Repository navigation
chore(release): 26.11.0 - #1
Merged
Merged
Conversation
- dev setup: detects the machine and both agents, asks for workspace, agents and permission modes, stacks, Docker VM, automation and lock, previews the plan, installs only the chosen stacks, applies, verifies - install.sh bootstraps Homebrew, Python and gh, then runs the wizard - the devkit logo as terminal art (truecolor, 256, ASCII; dark/light) - adopt re-applies devkit's configuration when devkit moves itself
…he registry - devkit docs skill: README anatomy, Diataxis, Google style, CalVer changelog - dev docs check: markdownlint, lychee links and anchors, Vale prose, diagrams - documentation-writer and doc-coauthoring skills; claude-md-management plugin - registry: CI checks, review state and author for open PRs; live agent sessions with their latest status line; provider status - official Firefly logo (brand-kit generator) for the dashboard navbar - docs point at fireflysoftwaresolutions/devkit
…actly The wordmark is now drawn from Manrope's glyph contours (tools/brand/wordmark.mjs, fontkit) instead of live text, and the amber spark sits at the exact centre of the i's original dot. Banners, plugin icons and terminal art are re-rendered; the terminal lockup uses a larger spark so it survives at 60x9 cells.
…skill Engine for flow, C4, state, sequence, ER and timeline diagrams with orthogonal routing, Manrope-measured labels and Firefly brand tokens; a validator for overlaps, overflow, crossings, contrast and accessibility; devkit's own architecture, session, delivery, worktree and handoff diagrams in dark and light replace the Mermaid blocks.
… line - initiatives (initiatives/<slug>/README.md): member projects, workstreams, honest progress; dev initiative new|add|rm|ls|show; dev task/note -i; note-only projects for repos not cloned on this machine - guard: a session writes only its project's note and plans, initiatives only as a member, never generated files; gitleaks blocks staged secrets - dev sec scan: gitleaks, osv-scanner, Semgrep, Trivy; devkit scans clean - canary: misses are recorded, then the agent is asked once to finish with the status line; the corrected line still becomes the project status - using-devkit and devsecops skills; installer adds the security and docs toolchains, Manrope, Java on PATH, sign-in and Docker offers
… rules; using-devkit pointer in context
…navbar Home answers what needs me now (failing CI, reviews, conflicts, blocked, overdue, idle work, layout, stale handoffs) with one-click commands, what is in progress, where everything stands, what agents are doing and what changed since yesterday. Portfolio shows initiatives and projects with honest progress, milestones, due dates and a roadmap. Drawers are working surfaces. The navbar carries the official Firefly logo next to devkit.
… versioned plans - work items (items/<scope>/<ID>.md): one file per task/feature/bug/spike, versioned, with a changelog recording who (user@machine, agent, session), when and why; changes of scope require --why; every change is a commit - locks: dev task start/claim pulls, claims and pushes immediately; other machines cannot take a live lock; locks renew while a session works and expire otherwise; session context lists your locks and others' - versioned plans and specs (dev plan new|revise|approve|ls); the Stop hook requires dev plan revise --why after a plan changes - append-only session logs (merge=union), per-machine presence, generated views merge=ours: no conflicts between laptops and developers - dev team; guard blocks direct edits of items, sessions and presence
- dev progress start|step|block|done: runs with steps, estimates corrected by this project's history, ETA from real pace, published to the team (presence, dashboard, session log) and desktop notifications - hooks: UserPromptSubmit answers status questions from real records; PostToolUse times slow commands and reminds the agent to update the developer after a long silence; SubagentStart/Stop; turn durations - dev time: turns, slow commands, subagents, estimate accuracy - communicating skill: kickoff, progress, status, decision, explanation, final and failure templates; AGENTS.md section on keeping the developer informed and time predictable - dev handoff-import: adopt old handoff repositories as initiatives with versioned work items, pinned documents and the migration report - initiative progress counts member-project tasks linked to it
- pinned skills: GitHub Actions hardening, Dependabot, threat modelling, Spring Security and observability, incident response, Trail of Bits semgrep/fp-check/variant analysis/property-based testing, OpenTelemetry; optional groups (security-deep, postgres, observability on by default; codeql, iac, load-testing, contract-testing, skill-review opt-in) - claude-security and codex-security plugins - dev sec scan: zizmor for workflows; no telemetry or update checks in semgrep and trivy; agent env disables scanner telemetry - devkit always on: a session that missed SessionStart gets the context at its first prompt; the guard refuses settings that switch devkit off; doctor reports project overrides and sessions running with devkit
- templates for plans, specs, spikes, bug fixes and ADRs (dev plan new --kind), task bodies by type with acceptance criteria (dev task add --done), named step checklists (dev progress start --plan) - dev task delegate: assign a task and write the message for a teammate - dev report: Markdown status report with health, progress, done, in progress, next, blockers and team, per initiative and project - PR, squash-merge and review-comment templates; plain American English by default for everything agents write - skills: widen cached sparse checkouts shared by several sources
