Patch release — game polish.

Fixed

• (#619) game (site/game.html): outro footer no longer points players at LangGraph / unrelated tools — repointed to ApexYard's "Loop Engineering" read + yard.apexscript.com; fixed stale intro copy/chips missed when the 11th level landed ("Ten quick rounds" → "Eleven … loop engineering last", added the "Loops" chip); added a dedicated game OG share card (site/og/game.png, 1200×630) and pointed og:image/twitter:image at it instead of the generic site OG (cb701c7)

Closes

• Closes #619

Patch release — game scoring fix.

Fixed

• (#614) game (site/game.html): total score could exceed the 1100 max (share text showed "1188/1100"). level1 and levelTemp called addScore() per round but recorded only the per-level average; levelTemp also double-divided, capping it at ~33. Each level now adds its 0–100 once — total maxes at 1100 and matches the breakdown, and Temperature scores correctly (2224a53)

Closes

• Closes #614

Patch release — game mobile fix.

Fixed

• (#609) game (site/game.html): the Embeddings level was unplayable on a phone (free-form drag of words into a 2D plane). Replaced with a tap-the-meaning-group picker (reuses the mobile-proven cut-* card pattern); removed the dead .emb-* drag CSS (583e8a6)

Closes

• Closes #609

Patch release — CI fix + marketing-site game improvements shipped to production.

Fixed

• (#601) pin ossf/scorecard-action@v2.4.3 — the floating @v2 major tag stopped resolving, failing the Scorecard supply-chain workflow on every push to main (771e2ea)
• (#602) game (site/game.html): mobile-responsive pass so every round plays on a ~360–390px phone, a universal via #apexyard share message (works across X / LinkedIn / WhatsApp / Copy, not just X), and a new capstone level "Engineer the loop" — toggle the guardrails that make an agent loop safe to run unattended (b3e9f4a)

Added

• (#606) game: Skip level option for stuck players — a footer SKIP button (tap-to-confirm) that forfeits the current level (scores 0) and advances, so a hard level never blocks finishing the game (ebd3582)

Closes

• Closes #601, #602, #606

Post-v3.0.0 cycle — a new governed-looping pattern, an interactive marketing-site game, and a batch of hook / release-tooling fixes shaken out while cutting and syncing v3.0.0. The headline feature is governed looping: a trigger-heuristic rule that recommends a bounded, self-verifying loop for repetitive multi-item work and binds every loop to apexyard's existing merge gates as its eval.

Added

• (#594) governed looping — loop-mode.md trigger rule + AgDR-0068 (when to OFFER a closed loop, which primitive, and the halt-at-CEO-gate / verify-with-tests guardrails) (9797a29)
• (#585) interactive "You vs. the LLM" game on the marketing site, with social score-sharing (X / LinkedIn / WhatsApp / Copy) and a play-the-game CTA across the site (fe743f9)

Fixed

• (#549) block-main-push checks the operation's target branch, not the session cwd — no longer false-blocks a push to a feature branch from a dev checkout (eaa0fa9)
• (#547) git-push hook parses the destination ref and ignores redirection tokens + tag pushes (2b41158)
• (#548) pre-push markdownlint lints tracked files only (98a0aba)
• (#568) PR-number extractor ignores redirection tokens + unexpanded $VAR args (7da5984)
• (#569) bash-write ticket gate exempts .claude/, /tmp, rm, and $VAR targets (be50036)
• (#550) /release tags the squash commit on main + adds an ancestry guard before pushing the tag (63b72bf)
• (#559) Rex + /approve-merge resolve the review-marker home pin-first (split-portfolio marker lands where the gate reads it) (50b54a5)
• (#562) durable guard for the hero pill + releases-shipped metric against site/CHANGELOG version drift (a7f5f34)

Changed

• (#588) dependabot + sync branches are exempt from the PR-create ticket-ID check; dependabot targets dev (207a761)
• (#590) bump upload-artifact v4→v7 + codeql-action v3→v4 (38dcf45)
• (#543, #542, #540) dependabot bumps — markdownlint-cli2-action 16→23, github-script 7→9, gitleaks-action 2→3 (4c8352a, 4c2a3cb, 4b69896)
• (#545) exempt sync/ branches from the PR-create ticket-ID rule (f2ed536)
• (#560) re-fork & data-preservation guide added to docs/upgrading.md (28b34fe)

Closes

• Closes #594, #585, #549, #547, #548, #568, #569, #550, #559, #562, #588, #590, #545, #560

Minor release — non-breaking.

