v1.3.0 — bundle subagents alongside skills

What changed

Subagents now ship with the plugin. The six agents the skills fan out to are bundled under agents/ and declared in plugin.json:

• security-auditor — threat modeling, vulnerability assessment
• test-auditor — test effectiveness beyond coverage
• frontend-architect — component design, deep modules, structural health
• parity-check — audit code migrations for missing functionality
• git-detective — investigate git history and trace changes
• learner — capture insights into CLAUDE.md

Installing hb is now self-contained: the agents that /hb:review and /hb:plan reference come along with the skills — no separate setup. Claude Code only; other agents keep consuming skills/.

Full Changelog: v1.2.0...v1.3.0

v1.2.0

Changed

• Collapse the code-reviewer and debugger subagents into their skill twins (code-review, diagnose) — single source of truth, per the skill-only model (Matt Pocock / obra superpowers). code-review now carries the full review criteria: axes, "Common Rationalizations", and a verification checklist.
• Repoint plan and review references from removed agent types (code-reviewer, debugger, test-quality, ts-enforcer) to available ones.

Distinct read-only lenses without a skill twin (security-auditor, test-auditor, frontend-architect, git-detective, parity-check) are kept as subagents.

v1.1.0 — visual-review

Added

• visual-review — renders a GitHub PR diff as a self-contained, offline HTML page where each changed hunk is annotated with a design/simplification principle and a suggested before → after rewrite. Read-only; you comment on the PR yourself.
  • Lens (12 principles): simplification (memoization, speculative abstraction, mutation, nesting, naming, dead weight, duplication) + engineering (SRP, dependency inversion & seams, OCP/LSP/ISP, testability, coupling & cohesion).
  • Deliberately scoped to design feedback — bugs, security, and scope/claim mismatches stay with code-review.
  • Sibling of code-review (text) and visual-validate (browser UI). Invoke with /hb:visual-review [pr-url-or-number]; defaults to the current branch's PR.

Registered in README + AGENTS; plugin bumped to 1.1.0.

v1.0.0 — first stable release: the spec→ship SDLC flow

First stable release. The workflow has settled into a coherent, six-phase SDLC spine that carries a feature from idea to production — each phase a dedicated skill that orchestrates the smaller toolbelt skills beneath it.

The flow

SPEC → PLAN → BUILD → TEST → REVIEW → SHIP

• spec — interview + codebase exploration → a structured spec in .specs/specs/<slug>.md.
• plan — turn the spec into phased, tracer-bullet vertical slices in .specs/plans/<slug>.md.
• build — implement one phase per invocation, with feedback loops, checkbox marking, and a commit offer.
• test — prove it works: validation (lint/types/tests) + changed-line coverage, then verify plan checkboxes against the codebase via a read-only subagent.
• review — optional QA pass: fan out parallel, read-only reviewers (scope-detected audits + independent agent lenses) into one severity-ranked verdict.
• ship — pre-launch gate (validate-code + safe-repo) then atomic commits + push. User-invoked only.

Type the spine in order or let each phase chain into the next. Every model-invoked skill also auto-routes by description; the outward-facing steps (ship, create-pull-request) stay gated behind explicit invocation.

What's in v1

• 41 skills across the SDLC spine plus on-demand tools: TDD, diagnosis, code review, a11y/i18n/perf/deps/security audits, design & discovery (codebase-design, architecture-audit, domain-modeling), and session/meta/writing helpers.
• Artifact convention — workflow skills persist to .specs/{specs,plans}/, local-first.
• Toolchain-agnostic gates — validation/coverage detect the project's own tooling (Node, Python, Go, Rust); no hardcoded package manager.
• Effort routing — skills carry an effort hint (low/medium/high/xhigh) so reasoning depth matches task complexity for the turn the skill fires.
• Pure Markdown, zero runtime deps — installable as a Claude Code plugin or copied into OpenCode, Gemini CLI, or Cursor.

Changes since v0.10.0

A behavior-preserving simplification pass (~168 lines of redundancy removed):

• Within-skill restatement removed — deleted sections that re-derived what a skill's own workflow/gate/frontmatter already stated (ship, source-driven, create-adr, harden, visual-validate, codebase-design, build).
• Reference-file dedup — trimmed reference files that restated their parent SKILL (e2e/selectors.md, i18n/patterns.md, architecture-audit/deep-modules.md, safe-repo/report-template.md), keeping each file's unique contribution.

