[nistapp-release-bot]

Release-please opened this pull request. Merging it tags the release, publishes the files and opens the back-merge pull request into dev. See RELEASE_PROCESS.md.

0.3.3 (2026-11-10)

Features

• audit: open the rendered report with a bottom line (52768e2)
• audit: record a check newer than the engine's ruleset as UNKNOWN (4c9c82d)
• audit: record the framework release and install in each report (61d0e2d)
• dev: agent tools for this repository: one .mcp.json, a first-run offer, language servers (109e7ad)
• dev: assert the pull request body layout in the implement eval (51bddf9)
• dev: check that each recipe SKILL.md links the user prompt (1a569d0)
• dev: document language servers beside the code index (07d42bb)
• dev: give prose-check issues a severity and always exit 0 (d36a954)
• dev: offer each contributor a one-time agent tool setup (6dce4b1)
• dev: register codebase-memory-mcp in one project .mcp.json (683ddb3)
• dev: translate .mcp.json into each harness's MCP config (b0b2085)
• engine: add AGT-12 and DOC-05, the v0.3.4 Track T checks (1703aa2)
• engine: add AGT-12, communication rules stated (5d16098)
• engine: add CI-05, workflow files are linted (a86ddab)
• engine: add DOC-05, docs are readable (fc80971)
• engine: add EXEC-08, tool versions visible to dependency automation (7172596)
• engine: add TOOL-07, a local guard against commits to a protected branch (17bd680)
• engine: add TOOL-07, a local guard against commits to a protected branch (v0.3.3 C5.2) (2fc92ec)
• engine: AGT-09 names every branch the declared rules protect (910b718)
• engine: AGT-09 names every branch the declared rules protect (1dc8bab)
• engine: HYG-09 reads ecosystem coverage and the target-branch trap (c035331)
• engine: HYG-11 reads ruleset files and the source-branch check (23f7146)
• engine: HYG-11 reads ruleset files and the source-branch check (v0.3.3 C5.1) (4b93763)
• engine: open the Markdown report with a bottom line (6afaba3)
• engine: TOOL-04 reads CI as well as the local verbs (36aa387)
• engine: TOOL-04 reads CI as well as the local verbs (9dfc3ae)
• engine: TOOL-06 also reads the commit rule in CI (d7ad429)
• fix the layout of the recipes' questions and reports (3993263)
• give both recipes one prompt on how to talk to the user (cf7a101)
• greenfield: check commit messages in CI as well as in the hook (9f693fe)
• implement: record in the state which framework created and last wrote it (23b354c)
• implement: stop on a report from another schema or a newer release (2309763)
• plain communication in the recipes and a report bottom line (v0.3.4 R, H) (b990687)
• stack-adaptive hook guidance and CI-05 workflow lint (v0.3.3 Track C: C0, C1) (66479e7)
• stamp the framework release in reports and states, and refuse files the tools cannot read (2047b4f)
• stamp the release version in reports, state and skill bundles (5d4ff90)
• TOOL-06 reads the commit rule in CI as well as in the hook (v0.3.3 C4) (5232740)
• v0.3.3 Track C2 and C3 (HYG-09 reads the update policy, new check EXEC-08) (a701a04)

Bug fixes

• audit: list what the scan could not settle as sub-bullets (80e7bbc)
• dev: ignore .env files at any depth (f807d63)
• dev: keep each osv-scanner ignore file next to the lockfiles it covers (8b64cc1)
• dev: name more harnesses and move the first-run trigger to the top (22ba4a6)
• engine: EXEC-01 and TOOL-04 read nested pins and Makefile chains (4f1f1bf)
• engine: EXEC-01 reads the toolchain pin in a nested manifest (f2ff3bd)
• engine: EXEC-07 counts types per language and reads a pyright mirror (26fd6f5)
• engine: EXEC-07 counts types per language and reads a pyright mirror (73fa46b)
• engine: TOOL-04 follows Makefile variables and prerequisites (2e00e34)