Added

• Solution Architect role + /design-review (#471) — independent design review before Build, gated at merge (Gate 3b). Ships /design-review + /approve-architecture.
• /launch-check --workflow (#473) — opt-in parallel + adversarially-verified readiness audit.
• /handover checklist-first doc selection (#480) — per-handover doc + template choice.
• /report-apexyard-bug + /request-apexyard-feature (#482) — file framework feedback upstream (leak-scrubbed).

Changed

• Pre-push gate runs the framework CI locally (#506) — .pre_push.commands + a .githooks/pre-push for terminal pushes.
• /release auto-bumps the marketing-site version (#493) — with a drift guard.
• Release-gated security scan (#487).
• sync accepted as a commit / branch / PR type (#458).

Fixed

• Build-agent self-review blocked (#494) — guardrails + advisory warn hook.
• Issue-filing version on dev (#493) — reads CHANGELOG instead of a stale tag.
• Tracker hooks shape-only fallback (#493) — non-GitHub trackers no longer hard-block.
• Repo-qualified review markers (#485).
• PR-create hooks resolve the PR's origin repo (#464).
• Sync PRs require --merge (#459).
• AgDR-arch-PR body extractor (#461).

Full Changelog: https://github.com/me2resh/apexyard/blob/main/CHANGELOG.md

Local agent routing + split-portfolio v2 hardening + release-cycle plumbing

Minor release bundling three themes:

1. Local agent routing pipeline — when agent-routing.yaml configures an Ollama/LiteLLM endpoint, the framework now verifies reachability and model availability at SessionStart, exports ANTHROPIC_BASE_URL session-wide so routed traffic actually lands on the local endpoint, and warns at SessionStart when routing is configured but INACTIVE (shell-profile snippet not yet sourced).
2. Split-portfolio v2 hardening — partial-config detection (registry pointing at sibling but workspace_dir falling back to in-fork default is now a structured SessionStart error, not a silent split), SETUP step 1 routed through the portfolio helper, and 10 prompt-based skills tightened to source the helper inline before any write block so projects_dir never falls back to literal paths.
3. Release-cycle plumbing — /release-sync now carries forward CHANGELOG.md from main to dev as a separate atomic commit on top of the -X ours merge, closing the silent drift gap that previously required occasional manual resync PRs.

Plus a handful of correctness fixes around hook walkers, merge-gate parsing, branch protection on split-portfolio sibling repos, and a regression guard against legacy v1 walker hooks.

Added

• feat(#417) /handover clones the target repo at step 1.5 — when given a Git URL, the skill clones immediately before any reads, so steps 2–6 run against a local checkout instead of the GitHub API. Subsequent reads are 3–15× cheaper per query; failure paths preserved. (PR #432)
• feat(#438) Ollama / LiteLLM local agent routing — single source of truth replaces three ad-hoc env-var setups across skills. SessionStart verifies endpoint reachability (a), confirms each configured model is pulled (b), exports ANTHROPIC_BASE_URL session-wide (c) so routed traffic actually lands on the local endpoint. (PR #440)
• feat(#448) /release-sync carries forward CHANGELOG.md from main to dev — adds a step 5b that runs after the existing -X ours merge: if dev's CHANGELOG drifted from main's, restore main's version via a separate atomic commit on the sync branch. Path-specific (only CHANGELOG.md), idempotent via git diff --quiet upstream/main -- CHANGELOG.md guard, audit-trail-visible in the sync PR. Closes the silent drift gap that required occasional manual chore PRs to resync. 14/14 tests pass (11 original + 3 new). (PR #451)
• feat(#449) Rex handbook discovery — additive supplement — opt-in, fail-soft enhancement to the path-convention handbook matching Rex already performs. When unavailable or unconfigured, Rex's review behaviour is byte-for-byte unchanged. Adopters who don't configure it see zero impact. (PR #450)

