Changelog #

[0.8.0] - 2026-09-27 #

Added #

• Native GitLab Code Quality output through lintlang scan --format gitlab, with repository-relative locations, stable fingerprints, and a CI example for merge requests and the default branch. Incomplete reports fail explicitly instead of hiding findings behind a successful export.
• Parser-backed source locations for structured prompts, tools, schemas, and messages, plus source spans for whole-prompt checks. The shared provenance also improves existing terminal, JSON, and SARIF reports.

[0.7.1] - 2026-09-23 #

Fixed #

• lintlang init --github and the maintained Code Scanning examples now pin the released v0.7.0 Action commit. Existing generated workflows remain untouched unless their owners rerun the initializer with --force.
• Dev Container Feature 1.0.1 defaults to the published LintLang 0.7.0 package, including the installer fallback. Current setup guides point to these corrected release routes.

[0.7.0] - 2026-09-23 #

Added #

• A conservative lintlang scan --fix path for instruction documents applies a bounded in-place rewrite and declines files without a leading instruction section or edits that would introduce an example. Use --dry-run to preview without writing or --backup to preserve the original bytes before writing; automatic repair is not a safety verdict.

• HERM confidence output now names its coverage drivers, so a low confidence label can be traced to missing or sparse evidence rather than read as a detector accuracy measurement.

• Native distribution entry points now include an on-demand Pi scan skill, a GitHub Copilot CLI audit skill, and Cursor marketplace packaging for the portable Claude Code audit skill. Each invokes the standalone scanner on selected files; none scans a whole host session or proves runtime behavior.

• A Dev Container Feature installs an exact LintLang release in an isolated environment. Its default remains the published 0.6.0 package until the 0.7.0 package is available; the version option can select a later release.

• A second Agent Plugins 1.0 manifest at the Claude Code plugin root makes its existing skill discoverable by hosts using that format. The automatic Claude Code hook remains a separate surface.

• Tool definitions are found by shape, wherever they sit. Previously only a root tools/functions list of name + parameters/input_schema objects was read: a root JSON array was an input error, and MCP inputSchema tools, mcpServers.<server>.tools, vendor keys such as VS Code contributes.languageModelTools, name-keyed tool maps and Gemini functionDeclarations scanned PASS with nothing inspected. See "Supported formats and extraction" in llms-full.txt for the exact signatures and the hard negatives (SBOMs, JSON Schema, OpenAPI, lockfiles, pipeline templates).

• Every result reports what it inspected (Inspected: line; inspected in JSON). A file with nothing to inspect is SKIPPED with its reason, never PASS. A scan in which every file was skipped, and a named file whose tool-like objects could not be read, exit 1; --allow-uninspected opts out. JSON also gains not_inspected, skipped, and a per-finding line.

• Markdown files are instruction documents, not chat system prompts. YAML front matter with name/description is read as skill metadata: H1.1/H1.2 on the description, H1.7 (over 1024 characters), H1.8 (no "when to use"), H1.9 (name invalid or different from the SKILL.md directory). Front matter is no longer linted as body prose.

• H4.5: an instruction document references a project file that does not exist.

• Findings in text files carry their line number (terminal file:line, JSON line, SARIF region) and quote the whole offending line.

• --show-all; the terminal otherwise shows five findings per code and counts the rest. Clean and skipped files in a multi-file scan are summary rows.

Changed #

• Terminal scans on a TTY end with one dim package-version and repository pointer. Redirected output, JSON, Markdown, and SARIF omit the pointer.

• lintlang init --github now generates a workflow pinned to the v0.6.0 Action commit. Existing generated files are reported as different and are not overwritten without --force.

• Concrete short tool descriptions no longer fail solely on length. One-sided tool-description containment respects distinct input property schemas.

• Parameter descriptions are not required to repeat explicit scalar schema or tool-description context. Unexplained parameters still produce H3 findings.