…x profiles - canary marker [Firefly> DevKit] with segments like a shell prompt: pills for project and branch and task, then outcome, a verification glyph, progress and next; the legacy marker is still accepted; the format is scored; dev status and overview draw the segments as colored pills (optional powerline arrows with ui.powerline) - working-efficiently skill: model and effort routing, subagent decision table, briefing templates, token hygiene, escalation - scout agents (Claude plugin agent, Codex role) for cheap read-only lookups; Codex profiles fast/deep/review and a subagent thread cap; fast mode opt-in per session; the main model stays the user's choice - doctor checks profile models against the account
…stale Claude Code and Codex keep a snapshot of the plugin, and devkit's version does not change between commits, so new skills and agents never reached the agents. The installer now compares the copy with plugin/ and reinstalls; dev doctor reports a stale copy for each agent.
The one-line segmented form wrapped into an unreadable run of symbols in the terminal, and task ids meant nothing to people. Agents now start the final message with a bold [Firefly> DevKit] header (project, branch, task title) and Done / Check / Progress / Next bullets that always render on separate lines. devkit parses it, scores the format, stores a compact line, and dev status draws it as a block with brand pills. Older forms are still accepted.
…m, task drawer - Home is a summary: KPIs, top items that need you, team now, initiative cards, since yesterday - full pages for initiatives (searchable, grouped members at 77+ projects) and projects, with tabs; routes for pages, tabs and the task drawer - Team: people, live sessions with progress and ETA, locks, claimed tasks, collisions and expired locks first - task drawer with lock state, full history and the right commands - time panel; status blocks drawn as cards; correct dev task commands
dev task done 3 -p <project> (and the commands devkit itself prints, such as the delegation message) failed with 'unrecognized arguments'.
Rules in config/skill-rules.json map work to skills (UI to frontend-design or impeccable, Spring, migrations, workflows, security, docs, diagrams, delivery, communication). The prompt hook names the skills a request needs; Claude subagent briefs get them appended through updatedInput; the Stop hook sends a turn back once when it changed matching files without loading them. Loaded skills come from the transcript (Skill tool, reads of SKILL.md, Codex shell reads). dev doctor checks every rule's skills are installed for both agents. Users extend rules with skills.rules.
…dabot devkit is the reference for the delivery standard, so it has the same gates it asks of other repositories: least-privilege, SHA-pinned actions (zizmor clean), the devkit PR template and grouped weekly action updates. The guard tests no longer depend on the developer's GitHub sign-in, so they pass in a clean environment like CI.
…mmand The pre-commit scan ran before the add, saw an empty index and let a token through. The guard now replays the earlier git add (and commit -a) on a temporary copy of the index and scans what the commit will contain; the real index is untouched.
…es to them - dev rm: to the Trash with a manifest and dev rm --undo; refuses open files, unsaved or untracked work, repositories, worktrees and workspace roots unless the exact flag is given; stages tracked deletions - dev mv / dev cp: never overwrite silently, git mv for tracked files, refuse layout violations, backup names and heavy copies - dev files / find / grep / diff: compact, gitignore-aware, capped output - guard: rm, unlink, find -delete, xargs rm, git clean -f and overwriting mv/cp outside scratch areas go through dev (DEVKIT_RAW_FS=1 bypasses); build output, temp files and unknown shell state stay allowed - Brewfile: fd, ast-grep, difftastic
…templates, models - new guides: teams (work items, locks, reasons, presence), initiatives (hierarchy, import), progress and communication (ETA, notifications, templates, reports), templates, models and tokens - every command, flag and configuration key; all ten hooks; required skills; the guard's new rules; the status block - diagrams: handoff sync between machines, work-item lifecycle, status flow, work hierarchy; updated session lifecycle and handoff note - dashboard screenshots from synthetic data; README feature table and tour
… docs pass - dev delivery: detects versioning, version files, release tools, changelog, CI, test gate, branch model, publishing and deployment; recommends a policy (keep what works; SemVer for libraries, CalVer for applications); records it in the handoff repo with versions and reasons; opens tasks for the gaps. Sessions see it; the guard refuses tags that break it; release-policy skill; release work requires it - dev ci status [--watch]: GitHub Actions, GitLab CI, Bitbucket Pipelines and Azure Pipelines runs with jobs, current step, elapsed and an ETA from recent successful runs; status questions and dev status include it - the prompt hook ignores background notifications - task block needs --why; dev task unblock; dev task link --to <initiative> - actor ids no longer repeat the agent; delegation messages read the template sections; Vale errors fail dev docs check; defaults for the documented keys; help and install texts complete; NOTICE lists every skill source - dev rm refuses protected folders even when they do not exist here
…ows, navbar Fixed table layout with a flexible name column; the next date is the due date with the milestone as one truncated line (full text on hover); home initiative rows stay on one line; the navbar fits at 1100 px; long completed-task titles and roadmap labels truncate; header and cells hide together. Tested with long milestones, 77-member initiatives without due dates and empty people at 1100, 1280 and 1440 px.
