chore(main): pre-release 4.1.330

[hve-core-release-please]

Pre-Release 4.1.330

✨ Features

• add label margin and font overrides to arrow_flow in powerpoint skill (feat(skills): add label margin and font overrides to arrow_flow in powerpoint skill #2466)
• add data-governance controls reference to privacy-standards (feat(skills): add data-governance controls reference to privacy-standards #2416)
• enforce asset-doc completeness and region sync in CI (feat(scripts): enforce asset-doc completeness and region sync in CI #2470)
• add --collapse-newlines option to tts-voiceover (feat(skills): add --collapse-newlines option to tts-voiceover #2465)
• scaffold asset docs pages and wire Docusaurus Asset Catalog (feat(docs): scaffold asset docs pages and wire Docusaurus Asset Catalog #2389)
• align HVE Builder artifact workflows (feat(hve-builder): align HVE Builder artifact workflows #2438)
• asset-docs foundation, generator, and validator (feat(scripts): asset-docs foundation, generator, and validator #2365)
• validate unstaged files and dependency pins (feat(scripts): validate unstaged files and dependency pins #2437)
• add accessibility coverage matrix and runtime-probe harness (feat(skills): add accessibility coverage matrix and runtime-probe harness #2392)
• remediate Docusaurus site accessibility (WCAG 2.2 AA) (feat(docs): remediate Docusaurus site accessibility (WCAG 2.2 AA) #2391)
• isolate VSIX and VEX provenance for SLSA Build Level 3 (feat(workflows): isolate VSIX and VEX provenance for SLSA Build Level 3 #2388)
• adopt hybrid Poutine + homegrown template-injection gate (feat(security): adopt hybrid Poutine + homegrown template-injection gate #2344)
• harden MCP/skill trust boundaries and add per-skill security models (feat(skills): harden MCP/skill trust boundaries and add per-skill security models #2326)
• add agent frontmatter to standalone prompts (feat(prompts): add agent frontmatter to standalone prompts #1840)
• execute changed stimuli when eval specs are modified (feat(evals): execute changed stimuli when eval specs are modified #2300)
• SLSA L3 provenance verify gate + branch-protection doc (feat(workflows): SLSA L3 provenance verify gate + branch-protection doc #2231)
• remove issue-triage decomposition and improve labeling (feat(agents): remove issue-triage decomposition and improve labeling #2223)
• update skill workflows and eval coverage (feat(rpi): update skill workflows and eval coverage #2202)
• add beval behavioral evaluation workflow for dt-coach agent (feat(workflows): add beval behavioral evaluation workflow for dt-coach agent #1129)
• add local session telemetry hooks (feat(hooks): add local session telemetry hooks #2008)
• add Privacy Planner, SSSC reviewer, and privacy-standards skill (feat(agents): add Privacy Planner, SSSC reviewer, and privacy-standards skill #2168)
• document plain-text path convention for .copilot-tracking artifacts (feat(agents): document plain-text path convention for .copilot-tracking artifacts #2147)
• consolidate code-review agents and add orientation-first review loop (feat(agents): consolidate code-review agents and add orientation-first review loop #2100)
• register Vally artifacts and regenerate plugins (feat(collections): register Vally artifacts and regenerate plugins #1836)
• Improve quality of rpi-agent.agent.md (feat: Improve quality of rpi-agent.agent.md #1949)
• add experimental Caveman response style skill (feat: add experimental Caveman response style skill #1861)
• add Vally evaluation agents and prompts (feat(agents): add Vally evaluation agents and prompts #1834)
• introduce skill-forward RPI workflows (feat(rpi): introduce skill-forward RPI workflows #1953)
• add behavior eval corpora and Pester test suite (feat(evals): add behavior eval corpora and Pester test suite #1832)
• replace doc-ops agents with unified documentation agent and skill (feat(skills): replace doc-ops agents with unified documentation agent and skill #2095)
• add PR Walkthrough narrative orientation agent (feat(agents): add PR Walkthrough narrative orientation agent #1947)
• migrate Security Planner to skill (feat(security): migrate Security Planner to skill #2045)
• add devcontainer lockfile integrity check (feat(workflows): add devcontainer lockfile integrity check #1874)
• keep internal workflow references out of comments (feat(agents): keep internal workflow references out of comments #2023)
• add evals orchestration modules and runners (feat(scripts): add evals orchestration modules and runners #1831)
• extract supply-chain-security skill and thin SSSC Planner (feat(security): extract supply-chain-security skill and thin SSSC Planner #1950)
• add seven project-planning BRD skills (feat(skills): add seven project-planning BRD skills #1856)
• add vally-tests skill (feat(skills): add vally-tests skill #1830)