• Server manifest instructions no longer inherit host-agent shape requirements. Unresolved localization keys are disclosed as uninspected text, and skill source catalogs are skipped with an explicit reason.

• The chat-prompt shape heuristics no longer run on Markdown instruction documents: H5 instruction count without priority ordering, H5 negative density, H6 missing output format, H6 missing version marker, H4 missing boundary vocabulary. Those generic prompt-shape notices did not identify a specific sentence to repair in an instruction document. They still run on .txt/.prompt files and config system prompts.

• H1.3 no longer treats get/set/run/execute/use/make as vague verbs. One-sided H1.6 needs a shared domain term and the same leading verb. H1.4/H1.5/H1.6 compare within one tool container. H3 ignores unions of scalar types.

• Python: a string is extracted as a prompt when the code uses it as one; docstrings, help text, log and exception messages are not prompts. P2 is LOW (over 500 characters) / INFO instead of MEDIUM / LOW, and the version-marker note does not apply to extracted literals. A Python tool's schema is counted as inspected only when it is a literal object; dynamic schema expressions are retained as coverage notices rather than silently treated as empty schemas. Python test files excluded during directory walks now appear as explicit SKIPPED results instead of disappearing from the reported coverage.

• Baselines: evidence is part of a finding's fingerprint and H2/H4/H5 evidence in text files is now the whole line, so such entries recorded by 0.6.0 resurface once and need re-recording.

Added (earlier in this cycle) #

• On-demand lintlang-audit skill in the Claude Code plugin (integrations/claude-code/skills/lintlang-audit/), plugin version 0.2.0. It audits the file a user names, resolving the released CLI from PATH or through uvx --from lintlang==0.6.0, so it needs no checkout of this repository. Previously the plugin shipped only the automatic PostToolUse hook, which covers just the file Claude Code has already changed; there was no way to ask for an audit. The two surfaces are separate: the skill is not a hook, and the plugin README and manifest descriptions now say so.
• lintlang scan --discover [ROOT] opts in to repository discovery of recognized agent-instruction files anywhere under ROOT (default .): AGENTS.md, CLAUDE.md, GEMINI.md, SKILL.md, agent.yaml/.yml/ .json, .github/copilot-instructions.md, and *.instructions.md under .github/instructions/, matched case-sensitively at any depth — that directory's documented spelling, so a README or a scratch note kept beside the real instruction files is not scanned as one. Editor and host layouts (.cursor/rules, .claude/agents, .windsurfrules) are known omissions, not discovery targets; pass such a file as an explicit argument. Symlinks are not followed, as in a directory scan, but a recognized instruction file skipped for that reason is now named on stderr instead of silently dropping out of the scanned set; an excluded one is not reported. Explicit file arguments remain canonical; --discover unions its discovered set with them, deduplicated. --exclude globs and a repository's .lintlangignore filter discovered files exactly as they filter a directory scan, so a repository that keeps deliberately broken instruction fixtures can keep them out of its own repository-mode gate. Generic directory scanning (lintlang scan <dir>) is unchanged and keeps its own broader, extension-based sweep.
• lintlang scan - --stdin-filename <virtual-path> scans exactly one document from standard input. The virtual path drives parsing (including .py AST extraction), reported locations, JSON/SARIF identity, and baseline matching; the path itself is never opened. - without --stdin-filename, more than one -, --stdin-filename without a - input, and - combined with --discover are all rejected with a usage error (exit 2). One invocation takes one unambiguous source of files: a generator scans what it generated, a repository gate scans the repository. Released 0.6.0 rejected a bare - as a missing file (exit 1), so a wrapper that branches on that exit code sees 2 instead.
• lintlang init --github also recognizes a root SKILL.md as an automatic candidate, checked last in the existing detection order so no previously auto-selected repository changes which file it picks. An explicit --path still wins over every candidate.