Full changelog: v0.10.0...v1.0.0

v0.10.0 — drop brief + grilling, review optional, effort/vocab cleanup

Skill-collection cleanup pass (analyzed with skill-creator).

Changed

• Removed brief — leftover from an older flow; its progress-counting overlapped test's Progress section. Routing in AGENTS.md and handoff's cross-ref repointed to test.
• Removed grilling; folded its interview engine into grill-me — the two were near-duplicate model-invocable skills competing for the same trigger.
• review marked as an optional QA pass, not a ship gate — ship's pre-launch gate is validate-code + safe-repo only.
• build: renamed "PRD" → "spec" in the read-only rule to match the spec skill.
• Normalized effort frontmatter — added effort: high to test (verify phase spawns a read-only subagent; matches the rest of the spine); moved effort: before description in domain-modeling, research, resolving-merge-conflicts.

Skill count: 43 → 41.

Full changelog: v0.9.0...v0.10.0

v0.9.0 — toolchain-agnostic gates + drop coverage skill

Gates now adapt to the project's toolchain

Following Matt Pocock's detect-and-delegate pattern — the quality gates detect the ecosystem (Node / Python / Go / Rust) and run the project's own tasks instead of hardcoding npm. The SDLC flow now works for backend in any language, not just Node/TS.

• validate-code — detects fmt/lint/typecheck/test commands from the manifest
• lint — detects the project's linter/formatter
• deps-audit — detects the package manager from its lockfile (npm/pnpm/yarn/pip/go/cargo)
• build — feedback loop detects checks across ecosystems

Removed the standalone coverage skill

Neither Matt nor Addy ship a coverage skill — coverage is a TDD byproduct / review concern. Dropped the skill and its parse-lcov.py (the last script in the repo). test now does a changed-line coverage check inline, delegating to the project's coverage command when one exists.

Full changelog: v0.8.0...v0.9.0

v0.8.0 — consolidate atomic-commits into commit

commit now makes atomic commits by concern

• commit groups unstaged changes into atomic commits by concern by default (a single concern is just one commit).
• Push removed from commit — pushing belongs to the /ship cycle.
• Removed the redundant atomic-commits skill; ship now links commit's grouping rules.
• README + AGENTS updated.

Full changelog: v0.7.0...v0.8.0

v0.7.0 — SDLC spine rename + code-simplify

SDLC spine renamed to spec / plan / build / test / review / ship

• prd → spec — align with community naming (Matt Pocock, addy).
• verify-plan → test — now a VERIFY orchestrator: validate-code + coverage + plan-checkbox verification. Works for frontend and backend.
• New code-simplify skill — behavior-preserving simplification (Chesterton's Fence, clarity over cleverness); cross-refs codebase-design / fortify / architecture-audit.
• Artifacts moved .specs/prds/ → .specs/specs/.
• Docs (README, AGENTS, CONTRIBUTING, cursor/gemini/opencode setup) and plugin manifest aligned. Dropped stale check / tracerkit references.

Full changelog: v0.6.0...v0.7.0

v0.6.0

Highlights

• New skill: frontend-ui-engineering — front-loads UI construction decisions (component boundary & prop API, where state lives, the required loading/empty/error/disabled states, responsive behavior, accessibility by construction). The frontend counterpart to codebase-design; hands off to tdd / visual-validate / review.
• review now fans out to parallel subagents — each scope-detected audit runs in its own fresh-context subagent, then findings are consolidated with convergence flagging. validate-pr has been consolidated into review.
• Removed caveman (unused).

Full Changelog: v0.5.0...v0.6.0

v0.5.0

Highlights

Bug fixes surfaced by a full skill-eval hardening pass (each skill run under eval):

• safe-repo — scan-secrets.sh silently detected nothing (set -euo pipefail aborted on a grep no-match; grep -P is unsupported on BSD/macOS). Rewritten with process substitution + POSIX ERE.
• atomic-commits — an unconditional git push could land on main; added a branch guard.
• validate-code — silent eslint --fix mutations; now reports the files it auto-fixed.
• perf-audit — interactive vite-bundle-visualizer hung headless; switched to non-interactive analysis.

Full Changelog: v0.4.0...v0.5.0