Skip to content

Changelog

The canonical changelog lives at CHANGELOG.md at the repo root. This page mirrors it for in-docs navigation.

The format is based on Keep a Changelog, and this project adheres to Semantic Versioning.

[1.0.0] — 2026-05-03

Added

  • 314 Mandatory / Conditional / Flag-and-Defer items across 7 senior-engineering roles (architect, backend, database, security, devops, sre, qa).
  • 6 project-type profiles (b2b-saas-web, b2c-saas-web, marketplace, ai-wrapper, mobile-app, internal-tool) with filtered Mandatory subsets ranging from 184 to 264 active items per profile.
  • 5 tool-distribution layers under integrations/:
  • Cursor (.cursor/rules/*.mdc, 10 files).
  • Claude Code Skill (5 files).
  • Cline (10 files).
  • Aider (12 files).
  • Plain prompt templates (12 files: 3 sizes × 6 profiles + audit + usage guide).
  • Claude Code Plugin (.claude-plugin/marketplace.json + plugins/vibecodingisold/):
  • Marketplace installable via /plugin marketplace add 0zoriginals/vibecodingisold.
  • Skill mirrored at plugins/vibecodingisold/skills/vibecodingisold/.
  • Three slash commands: /vibecodingisold:init, /vibecodingisold:audit, /vibecodingisold:profile.
  • Vendored canonical knowledge under plugins/vibecodingisold/core/ (sync via scripts/sync-core.ps1 / .sh).
  • Smoke-test scripts (scripts/smoke-test.ps1 / .sh) for post-install verification.
  • 8 binding Numerical Contracts in core/_conflict-resolutions.md (idempotency TTL, liveness timeout, terminationGracePeriodSeconds floor, webhook timestamp tolerance, vuln-scan severity gate, secret rotation cadence, RPO/RTO floors). See Numerical Contracts.
  • 9 cross-role conflicts resolved with rationale (RLS ownership, Idempotency-Key ownership, probes 3-way ownership, graceful shutdown, vulnerability scanning placement, secret management, license scanning, etc.).
  • 21 adversarial gaps surfaced and patched in Phase 3 review.
  • 7 LLM-failure-mode categories, 58 anti-patterns documented in core/anti-patterns.md.
  • 6 worked end-to-end examples under examples/: HiringDesk (B2B SaaS), PantryPal (B2C SaaS Web), BoardSwap (Marketplace), CaseLens (AI Wrapper), ShelfTrack (Mobile App), OpsConsole (Internal Tool).
  • Pre-launch marketing assets under launch-posts/: HN, X, LinkedIn, Reddit drafts + comment-response templates + post-launch cadence plan.
  • Methodology documentation (methodology/brain-worker-orchestration.md, 962 lines) — full walkthrough of the brain-worker hybrid build pattern. See Brain-Worker Pattern.
  • CI quality gates (.github/workflows/quality-gates.yml):
  • validate-items.py — 9-field item template + Tier-1 source compliance.
  • validate-numerical-contracts.py — alignment check across roles.
  • validate-cross-references.py — every cross-ref resolves.
  • validate-plugin-sync.py — vendored core/ stays byte-identical to canonical.
  • validate-plugin-fresh-install.sh — fresh-install smoke test, gated in CI on ubuntu-latest. A .ps1 sibling ships for local Windows-developer parity; not currently wired into CI.
  • Markdown lint workflow (.github/workflows/markdown-lint.yml) — markdownlint with line-length warnings non-blocking.
  • JSON validation workflow (.github/workflows/json-validate.yml) — every JSON manifest parses against schema.

Notes

  • License: MIT.
  • The plugin's vendored core/ MUST stay in sync with repo-root core/. Run scripts/sync-core.ps1 (or .sh) after any edit to canonical files. CI will fail on drift.
  • Numerical Contracts are binding across all 7 roles and all 6 profiles — never edit one without propagating to the others.

Known V1 gaps (named, not promised)

V1 ships with named gaps rather than pretending to cover everything. V2 will close them.

  • No Mobile-Engineer role. The mobile-app profile flags 5 gaps inline (push notification security, App Store / Play Store policy hooks, on-device storage security, deep-links / Universal Links, certificate pinning + attestation). The mobile example walks them in detail.
  • No ML-Engineer role for AI products. The ai-wrapper profile triggers the LLM input/output handling item (security 49) and the prompt-injection defense pattern, but does not cover model evaluation harnesses, fine-tuning pipelines, RAG-architecture-specific items, or token-cost SRE patterns beyond the basic budget alarm. Plan for ~5 gaps to be filled manually.
  • No UX-Designer role. Conversion-rate optimization, accessibility-beyond-axe-baseline, design-system specs, information architecture — all out of scope for V1. The QA role's accessibility item (Item 27) is a baseline; serious WCAG conformance (Item 36) triggers as Conditional but isn't paired with design-side guidance.
  • No Compliance-Officer role. HIPAA + PCI-DSS hooks are present in the security role (data classification, encryption-at-rest, key custody), but the formal audit-prep workflow (evidence collection, control mapping, vendor-management programs) is V2.
  • ASVS 4.0.3 references throughout core/roles/security.md. ASVS 5.0 was published May 2025; section numbers shifted in some chapters (e.g., password-hashing moved from V2.4 to V6.4). Recalibration to v5.0 is planned for V1.x — items remain valid as ASVS 4.0 anchors, only the section labels change.
  • Empirical-validation pipeline is V2. V1 is validated through dogfooding on the maintainer's own client-delivery work. Reference projects with measurable outcomes are V2.
  • Senior-engineer pre-launch reviews are V2. V1 used adversarial-review subagents inside the Brain session (good signal-to-noise but not equivalent to a named senior eng signing off).

[Unreleased]

Tracking work in flight for the next minor / patch release. See the public ROADMAP at the repo root once it's published.

Convention for entries

Per Keep a Changelog, each release uses these section headings:

  • Added for new features.
  • Changed for changes in existing functionality.
  • Deprecated for soon-to-be removed features.
  • Removed for now-removed features.
  • Fixed for any bug fixes.
  • Security in case of vulnerabilities.

Versioning follows SemVer 2.0.0:

  • MAJOR when items are removed, profiles are removed, Numerical Contracts are changed in a non-additive way, or the 9-field template structure changes.
  • MINOR when items, profiles, integrations, or commands are added in a backward-compatible way.
  • PATCH when items are clarified, sources are updated, or bugs are fixed without changing the contract.

The plugin tracks the same version as the repo. core/ and plugins/vibecodingisold/core/ are always at the same version (enforced by validate-plugin-sync.py).