Changed #

• A scan that inspects zero files is an input/coverage error on every channel. Released 0.6.0 already exited 1 for it and said so on stderr (Error: No files were successfully scanned.) and in SARIF, which reported executionSuccessful: false with an LL_INPUT_ERROR notification but no ERROR result; JSON alone still printed [], so the JSON report contradicted the process status. The scan now exits 1 with a matching ERROR result on every output channel (terminal, JSON, SARIF). New --allow-empty is the opt-out for a caller that intentionally scans an input that may sometimes be empty: it exits 0 with a stderr note, [] for JSON, and an empty SARIF run reporting executionSuccessful: true. Report and exit status now agree in both directions. An interim change on main after the 0.6.0 tag made a zero-file scan exit 0; it was never released, so no published version behaved that way and an upgrade from 0.6.0 sees only the added channels and the new flag. The first-party GitHub Action runs the same CLI over its path input, so a path that inspects zero files now fails the step with exit 1; the Action exposes no input that forwards --allow-empty, so a workflow that needs the opt-out has to call the CLI directly. --write-baseline's pre-existing empty-scan error, which already refused to write a baseline, is unchanged.
• Breaking: the pre-commit hook now consumes pre-commit's own changed-file selection instead of a hard-coded path. args: [AGENTS.md], pass_filenames: false, and always_run: true are gone from .pre-commit-hooks.yaml; the hook now declares a conservative files: regex matching exactly the recognized instruction set above, so it fires only on changed files that are themselves agent instructions, across however many such files changed in one commit. A repository that relied on the hook always running regardless of which files changed should instead run pre-commit run lintlang --all-files. Reproducing the exact old single-path behavior takes all three settings in its own .pre-commit-config.yaml — args: [AGENTS.md], pass_filenames: false, and always_run: true — because pre-commit appends the changed filenames after args, so args: alone adds a fixed path rather than replacing the selection. The pre-commit guide now states that consequence and the advisory default it sits next to: without --fail-on, a FAIL verdict does not block the commit, because the scan exits 0 whatever it found and only an input error is nonzero.
• Behavior change: --exclude and .lintlangignore globs are now anchored and translated correctly. The previous translator rewrote the pattern by sequential string replacement and matched it unanchored, with two consequences: **/ became a mandatory rather than an optional path segment, so **/*.md matched docs/a.md but not a root-level a.md; and any pattern matched anywhere in a path, so docs/** also excluded notdocs/a.md and *.md also excluded myfoo.md.bak. Both are fixed. Following gitignore, a pattern containing no / still matches at any depth, so CHANGELOG.md and *.md keep excluding nested files. A repository whose exclusion happened to depend on the over-broad matching will now scan those previously skipped files. The same translator backs --discover filtering.
• H5's per-negative-instruction LOW notices (Negative instruction '…' could be reframed positively.) are removed. The aggregated MEDIUM density finding for a prompt with many instructions and no explicit priority ordering is unchanged.

Fixed #

• Direct-format tool entries with a non-string name now produce a located input error instead of an internal attribute error. The result remains ERROR with exit code 1.

• H2 no longer treats a finite loop over or loop through instruction as indefinite without an explicit continuation term. H4 no longer treats a domain invariant such as Always maintain backward compatibility as cross-context memory. Their actual unbounded and memory-carrying forms remain findings; a file whose only HIGH or CRITICAL findings were these false positives can now move from FAIL to REVIEW or PASS.

