Repository navigation
chore(release): 26.11.1 - #2
Merged
Merged
Conversation
Agents wrote tests that checked nothing and reran whole suites after one failure. dev test runs the last failures first, then the blast radius of the changes (imports, class references, packages, related-test search), and never treats zero selected tests as a pass. dev test plan shows the selection, dev test prove checks that new tests fail without the change and stay green five times, and dev test audit reports tests that cannot fail (no assertion, trivial assertion, swallowed failure, mock-only, smoke-only and more) in Python, JS/TS, Java/Kotlin, Go and PHP. dev ci --run --resume reruns only the failed steps and what the fix affects.
dev ci audit diagnoses GitHub Actions, GitLab CI, Bitbucket and Azure pipelines in five areas (speed, reliability, security and DevSecOps, quality gates, delivery), merges actionlint and zizmor, and --fix applies the safe GitHub fixes (SHA pins, permissions, timeouts, superseded-run cancel). dev ci init writes a pinned, least-privilege pipeline for the detected stack with a security job, and on GitHub a cache-free release workflow with SBOM and attestation. dev ci watch follows the run after every push or PR, reads the first error, classifies it and hands the fix to Link. The delivery policy gains job_timeout_minutes. devkit's own CI now runs the security scanners.
lstrip('./') removed every leading dot and slash, so ./.github/workflows/ci.yml became github/workflows/ci.yml and findings pointed at a file that does not exist. Only the ./ prefix is stripped now; the same fix applies in pipelines and testx.
The developer wants everything built for real. dev stubs finds TODO and FIXME markers, not-implemented code, placeholders and empty bodies in changes or the whole repository; the Stop hook sends a turn back and the commit guard refuses a commit that adds them, unless the line names its task (TODO(T-...)), an issue, or carries devkit: allow-stub with a reason. In Markdown only real markers count, not docs that talk about them.
Work is split by expertise instead of one generalist agent. config/crew.json defines 25 members named after Matrix characters (architect, analyst, programmers per layer, security, systems, QA, docs and more) plus Morpheus, the main session, with roles, professional personalities, skills, tools and routing keywords. dev crew briefs, routes, delegates and declines work deterministically, carries messages and decisions between members and the developer, and supports guided and automatic modes. The same roster generates the Claude Code agents and the Codex roles. Every member's report must start with its own status block, checked at SubagentStop.
Estimates and elapsed time were unreliable, and a wrong step could be closed. Active time is now the union of turn and subagent intervals; steps carry their own estimate, owner, file scope and dependencies; the ETA is a critical-path range with robust pace. Closing a step needs matching text and evidence, open dependencies or a running owner block it, and add, reopen, skip and history keep an audited record. Subagents update their own lane only: they cannot assign, start, reopen or skip the main plan. The dashboard shows active time, the ETA range, the steps and the crew lanes live.
The CLI registers dev test, dev ci audit/init/watch, dev stubs and dev crew. The hooks route subagent progress to its lane (quote-aware, so a quoted ; is text), enforce member scopes and the parallel limit, gate Stop and commits on unfinished work and useless tests, start the CI watcher after a push, and ask for a diff review after any regex rewrite of files. The installer builds the Codex plugin with the commands as skills and writes the crew roles; the Claude Desktop extension has 18 tools, including the crew, unfinished work, the test plan and the CI audit.
A member's file scope refused its own session scratchpad, which the global rules name as the place for scratch files. Scopes keep parallel members apart inside the repository; temp paths outside it belong to no other member, so they are allowed. Another repository stays refused. The two files also carry the new license header.
devkit becomes open source and its repository public. LICENSE is the canonical Apache-2.0 text, NOTICE carries the Apache notice and keeps the third-party list (devkit still bundles no third-party code), every source file has an SPDX-License-Identifier header, and the plugin, Codex plugin and Claude Desktop manifests declare Apache-2.0.
On GitLab, Bitbucket and Azure every scan finding printed the same gitleaks snippet with a placeholder image, so no-sast and no-sca offered a fix that fixed nothing. Each finding now carries the block of devkit's own security fragment that adds its scanner, pinned by digest, on GitLab's default test stage. dev ci init also follows the delivery policy: the test job runs the policy's test gate (one interpreter, the one the setup installs), so a generated pipeline audits clean on projects such as devkit, and job_timeout_minutes sets every generated job's timeout.
The refusal pointed to dev stubs --changed, a flag that does not exist; the changes since HEAD are plain dev stubs. A test parses the suggested command with the real CLI.
The handoff reminder never fired for sessions that started outside the repository (Claude Desktop, a terminal in ~), fired at most once per session, and counted a task update as a note update. It now works per project from where the session is: at the end of every development turn, commits by the developer newer than the last change of the note's human sections send the turn back to update the note and the tasks, and it re-arms after each update. The first time a note is seen, the handoff repository's history says when its human sections last changed.
