chore(release): 26.11.1

.github/workflows/ci.yml

@@ -36,3 +36,27 @@ jobs:
         run: python -m unittest discover -s tests
         env:
           DEVKIT_NO_NOTIFY: "1"
+
+  security:
+    name: Security scans
+    runs-on: ubuntu-24.04
+    timeout-minutes: 20
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+      - name: Secrets (gitleaks)
+        run: docker run --rm -v "$PWD:/src" -w /src ghcr.io/gitleaks/gitleaks:v8.30.1@sha256:c00b6bd0aeb3071cbcb79009cb16a60dd9e0a7c60e2be9ab65d25e6bc8abbb7f dir --redact --no-banner .
+      - name: Code (semgrep)
+        run: >-
+          docker run --rm -v "$PWD:/src" -w /src semgrep/semgrep:1.182.0@sha256:4a34048c04fef049f71665047f074cffb00cc3d89482f965a5cd151d589237af
+          semgrep scan --config p/default --error --metrics off --disable-version-check
+      - name: Dependencies (osv-scanner)
+        run: docker run --rm -v "$PWD:/src" -w /src ghcr.io/google/osv-scanner:v2.7.0@sha256:4f3b7e2c64b9d38a5febc5a7e4a3dfef1d1362f726dea7a2ef4762b46469fcd0 scan source -r --allow-no-lockfiles .
+      - name: Filesystem and IaC (trivy)
+        run: >-
+          docker run --rm -v "$PWD:/src" -w /src ghcr.io/aquasecurity/trivy:0.76.1@sha256:790fd66d1697395d8693d1acaa1ea702406a20f109b6fc7bac8db623eca6c06c
+          fs --scanners vuln,secret,misconfig --severity HIGH,CRITICAL --exit-code 1
+          --skip-dirs node_modules --skip-dirs .venv .
+      - name: Workflows (zizmor)
+        run: docker run --rm -v "$PWD:/src" -w /src ghcr.io/zizmorcore/zizmor:1.31.1@sha256:42d409dbb851d4c5d35a058cf042b828bea1e3f2884378c526eb0974780e18d9 --offline --min-severity medium .github/workflows

.gitleaks.toml

@@ -0,0 +1,12 @@
+# Copyright (c) 2026 Firefly Software Solutions Inc.
+# SPDX-License-Identifier: Apache-2.0
+# gitleaks configuration: the default rules, minus compiled Python caches. A .pyc file is built locally from the
+# sources (which are scanned) and is never committed; Python folds test fixtures such as "ghp" + "_" + "…" into one
+# constant there, so the cache looks like a token while the source does not.
+
+[extend]
+useDefault = true
+
+[allowlist]
+description = "compiled Python caches, never committed"
+paths = ['''(^|/)__pycache__/''', '''\.pyc$''']

Brewfile

@@ -42,6 +42,7 @@ brew "gitleaks"
 brew "osv-scanner"
 brew "trivy"
 brew "zizmor"        # GitHub Actions security audit (dev sec scan)
+brew "actionlint"    # GitHub Actions workflow linter (dev ci audit)
 brew "semgrep"
 brew "syft"
 brew "cosign"

CHANGELOG.md

@@ -3,6 +3,104 @@
 All notable changes to devkit. Versions follow CalVer `YY.MM.PATCH` (PATCH restarts at 0 each month); tags are
 `vYY.MM.PATCH`. Sections follow [Keep a Changelog](https://keepachangelog.com/).
 