• Verdict change, in both directions. H2 no longer reports an unbounded-behavior phrase that the prompt forbids. Do not continue indefinitely; stop at the first terminal result. was reported as Unbounded continuation (CRITICAL) and scanned FAIL; it now carries no H2 finding. One guard covers every H2 unbounded-behavior phrase (keep trying until, retry until, loop until, loop over / loop through, continue until / continue indefinitely). The negator (never, do not, don't, should not, must not, their contractions, and cannot / can't after a subject) must sit directly on the phrase, with at most two adverbs from a closed list between them. A file whose only CRITICAL findings were such prohibitions now scans REVIEW or PASS. The guard replaces the narrower negation check that retry until has had since 0.6.0 and is stricter than it: a never retry until … that carries a trailing condition (unless, if, when, except), is asked as a question, is doubly negated, or is split from the phrase by a tab or a blank line is now reported where 0.6.0 was silent, so a file relying on one of those forms can move to FAIL. An interrupted or delegated prohibition (Do not, under any circumstances, …, Do not let the agent …) is still reported; put the negator directly on the phrase. A stop condition in a clause coordinated after the prohibition — Do not continue indefinitely and stop when the queue drains. — does not make the prohibition conditional, so the corrected wording a user writes after being flagged is not flagged again; a condition attached to the forbidden behaviour itself (Do not keep trying until it works when the credentials are wrong.) still is. The guard reads the negator's own clause: to its left a comma opens that clause only when it starts a coordinated one (…, and do not retry until success), so a parenthetical or a complement cannot hide an earlier negative (It is not true, however, that you must never retry until it works. is reported); an earlier negative counts with or without its apostrophe (wont as well as won't); and a condition introduced after the phrase (…, if the queue is non-empty) defeats the prohibition exactly as an unpunctuated one does, whether the condition is introduced by a comma, a dash, or a parenthesis (Do not retry until it works (if the queue is non-empty). is reported, as its comma form is). A parenthesis that opens anything other than an if / when / whenever condition is an aside or the author's own bound and leaves the prohibition whole (Do not retry indefinitely (see the runbook)., Do not continue indefinitely (stop after ten items).). Fronted and trailing conditions are treated consistently: both If the queue is non-empty, do not retry until it works. and Do not retry until it works, if the queue is non-empty. remain reportable because neither states an unconditional bound. Trailing conditions remain visible through ordinary modifiers (Do not retry until it works, only if the queue is non-empty.), so the prohibition is not mistaken for a bound. Finding descriptions and evidence text are unchanged, so existing baseline entries still match.

• H4's Long system prompt with no context boundary markers (MEDIUM) now also requires the prompt to demonstrate cross-context statefulness — carrying state, memory, or history across turns, tasks, or sessions — before it reports. A long, single-shot reference prompt that never asks the agent to carry anything between turns no longer reports this finding on length alone; the other H4 erosion patterns are unchanged. The statefulness signal is a recognizer, so a prompt that asks for carry-over in wording it does not list (Keep the running tally from earlier questions in mind.) is a known miss.

• H6's System prompt references multiple output formats (…) (MEDIUM) now requires each named format to carry its own output-format instruction, not a bare mention. A prompt that names two formats only while describing which file types a tool reads no longer reports this finding. An imperative taking the format as a direct object (Always output JSON., Return JSON only., Emit XML.) counts as an output instruction; a descriptive third-person clause (The upstream service returns JSON.) does not. That negative is correct only when the clause describes what some other system emits. A two-format delivery of the agent's own reply stated in the third person (The agent's reply is delivered as JSON to the API and as Markdown to the UI.) is recognized as the competing contract this rule exists to surface.

• H6's System prompt has no explicit output format specification or example. (LOW) no longer reports on a prompt that does specify one in an ordinary spelling. Return Markdown only. and Return a plan as Markdown. were both missed because the verb had to be immediately followed by in/as/with/ using. The recognizer is deliberately not widened to arbitrary words before the format name, so Output exactly one Markdown document. is a known remaining miss — as is any wording that puts an unlisted word between the connector and the format name (Reply using the YAML shape below.) or uses an unlisted verb (Produce a single JSON object.). Each documented miss for the narrowed H4 and H6 rules now has a test that asserts the behaviour the rule should have and is expected to fail until the miss is fixed, so closing one of these gaps is a visible decision rather than a silent change.

