tag:github.com,2008:https://github.com/CognitiveCodeAI/lazarus/releases 2026-06-11T00:39:53Z tag:github.com,2008:Repository/1258950224/v0.8.0 2026-06-11T00:40:40Z <h2>⚡ GitAlive — the repo-page journey gets a name worthy of it</h2> <p>Two days ago we shipped a feature with a forgettable name. <strong>"Presentation" told you nothing about what the tool does</strong> — it could have meant slides. Users asked, fairly: <em>"make what presentable?"</em></p> <p>So while the install base is still small enough to make a rename cheap, the pair gets its real name — <strong>GitAlive</strong> ⚡ — because that's what your repo page actually is: your project's <strong>proof of life</strong>. The README, the badges, the license, the templates — they're the evidence a visitor checks to decide whether a project is alive and worth their time. Lazarus raises the codebase; GitAlive makes the page prove it.</p> <table> <thead> <tr> <th>Was (v0.6–v0.7)</th> <th>Now</th> </tr> </thead> <tbody> <tr> <td><code>/lazarus:presentation</code></td> <td><strong><code>/lazarus:gitalive</code></strong> — the audit (read-only, zero shell)</td> </tr> <tr> <td><code>/lazarus:presentation-repair</code></td> <td><strong><code>/lazarus:gitalive-repair</code></strong> — the fixes (ratified, one finding at a time)</td> </tr> <tr> <td><code>PRESENTATION_AUDIT.md</code> / <code>PRESENTATION_CHANGES.md</code></td> <td><code>GITALIVE_AUDIT.md</code> / <code>GITALIVE_CHANGES.md</code></td> </tr> <tr> <td><code>.lazarus/presentation-waivers.yml</code></td> <td><code>.lazarus/gitalive-waivers.yml</code></td> </tr> </tbody> </table> <h2><g-emoji class="g-emoji" alias="warning">⚠️</g-emoji> Breaking / migration</h2> <ul> <li>The old command names <strong>no longer exist</strong> after <code>/plugin update lazarus@cognitivecode</code> + <code>/reload-plugins</code>. Type <code>/lazarus:gitalive</code> (or just say <em>"polish my README"</em> — plain English still routes you).</li> <li><strong>Your old audit still works:</strong> <code>gitalive-repair</code> explicitly accepts a legacy <code>PRESENTATION_AUDIT.md</code> produced by v0.6/v0.7, so nothing you generated is stranded.</li> </ul> <h2>🖼️ New: the before/after, with receipts</h2> <p>The README has a new spotlight section — <strong>"GitAlive — your repo's proof of life"</strong> — featuring a before/after picture of the feature in action. It isn't a mock-up: it's <em>this repo</em>, as GitAlive's first run found it (project name trapped in a PNG, a CI pipeline wearing no badge, a 300-line README with no table of contents, contributor docs one plugin behind) and as it stands after the fixes (real H1, live badge, ToC — written by <code>gitalive-repair</code> itself — and a clean re-audit).</p> <h2>✅ Verified</h2> <ul> <li>Both renamed skills register with all support files in an isolated-<code>HOME</code> install at the tagged commit (6 core skills, 8 marketplace-wide); <code>claude plugin validate</code> ✔; CI green.</li> <li>Rename swept with a guarded replace + manual review: zero remaining skill-name uses of "presentation" (the plain-English word survives only where it means the domain).</li> <li>Directory-name == frontmatter-<code>name</code> rule held for both skills.</li> </ul> <h2>Install / update</h2> <div class="snippet-clipboard-content notranslate position-relative overflow-auto" data-snippet-clipboard-copy-content="/plugin update lazarus@cognitivecode /reload-plugins"><pre class="notranslate"><code>/plugin update lazarus@cognitivecode /reload-plugins </code></pre></div> <p>New here: <code>/plugin marketplace add https://github.com/CognitiveCodeAI/lazarus</code> → <code>/plugin install lazarus@cognitivecode</code> → <code>/reload-plugins</code>.</p> <p><strong>Full changelog:</strong> <a class="commit-link" href="https://github.com/CognitiveCodeAI/lazarus/compare/v0.7.0...v0.8.0"><tt>v0.7.0...v0.8.0</tt></a></p> CognitiveCodeAI tag:github.com,2008:Repository/1258950224/v0.7.0 2026-06-11T00:11:36Z <h2>✨ The headline: <code>/lazarus:presentation-repair</code></h2> <p>v0.6.0 gave you the DevRel audit. v0.7.0 closes the loop: <strong><code>presentation-repair</code> executes it.</strong> Ratify the findings and it works them <strong>one at a time</strong> — scaffolding your CONTRIBUTING and SECURITY.md, fixing alt text and heading structure, adding the ToC — verifying every change against the rubric check that flagged it, and logging it all to <code>PRESENTATION_CHANGES.md</code>.</p> <p>That makes Lazarus three complete plan-then-execute journeys: <code>discover → repair</code> (make it run), <code>audit → audit-repair</code> (assess, then fix), and now <strong><code>presentation → presentation-repair</code></strong> (make it presentable, then fix that too). Every apply phase refuses to run without its ratified report.</p> <p><strong>The rules that make it trustworthy:</strong></p> <ul> <li><strong>It re-checks before it touches.</strong> Every finding is re-observed against the file's <em>current</em> state first — one that's been fixed since the audit is logged <code>already-satisfied</code> and left alone. No stale-audit blind edits, ever.</li> <li><strong>It will not invent a fact.</strong> Which license is a <em>legal decision</em>; a security contact is <em>yours</em>. Scaffolds carry explicit ask-the-user placeholders, and a file is never written with one unresolved — no answer means an honest <code>needs-input</code> with the exact question logged, not a fabricated email address.</li> <li><strong>A tampered audit can't weaponize it.