Fixed

• fix(#373) Split-portfolio v2 partial-config detection — when adopters' .claude/project-config.json has the registry / projects / onboarding keys pointing at a sibling repo but leaves workspace_dir falling back to the in-fork default, portfolio_validate() now emits a structured SessionStart error naming .portfolio.workspace_dir and the fix instead of letting clones silently accumulate in the public ops fork. Plus 9 prompt-based skills (/extract-features, /feature-diagram, /handover, /journey, /plan-initiative, /process, /roadmap, /stakeholder-update, /tech-vision, and /dfd) tightened to source the portfolio helper before any write block so they cannot drift back to literal projects/<name>/... paths. (PR #441)
• fix(#414) Regression guard against v1 walker hooks — adds a wrapper-test that asserts no v1 hook surfaces in CI, covering the gh issue edit / gh issue create blockers that v1 walker hooks reintroduced if a stale install was layered on top of v2. (PR #430)
• fix(#415) /split-portfolio configures branch protection on the private portfolio repo — after a fresh split, the private sibling repo's main branch is now protected (required reviews, no force-push) instead of being left wide open. (PR #431)
• fix(#419) Bootstrap exemption scope guard — narrows require-active-ticket.sh's bootstrap exemption to /handover only (was previously broad enough to leak through to other bootstrap-listed skills mid-session). (PR #423)
• fix(#424) Hook walker reads session pin first — the hook walker now checks the CLAUDE_CODE_SESSION_ID session pin before walking the cwd up the tree, so edits made inside workspace/<project>/ correctly resolve to the project's marker file under the ops fork. Closes a class of "ticket marker not found" failures for managed-project work. (PR #425)
• fix(#426) Merge hook handles compound marker-write + merge commands — the merge-gate hook now correctly parses cmd_a && cmd_b shapes where the first half writes the CEO marker and the second half is the actual gh pr merge. Previously the marker write was treated as the gated command and the merge slipped through unguarded. (PR #427)
• fix(#434) SETUP step 1 routes onboarding.yaml through portfolio helper — first-run /setup was reading the in-fork copy unconditionally; split-portfolio v2 adopters now correctly see the sibling repo's copy on SETUP step 1 without manual workaround. (PR #437)
• fix(#442) SessionStart warns when local agent routing is INACTIVE — when agent-routing.yaml configures a local endpoint but the current shell has not exported ANTHROPIC_BASE_URL (e.g. shell-profile snippet not yet sourced), SessionStart now prints an INACTIVE warning naming the missing env vars and the shell-profile step. (PR #444)
• fix(#443) Per-block helper-source preamble across 10 skills — each bash write block in /dfd, /extract-features, /feature-diagram, /handover, /journey, /plan-initiative, /process, /roadmap, /stakeholder-update, /tech-vision now sources the portfolio helper at the top of the block. Eliminates the cross-block scoping bug where projects_dir from an earlier block was undefined in a later one and writes silently fell back to literal projects/<name>/.... The Write-targets rule in each SKILL is strengthened with a "REQUIRED per-block preamble" note. (PR #445)

Changed

• chore(#446) CHANGELOG.md on dev resynced with main — v1.3.0 → v2.1.0 release-notes entries were missing on dev due to accumulated -X ours merge drift over 5 release cycles. One-off content fix; the follow-up #448 closes the underlying mechanism so this won't recur. (PR #447)

Compatibility

No breaking changes. Adopters running purely on Anthropic's hosted API see no behaviour change. Adopters who use local agent routing get correctness improvements (reachability checks, INACTIVE warnings) instead of silent fallbacks. Split-portfolio v2 adopters whose configs are complete see no behaviour change; those whose configs are partial now get a clear SessionStart error directing them to set .portfolio.workspace_dir.

[2.1.0] — 2026-05-24

/release-sync closes the dev/main divergence loop + one small bug fix

Minor release. Adds a new /release-sync skill that automates the main→dev sync after each release-PR merge, so the squash-merge divergence stops compounding from one release to the next. After this release, the next dev → main release cycle can run the canonical flow instead of cherry-picking.

