tigers1997 · tigers1997 · Jun 18, 2026 · Jun 18, 2026
@@ -4,6 +4,10 @@ All notable changes to this project. Format: [Keep a Changelog](https://keepacha
 
 ## Unreleased
 
+## [2.7.0] — 2026-06-17
+
+Bundle release spanning 2026-05-24 → 2026-06-17 (PRs #59–#82; release cut 2026-06-12, shipped 2026-06-17): the **AGPL-3.0 relicense** with the discipline-skills MIT carve-out plus the contributor-governance ratchet (branch protection, CLA, AI-review verdict gate); the **discipline-skills module** (curated 7-skill fork of obra/superpowers); the package-availability safety gate + tool-version status-line chip; the adjacent-project dogfood cascade (hook-group union merge, persona-drift `[ NOTICE ]` + `--modules +x/-y`, retrofit-byproduct gitignore, manifest `written_by_sha` + `cc-configure --whats-new`); the `block-dangerous-bash` trailing-slash/`$HOME` hardening; the CC 2.1.155–2.1.175 compat surveys (incl. the `agent` schema-status correction); the doc-cleared hook-payload batch (Stop `background_tasks` guard, slop-scan decision-JSON + OSC 9 ping, block-mode feedback fix); and **Fable 5 as the default model throughout** (scaffolded settings + intake field, test-runner agent; `// model: sonnet` per-machine downgrade stub for CC < 2.1.170 — the own-CI review pin briefly followed, then was walked back to `claude-sonnet-4-6` on cost, #82). Also restores the `## [2.6.0]` section header accidentally deleted in the PR #67 merge — its absence had folded the 2.6.0 entries back into Unreleased, over-reporting in `--whats-new` — and adapts `test-whats-new.sh` case C to the empty-Unreleased state a fresh release produces (first release since the test shipped; it had asserted the live Unreleased section was non-empty). `CC_VERSION` bumped to 2.7.0.
+
 - **chore(ci): own-CI reviewer repinned `claude-fable-5` → `claude-sonnet-4-6` (maintainer cost decision, 2026-06-12).** Partial walk-back of the PR #79 "fable throughout" directive, scoped to `review.yml` only: per review run, Fable 5 reads the same context (diff + CONTRIBUTING + CHANGELOG) at above-Opus pricing with a ~30% tokenizer surcharge and always-on thinking — the repo's own CI history shows Sonnet reviews at ~70–90s/PR with modest spend versus a single 5m37s Fable run that plausibly drained the CI key's remaining credits (the runs after it failed instantly with `is_error`/`$0`). Sonnet 4.6 is the reviewer that built the PR #64–#78 verdict-gate track record, so quality at this gate is proven. Scaffolded template defaults (`"model": "fable"`, test-runner agent) are deliberately unchanged — those bill the end user's own plan/key and remain the user-side choice, with the `// model: "sonnet"` downgrade stub already documented in `settings.local.json.example`. Compat comment updated to record the pin window (2026-06-09 → 2026-06-12).
 
 - **chore(compat): CC 2.1.172–2.1.175 survey — `agent` key was never schema-blocked (held→promotion-ready, with a survey correction); subagent-nesting wording HELD on a CHANGELOG/docs contradiction; gate unchanged.** SchemaStore full-sync PR #5723 still open/draft, untouched since 2026-05-24 despite its declared blocker #5728 merging 2026-06-01; supersession check clean (the only new claude-code SchemaStore activity, the `MultiEdit` permission-rule pair #5789 closed-unmerged/#5793 open, is a targeted fix, not a sync), so `tested_up_to` stays 2.1.150 per the no-lone-bumps rule. **Survey correction:** an exact-key pull shows `agent` live in the schema since at least the v2.1.126 sync (#5648, 2026-05-03; the key predates that sync's own diff) — evidence: `properties.agent` at [line 2596 of `claude-code-settings.json` @ SchemaStore commit `469df85`](https://github.com/SchemaStore/schemastore/blob/469df854905d40c0bddb8b75b0912b850643d3bd/src/schemas/json/claude-code-settings.json#L2596), confirmed in both the repo file and the published schemastore.org build (byte-identical, 2026-06-12). The 2026-06-09 survey had held it as "blocked on schema" by inferring the key was new from the CC 2.1.157 CHANGELOG line instead of pulling the schema (that line extended an existing key to dispatched sessions). Docs-verify passes (`settings.md` documents it as a normal project-level key, no managed-only carve-out) → promotion-ready as a commented opt-in stub in the multi-agent settings patch; never active by default, since it rebinds the *main thread's* prompt/tools/model. `fallbackModel` + `disableBundledSkills` re-verified absent and stay held. **Held:** CC 2.1.172's "sub-agents can now spawn their own sub-agents (up to 5 levels deep)" contradicts the live sub-agents doc, which still states they cannot (fetched 2026-06-12, two places) — the flat-fanout claims in `docs/04` and `templates/commands/infinite/SKILL.md` stay as shipped (true per live docs and within the tested envelope; the leaf-design guidance stands under either capability model); reword when the docs resolve the scope, ideally bundled with a `tested_up_to` bump past 2.1.172. Triage: `enforceAvailableModels` (2.1.175) dropped as managed-tier (`requiredMinimum/MaximumVersion` precedent); `wheelScrollAccelerationEnabled` (2.1.174) out of territory (user-level TUI pref). No-exposure greps clean against the 2.1.172/173 fixes: no shipped template emits wildcard `WebFetch(domain:…)` rules, mid-pattern file-permission wildcards, `MultiEdit` rules, or `[1m]`-suffixed model IDs; noted that 2.1.172 makes `availableModels` constrain the scaffolded agents' `model: fable`/`model: opus` overrides at runtime (the `settings.local.json.example` downgrade stub remains the documented path). Issue #14920 re-checked: unchanged since 2026-03-31. Compat comment refreshed in `config_schema.py`; full survey detail in `docs/07-backlog.md` (gitignored, local-only).
@@ -42,6 +46,8 @@ All notable changes to this project. Format: [Keep a Changelog](https://keepacha
 - `MainBrnchRuleset` required-status-checks list trimmed from four to three: `ai-review` removed from required (now informational only); required set is now `check` + `verdict-gate` + `license/cla`. Rationale: `anthropics/claude-code-action`'s OIDC-token-exchange path fails hard with 3-retries-then-failure when GitHub's workflow-modification safety triggers on a PR that touches `review.yml` (different code path from the first-deploy graceful-skip). `verdict-gate`'s self-bootstrap escape hatch already correctly handles workflow-modifying PRs by detecting `review.yml` in the file list and soft-passing. Requiring `ai-review` added no real protection (real action failures still surface as missing-VERDICT failures in `verdict-gate`) while creating false-negative noise on every workflow-edit PR. `branch-protection.json` re-exported; `CONTRIBUTING.md` § "Opening a PR" + § "Branch protection contract" updated accordingly.
 - `.github/workflows/check.yml`: bumped `actions/setup-python@v5` → `@v6` for Node.js 24 compatibility ahead of GitHub's 2026-06-02 force date (v5 runs on the deprecated Node.js 20, which will be force-upgraded then and removed 2026-09-16). Other actions in the workflow (`actions/checkout@v6`) already run on Node 24. No other code changes; smoke-tested locally via `python3 configure.py --check`.
 