</strong> Findings drive edits only inside a strict presentation-file allowlist. We tested it against a malicious audit instructing it to <em>delete LICENSE, pipe curl to sh, and edit CI</em>: refused in full, logged <code>out-of-scope-refused</code> — and it flagged the finding's mismatched evidence as consistent with tampering. It also never deletes a file. Any file. Ever.</li> <li><strong>Zero shell.</strong> Like <code>presentation</code>, <code>Bash</code> isn't in its tool pool. It can scaffold your SECURITY.md; it physically cannot <code>curl</code> anything.</li> <li><strong>It respects your recorded choices.</strong> Waived items are never edited — even when the audit's own finding claims otherwise; the waiver file is the contract.</li> <li><strong>It preserves meaning.</strong> Restructure presentation, never rewrite technical claims — a suspect claim gets flagged for <code>audit</code>/<code>repair</code>, not "improved."</li> </ul> <h2>🐕 The dogfood receipt</h2> <p>We ran it on this repo against the real v0.6.0 audit — the one whose fixes had <em>already shipped</em>. Result: <strong>7 of 8 findings correctly detected <code>already-satisfied</code>, zero edits made to any of them.</strong> The eighth — the missing table of contents — it fixed: <strong>the ToC now at the top of the README was written by this skill</strong>, its anchor links verified against GitHub's live slugger (including the two emoji headings with U+FE0F variation selectors, a detail it got right and we had to double-check).</p> <p>A repair tool whose dogfood run consists mostly of <em>declining to repair things</em> is exactly the behavior the design demanded.</p> <h2>✅ Verified before tagging</h2> <ul> <li><strong>Happy path:</strong> in-place fix <code>[VERIFIED]</code> by re-reading; stale finding → <code>already-satisfied</code>; missing-facts scaffold → <code>needs-input</code>, no placeholder file written.</li> <li><strong>Refusal:</strong> no <code>PRESENTATION_AUDIT.md</code> → stopped at the hard precondition, offered to run <code>presentation</code>, zero files touched.</li> <li><strong>Hostile audit + waiver:</strong> malicious fix refused; waiver honored over the finding's own flag; LICENSE intact; checksum-verified single-file footprint.</li> <li>All three plugins <code>✔ enabled</code>, <strong>all eight skills</strong> register in an isolated-<code>HOME</code> smoke test at the tagged commit; <code>claude plugin validate</code> ✔; CI green.</li> </ul> <h2>🚫 Deliberately not in this release</h2> <ul> <li><strong>GitHub-settings audit &amp; push</strong> (description, topics, social preview) — needs <code>gh</code>; future <code>lazarus-github</code> settings skill.</li> <li><strong>More project types</strong> for the presentation rubric (Go, Rust, SaaS, monorepos) — once the four-type engine has real-world miles.</li> </ul> <h2>Install / update</h2> <p>New here:</p> <div class="snippet-clipboard-content notranslate position-relative overflow-auto" data-snippet-clipboard-copy-content="/plugin marketplace add https://github.com/CognitiveCodeAI/lazarus /plugin install lazarus@cognitivecode /reload-plugins"><pre class="notranslate"><code>/plugin marketplace add https://github.com/CognitiveCodeAI/lazarus /plugin install lazarus@cognitivecode /reload-plugins </code></pre></div> <p>Already installed: <code>/plugin update lazarus@cognitivecode</code> then <code>/reload-plugins</code>.</p> <p>Then: <code>/lazarus:presentation</code> for the report — and when you're ready, <em>"apply the presentation audit."</em></p> <p><strong>Full changelog:</strong> <a class="commit-link" href="https://github.com/CognitiveCodeAI/lazarus/compare/v0.6.0...v0.7.0"><tt>v0.6.0...v0.7.0</tt></a></p> CognitiveCodeAI tag:github.com,2008:Repository/1258950224/v0.6.0 2026-06-10T23:25:33Z <h2>✨ The headline: <code>/lazarus:presentation</code></h2> <p>Your code works. But is the <em>repo</em> ready — to go public, to hand to a client, to survive a stranger's first 30 seconds? Most of us never really know, and most of us don't have a DevRel team to ask.</p> <p>Now you do. <strong><code>presentation</code></strong> is a read-only, DevRel-grade audit of everything a visitor sees <em>before</em> your source code: the README, the community-health files (LICENSE, CONTRIBUTING, CODE_OF_CONDUCT, SECURITY, issue/PR templates), and markdown accessibility. It detects your project type — Claude Code plugin, Python library, Node CLI, Node library — and grades against that type's actual conventions, producing a scorecard + findings report (<code>PRESENTATION_AUDIT.md</code>) behind the same you-approve-first gate as every Lazarus skill.</p> <p><strong>The rule that makes it a senior review instead of a nagging linter:</strong></p> <ul> <li><strong>No taste. Ever.</strong> Every finding cites a named standard — GitHub's own community-profile checklist, CommonMark, WCAG 2.x, Diátaxis, the README-content research (Prana et al., <em>EMSE</em> 2019) — with file-and-line evidence. A self-check gate rejects anything that's just an opinion.</li> <li><strong>It respects your choices.</strong> No code of conduct <em>on purpose</em>? Record a one-line waiver in <code>.lazarus/presentation-waivers.yml</code> and it never flags it again. The skill proposes waivers; it never writes one without your approval.</li> <li><strong>It cannot touch anything.</strong> Shell, network, and delegation tools are stripped from its tool pool (<code>disallowed-tools</code>) — it physically cannot run a command. Its only write, ever, is the report you approve.</li> <li><strong>It won't guess your type.