• HERM recognizes explicit prose priority statements such as Priority order is: … then … without treating absence or uncertainty language as an ordering. A public-safe machine-readable case and scanner fixture preserve this boundary.

[0.6.0] - 2026-09-12 #

Added #

• Opt-in baselines for incremental adoption: scan --write-baseline FILE records reviewed structural findings; scan --baseline FILE reports and gates remaining findings. Exact repository-relative identities and occurrence counts prevent file-wide or rule-wide suppression. Invalid inputs remain fatal, and baseline creation refuses to overwrite existing paths.
• Optional first-party GitHub Action baseline input for both terminal and SARIF output, with protection against a SARIF report overwriting the baseline. Reports disclose the acknowledged finding count; HERM scores are unchanged.
• The Claude Code hook now resolves LintLang without putting the edited project's directory on the import path. It prefers the installed lintlang executable, and uses python3 -m lintlang only with -P and PYTHONSAFEPATH=1 on interpreters that support them. Previously the -m probe ran before the pinned version was compared, so a lintlang.py in an opened project could be executed by the hook.
• Root Claude Code marketplace manifest (.claude-plugin/marketplace.json) cataloging the existing integrations/claude-code plugin. Claude Code cannot install a plugin that no marketplace lists, so the adapter previously required a local checkout and --plugin-dir; /plugin marketplace add hermes-labs-ai/lintlang then /plugin install lintlang@lintlang now works from the repository. The marketplace is named lintlang rather than hermes-labs, which is already taken by the published hermes-labs-ai/agent-signage catalog.
• External MegaLinter plugin exposing the pinned LintLang scanner as AI_LINTLANG, with an exact configuration guide and clean/failing fixture coverage. Verified end to end in oxsecurity/megalinter-python:v9.4.0: the descriptor loads, lintlang==0.5.3 installs at run time, a failing fixture exits 1, and a clean-only workspace exits 0.

Fixed #

• H2 recognizes explicit local verification bounds and negated retry prohibitions, reducing false positives for those instruction patterns.

[0.5.3] - 2026-09-02 #

Added #

• Native Gemini CLI AfterTool extension that returns bounded LintLang repair context after successful write_file and replace edits.
• Native Claude Code PostToolUse plugin for successful Write and Edit operations, with shell-safe paths and an exact scanner-version contract.
• Native OpenCode 1.18.27 tool.execute.after adapter that scans explicit changed-file paths and skips ambiguous patch operations.

The Gemini extension passed a copied-install live host run and bundles the repository source with a pinned runtime dependency. All three adapters are non-blocking and never rewrite the changed file.

[0.5.2] - 2026-09-02 #

Added #

• Native Hermes Agent pre_verify integration that scans changed instruction-bearing files once before a coding turn finishes. PASS and REVIEW remain non-blocking; FAIL or input ERROR reopens the turn with the exact local scan command.

[0.5.1] - 2026-09-02 #

Fixed #

• Generated GitHub Code Scanning workflows now isolate SARIF upload permission in a second job, disable persisted checkout credentials, and preserve failed scan results through an artifact handoff.

[0.5.0] - 2026-08-24 #

Added #

• lintlang init --github creates an idempotent, pinned GitHub Code Scanning workflow for an existing repository-owned instruction file. It auto-detects common agent-instruction paths, supports an explicit repository-relative --path, uploads native SARIF, and refuses silent overwrite unless --force is supplied.

[0.4.1] - 2026-08-15 #

Changed #

• PyPI Homepage and Documentation links now point to the dedicated LintLang product page at https://hermes-labs.ai/lintlang. This is a metadata-only release; LintLang's scan behavior and GitHub Action interface are unchanged.

