook timing — historical only, not relevant to plugin behavior.

---

## [1.9.0] - 2026-05-03

### Added — Playground v3 (full architecture rewrite)

The playground at `playground/ms-ai-architect-playground.html` was rebuilt from scratch as a multi-surface decision-builder + report viewer (3867 lines, single-file). It replaces the v2 5-step pipeline with a project-aware app that persists state across sessions and visualizes parsed reports inline.

- **4 surfaces:**
  - Onboarding — 5 grouped expansion sections (organization, technology, security, architecture, business) with 18 fields covering organization profile, tech stack, compliance, architecture preferences, and business references. Drives prefill across all 24 commands.
  - Home — 3 entry tracks (Onboard / New project / Catalog) plus project list with completion-meter per project.
  - Catalog — 24 commands grouped in 5 expansion categories (regulatory, security, economy, documentation, tool) with full-text search, filtered counts, and direct form-launch.
  - Project — per-project tabs (one per command category), command form prefilled from shared onboarding state, paste-back markdown import that parses and visualizes reports inline.
- **Persistent state:** IndexedDB primary store with localStorage fallback. Schema-versioned (`STATE_KEY = 'ms-ai-architect-state-v1'`) with eager `MIGRATIONS` pipeline that runs at cold-load and import time. Throttled writer prevents excessive disk traffic.
- **17 inline report renderers** routed via canonical archetype-routing table:
  - Regulatory (6): classify pyramid, requirements list, transparency text, FRIA, conformity checklist, DPIA matrix-risk-6×5
  - Security (3): security 5×5 matrix, ROS 5×5 matrix with 7-dimension threat library, review findings
  - Economy (2): cost distribution P10/P50/P90, license capability matrix
  - Documentation (6): migrate phased plan, ADR, summary markdown, POC verdict, utredning, compare
- **14 markdown parsers** with the same archetype keys, exposed as `window.__PARSERS`. All parsers return `{ok, data}` or `{ok, errors[]}` — never throw.
- **Light/dark theme toggle** in the topbar, persisted in `localStorage('ms-ai-architect-theme')`. FOUC-safe: a small bootstrap script in `<head>` reads the saved value before stylesheets parse.
- **Export/import** as JSON Decision Record envelope (Blob + FileReader). Schema-version-aware on import; downgrades trigger MIGRATIONS automatically.
- **Vendored design-system** at `playground/vendor/playground-design-system/`, kept in sync via `scripts/sync-design-system.mjs ms-ai-architect` from the marketplace root. SHA-256 MANIFEST detects local drift.
- **24 ACTIONS** registered through a single delegated click handler on `document` — keeps event-handler footprint minimal.

### Added — Playground validation

- `tests/test-playground-v3.sh` — bash 3.2-compatible static structure tests (170 PASS lines): vendored CSS link order, file://-safety, surfaces, 24 commands, 14 parsers, 17 renderers, design-system class usage, exposed globals, 23 ACTIONS handlers.
- `tests/test-playground-parsers.sh` — 70 PASS lines: validates 17 fixtures × parser routing keys + handlePasteImport wiring.
- `tests/run-e2e.sh --playground` — new flag dispatching both suites; included in `--all`.
- `playground/test-fixtures/` — 17 synthetic markdown fixtures (one per report-producing command) covering all canonical parser archetypes. Generic example data only.
- `playground/A11Y-RAPPORT.md` — accessibility report skeleton with WCAG 2.2 AA test grid for both themes.
- `playground/MANUAL-CHECKLIST.md` — 10-section manual QA checklist (round-trip, schema migration, project CRUD, command form prefill, paste-import per report type, parse errors, export/import cycle, theme toggle, file://-standalone, axe-core a11y per surface) with concrete DevTools-console assertions.

### Changed

- `playground/ms-ai-architect-playground.html` — replaced (v2 1990 lines → v3 3867 lines). Same canonical filename, so external links continue to resolve.
- Plugin README — new "## Playground (v3)" section documenting the 4-surface architecture and validation matrix.
- Plugin CLAUDE.md — replaced v2 5-step pipeline section with v3 architecture overview. `docs/playground-v2-spec.md` retained as historical reference but no longer the contract; v3 spec lives at `.claude/projects/2026-05-03-playground-v3-architecture/`.
- Marketplace root README — playground listing for ms-ai-architect updated to describe v3 architecture, persistence model, 17 renderers, theme toggle, and 240-test validation.

### Notes

- **Plugin API surface unchanged.** All 24 commands, 12 agents, 5 skills (387 reference docs), 2 hooks, and MCP server configuration remain identical to v1.8.0. Playground v3 is an additive, optional UI surface — users invoking `/architect:*` directly see no behavioral difference.
- v1.9.0 is a minor bump per SemVer because the plugin contract (commands/agents/skills/hooks/MCP) is backward-compatible. The playground's local IndexedDB state schema would only affect users who had the v2 playground running; existing state is auto-migrated by the eager MIGRATIONS pipeline.