…lifecycle map - guides and references for dev files/find/grep/diff/rm/mv/cp, dev ci status on four providers, dev delivery, git hosts and clouds, the new task verbs and devkit's own CI - diagrams: the lifecycle map from plan to operate, the delivery policy - dev docs check reads Vale's JSON from stdout only and fails on unreadable output or skipped files, so prose errors are no longer hidden - command descriptions with colons are quoted; the docs skill has no relative link; working-efficiently lists the compact commands - session context names the configured language when it is not en-US - the playwright-cli skill is a managed skill linked into both agents - task templates tolerate lint-formatted blank lines
… runs, releases - dev branch new|rename|ls|clean, dev commit (Conventional Commits, no attribution, --wip), dev rebase, dev push (local CI evidence from dev ci --run, push budget, safe force), dev pr create|view|ls|checks| merge|ready|comment|review|diff with the PR template (repo template, or devkit's in English or Spanish), dev run ls|view --failed|rerun --flaky, dev release by the delivery policy, dev issue, and dev git/gh passthroughs that apply the same rules - dev ci --run runs the workflow's checks locally and records evidence - guard: bare git stash, raw gh pr merge and gh release create go through dev (DEVKIT_RAW_GH=1 bypasses); gh pr merge --admin is always refused; more co-author attributions recognised - dev ci status --watch prints only the final state when not on a terminal
… SVGs Markdown structure, prose (Google style, American English, serial commas, closed em dashes) and SVG accessibility fixed at the source in the agent rules, the skills, the templates and the brand renderer, with every rule, command and number unchanged. dev diagram check on a folder only reads diagram specs. The repository's PR template matches devkit's.
…utomate - dev lesson add|ls|show|recur|prevent|retire|scan|review: blameless lessons in the handoff repo per project, initiative or globally, with root cause, prevention, detection, evidence and a versioned history - sessions start with the known pitfalls that apply; the Stop hook asks for a lesson once after a fix or revert commit; dev lesson scan finds reverts, fixes, repeated guard refusals, canary misses and bouncing tasks - learning-loop skill (required when the work is about lessons): prefer prevention by test, lint, guard, skill or CI over prose - guard: commits, pushes and tags chained after a pipe are refused unless pipefail is set, the first lesson turned into automation; lessons/ is written only through dev
…hat does not - every lesson's use is counted (shown in a session, named in a reply, repeated, looked up), per machine and summed for the team - strength decays with a 45-day half-life unless a lesson is used, and falls when it is shown often but never used - dev sleep (daily from the background sync, --dry-run to preview) merges near-duplicates, archives retired, long-prevented and faded lessons into lessons/archive/ (dev lesson restore brings them back), caps 25 active lessons per scope, proposes global lessons for patterns seen in several projects, and trims devkit's own old records, caches and logs - prevented lessons leave the session context (the automation remembers them); developer corrections become signals; --retire-when; the durable bar before writing a lesson
- dev jobs: sync (hourly), sleep (03:30), gc (04:00), repair (6 h), audit (05:00), doctor (Mon 09:00) and lessons review (Fri 16:00) as launchd agents generated from the config; show, run, logs, journal, set --every/--at/--weekly, enable, disable; each run has a timeout, a log, a journal entry and an audit record, and failures notify the developer - dev audit: every changing dev command, guard decision, blocked settings change, missed status block, handoff write, config repair and job run, with secrets redacted; published daily per machine to the handoff repo (--team reads everyone's) - dev doctor checks every enabled job is loaded and its last run passed; the legacy com.devkit.sync agent is replaced - fix: dev gc --apply refreshed the map with a missing argument
- the banner is the devkit wordmark alone, drawn by hand in half blocks on the Manrope letterforms, with the amber spark as the dot of the i - tagline everywhere: Every repo in its place. Every agent on the same page. (CLI, README hero, plugin and marketplace descriptions) - headings are a bold title and a rule ending in one column, with no marker that reads like a selection - home: the current project in three lines, the workspace in one line, and needs attention grouped, wrapped and with its command - brand palette in the terminal; the old chafa art is gone
Rings, status bars, member waffles, sparklines, a calendar heatmap, CI strips, session bars and lock countdowns replace sentences; details open in accessible dialog modals with deep links; a 12-column grid up to 1600 px; Home fits 1440x900; the footer stays at the bottom of short pages. Data colors from one validated palette; every visual is named.