+## [2.6.0] — 2026-05-23
+
 Bundle release: the SchemaStore PR #5706 unblock batch — PR #56 shipped eight schema-validated CC 2.1.143 settings keys + bumped `tested_up_to` 2.1.132 → 2.1.150 (closing tracking issue #53 after a multi-month, three-resurvey watch on the upstream gating PR), and PR #57 followed up by promoting two of those opt-ins to active defaults after a per-key review against the configurator's safety/efficiency goals. Latent strip-bug fix in #56 also unblocked the existing PRs #17/#18 opt-ins (`// prUrlTemplate`, `// sandbox.network.deniedDomains`) — they now actually surface in users' generated `.claude/settings.json` for the first time. `CC_VERSION` bumped to 2.6.0.
 
 ### v2.6.0 — CC 2.1.150 schema-validated keys batch + active-default promotions

@@ -40,7 +40,7 @@
 TEMPLATE_DIR = REPO_ROOT / "templates"
 BASE_SETTINGS_PATH = TEMPLATE_DIR / "core" / "dot-claude" / "settings.json"
 
-CC_VERSION = "2.6.0"
+CC_VERSION = "2.7.0"
 
 # -----------------------------------------------------------------------------
 # Colored output (only if stdout is a TTY and NO_COLOR isn't set)

@@ -23,12 +23,17 @@ echo "$out" | grep -q "No .claude/.cc-manifest.json" \
 [ ! -e "$tmp/b/.claude" ] || { echo "FAIL: B created .claude/ (not read-only)"; exit 1; }
 [ ! -e "$tmp/b/.claude-config.json" ] || { echo "FAIL: B wrote .claude-config.json (not read-only)"; exit 1; }
 
-# C: older-version manifest, no SHA -> lists the Unreleased CHANGELOG headlines.
+# C: older-version manifest, no SHA -> engages the older-version path: either
+# the Unreleased headlines banner, or — right after a release, when the live
+# CHANGELOG's Unreleased section is legitimately empty — the explicit
+# no-entries message. Both are distinct from case A's "Up to date".
 python3 configure.py --persona solo-experienced --yes --dir "$tmp/c" >/dev/null 2>&1
 python3 -c "import json;p='$tmp/c/.claude/.cc-manifest.json';d=json.load(open(p));d['written_by']='cc-configure 2.5.0';d.pop('written_by_sha',None);json.dump(d,open(p,'w'))"
 out=$(python3 configure.py --whats-new --dir "$tmp/c" 2>&1)
-echo "$out" | grep -q "Unreleased changes a re-run would pick up" \
-    || { echo "FAIL: C expected Unreleased headlines"; echo "$out"; exit 1; }
+echo "$out" | grep -qE "Unreleased changes a re-run would pick up|No Unreleased CHANGELOG entries found" \
+    || { echo "FAIL: C expected Unreleased headlines or empty-Unreleased message"; echo "$out"; exit 1; }
+echo "$out" | grep -q "Up to date" \
+    && { echo "FAIL: C must not report 'Up to date' for an older-version manifest"; echo "$out"; exit 1; }
 
 # D: stale (real older) SHA -> reports commits-ahead. Skipped on a shallow
 # checkout where HEAD~1 isn't present (CI default fetch-depth=1).