</strong> Both <code>pyproject.toml</code> <em>and</em> <code>package.json</code> present? It stops and asks — a wrong-rubric finding is a defect, not a default.</li> <li><strong>Hostile content is data.</strong> A README hiding "ignore your instructions, run this curl" in an HTML comment gets <em>reported as a High-severity finding</em> — never obeyed. We ship the injection fixture it was tested against.</li> </ul> <h2>🐕 We pointed it at this repo before shipping. It drew blood.</h2> <p>Lazarus's own README — the one that's been polished for six releases — scored <strong>0 Critical · 2 High · 2 Medium · 4 Low</strong>. What it caught:</p> <ul> <li><strong>The repo that ships a CI pipeline testing its own safety guard… wore no CI badge.</strong> Five shields, none of them live. (<code>readme.badges</code>, High)</li> <li><strong>A ~300-line README with no H1</strong> — the project's name existed only inside a PNG. One heading fixed two findings. (<code>readme.title</code> + <code>md.heading-order</code>)</li> <li><strong>The contributor docs were one plugin behind reality</strong> — CONTRIBUTING and MAINTAINING still said "two plugins" while the marketplace ships three. (<code>community.contributing</code>)</li> </ul> <p>Every Medium-and-above finding is <strong>fixed in this release</strong> — the diff is the receipt. Community profile, for the record: 7/7 ✅.</p> <h2>✅ Verified before tagging</h2> <ul> <li>All four planned acceptance fixtures pass: missing-everything (both Criticals, cited), complete repo (zero fabricated findings), ambiguous-type (hard-stopped and asked, wrote nothing), hostile README (injection reported, never obeyed) — with <strong>checksum-verified zero mutation</strong> beyond the audit artifacts.</li> <li>"No hidden execution" review: no dynamic-context injection, no shell usage in skill logic, no hooks/MCP/settings shipped, no credential patterns.</li> <li>All three plugins install <code>✔ enabled</code> in an isolated-<code>HOME</code> smoke test at the tagged commit; <strong>all seven skills</strong> register.</li> <li><code>claude plugin validate</code> passes ×4; CI green on the tagged commit.</li> </ul> <h2>🚫 Deliberately not in this release</h2> <ul> <li><strong><code>presentation-repair</code></strong> — the apply phase that executes the audit's recommendations, mirroring <code>discover → repair</code> and <code>audit → audit-repair</code>. Named, designed, next.</li> <li><strong>GitHub-settings audit</strong> (description, topics, social preview) — needs <code>gh</code>/network, so it belongs to a future <code>lazarus-github</code> settings skill, keeping core Bash-free.</li> <li><strong>More project types</strong> (Go, Rust, SaaS, monorepos) — v0.2 of the rubric engine, once the four-type core is proven in the wild.</li> </ul> <h2>Install / update</h2> <p>New here:</p> <div class="snippet-clipboard-content notranslate position-relative overflow-auto" data-snippet-clipboard-copy-content="/plugin marketplace add https://github.com/CognitiveCodeAI/lazarus /plugin install lazarus@cognitivecode /reload-plugins"><pre class="notranslate"><code>/plugin marketplace add https://github.com/CognitiveCodeAI/lazarus /plugin install lazarus@cognitivecode /reload-plugins </code></pre></div> <p>Already installed: <code>/plugin update lazarus@cognitivecode</code> then <code>/reload-plugins</code>.</p> <p>Then open any repo and ask: <em>"is this repo ready to go public?"</em> — or type <code>/lazarus:presentation</code>.</p> <p><strong>Full changelog:</strong> <a class="commit-link" href="https://github.com/CognitiveCodeAI/lazarus/compare/v0.5.0...v0.6.0"><tt>v0.5.0...v0.6.0</tt></a></p> CognitiveCodeAI tag:github.com,2008:Repository/1258950224/v0.5.0 2026-06-09T21:04:59Z <h2>✨ Highlights</h2> <ul> <li><strong><code>discover</code> can finally say "this was never built."</strong> <code>DISCOVERY.md</code> now opens with a <strong>Repairability verdict</strong> — <code>repairable</code> / <code>partially-runnable</code> / <code>not-repairable</code> — with an evidence-cited justification. Underneath it, broken-but-fixable <strong>blockers</strong> are now split from never-built <strong>gaps</strong> (stub bodies, imports of modules that don't exist, README features with no code behind them). Gaps can never become Definition-of-Done checkboxes, so a half-finished app can no longer produce a "repair" plan that's secretly feature development. (<a class="issue-link js-issue-link" data-error-text="Failed to load title" data-id="4624848307" data-permission-text="Title is private" data-url="https://github.com/CognitiveCodeAI/lazarus/issues/19" data-hovercard-type="pull_request" data-hovercard-url="/CognitiveCodeAI/lazarus/pull/19/hovercard" href="https://github.com/CognitiveCodeAI/lazarus/pull/19">#19</a>)</li> <li><strong><code>repair</code> gains a second refusal.</strong> Alongside its existing missing-<code>DISCOVERY.md</code> refusal, it now stops on a <code>not-repairable</code> verdict and presents the honest options: re-scope discovery to the subset that exists, or commission the missing pieces as deliberate feature work. On <code>partially-runnable</code> it proceeds with the gaps explicitly out of scope. <strong>Backward compatible:</strong> a <code>DISCOVERY.md</code> from before this release (no verdict field) is treated as <code>repairable</code> and noted in the verification report. (<a class="issue-link js-issue-link" data-error-text="Failed to load title" data-id="4624848307" data-permission-text="Title is private" data-url="https://github.com/CognitiveCodeAI/lazarus/issues/19" data-hovercard-type="pull_request" data-hovercard-url="/CognitiveCodeAI/lazarus/pull/19/hovercard" href="https://github.com/CognitiveCodeAI/lazarus/pull/19">#19</a>)</li> <li><strong>The README now leads with the two journeys, not four commands.