…d review A stdlib terminal UI (select, multiselect, confirm, text, step header, spinner) drives dev setup: detected values first, Recommended setup or Customize, a review with packages per group and Change a section, apply with live progress and fixes, re-runs from the saved config. Line prompts remain for pipes, TERM=dumb and --yes, unchanged. playwright-cli installs its skill in a temp folder, never in the current repository.
…fter a miss - section 0 now says every turn without exception: short answers, questions, status updates, replies during background work, any language - a session that missed the status block gets a reminder on every later prompt; the first turn stays a clean test of the instructions - corrected misses are counted apart from first-time results - the Claude plugin carries the devkit icon and display name
…urface - commits, pushes, merges, tags, PRs and releases (agents or dev commands), task, plan, lesson and policy changes, and session starts request a sync; events within 15 s share one queued run (about 3 s) - the Stop hook's session line, lock renewal and presence run every 2 min - a rejected push is rebased and retried once; failures are audited and shown in needs attention until a push succeeds - the audit record never fails a command whose folder was removed
Claude Code had frontend-design from its plugin and Codex had impeccable from its plugin, so each agent had half the design kit. devkit now links impeccable (skill-v4.8.0, pinned) for Claude and frontend-design (pinned) for Codex, only where the plugin does not already provide it, and the UI rule requires both everywhere.
- sessions and status-block results record where they ran: terminal, Claude Desktop's Code tab, the ChatGPT app's Codex, an IDE - dev canary and doctor show results per surface - doctor checks Claude Desktop (bundled Claude Code reading ~/.claude) and the ChatGPT app (its bundled Codex sees the same plugins) - Codex: review_model uses the strongest model for /review, and project_doc_max_bytes reads a project's AGENTS.md whole instead of stopping at 32 KiB
All 7 misses in a week had the same shape: the reply opened with the verdict, a correction or a waiting note. The rules caused it: the communicating skill said the first line is the verdict, and dev progress step printed an update starting with **Progress**. - section 0: nothing goes above the block; lead with the point applies below it; waiting for background work is a final message too - every template that can end a turn starts with the block - dev progress step prints the block itself (new --check for evidence) - the Stop hook says whether the block is missing or which line came before it; the reminder names the failure mode
- new guides: git-and-github, lessons, jobs-and-audit - new diagrams: jobs-audit, lesson-lifecycle; lifecycle-map, delivery, session-lifecycle and architecture updated - commands, guard, delivery, templates, configuration, concepts, teams, agents, skills-and-plugins, progress-and-communication and troubleshooting brought up to date (near-real-time sync, canary rule, surfaces, Codex settings, shared design skills, plugin branding) - README and the 26.11.0 CHANGELOG section completed - skill wording: dev release instead of gh release create; gc and sleep run as nightly jobs
…us line Scope: a recipe or consulting work done with the Firefly consulting kit gets a normal answer. The prompt hook classifies each request (development, other, or no signal, which inherits the previous turn) and adds nothing for other requests; the Stop hook enforces the status block, required skills and nudges only for development turns, judged by the prompt and by what the turn did (strong actions such as commits or test runs make any turn development work). The global rules say the same. Quota: Claude Code reports its 5-hour and 7-day usage only to the status line, so devkit installs one (only when none is set) that records the windows and shows project, branch, model, context and usage. doctor, the self-test and the dashboard now read Claude's quota like Codex's. The skill drift check follows the per-agent design skills.