Everything added since 26.11.0, for the reader who was not there: a new CI/CD guide (the findings catalog, --fix, init per host, the CI watcher), the testing guide, the crew guide with its coordination diagram (dark and light), the commands reference for dev test, dev ci audit/init/watch, dev crew and dev stubs, troubleshooting for the new refusals, the 18 extension tools, the new skills (testing, cicd, crew) and wording fixes so dev docs check passes 0/0/0. The README, CHANGELOG and development guide now state the Apache License 2.0.
devkit 26.11.1: open source under the Apache License 2.0, with blast-radius testing and the test audit, CI/CD audit, generation and watching on four hosts, the crew of 25 specialists, the deterministic time model and safe plan updates, the unfinished-work gates and the per-turn handoff check. VERSION, the plugin, Codex plugin and Claude Desktop manifests move to 26.11.1; the CHANGELOG section becomes the release notes.
Claude Code's own helper subagents (the compaction summary, prompt echoes) fire SubagentStop too. They have no brief and owe no report, but they were counted as crew misses and sent back, so doctor showed the crew at 5 of 11 when the real record was 6 of 7. Only subagents with a lane or the Agent tool's launch record (<transcript>.meta.json) are checked now, a member is named from its launch description, and a report corrected after the reminder is recorded like the main canary's. Records marked internal are left out of the crew rate.
The release notes come from this section, so they name the zizmor path fix that affects 26.11.0 users and the crew canary fix.
Local CI ran gitleaks over the working folder, where tests/__pycache__ holds .pyc files in which Python has folded fixtures such as "ghp" + "_" + "…" into a token-shaped constant. CI's clean checkout has no caches, so local CI disagreed with CI. .gitleaks.toml keeps the default rules and leaves out __pycache__ and .pyc files only; a token in a source file is still caught (checked with and without the config).
dev test prove <file> took every test in a named file, so tests that already existed (and pass without the change, as they should) were reported as not testing it: 15 false findings on this release. A named file now gets the same per-test selection as the default, and the whole file only when none of its tests changed.
The main canary honored canary.enforce: false, but crew reports without their block were still sent back. Off now means measured and not sent back, for the crew as for the main session.
dev progress step always closes a step, and the silence reminder and the global rules asked for one every 8 to 10 minutes, which pushed agents to close steps that were not finished (it happened in this release). dev progress note records and prints the update, with Check '– the step is still running', and changes no step; a crew member's note stays in its lane. The reminder, the global rules, the communicating skill and the docs now ask for a note while a step runs and a step only when it is finished.
This was referenced Nov 6, 2026
Merged
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What and why
devkit 26.11.1. It makes devkit open source under the Apache License 2.0, and adds what agents need to deliver real
work: tests that can fail and runs limited to what a change can break, CI/CD pipelines audited and generated on four
hosts and watched after every push, a crew of 25 specialist agents coordinated by Morpheus, a deterministic time model
with safe plan updates, gates against unfinished work, and a handoff note checked after every turn with new commits.
Changes
LICENSE, the Apache notice inNOTICE, an SPDX header in every source file,and the manifests updated. devkit bundles no third-party code.
dev test(the last failures first, then the blast radius),plan,prove, andaudit. The Stophook refuses tests that cannot fail.
dev ci --run --resumereruns only what failed and what the fix affects.dev ci audit [--fix]anddev ci initfor GitHub Actions, GitLab CI, Bitbucket and Azure Pipelines, withevery action pinned by SHA and every image by digest.
dev ci watchstarts after a push, reads the first error, classifies it and hands the fix to Link.config/crew.jsondefines the 25 specialists plus Morpheus, and one roster generates both theClaude Code agents and the Codex roles.
dev crewroutes, delegates, carries messages and decisions, and hasguided and auto modes. The crew canary runs at SubagentStop, and file scopes and a limit of 4 working in parallel
are enforced.
subagents update their own lane only.
dev progress noteposts anupdate while a step runs, without closing it.
dev stubs, the Stop gate and the commit gate.repository.
subagents;
.pyccaches in the local secret scan;dev test prove <file>reporting tests that already existed.troubleshooting.
dev docs checkis 0/0/0.How to verify
python3 -m unittest discover -s tests,/usr/bin/python3 -m unittest discover -s tests).dev ci --runpassed every CI step, the scanners in their pinned containers (evidence for tree045b3b8).dev sec scanis clean, and gitleaks finds 0 leaks over the full history.dev test audit tests/reports 0 findings.dev test proveshows the new tests fail without their changes.6d2c696(tests on Python 3.9 and 3.13, the security job on Linux).claude plugin validate ./pluginpasses, anddev crew sync --checkmatches all 26 agent files.dev installpasses on this Mac. The extension launcher serves 18 tools on the system Python 3.9.Risk and rollback
the handoff note, and for crew reports without their block. Turn them off with
handoff.enforce: falseorcanary.enforce: false.host yet (task
S-fx0e6z4q7h0).v26.11.0in the devkit checkout and rundev install. The license change cannot be revoked for a version already published under it.Links
[26.11.1]section ofCHANGELOG.md.v26.11.0).