Added

• feat(#403) /release-sync skill — runs as Step 9 of /release. Creates a sync branch from upstream/dev, merges upstream/main with --no-ff -X ours (dev wins on conflicts because dev already has the un-squashed equivalents), opens a sync PR. Stops at PR creation; normal Rex + CEO merge gate applies. Framework-only (refuses on managed projects). Defensive cases handled: already-in-sync (no-op exit 0), going-backwards (refuse exit 1). 11 unit tests, AgDR-0052 documents the design trade-offs.

Fixed

• fix(#404) /pdf convert.sh fallback path — removed stale --pdf-output-folder and --dest-name flags from the md-to-pdf dispatch branch (md-to-pdf removed both flags in a breaking API change). New strategy: stage source into a temp dir under the desired output stem, run npx md-to-pdf, move the result to the requested destination. Pandoc preferred-path unchanged; graceful-degrade (exit 3) on no converter installed preserved. New regression test (test_md_to_pdf_fallback.sh) pinned against npm latest to catch future upstream API drift.

Compatibility

No breaking changes. Adopters using /pdf on systems without pandoc see the fallback path work again. Adopters using /release get a new optional Step 9; existing release flow unchanged unless /release-sync is invoked.

[2.0.2] — 2026-05-24

GA4 + consent banner on all 4 site pages

Patch-only release. v2.0.0 + v2.0.1 left Google Analytics + the cookie consent banner only on site/index.html. Any visitor landing directly on /how-it-works, /architecture, or /skills (Twitter/LinkedIn shares, search results, LLM citations from llms.txt) was invisible to GA4 — and worse, never saw the consent UI at all, a GDPR gap. This release closes that. No framework changes — site-only.

Fixed

• fix(#399) GA4 tag on all 4 site pages — copied gtag.js + Consent Mode v2 default block from index.html to how-it-works.html, architecture.html, skills.html. Each block wrapped in <!-- begin: gtag --> ... <!-- end: gtag --> markers for greppable future sync (static site, no build step). Every share-driven visit now tracked (subject to consent).
• fix(#399) Cookie consent banner on all 4 site pages — same Accept/Decline/Escape flow + localStorage.ay-consent persistence as the existing index.html implementation. A user landing on /how-it-works first now gets the consent choice; the choice is honoured site-wide on subsequent navigation.
• fix(#399) Removed dead anonymize_ip: true config — no-op in GA4 (Universal Analytics carryover; GA4 anonymizes all IPs by default).
• fix(#399) Refreshed <meta name="llm:token-count"> + <meta name="llm:doc-length"> on all 4 pages to reflect new sizes after the GA4 block additions.

Compatibility

No breaking changes. No framework code touched. Adopters see no changes to hooks, skills, rules, agents, templates, or workflows — only site/ files modified.

[2.0.1] — 2026-05-24

Mobile UX hotfix for the v2.0.0 marketing site

Patch-only release fixing 7 mobile UX regressions surfaced after v2.0.0 shipped. No framework changes — site-only.

Fixed

• fix(#393) Main-page nav restored on mobile — architecture, skills, and how it works links were hidden by the <700px collapse rule on all 4 site pages. Added class="always" so they stay visible. Mobile readers can move between sections again.
• fix(#393) Eyebrow row wraps cleanly — the "Copy as Markdown for AI" button no longer crowds the pill+subtitle row at narrow widths. Drops to its own line below the eyebrow on mobile.
• fix(#393) Duplicated lead text hidden from sighted users on /how-it-works — the #ai-lead block (added in v2.0.0 to satisfy /geo-audit G12) is now visually-hidden via clip+position trick. AI crawlers and screen readers still consume it; sighted users no longer see the same prose twice.
• fix(#393) Homepage hero polish — "Built by me2resh" moved from between tagline and subhead to below the CTAs; version line dimmed further (14px→13px, opacity 0.7→0.55); hero inline link shortened and white-space:nowrap so it doesn't wrap mid-phrase.
• fix(#393) Subtitles trimmed on /architecture and /skills so they don't wrap awkwardly on mobile.

Compatibility

No breaking changes. No framework code touched. Adopters see no changes to hooks, skills, rules, agents, templates, or workflows — only site/ files were modified.