[0.4.0] - 2026-08-13 #

Added #

• Deterministic SARIF 2.1.0 output for lintlang scan --format sarif, validated offline against the hash-frozen OASIS errata-01 schema. Findings use their most specific stable code as ruleId; severity maps to SARIF level without security metadata or custom fingerprints.
• Repository-relative, URI-encoded artifact locations. AST-extracted Python findings include evidence-supported line spans; structured YAML, JSON, and text findings remain file-level rather than inventing line or column data.
• An optional sarif-file input for the first-party composite Action and a least-privilege example that uploads the generated file with GitHub's immutable upload-sarif Action pin, even when verdict gating returns nonzero.

Changed #

• Release publication now checks out the GitHub Release tag, verifies that its vX.Y.Z value matches the package version and checked-out commit, runs Twine metadata checks, and uses immutable Action SHAs before trusted publishing.

Fixed #

• Quoted detector examples, inline code, fenced code, and metalinguistic descriptions no longer trigger H2, H4, or H5 merely by mentioning detector phrases. Live directives remain reportable, and scope-classification failures preserve prior reporting. This post-0.3.8 fix was merged separately in PR #41 and remains regression-covered.

[0.3.8] - 2026-08-05 #

Added #

• H1.6, a sub-code of H1 that reports tool pairs carrying no differentia — where every meaning-bearing term in one description also appears, or has a synonym, in the other. A description states what a tool is; a diagnosis states what distinguishes it from its nearest neighbour. An individually accurate description can still fail to distinguish its tool from a neighbouring tool. H1.6 reports that relational ambiguity before runtime. Schema validation cannot reach it because each colliding tool is individually valid.
• Detection uses a curated synonym lexicon, so it reaches some pairs that word overlap cannot. Search the documentation and Search through the docs score 0.25 on H1.5's Jaccard measure while carrying no distinguishing term under H1.6's model.
• Two shapes are distinguished. Mutual — neither tool distinguishes itself. Domination — one tool's every analysed term is covered by the other, so the finding identifies the less-specific description to repair.
• Finding.sub_id and Finding.code, so a finding can be cited precisely ("that's an H1.6") without renaming the pattern IDs already in use. JSON output gains a code field. pattern_id is unchanged.

Changed #

• Some pairs reported in 0.3.2 are now silent by design: a pair whose descriptions reference each other by name is treated as self-disambiguating and skipped, unless one of them declares itself an alias. Diffing findings across versions will show this.
• H1.6 findings are MEDIUM, not HIGH, so they inform a build rather than break one. --fail-on fail keys on CRITICAL/HIGH and is unaffected; use --fail-on review to gate on them. This is deliberate while the check's recall is unmeasured against a labelled corpus.
• H1.6 comparisons are scoped to tool definitions extracted from one parsed input. Directory scans do not aggregate definitions across files or infer that separate files share a selection namespace.

Fixed #

• Descriptions in non-Latin scripts are no longer reported as redundant. Tokenization matched ASCII only, so Chinese, Japanese, Korean, Cyrillic and Arabic descriptions produced no terms at all — and set containment holds vacuously for an empty set, so such a tool read as "dominated by" whatever it sat beside, with advice to delete it. Tokenization is now Unicode-aware, and a tool carrying too little analysable text is skipped rather than compared. The lexicon remains English, so synonyms in other languages are not detected.
• A tool whose description declares it an alias of another is now reported as a collision. Detection matches a fixed list of phrasings (Compatibility alias for X, Deprecated. Use X, Superseded by X); the same relationship phrased differently is still missed, the same way the synonym lexicon is finite.
• A tool named with an ordinary English word — access, configure — no longer suppresses findings against its neighbours merely because that word appears in their descriptions. Only an identifier-shaped name counts as one tool naming another.

Note for anyone diffing the source: several entries that appeared here during development described defects introduced and fixed within this unreleased branch, not behaviour any 0.3.2 user encountered. They have been removed. The cardinality and name-suppression problems never shipped.

[0.3.2] - 2026-08-04 #

Added #

• A first-party composite GitHub Action that installs LintLang from the selected action ref and preserves the CLI's verdict-based exit status.
• CI smoke coverage for successful and failing action invocations.
• A native pre-commit hook that visibly reviews explicit repository-owned instruction paths without blocking on heuristic verdicts by default.