---

## [1.8.0] - 2026-04-09

### Added
- Sitemap-based KB change detection system (`scripts/kb-update/`)
  - `build-registry.mjs` — extracts 1342 unique URLs from 387 reference files
  - `poll-sitemaps.mjs` — streams 18 Microsoft Learn sitemaps for `<lastmod>` changes
  - `report-changes.mjs` — prioritized change report (critical/high/medium/low)
  - `discover-new-urls.mjs` — finds relevant new MS Learn pages not yet covered
  - `run-weekly-update.mjs` — weekly orchestrator with `--force`, `--discover`, `--dry-run`
- Shared libraries: `url-normalize.mjs`, `sitemap-stream.mjs`, `registry-io.mjs` (zero npm deps)
- Background poll trigger in session-start hook (auto-runs if >7 days since last check)

### Changed
- Session-start hook reads sitemap-based change report instead of broken mtime staleness check
- `generate-skills --update` reads `change-report.json` for targeted MCP updates with `changed_urls`
- KB maintenance section in README updated with automated freshness and auto-update info

### Deprecated
- `scripts/kb-staleness-check.sh` (mtime-based, unreliable after git clone — kept for backwards compat)

---

## [1.7.0] - 2026-04-07

### Changed
- Open-source release in ktg-plugin-marketplace
- Moved skill-gen tooling from `orchestrator/` to `scripts/skill-gen/`
- Fixed broken DPIA knowledge base reference path (norwegian-public-sector-governance/ → responsible-ai/)
- Removed orphaned `pre-edit-secrets` hook (secrets scanning consolidated to llm-security plugin)
- Updated all badge counts (version 1.7.0, 387 ref docs, 12 agents)
- Fixed agent model column in CLAUDE.md (sonnet → opus, matching actual frontmatter)
- Added missing `ai-act-assessor` agent to README agent table
- Added Bash scope guardrail to `commands/export.md`
- Added supply chain warning for remote install scripts in knowledge base

### Removed
- Internal orchestrator tooling (Linear integration, hardcoded issue IDs)
- Client-specific utredning examples (`docs/utredning/`)
- Generated test report artifacts (`e2e-test-report.md`, `.pdf`)

---

## [1.6.0] - 2026-02-19

### Added
- ROS analysis command and agent (`/architect:ros`)
- 7-dimension risk assessment with NS 5814/ISO 31000 methodology
- AI threat library (49 threats across 7 categories)
- Sector-specific checklists (health, transport, finance, justice, education)
- MAESTRO multi-agent security model integration
- 7 new KB reference documents (3,131 lines)
- E2E test suite for ROS (24 checks)
- `summary-agent` integration for ROS output

---

## [1.5.0] - 2026-02-13

### Added
- E2E regression tests (43 checks across 3 suites: security, cost, summary)
- Auto onboarding detection at session start
- Systematic KB update process with staleness policy
- `kb-staleness-check.sh` with `--json` output mode

---

## [1.4.0] - 2026-02-13

### Added
- Onboarding agent (`/architect:onboard`) — 5-phase structured interview
- README rewrite to English

---

## [1.3.0] - 2026-02-13

### Changed
- 5-skill migration: 1 monolithic skill → 5 domain-specific skills (ms-ai-advisor, ms-ai-engineering, ms-ai-governance, ms-ai-security, ms-ai-infrastructure) with 364 reference documents
- Fixed 13 broken KB references
- Fixed UTF-8 encoding issues across reference files

---

## [1.2.0] - 2026-02-13

### Added
- Runtime hooks: secrets detection (`pre-edit-secrets.mjs`), session context, stop reminders
- Test infrastructure: hook tests, KB integrity tests, plugin discovery tests
- `/architect:export` command for PDF export

---

## [1.1.0] - 2026-02-13

### Added
- `summary-agent`: executive summary and decision memo synthesis
- `dpia-agent`: DPIA/PVK for AI systems
- Utredning orchestrator v2
- Production readiness (21 bug fixes)

---

## [1.0.0] - 2026-02-12

### Added
- Initial release: 20 knowledge bases, 8 agents, `architecture-review-agent`
- Cosmo Skyberg architect persona with 7-phase advisory methodology
- MCP integration with Microsoft Learn for live documentation verification
- Core commands: `/architect`, `/architect:research`, `/architect:security`, `/architect:cost`, `/architect:adr`, `/architect:diagram`, `/architect:review`, `/architect:compare`

---

## [0.4.0] - 2026-02-07

### Note
First formal version. Previously unversioned.

### What existed
- 145+ reference documents across 14 categories
- 6 specialized agents: research, security assessment, cost estimation, ADR writer, license mapper, diagram generation
- 13 commands: research, compare, cost, license, security, poc, adr, migrate, utredning, generate-skills, diagram, setup, help
- Cosmo Skyberg architect persona
- MCP integration with Microsoft Learn
- Session logging with ADR reminders