0.67.0-alpha · core 2026-09-19

release 0.67.0-alpha on GitHub →

Changed

• Testing skills aligned with 2026 evidence. stelow-workflow-testing-ai-code and stelow-workflow-testing-execution now ban presence-only tests (except topology/count/refusal pins), require red-proof (a test never observed failing is rejected), and prefer hand-mutation plus extreme mutation over full mutation tooling (not recommended by default; adequacy is not a goal). TDD claims calibrated to independent meta-analyses; TDAD paradox documented (procedure without test context backfires). Scope tables and brownfield procedures live under references/ (SKILL.md back under 500 lines).

Removed

• Dead Stryker wiring. stryker.config.json mutated nothing ("mutate": []), test:mutation ran in no CI workflow, and the config pointed at a TODO doc that never existed. Removed config, script, and the three @stryker-mutator devDependencies. Mutation guidance now lives in the testing skills (hand-mutation first, extreme second, full tooling only for regulated code).

• Multica/Fusion residue across live docs. host-levers.md Fusion section, per-host tables/rows in README.md, stelow-helper.md and INSTALLATION.md, the dead host object in stelow.schema.json (never written by anything), dead plugins/fusion-* ignore rules, and stale skill counts (25/26 → 28) in architecture.md, cli-agents/, INSTALLATION.md, host-levers.md and source-of-truth.md (rewritten). Fixed 7 dangling pointers to skills/.../entry/references/host-levers.md (file never existed) to the canonical references/host-levers.md. Historical records (audits, post-mortems, CHANGELOG, superseded design docs) and the intentional setup-pulse.sh removal stub are untouched by design.
• stage-status.md rewritten around the 17 canonical stages. The 0-indexed 15-phase table, numeric stage=N form and "edit stelow.json directly" advice contradicted the transition contract.

Added

• Workflow mechanics portable beyond git repos. Non-repository workspaces resolve their root from STELOW_STATEDIR; review-mode rules (mode-skipped passthroughs, gate refusals with redirects) and statedir-first artifact preconditions moved from a downstream fork into do_advance, so any host gets identical behavior.
• Portable stelow CLI surface: seed, schema, ask, advance --dry-run/--json. seed mints per-workflow state dirs from a single template (+ tracking entry); schema dumps machine-readable command contracts for runtime introspection; ask implements the file-handoff question protocol (ask/pending.json + answer.json, identity from env only, typed exit codes); advance validates without mutating under --dry-run and emits JSON. Usage errors exit 2, runtime failures exit 1, everywhere.
• Generated transitions.md with CI gate. stages.yaml is now really single source: scripts/generate-transitions.py (+ npm run gen:transitions, --check gate test) emits order table and transition lines byte-identically. Generation already caught real drift (stale reject: execution, outdated order descriptions).
• Zero host names in skills. stages.yaml tool table is a canonical list (per-host columns removed); ask.md shows only the portable stelow ask form; host conditionals rewritten in capability language. The host-agnostic audit test now also forbids bb stelow, fn_* calls and host names.

Fixed

• Ask thread placeholder names the worker session. ask.md showed --thread <this_thread_id>, sending workers guessing with provider session ids and directory hashes — a wrong id failed deep inside blaming storage. Now <your-worker-thread-id> with an explicit never-list. (Orchestrator copy only; per-skill copies regenerate via sync-cli-tools.sh.)
• Transition tokens ignore prose comments. Parenthetical prose in transition blocks ((full rework path …), (none …)) leaked bare words as valid candidates — advance stays would have corrupted current_stage. Lines are cut at the first paren before tokenizing.
• Read-only commands never touch the filesystem. status, doctor and dry runs no longer mkdir the state dir as a side effect.
• stage-status.md tells the truth. The 0-indexed 15-phase table (wrong stages, "edit stelow.json directly") is replaced by the 17 canonical slugs with phasename-only commands.

• README workflow table lists all 14 skills. entry and router rows were missing, failing the skill-count contract (the test was right, the docs were stale).

• State Coverage Table template uses valid GFM delimiters. The interface-alternatives references shipped :---:+ separator cells (stray +), which no GFM renderer recognizes — every generated table rendered as raw pipes. Workers copying the template now produce real tables; a plugin-side regression test scans vendored skills for bad delimiters.

• Ask batching rule replaces the parallel-questions exception. ask-patterns.md called Pattern 5 "the ONLY place with multiple questions in parallel", discouraging batching everywhere else. The rule is now dependency-based: independent questions share ONE ask_user_question call (the user answers together), dependent ones stay sequential. Appetite (Pattern 7) and Review Mode (Pattern 8) stay separate by deliberate decision sequencing. The bb host mapping (references/cli-tools/ask.md) documents repeated --question groups.
• Interface selection no longer waits for a human in Auto / Product Spec Gate modes. The interface-alternatives skill ordered an unconditional user pick, contradicting the Mode table (Auto → LLM decides) and parking Auto cards forever. The pick is now mode-gated, with a new machine-readable policy at skills/stelow-workflow-orchestrator/references/human-gates.md that plugin surfaces can derive the same rules from. Orchestrator safety rules, stage table, and transitions stage list point at it.
• Scope adjustment and execution start covered by the same policy. Pattern 3 (scope IN/OUT ask) and the plan-gate body are mode-gated; execution never asks to proceed. human-gates.md additionally defines the gate-tool fallback (missing visual_review → Auto self-approves with a receipt, gated modes open a structured ask, chat-parking is forbidden).

Changed (Breaking)

• Opportunity mapping outputs Markdown instead of Confluence markup. No Confluence consumers remain and backward compatibility is waived: headings, nested lists, bold/italic map mechanically, emoji carry over, and the single wrapping code block goes away (in Markdown it would prevent rendering — Confluence needed it as paste-source).

• *Rename 12 workflow stage skills from stelow-product- to stelow-workflow-* — orchestrator, shape-up, interface-alternatives, plan-critique, tech-planning, scope-executor, ux-critique, codebase-critique, coding-standards, testing-ai-code, testing-execution, execution-critique. stelow-product-health was renamed back from the intermediate stelow-workflow-health (it is a strategy library, not a stage skill). Recorded in retired-skills.yaml so install.sh prunes stale ~/.agents/skills/ copies.
• README Skills section grouped by prefix — stelow-workflow- (12, the machinery that runs the workflow) and stelow-product- (14, product strategy & domain libraries). Frontmatter metadata.category aligned to the prefix (workflow / product) in all 28 skills (incl. stelow-workflow-entry/stelow-workflow-router); the obsolete product/research/code/meta taxonomy is gone.
• Remove tooling dirs from the repo — .changeset/, .github/ (CI + release docs), .husky/ (commit-msg + pre-push hooks), .opencode/ (host-specific command wrappers). All gitignored.
• Drop the npm-package surface — main/exports entry points into build/ (which the current build never produces), files, publishConfig, prepublishOnly/prepack, the unused typebox peer dependency, and the unused yaml dependency. Distribution stays Git/GitHub-only (skills-only).

Added

• stelow-product-paywall — paywall & onboarding monetization funnel, adapted from Jake Castillo's Cal AI playbook (paywall-first build order, paywall as PMF test, pain-matched onboarding, 3 funnel benchmarks, trial policy, web2app).

Removed

• husky dev dependency and prepare hook-install script — no hooks remain in the repo.
• CI/coverage badges from README (workflow deleted).

Changed

• Skill count 25 → 26; counts, globs, and docs updated to the dual stelow-product- / stelow-workflow- prefix convention.