Documentation

• add a diagram to each explanation page and tutorial (d965909)
• add a purpose line and a diagram to the page templates (9506b0c)
• add generated audit and implement master lists (b3a9377)
• add generated audit and implement master lists (01be98d)
• audit: an opt-in live read of the branch rules for HYG-11 and CI-04 (d83d55b)
• audit: rewrap the EXEC-07 engine paragraph to the line limit (f69e70c)
• count the 102 engine fixtures after the dev merge (d749568)
• count the 103 engine fixtures after AGT-09's (34c358b)
• count the 105 engine fixtures after EXEC-01's and TOOL-04's (4306699)
• describe the coverage parts and the audit tools' shards (00fdf59)
• describe the engine shards and the nightly run (04c1df0)
• describe the prose check as advisory (b736b0d)
• implement: adapt-agents-md names the branches the rulesets protect (8299e32)
• implement: add the workflow-lint step for CI-05 (24a5675)
• implement: add-hooks-and-commit-rules adds the branch guard by stack (6526ec0)
• implement: add-repo-hygiene declares branch rules as code (5f7ce86)
• implement: add-repo-hygiene writes a routing-only CODEOWNERS by default (9002f22)
• implement: choose the hook manager by the target's stack (304420e)
• implement: configure-quality-tools runs the security verb in CI (3650dad)
• implement: move inline tool versions into a manifest for EXEC-08 (c93011b)
• implement: register-index names the language-server inputs (c76f357)
• implement: register-index writes one .mcp.json and offers the setup (35feab4)
• implement: release provenance and language-server inputs (5143e1e)
• implement: routing-only CODEOWNERS and the index setup offer (cf065b8)
• implement: run the commit rule in a local stage and in CI (f429ae7)
• implement: split the ruleset sentence in adapt-agents-md step 6 (7e1289a)
• implement: the release page may state the release provenance (5dd2d21)
• implement: write or fix the dependency-update file for HYG-09 (81b0002)
• link the agent tool setup from the contributor entry points (98a13e1)
• list the two security jobs (3fa15e5)
• name the prose check in the pull request checklist (1e9ed7e)
• queue a dev pull request with Merge when ready, not gh pr merge (63434f4)
• queue a dev pull request with Merge when ready, not gh pr merge (1a1bd92)
• record that dev no longer requires an up-to-date branch (32f9374)
• record the dev merge queue in Current state (651c004)
• record the dev merge queue in Current state (3de9d91)
• record the version rule in ADR 0008 and a versions reference (5f0a8db)
• record why make check does not run the prose check (621c600)
• regenerate the master lists for EXEC-08 (85a2a94)
• rewrite the three worst docs pages in plain language (5a577a5)
• say that CI tests Linux only for now (b0b3742)
• self-audit: refresh the self-audit page and neutralise the baseline (65024fb)
• shorten the long sentences in AGENTS.md and lint it (3adc114)
• split the long sentences in REQ-SH-060 and the DOC-05 rubric (2cdddb6)
• stacks: recommend each stack's own hook and commit tools (110f2f7)

Refactoring

• engine: move the Makefile walk into _common as follow_makefile (6296b3e)
• engine: split the engine tests into one package per check pack (c44aa26)
• engine: split the engine tests into one package per check pack (a06eab4)

Build and dev tools

• add engine shard targets and a sharded coverage combine (55f9832)
• dev: add a shard runner for the engine's test suite (29ca367)
• dev: add a typos spell check to make check (4ee9b51)
• dev: audit the dev tools' dependencies with osv-scanner in make security (345890b)
• dev: build actionlint from a Go tool module, not from actionlint-py (095994f)
• dev: let the shard runner split the audit tools' suite (c9cd5aa)
• dev: make the prose check advisory, with severities (320fad8)
• dev: run make coverage as CI does, so a local pass means a CI pass (9101437)
• dev: run make coverage as CI does, so a local pass means a CI pass (0f4a6e0)
• dev: stop gating on the prose check (9308f0d)
• dev: update mermaid-cli to 12.2.0 for a katex advisory (a432659)
• dev: update uv to 0.13.5 for two security advisories (d21d061)
• run the test suites at once on Linux and split coverage per suite (010b358)
• shard the audit tools' suite and add coverage-part (bb7ad4e)
• split make security into security-secrets and security-deps (e9f6caf)

CI and release

• add a nightly run of the unsharded verbs (55b3d61)
• add an advisory CodeQL workflow for Python and Actions (1a32a51)
• add an advisory OpenSSF Scorecard workflow (c0cc4a7)
• faster CI per pull request and a merge queue for dev (bf3b533)
• fix zizmor's pedantic findings and gate on the pedantic persona (5c26847)
• publish the Scorecard results and fix its Vulnerabilities alert (fcd5c7f)
• publish the Scorecard results and record how each alert is handled (818676d)
• run CI on merge groups of the dev merge queue (8df5231)
• run the audit tools' suite in shards and drop the test-tools job (e8c598a)
• run the check matrix on Linux only (5e50513)
• run the coverage suites in two parts and drop the test-tools job (9fb632a)
• run the engine's suite in two shards on both Python versions (b59be30)
• run the engine's test suite in shards on both Python versions (6b22dd1)
• run the secrets scan and the dependency audit as two jobs (0ea219d)
• run the secrets scan and the dependency audit as two jobs (ae30d59)
• run the steps of make check as parallel jobs (0dfe7eb)
• sign build provenance for the release files (7c7cfa7)

---

This PR was generated with Release Please. See documentation.

[nistapp-release-bot]

🤖 Created releases:

• v0.3.3

🌻