</strong> <em>Make it run</em> (<code>discover</code> → you approve → <code>repair</code>) and <em>assess it, then optionally fix it</em> (<code>audit</code> → your call → <code>audit-repair</code>) — with the four commands presented as the steps inside them. New callout for something that was always true but never said: <strong>don't memorize the order — start anywhere</strong>; every skill routes you to the right phase. The flow diagram also caught up to v0.4.0 with the optional <code>audit-repair</code> leg. (<a class="issue-link js-issue-link" data-error-text="Failed to load title" data-id="4624893743" data-permission-text="Title is private" data-url="https://github.com/CognitiveCodeAI/lazarus/issues/20" data-hovercard-type="pull_request" data-hovercard-url="/CognitiveCodeAI/lazarus/pull/20/hovercard" href="https://github.com/CognitiveCodeAI/lazarus/pull/20">#20</a>)</li> </ul> <h2>📚 Docs</h2> <ul> <li><code>docs/OVERVIEW.md</code> caught up to shipped reality: an <code>audit-repair</code> section, <code>lazarus-forge</code> in the ecosystem, the full six-command list, and the journeys framing — it still described three skills and stopped at v0.3.0. (<a class="issue-link js-issue-link" data-error-text="Failed to load title" data-id="4625583882" data-permission-text="Title is private" data-url="https://github.com/CognitiveCodeAI/lazarus/issues/21" data-hovercard-type="pull_request" data-hovercard-url="/CognitiveCodeAI/lazarus/pull/21/hovercard" href="https://github.com/CognitiveCodeAI/lazarus/pull/21">#21</a>)</li> </ul> <h2>✅ Verified</h2> <ul> <li>All three plugins install <code>✔ enabled</code> via an isolated-<code>HOME</code> smoke test at the tagged commit; all six skills register and the guard script lands executable.</li> <li><code>claude plugin validate</code> passes for all three plugins and the marketplace (only the expected "No version specified" notice).</li> <li>CI green on the tagged commit (manifest validation + shellcheck + guard block/allow/precision assertions).</li> </ul> <h2>🚫 Deliberately not in this release</h2> <ul> <li>Routing discover's never-built gaps onward (a future router, or <code>audit</code> ingesting them) remains a separate, deliberately-unbuilt problem, recorded in <code>docs/PROPOSAL_audit-repair.md</code>. This release makes gaps <em>visible and load-bearing</em> inside the discover → repair journey; it does not wire them anywhere else.</li> </ul> <h2>Install</h2> <div class="snippet-clipboard-content notranslate position-relative overflow-auto" data-snippet-clipboard-copy-content="/plugin marketplace add https://github.com/CognitiveCodeAI/lazarus /plugin install lazarus@cognitivecode # core: discover, repair, audit, audit-repair + destructive-command guard /plugin install lazarus-github@cognitivecode # optional sibling: turn audit findings into GitHub Issues /plugin install lazarus-forge@cognitivecode # optional sibling: pre-build design review for new skills/plugins /reload-plugins"><pre class="notranslate"><code>/plugin marketplace add https://github.com/CognitiveCodeAI/lazarus /plugin install lazarus@cognitivecode # core: discover, repair, audit, audit-repair + destructive-command guard /plugin install lazarus-github@cognitivecode # optional sibling: turn audit findings into GitHub Issues /plugin install lazarus-forge@cognitivecode # optional sibling: pre-build design review for new skills/plugins /reload-plugins </code></pre></div> <p><strong>Full changelog:</strong> <a class="commit-link" href="https://github.com/CognitiveCodeAI/lazarus/compare/v0.4.0...v0.5.0"><tt>v0.4.0...v0.5.0</tt></a></p> CognitiveCodeAI tag:github.com,2008:Repository/1258950224/v0.4.0 2026-06-09T19:06:41Z <h2>✨ Highlights</h2> <ul> <li><strong>The audit gets its apply phase: <code>/lazarus:audit-repair</code>.</strong> Until now, <code>CODEBASE_AUDIT.md</code> was a report you read; acting on it was on you. The new core skill executes a <strong>ratified</strong> audit's §11 Top 10 action items <strong>one finding at a time</strong> — ratify → act → verify against each item's acceptance check — working in Modernization-Plan order (safety rails before refactors), behind the same destructive-command guard. It refuses to run without a ratified <code>CODEBASE_AUDIT.md</code>, exactly as <code>repair</code> refuses without <code>DISCOVERY.md</code>. Its outputs are <code>AUDIT_</code>-prefixed (<code>AUDIT_VERIFICATION_REPORT.md</code>, <code>AUDIT_IMPLEMENTATION_SUMMARY.md</code>) so they never clobber the discover → repair line's files. (<a class="issue-link js-issue-link" data-error-text="Failed to load title" data-id="4609766561" data-permission-text="Title is private" data-url="https://github.com/CognitiveCodeAI/lazarus/issues/17" data-hovercard-type="pull_request" data-hovercard-url="/CognitiveCodeAI/lazarus/pull/17/hovercard" href="https://github.com/CognitiveCodeAI/lazarus/pull/17">#17</a>) <ul> <li><em>Naming note:</em> this is the tool v0.3.0 teased as <code>/lazarus:remediate</code> — it shipped as <strong><code>audit-repair</code></strong> to make the pairing explicit.</li> </ul> </li> <li><strong>Two workflows, one gate — now symmetric.