Changed #

• The GitHub Actions quick start now uses hermes-labs-ai/lintlang@v0.3.2.
• The quick start now includes exercised uvx and isolated pipx paths.
• Repositories can opt into blocking pre-commit FAIL findings after reviewing their baseline.

[0.3.1] - 2026-07-19 #

Changed #

• Python source scanning uses AST extraction for embedded prompts and the P1/P2 pipeline checks while preserving the offline, deterministic scan contract.
• An unsupported embedding experiment was removed from the candidate before release because an unavailable backend could not be distinguished from a clean result.

Added #

• Provider-neutral preflight candidate: deterministic analysis of one present instruction plus typed explicit context, with PF001-PF005 exact evidence, ALLOW | NOTICE | HOLD | UNAVAILABLE | ERROR, redacted-by-default JSON, and explicit source-bound correction previews. It never retrieves history or sends to a provider.
• Version-of-record consistency gate (tests/test_version_consistency.py): asserts lintlang.__version__ equals pyproject.toml's [project].version, reading source directly so it holds in a fresh clone. Fixes and guards against the prior drift where __version__ reported 0.2.1 while the published artifact was 0.2.2. This is the "separate gate" that test_docs_consistency.py names as out of its scope.
• Fatal input-integrity channel: missing, unreadable, or malformed requested inputs now produce explicit ERROR results in the CLI, scan_file(), and scan_directory(), and the CLI exits 1 regardless of --fail-on; another valid input can no longer mask omitted coverage.
• compute_verdict(result) and the public terminal/Markdown formatters preserve that ERROR state instead of treating an unread input with zero findings as clean; passing a findings list remains compatible after successful input.
• JSON output includes input_error for every path and uses verdict: ERROR for input failures instead of converting parse errors to INFO/PASS lint findings.
• README examples now report 0.3.1, and verdict/detector language is scoped to structural findings rather than runtime guarantees.
• Documentation consistency checks now forbid brittle suite-size claims and scope the bundled samples as regression fixtures rather than accuracy evidence.

Notes #

• Zero runtime dependency change — pyyaml remains the only runtime dependency.
• 0.3.0 was never published to PyPI or created as a GitHub Release. A public v0.3.0 Git tag already points to an older, pre-fix commit, so this release advances to 0.3.1 rather than moving or reusing that immutable tag.

[0.2.2] - 2026-04-26 #

Added #

• INTENT.md at repo root — Hermes Labs convention; one-page invariants doc covering accepts/refuses/non-goals + verification contract.
• evals/sample-detection-rate.sh — runnable regression check that scans the bundled samples and asserts the expected outcomes. This fixture is not an external accuracy evaluation.
• tests/test_docs_consistency.py — mechanical CI gate (three assertions) that fails the build if the README opener / latest CHANGELOG entry / pytest --collect-only count drift apart. Catches the fabrication-class pattern where a chisel pass updates one surface but leaves a stale figure on another. Replaces manual eyeball-grep audits with pip install lintlang && pytest tests/test_docs_consistency.py-checkable invariant.

Changed #

• README refreshed for Hermes Labs Flagship Standard v1. Added detector scope, a comparison with model-based review, explicit non-goals, and a reproduce-yourself line pointing at evals/sample-detection-rate.sh.

Notes #

• Chisel pass — README + structural docs only. No detector changes.
• Tier B coverage against flagship-standard.md: 6/7 (B6 plugin path is the acknowledged miss; queued for v0.3 when a formal Protocol/register() extension surface lands).
• Experimental E-series detector work was not shipped. Any future integration requires a public evidence corpus, hard-negative tests, and an explicit opt-in contract before it can affect existing CI results.