+## [26.11.1] - 2026-11-06
+
+devkit is open source under the Apache License 2.0.
+
+### Added
+
+#### Testing
+
+- **`dev test`** runs the tests that failed last time first, then only the tests your changes can affect (the blast
+  radius), with pytest, unittest, Jest, Vitest, Maven, Gradle, Go, PHPUnit, or Pest. `dev test run` takes paths,
+  `--failed`, `--affected`, or `--all`; `dev test plan` shows what would run and why; `-p <project>` works from
+  anywhere. A selection that runs no test exits with `2` instead of passing.
+- **Tests that can fail.** `dev test audit` finds tests that cannot fail for a real bug (no or trivial assertions,
+  empty bodies, swallowed failures, skips without a reason, sleeps, mock-only and smoke-only tests) in Python,
+  JavaScript and TypeScript, Java and Kotlin, Go, and PHP. `dev test prove` checks that each new test fails without
+  your change and passes five times with it. The Stop hook sends back a development turn whose new or changed tests
+  cannot fail.
+- **`dev ci --run --resume`** repeats only the failed steps, the steps that never ran, and what the fix affects. Its
+  evidence combines the full run with the affected tests, and the pull request says so.
+- The `testing` skill: a test strategy per kind of code, TDD, flaky tests, mutation testing and diff coverage, and
+  diagnosing an existing suite. Required whenever a turn writes or runs tests.
+
+#### CI/CD
+
+- **`dev ci audit`** diagnoses the pipelines of GitHub Actions, GitLab CI, Bitbucket Pipelines, and Azure Pipelines:
+  security, reliability, speed, quality gates, and delivery, each finding with a severity and its fix, merged with
+  actionlint, zizmor, and `glab ci lint`. `--fix` applies the safe GitHub fixes (permissions, auto-cancel, job
+  timeouts, actions pinned by SHA) and prints the snippets for the other hosts; `--strict` fails on medium findings.
+- **`dev ci init`** writes a pinned pipeline for the detected stack and host: lint, tests with a JUnit report,
+  security scans, and on release tags an SBOM, signing or attestation, and a check of what was published. On GitHub
+  it writes `ci.yml`, a cache-free `release.yml`, and `dependabot.yml`; GitLab signs keyless, Bitbucket and Azure with
+  a cosign key.
+- **`dev ci watch`** starts after every push and pull request, follows the runs to the end, reads the first error of
+  a failure, sorts it into a class, and gives one next action. The main session gets it as a crew message and hands
+  fixes that are not trivial to Link.
+- The delivery-policy field `job_timeout_minutes` (default 30) sets the job timeout that `dev ci audit` suggests,
+  `--fix` writes, and `dev ci init` generates; a generated test job runs the policy's test gate.
+- The `cicd` skill: fast, reliable, DevSecOps pipelines on any host. Required whenever a turn changes a pipeline.
+- devkit's own CI runs a security job (gitleaks, semgrep, osv-scanner, trivy, zizmor), and `actionlint` joins the
+  security tools.
+
+#### The crew
+
+- **25 specialist agents** named after The Matrix and led by the main session as Morpheus, from one roster
+  (`config/crew.json`) for Claude Code, Claude Desktop, Codex (as roles), and the ChatGPT app. Each member has its own
+  lane and time, the files it is assigned (the guard keeps its edits inside them), and a status block it must end its
+  report with, which the SubagentStop hook checks (the crew canary). At most four members work at once.
+- **`dev crew`**: the roster and who works now (`show`), briefs with the launch line (`brief`), routing (`route`),
+  delegation (`delegate`, `decline`), the dispatcher (`next`), messages (`ask`, `answer`, `inbox`), decisions (`mode`,
+  `decide`, `decisions`), and `sync` for the generated agents.
+- **Guided or automatic.** In guided mode, decisions that are yours wait for you; in auto mode, the crew takes the
+  recommended option and records it for review. Irreversible actions wait in both unless you pre-approved them.
+- The `crew` skill: who to send for each kind of work, parallel or in sequence, briefs, and reports.
+
+#### Progress
+
+- **Time you can trust.** Active time (turns and subagents, never the wait for the developer), per-step estimates,
+  dependencies (`after`), a critical-path ETA shown as a range, and a pace that one odd step cannot swing.
+- **A plan that stays true.** Closing a step needs its evidence (`--check`) and a description that matches it;
+  `dev progress add`, `reopen`, `skip`, `history`, and `assign --scope`; every change is recorded and audited.
+
+#### Unfinished work
+
+- **Build it for real.** `dev stubs` finds unfinished work in a change or a repository: `TODO` and `FIXME` markers,
+  "not implemented" code, placeholders, and empty Python bodies. The Stop hook sends back a development turn that leaves
+  untracked ones, and the guard refuses a commit that would include them. Planned work names its task (`TODO(T-…)`) or
+  issue.
+- The global rules: every test must be able to fail for a real bug; after a failure, re-run only the failed tests and
+  what the fix affects; the full suite once, before the push; no stubs or placeholders in delivered work.
+
+#### Surfaces
+
+- Codex gets the plugin's slash commands as skills of the same name.
+- New slash commands: `/devkit:progress`, `/devkit:crew-status`, `/devkit:test`, and `/devkit:stubs`.
+- The Claude Desktop extension has 18 tools, among them `devkit_crew`, `devkit_stubs`, `devkit_test_plan`, and
+  `devkit_ci_audit`.
+- The dashboard's run card shows active time, the ETA range, the steps, and the crew's lanes.
+
+### Changed
+
+- **The handoff note stays current.** After every development turn with new commits, the Stop hook asks for a note
+  and task update when your commits are newer than the note's last real change (task and session lines written by
+  devkit do not count). It also works for sessions that started outside the repository, such as Claude Desktop's.
+- The scout is now Sparks, a member of the crew; `scout` remains an alias in Claude Code and Codex.
+- The UI skills are required for design work only: "open the dashboard" no longer asks for them.
+
+### Fixed
+
+- `dev sec scan` kept the leading dot of hidden paths in zizmor results: `./.github/workflows/ci.yml` no longer
+  becomes `github/workflows/ci.yml`.
+- The crew canary counts only subagents someone launched. Claude Code's own helpers, such as the compaction
+  summary, are no longer counted as crew misses or sent back, and a report corrected after the reminder is
+  recorded as corrected.
+- `dev progress note` sends an update while a step is still running, so no update has to close a step; the
+  silence reminder and the global rules now ask for a note, not a step, until the step is finished.
+- `dev test prove <file>` proves only the file's new or changed tests, so tests that already existed are no
+  longer reported as not testing your change.
+
 ## [26.11.0] - 2026-11-05
 
 The first release.