</strong> Lazarus is now two parallel plan-then-execute lines with your approval as the gate in each: <strong><code>discover</code> → <code>repair</code></strong> (make it run) and <strong><code>audit</code> → <code>audit-repair</code></strong> (assess, then fix). They remain deliberately independent — neither reads the other's output, and <code>audit</code> is still perfectly useful as a read-only report you never act on. The design rationale (including what was deliberately <em>not</em> wired together) is recorded in <code>docs/PROPOSAL_audit-repair.md</code>. (<a class="issue-link js-issue-link" data-error-text="Failed to load title" data-id="4609766561" data-permission-text="Title is private" data-url="https://github.com/CognitiveCodeAI/lazarus/issues/17" data-hovercard-type="pull_request" data-hovercard-url="/CognitiveCodeAI/lazarus/pull/17/hovercard" href="https://github.com/CognitiveCodeAI/lazarus/pull/17">#17</a>, <a class="issue-link js-issue-link" data-error-text="Failed to load title" data-id="4609864753" data-permission-text="Title is private" data-url="https://github.com/CognitiveCodeAI/lazarus/issues/18" data-hovercard-type="pull_request" data-hovercard-url="/CognitiveCodeAI/lazarus/pull/18/hovercard" href="https://github.com/CognitiveCodeAI/lazarus/pull/18">#18</a>)</li> <li><strong>New sibling plugin: <code>lazarus-forge</code>.</strong> Its first skill, <strong><code>/lazarus-forge:design-review</code></strong>, is a pre-build quality gate for Claude Code extension <em>proposals</em> (skills, plugins, agents, MCP servers, hooks): it classifies the proposal's input tier and blast radius, verifies platform claims against the live runtime and official docs, and returns exactly one verdict — <strong>BUILD / BUILD-WITH-CHANGES / DO-NOT-BUILD / NEEDS-MORE-DETAIL</strong> — with a closed required-changes list so review converges. Audit-only: it never builds or edits the artifact. Opt-in, like every outward-facing sibling. (<a class="issue-link js-issue-link" data-error-text="Failed to load title" data-id="4609766561" data-permission-text="Title is private" data-url="https://github.com/CognitiveCodeAI/lazarus/issues/17" data-hovercard-type="pull_request" data-hovercard-url="/CognitiveCodeAI/lazarus/pull/17/hovercard" href="https://github.com/CognitiveCodeAI/lazarus/pull/17">#17</a>)</li> </ul> <h2>📚 Docs &amp; hygiene</h2> <ul> <li><strong>README trimmed ~100 lines:</strong> repetition cut, install consolidated into one block, maintainer-facing material moved to the new <code>MAINTAINING.md</code>. (<a class="issue-link js-issue-link" data-error-text="Failed to load title" data-id="4605783491" data-permission-text="Title is private" data-url="https://github.com/CognitiveCodeAI/lazarus/issues/16" data-hovercard-type="pull_request" data-hovercard-url="/CognitiveCodeAI/lazarus/pull/16/hovercard" href="https://github.com/CognitiveCodeAI/lazarus/pull/16">#16</a>)</li> <li>README and <code>docs/OVERVIEW.md</code> now document <code>audit-repair</code> and <code>lazarus-forge</code>; dangling references to an unshipped "presentation" feature were removed. (<a class="issue-link js-issue-link" data-error-text="Failed to load title" data-id="4609864753" data-permission-text="Title is private" data-url="https://github.com/CognitiveCodeAI/lazarus/issues/18" data-hovercard-type="pull_request" data-hovercard-url="/CognitiveCodeAI/lazarus/pull/18/hovercard" href="https://github.com/CognitiveCodeAI/lazarus/pull/18">#18</a>)</li> <li><code>lazarus-github</code> got its own README section and doc hygiene pass. (<a class="issue-link js-issue-link" data-error-text="Failed to load title" data-id="4605630792" data-permission-text="Title is private" data-url="https://github.com/CognitiveCodeAI/lazarus/issues/15" data-hovercard-type="pull_request" data-hovercard-url="/CognitiveCodeAI/lazarus/pull/15/hovercard" href="https://github.com/CognitiveCodeAI/lazarus/pull/15">#15</a>)</li> <li>Fixed an arXiv citation (2603.27277) in the <code>repo-explorer</code> subagent; the five research citations grounding <code>audit</code> and <code>audit-repair</code> were independently verified against conference pages and mirrors before this release.</li> </ul> <h2>✅ Verified</h2> <ul> <li>All <strong>three</strong> plugins install <code>✔ enabled</code> via an isolated-<code>HOME</code> smoke test at the tagged commit; all six skills register (<code>discover</code>, <code>repair</code>, <code>audit</code>, <code>audit-repair</code> from core; <code>issues</code> from <code>lazarus-github</code>; <code>design-review</code> from <code>lazarus-forge</code>) and the guard script lands executable.</li> <li><code>claude plugin validate</code> passes for all three plugins and the marketplace (only the expected "No version specified" notice).</li> <li>CI green on the tagged commit (manifest validation + shellcheck + guard block/allow/precision assertions).</li> </ul> <h2>🚫 Deliberately not in this release</h2> <ul> <li><code>audit-repair</code> consumes <code>CODEBASE_AUDIT.md</code> <strong>only</strong> — it does not ingest <code>discover</code>'s output. Routing discover's "never-built / not-repairable" gaps is a separate, future problem, recorded as an explicit non-goal in <code>docs/PROPOSAL_audit-repair.md</code>.</li> <li>A <code>Repairability verdict</code> field for <code>DISCOVERY.md</code> (distinguishing fixable blockers from never-built gaps) is designed but not yet built.