[0.2.1] - 2026-04-13 #

Added #

• H5 layered exemption system — three-layer filtering reduces false positives on negatives:
  • Layer 1: Structural exemptions (HTML comments, code blocks, generated-file markers)
  • Layer 2: Phrase-level exemptions (privacy disclaimers, UI labels, descriptive text, idiomatic expressions)
  • Layer 3: Safety-context keyword window (existing behavior, now the fallback)
• Expanded vague qualifier detection — catches figurative verbs (lean into, err on the side of, double down on, keep it simple), broader ambiguous conditionals (if appropriate, when possible)
• H6 code-aware format detection — strips fenced code blocks, inline code, filenames, and CLI flags before counting format keywords (prevents --json flag from triggering mixed-format warnings)
• Multi-file summary table — box-drawing table with per-file verdict, findings breakdown, and scan timing (terminal output only, shown when >1 file scanned)
• Vague qualifier deduplication — identical matches within a file are reported once

Changed #

• Development status upgraded from Alpha to Production/Stable
• Author metadata updated.

[0.2.0] - 2026-03-25 #

Changed #

• Breaking: Replaced numeric HERM score with PASS/REVIEW/FAIL verdict in terminal and markdown output
  • ❌ FAIL — any CRITICAL or HIGH finding
  • ⚠️ REVIEW — any MEDIUM finding
  • ✅ PASS — only LOW/INFO findings or none
• Terminal output now leads with verdict + severity summary instead of dimension bars
• Markdown report restructured around verdict + findings (no score in header)
• JSON output: verdict at top level, HERM score moved under herm key (preserved for programmatic use)
• patterns command simplified to show H1-H7 detectors only

Added #

• --fail-on fail|review CLI flag for verdict-based CI gating
• compute_verdict() function in public API
• test_verdict.py with 10 dedicated verdict logic tests
• .md extension support in scan_directory (SKILL.md files were silently skipped)
• Expanded is_prompt_like regex to recognize SKILL.md format (description/purpose/role patterns)

Fixed #

• SKILL.md files now get proper coverage instead of defaulting to 65% (low confidence)
• Scanning directories with .md instruction files now includes them automatically

Deprecated #

• --fail-under (HERM score threshold) still works but --fail-on is preferred

[0.1.2] - 2026-03-02 #

Changed #

• Updated project URLs for PyPI backlinks (Homepage, Documentation, Repository, Bug Tracker, Changelog)

[0.1.1] - 2026-03-02 #

Fixed #

• Standardized package metadata for Hermes Labs.
• Fixed publish workflow to use API token authentication
• Added community health files (CONTRIBUTING.md, SECURITY.md, CODE_OF_CONDUCT.md)
• Added dependabot configuration

[0.1.0] — 2026-03-01 #

First public release.

Core #

• HERM v1.1 scoring engine (6 dimensions, 8 signal categories, coverage/confidence)
• H1-H7 structural detectors with Finding dataclass
• YAML, JSON, and plain text parsers with auto-detection
• Terminal (ANSI), Markdown, and JSON output formats
• --fail-under flag for CI gating

CLI #

• lintlang scan — scan files or directories
• lintlang patterns — list available patterns and dimensions
• python -m lintlang support via __main__.py
• --format, --patterns, --min-severity, --no-suggestions flags
• Dynamic pattern choices from registry

Detectors #

• H1: Empty/short/vague tool descriptions, duplicate names, word overlap (Jaccard + stopwords)
• H2: Missing constraint scaffolding, unbounded retry loops
• H3: Phantom required fields, missing param descriptions, generic names, nested object inspection
• H4: Context boundary erosion, missing scope signals
• H5: Negative instruction density, vague qualifiers
• H6: Mixed output formats, missing format specs, template variable detection
• H7: System message placement, consecutive roles, orphan tool results

Programmatic API #

• scan_file(), scan_directory(), scan_config()
• ScanResult, HermResult, AgentConfig, Finding, Severity exports
• PEP 561 py.typed marker