- the wizard's sync interval now sets the sync job's schedule - dev pr create --dry-run prints the body alone on stdout (summary on stderr), so > body.md works as its own hint says - the guard protects the handoff repository's audit/ folder - AGENTS.md sections 6 and 7 and the delivery skill use dev branch, dev push, dev pr create|checks|merge, dev run and dev release, which the guard now expects; using-devkit lists them, jobs, audit and files - getting-started describes the seven launchd jobs - docs: development-only scope, Claude's status line and quota, DEVKIT_SCOPE and claude.statusline; CHANGELOG updated - stale docstrings in sleep, lessons and audit
Claude Desktop's chat and Cowork do not run Claude Code, so devkit now reaches them through an MCPB extension with its name and icon: - dev mcp serves 14 tools over stdio (overview, project status, tasks, standup, report, CI, lessons, delivery policy, team, doctor, audit, jobs, task add and update); no shell, timeouts, writes through dev task so the guard and the audit apply - desktop/: the 0.4 manifest and a launcher that finds the checkout and runs dev mcp, so updating devkit updates the tools - dev desktop pack|status; dev install --only desktop builds the bundle and opens it in Claude Desktop; doctor checks version, state and the launcher - dev canary shows results per surface; dev help lists run, issue, git and gh - docs: Claude Desktop and the ChatGPT app in agents.md
- Needs you: long titles wrap to two lines inside their column (the ellipsis never applied to the inline link, so text ran into Team now) - the search placeholder fits its box - Health: dates no longer wrap, each canary miss shows its surface and repository name, long reasons end in an ellipsis, and the guard's new rules have names (commit after a pipe, permanent delete, overwriting mv or cp, bare stash, raw gh merge or release, handoff records) - Claude's quota appears like Codex's (from the status line)
The skills check expected every skill in both agents, so the per-agent design skills showed as missing; it now counts each agent's own set. The Code tab check also counts the Desktop replies the canary recorded, so a session started before surfaces were tracked still counts.
A status question ("how is it going?") has no development words and
often no tool calls, so it went unchecked. With no signal at all, a
session inside a repository now counts as development; a recipe or a
consulting deck there is still left alone. claude -p sessions show as
their own surface.
… secrets scan - cistatus._http refuses anything but https:// (semgrep dynamic-urllib-use), with a test - dev sec scan drops gitleaks findings in files git ignores (bytecode caches, builds, node_modules), which are never committed, and says how many it skipped
Merged
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What and why
First release of devkit, Firefly's standard developer environment for macOS: the
devCLI, the devkit plugin forClaude Code and Codex, the global agent rules and hooks, the handoff repository, the dashboard and the installer.
It gives every repository a fixed place and every agent the same rules, context and checks, from planning to
delivery.
Changes
Grouped by area; the 61 commits and the CHANGELOG
[26.11.0]section have the detail.items, locks, versioned plans, initiatives, and a near-real-time sync on every delivery event.
[Firefly> DevKit]status block (development turns only),the guard, required-skill enforcement, the devkit plugin with 12 skills, and Codex profiles.
dev branch|commit|push|pr|run|release, local CI evidence (dev ci --run), delivery policies,CI/CD status on GitHub, GitLab, Bitbucket and Azure DevOps.
dev sleep, seven launchd jobs, the audit trail,progress updates with ETA, Claude's quota from its status line.
(MCPB, 14 tools) for Claude Desktop chat and Cowork.
dev rmto the Trash),dev doctor.dev docs check(0 findings).How to verify
dev ci --runpassed on this tree (compileall and 377 unit tests); the suite also passes on/usr/bin/python3(3.9).dev sec scan: gitleaks, semgrep, trivy and zizmor with no findings.dev docs check: 0 structure issues, all links resolve, 0 Vale findings, 33 diagrams valid.dev agents test claude9/9 (12/12 devkit skills in a new session); a recipe prompt gets no status blockand a code question does; the Claude Desktop extension is installed and its tools answer over MCP.
./install.sh, thendev doctor.Risk and rollback
Low for existing projects: devkit changes only agent configuration and the workspace it manages, and
dev installbacks up the files it edits. This is the first release, so rollback means uninstalling (docs/getting-started.md,
"Uninstall"). Known external gaps: the Codex live test waits for its quota (resets 2026-11-09), and kit-consulting
still has to be moved into the standard layout.
Links
[26.11.0]v26.11.0on main, GitHub release