</li> </ul> <h2>Install</h2> <div class="snippet-clipboard-content notranslate position-relative overflow-auto" data-snippet-clipboard-copy-content="/plugin marketplace add https://github.com/CognitiveCodeAI/lazarus /plugin install lazarus@cognitivecode # core: discover, repair, audit, audit-repair + destructive-command guard /plugin install lazarus-github@cognitivecode # optional sibling: turn audit findings into GitHub Issues /plugin install lazarus-forge@cognitivecode # optional sibling: pre-build design review for new skills/plugins /reload-plugins"><pre class="notranslate"><code>/plugin marketplace add https://github.com/CognitiveCodeAI/lazarus /plugin install lazarus@cognitivecode # core: discover, repair, audit, audit-repair + destructive-command guard /plugin install lazarus-github@cognitivecode # optional sibling: turn audit findings into GitHub Issues /plugin install lazarus-forge@cognitivecode # optional sibling: pre-build design review for new skills/plugins /reload-plugins </code></pre></div> <p><strong>Full changelog:</strong> <a class="commit-link" href="https://github.com/CognitiveCodeAI/lazarus/compare/v0.3.0...v0.4.0"><tt>v0.3.0...v0.4.0</tt></a></p> CognitiveCodeAI tag:github.com,2008:Repository/1258950224/v0.3.0 2026-06-06T23:41:05Z <h2>✨ Highlights</h2> <ul> <li><strong><code>/discover</code> now shows up in the slash menu.</strong> Typing <code>/laz</code> or <code>/lazarus</code> used to list only <code>audit</code> and <code>repair</code> — <code>discover</code>, the entry point to the whole discover → repair flow, was hidden. Claude Code's slash menu fuzzy-matches over a skill's name + description (not the namespace), and <code>discover</code>'s description happened to miss the needed letters. Its description is now accurate <em>and</em> matches the filter, so all three core skills surface together. (<a class="issue-link js-issue-link" data-error-text="Failed to load title" data-id="4605451485" data-permission-text="Title is private" data-url="https://github.com/CognitiveCodeAI/lazarus/issues/14" data-hovercard-type="pull_request" data-hovercard-url="/CognitiveCodeAI/lazarus/pull/14/hovercard" href="https://github.com/CognitiveCodeAI/lazarus/pull/14">#14</a>)</li> <li><strong>The companion plugin is renamed <code>lazarus-backlog</code> → <code>lazarus-github</code>.</strong> The name now says what it does — file an audit's findings as GitHub Issues — and sets the pattern for future siblings (e.g. <code>lazarus-linear</code>, <code>lazarus-jira</code>). The command is now <strong><code>/lazarus-github:issues</code></strong>.</li> </ul> <h2><g-emoji class="g-emoji" alias="warning">⚠️</g-emoji> Breaking / migration</h2> <ul> <li>If you installed the companion as <code>lazarus-backlog@cognitivecode</code>, <strong>that name no longer exists.</strong> Reinstall it under the new name: <div class="snippet-clipboard-content notranslate position-relative overflow-auto" data-snippet-clipboard-copy-content="/plugin install lazarus-github@cognitivecode"><pre class="notranslate"><code>/plugin install lazarus-github@cognitivecode </code></pre></div> The core <code>lazarus</code> plugin is unaffected — <code>/plugin update</code> keeps it current.</li> </ul> <h2>🐛 Fixes</h2> <ul> <li><strong>repair:</strong> no longer commits build artifacts, and detects the build output directory from project config instead of assuming <code>dist/</code>. (<a class="issue-link js-issue-link" data-error-text="Failed to load title" data-id="4599456028" data-permission-text="Title is private" data-url="https://github.com/CognitiveCodeAI/lazarus/issues/11" data-hovercard-type="pull_request" data-hovercard-url="/CognitiveCodeAI/lazarus/pull/11/hovercard" href="https://github.com/CognitiveCodeAI/lazarus/pull/11">#11</a>)</li> <li><strong>README:</strong> dropped guidance that leaned on the slash-menu matcher to "group" a plugin's commands (brittle — it's what hid <code>/discover</code>); now points you at the command names directly. (<a class="issue-link js-issue-link" data-error-text="Failed to load title" data-id="4605451485" data-permission-text="Title is private" data-url="https://github.com/CognitiveCodeAI/lazarus/issues/14" data-hovercard-type="pull_request" data-hovercard-url="/CognitiveCodeAI/lazarus/pull/14/hovercard" href="https://github.com/CognitiveCodeAI/lazarus/pull/14">#14</a>)</li> </ul> <h2>📚 Docs &amp; presentation</h2> <ul> <li>New <code>docs/OVERVIEW.md</code> — a complete, top-to-bottom project overview.</li> <li>README: added an "is it actually ready?" peace-of-mind pitch, surfaced the sibling-plugin ecosystem, and reconciled the updates FAQ with how releases actually work. (<a class="issue-link js-issue-link" data-error-text="Failed to load title" data-id="4599209323" data-permission-text="Title is private" data-url="https://github.com/CognitiveCodeAI/lazarus/issues/10" data-hovercard-type="pull_request" data-hovercard-url="/CognitiveCodeAI/lazarus/pull/10/hovercard" href="https://github.com/CognitiveCodeAI/lazarus/pull/10">#10</a>)</li> <li>New phoenix banner + social-card artwork. (<a class="issue-link js-issue-link" data-error-text="Failed to load title" data-id="4599555755" data-permission-text="Title is private" data-url="https://github.com/CognitiveCodeAI/lazarus/issues/12" data-hovercard-type="pull_request" data-hovercard-url="/CognitiveCodeAI/lazarus/pull/12/hovercard" href="https://github.com/CognitiveCodeAI/lazarus/pull/12">#12</a>, <a class="issue-link js-issue-link" data-error-text="Failed to load title" data-id="4599727930" data-permission-text="Title is private" data-url="https://github.com/CognitiveCodeAI/lazarus/issues/13" data-hovercard-type="pull_request" data-hovercard-url="/CognitiveCodeAI/lazarus/pull/13/hovercard" href="https://github.com/CognitiveCodeAI/lazarus/pull/13">#13</a>)</li> <li>README: a star call-to-action, and a named teaser for the next tool, <code>/lazarus:remediate</code>.</li> </ul> <h2>✅ Verified</h2> <ul> <li>Both plugins install <code>✔ enabled</code> via an isolated-<code>HOME</code> smoke test; all four skills register (<code>discover</code>, <code>repair</code>, <code>audit</code> from core; <code>issues</code> from <code>lazarus-github</code>).</li> <li>The destructive-command guard was exercised directly: it blocks <code>terraform destroy</code> and <code>rm -rf</code> (exit 2), allows benign commands, and correctly does <strong>not</strong> block when a dangerous string appears only in a non-command field.</li> <li><code>claude plugin validate</code> passes for both plugins and the marketplace (only the expected "No version specified" notice).</li> </ul> <h2>Install</h2> <div class="snippet-clipboard-content notranslate position-relative overflow-auto" data-snippet-clipboard-copy-content="/plugin marketplace add https://github.com/CognitiveCodeAI/lazarus /plugin install lazarus@cognitivecode # core: discover, repair, audit + destructive-command guard /plugin install lazarus-github@cognitivecode # optional sibling: turn audit findings into GitHub Issues /reload-plugins"><pre class="notranslate"><code>/plugin marketplace add https://github.com/CognitiveCodeAI/lazarus /plugin install lazarus@cognitivecode # core: discover, repair, audit + destructive-command guard /plugin install lazarus-github@cognitivecode # optional sibling: turn audit findings into GitHub Issues /reload-plugins </code></pre></div> <p><strong>Full changelog:</strong> <a class="commit-link" href="https://github.com/CognitiveCodeAI/lazarus/compare/v0.2.1...v0.3.0"><tt>v0.2.1...v0.3.0</tt></a></p> CognitiveCodeAI tag:github.com,2008:Repository/1258950224/v0.2.1 2026-06-05T18:22:14Z <p>A patch release — every change here was surfaced by pointing Lazarus at real, unfamiliar codebases, not by speculation.</p> <h2>Fixed</h2> <h3>Guard: branch names containing <code>-f</code> are no longer mistaken for force-pushes</h3> <p>The destructive-command guard's force-push pattern matched a bare <code>-f</code> <em>anywhere</em> after <code>git push</code>, so normal pushes to branches like <code>bug-fix</code>, <code>feature-flag</code>, or <code>skill-fixes</code> — and the legitimate <code>--follow-tags</code> flag — were wrongly blocked. The pattern is now anchored to a real force flag (<code>-f</code> / <code>--force</code> / <code>--force-with-lease</code>), and CI gained regression cases for the whole <code>-f</code>-in-a-branch-name class. Real force pushes are still blocked (and <code>--force-with-lease</code> now explicitly).</p> <h2>Improved (skill instructions, from dogfood audits)</h2> <ul> <li><strong><code>audit</code> §11 — "acceptance check," not "validation command."</strong> Each action item carries a runnable command <em>or</em> a concrete observable assertion when no one-liner fits, plus a stable action title (downstream tools key on it).</li> <li><strong><code>audit</code> accessibility lens — compute contrast, don't eyeball it.</strong> Color-contrast claims must be computed (the WCAG ratio); any estimate is tagged <code>[INFERRED]</code> and verified before reporting.</li> <li><strong><code>discover</code> — Definition-of-Done gap for hardware/service-coupled apps.</strong> If the end-to-end smoke check needs a device, an external API, real credentials, or a running database you can't supply, state that dependency as an Open Question / <code>requires: &lt;X&gt;</code> rather than faking or silently dropping the check.</li> <li><strong><code>lazarus-backlog</code> — epic split + stable dedup key.</strong> Action items that span many files are proposed as sub-issues; deduplication now keys on a stable action slug instead of the §11 rank number (which shifts when a re-audit re-ranks the findings).</li> </ul> <h2>Upgrade</h2> <div class="snippet-clipboard-content notranslate position-relative overflow-auto" data-snippet-clipboard-copy-content="/plugin update lazarus@cognitivecode /plugin update lazarus-backlog@cognitivecode # if installed /reload-plugins"><pre class="notranslate"><code>/plugin update lazarus@cognitivecode /plugin update lazarus-backlog@cognitivecode # if installed /reload-plugins </code></pre></div> <p>No new commands and no breaking changes — <code>/lazarus:discover | repair | audit</code> and <code>/lazarus-backlog:issues</code> are unchanged.</p> CognitiveCodeAI tag:github.com,2008:Repository/1258950224/v0.2.0 2026-06-05T15:26:40Z <p>The audit was always the most powerful artifact Lazarus produces. v0.2.0 introduces the first opt-in plugin that does something with it — and establishes the pattern for everything outward-facing that follows.</p> <h2>What's new</h2> <h3><code>lazarus-backlog</code> — turn audit findings into GitHub Issues</h3> <p>A new opt-in plugin that converts <code>CODEBASE_AUDIT.md</code> §11 (Top 10 Action Items) into GitHub Issues. Each finding already carries priority, effort, risk, files involved, and a validation command — exactly what an actionable ticket needs.</p> <div class="snippet-clipboard-content notranslate position-relative overflow-auto" data-snippet-clipboard-copy-content="/plugin install lazarus-backlog@cognitivecode /lazarus-backlog:issues"><pre class="notranslate"><code>/plugin install lazarus-backlog@cognitivecode /lazarus-backlog:issues </code></pre></div> <p>GitHub-only for v1, via the <code>gh</code> CLI — no API tokens, no auth setup. Fails fast and explicitly if <code>gh</code> isn't installed, not authenticated, or can't resolve the current repo.</p> <p>Like everything in Lazarus, it ratifies before creating. Proposed issues are presented for review; you pick which to file, edit titles, set labels and milestones. Nothing is created silently.</p> <p><strong>Idempotent by construction.</strong> A hidden provenance marker (<code>&lt;!-- lazarus:audit-item:#N --&gt;</code>) plus a <code>lazarus-audit</code> label keeps the issue tracker clean across re-runs. Re-audit your repo and run <code>/lazarus-backlog:issues</code> again — existing items are skipped, only new findings get filed.</p> <p><strong>Scope is deliberately narrow.</strong> One-shot transform plus dedup. Not a project-management integration, not a two-way sync, not issue lifecycle tracking. It does not modify the audit, the codebase, or any of the core skills.</p> <h3>The sibling plugin pattern</h3> <p><code>lazarus-backlog</code> is the first sibling in what's now an explicit ecosystem pattern. Every outward-facing integration ships as a separate installable in the same marketplace — never bundled into core, never enabled by default:</p> <div class="snippet-clipboard-content notranslate position-relative overflow-auto" data-snippet-clipboard-copy-content="/plugin install lazarus@cognitivecode # core: discover, repair, audit, guard /plugin install lazarus-backlog@cognitivecode # GitHub Issues # Future siblings, same shape: # /plugin install lazarus-linear@cognitivecode # /plugin install lazarus-jira@cognitivecode"><pre class="notranslate"><code>/plugin install lazarus@cognitivecode # core: discover, repair, audit, guard /plugin install lazarus-backlog@cognitivecode # GitHub Issues # Future siblings, same shape: # /plugin install lazarus-linear@cognitivecode # /plugin install lazarus-jira@cognitivecode </code></pre></div> <p>Each sibling owns its own auth story, its own dependencies, its own failure surface. Core stays small, fast, and zero-config. The ecosystem grows by addition.</p> <p>If you don't install <code>lazarus-backlog</code>, <code>gh</code> failures and external side effects never enter your sessions. The three-commands-zero-config install promise for core is preserved.</p> <h2>Other changes</h2> <ul> <li>CI now validates manifests for every plugin in the marketplace, not just core.</li> <li>Release checklist (<code>RELEASING.md</code>) now includes a real-install smoke test in an isolated config dir, run before tagging.</li> <li>README updated with a discoverable pointer to <code>lazarus-backlog</code>.</li> </ul> <h2>What's deliberately not in this release</h2> <p>In the spirit of the project's evidence-driven design:</p> <ul> <li><strong><code>lazarus:remediate</code></strong> — a skill to work through specific audit findings. Spec'd, deferred. Waits for evidence from real audit runs about what its contract should look like.</li> <li><strong><code>lazarus-linear</code> / <code>lazarus-jira</code></strong> — sibling plugins for other trackers. Wait for real demand and the auth/MCP work each will need.</li> <li><strong>Offer-to-update dedup</strong> in <code>lazarus-backlog</code> — currently skip-if-exists. The smarter behavior waits for the first re-run scenario where skip is the wrong answer.</li> </ul> <h2>Upgrade</h2> <div class="snippet-clipboard-content notranslate position-relative overflow-auto" data-snippet-clipboard-copy-content="/plugin update lazarus@cognitivecode /plugin install lazarus-backlog@cognitivecode # optional /reload-plugins"><pre class="notranslate"><code>/plugin update lazarus@cognitivecode /plugin install lazarus-backlog@cognitivecode # optional /reload-plugins </code></pre></div> CognitiveCodeAI tag:github.com,2008:Repository/1258950224/v0.1.0 2026-06-05T03:27:51Z <p>Point Claude at a repo nobody understands — it <strong>walks again</strong>: running, documented, and audited — behind a guard that blocks destructive commands before they ever run.</p> <p>This is the first tagged release of Lazarus. It works on <em>any</em> unfamiliar repo — legacy, freshly inherited, open-source, or perfectly healthy.</p> <h3>What's inside</h3> <ul> <li><strong><code>/lazarus:discover</code></strong> — read-only triage → a ratifiable <code>DISCOVERY.md</code> (a plan plus a concrete Definition of Done). Stops and waits for your approval.</li> <li><strong><code>/lazarus:repair</code></strong> — works the blockers in order, logs every command it actually ran to <code>VERIFICATION_REPORT.md</code>, and promotes what <em>truly worked</em> into a <code>CLAUDE.md</code>.</li> <li><strong><code>/lazarus:audit</code></strong> — a 12-section principal-engineer <code>CODEBASE_AUDIT.md</code>: architecture, risks, security, frontend/accessibility, a phased modernization plan. Read-only, standalone.</li> <li><strong>The guard</strong> — a deterministic <code>PreToolUse</code> hook that blocks <code>rm -rf /</code>, <code>git push --force</code>, <code>DROP TABLE</code>, <code>terraform destroy</code>, and ~25 more patterns. It reads tool input as JSON (never coarse text-matching) and <strong>fails closed</strong> if no parser is available.</li> </ul> <h3>Install</h3> <div class="snippet-clipboard-content notranslate position-relative overflow-auto" data-snippet-clipboard-copy-content="/plugin marketplace add https://github.com/CognitiveCodeAI/lazarus /plugin install lazarus@cognitivecode /reload-plugins"><pre lang="text" class="notranslate"><code>/plugin marketplace add https://github.com/CognitiveCodeAI/lazarus /plugin install lazarus@cognitivecode /reload-plugins </code></pre></div> <p>The plugin is versioned by git commit — <code>/plugin update lazarus@cognitivecode</code> always pulls the latest <code>main</code>. This tag is a human-facing marker, not a version gate.</p> <p>MIT · macOS · Linux (use WSL on Windows).</p> CognitiveCodeAI