• add accessibility planner, reviewer, and code-review accessibility agents (feat(agents): add accessibility planner, reviewer, and code-review accessibility agents #1735)
• harden ADR Creator against untrusted content and sensitive data (feat(instructions): harden ADR Creator against untrusted content and sensitive data #1811)
• add accessibility state schema and noticeLog audit trail to planner schemas (feat(scripts): add accessibility state schema and noticeLog audit trail to planner schemas #1734)
• add accessibility instruction set and shared planner identity base (feat(instructions): add accessibility instruction set and shared planner identity base #1733)
• add accessibility standards skills and shared backlog-templates skill (feat(skills): add accessibility standards skills and shared backlog-templates skill #1732)
• allowlist accessibility skills subdomain and recognize templates subdir (feat(scripts): allowlist accessibility skills subdomain and recognize templates subdir #1731)
• add telemetry-foundations shared skill with consumer overlays (feat(skills): add telemetry-foundations shared skill with consumer overlays #1681)
• add instruction applyTo scope Pester suite (feat(scripts): add instruction applyTo scope Pester suite #1640)
• security-planner SSSC parity (feat(agents): security-planner SSSC parity #1642)
• add jira-setup credential configuration prompt (feat(prompts): add jira-setup credential configuration prompt #1698)
• add experimental mural skill with Python CLI, instructions, and agent integrations (feat(skills): add experimental mural skill with Python CLI, instructions, and agent integrations #1561)
• add Security Planner state schema with contract suite and fixtures (feat(planning): add Security Planner state schema with contract suite and fixtures #1638)
• add acceptance criteria template and issue type hierarchy strategy to backlog manager (feat(agents): add acceptance criteria template and issue type hierarchy strategy to backlog manager #1597)
• disclaimer SSOT migration (stacked on feat(agents): align sssc planner with rai parity, add signing and validation #1497) (feat(instructions)!: disclaimer SSOT migration (stacked on #1497) #1639)
• Add graphify skill with thin prompt + applyTo instructions (feat(graphify): Add graphify skill with thin prompt + applyTo instructions #1600)
• upgrade ADR Planner with phased identity and adr-author skill (feat(agents): upgrade ADR Planner with phased identity and adr-author skill #1554)
• add ADR consistency lint infrastructure (feat(scripts)(settings): add ADR consistency lint infrastructure #1552)
• align sssc planner with rai parity, add signing and validation (feat(agents): align sssc planner with rai parity, add signing and validation #1497)
• add weekly GitHub code scanning automation (feat(workflows): add weekly GitHub code scanning automation #1495)
• add npm eval scripts and shared environments (feat(evals): add npm eval scripts and shared environments #1626)
• add Vally evaluation infrastructure (feat: add Vally evaluation infrastructure #1590)
• add Pre-Release-As trailer override to pre-release w… (feat(workflows): add Pre-Release-As trailer override to pre-release w… #1565)
• optimize RPI agent context management with discipline rules (feat(agents): optimize RPI agent context management with discipline rules #1492)
• add cspell-config prompt for automated spell check maintenance (feat(prompts): add cspell-config prompt for automated spell check maintenance #1516)
• add enablement dimension to Experiment Designer for code-with MVEs (feat(agents): add enablement dimension to Experiment Designer for code-with MVEs #1416)
• per-agent model selection for cost optimization and /compact loop fix (feat(agents)!: per-agent model selection for cost optimization and /compact loop fix #1541)
• add 6 PowerPoint skill enhancements (feat(skills): add 6 PowerPoint skill enhancements #1481)
• convert pr-review to manual /review slash command (feat(workflows): convert pr-review to manual /review slash command #1544)
• add tts-voiceover skill for Azure Speech SDK voice-over generation (feat(skills): add tts-voiceover skill for Azure Speech SDK voice-over generation #1415)
• add structured JSON log output to Validate-Collections.ps1
• add github-security code-scanning skill (feat(skills): add github-security code-scanning skill #1418)
• add lint:py:fix to apply ruff autofixes across Python skills (feat(scripts): add lint:py:fix to apply ruff autofixes across Python skills #1450)
• add structured JSON log output to Validate-Marketplace.ps1 (feat(scripts): add structured JSON log output to Validate-Marketplace.ps1 #1430)
• expand fuzz_has_formatting_variation to cover all formatting properties (feat(skills): expand fuzz_has_formatting_variation to cover all formatting properties #1143) (feat(skills): expand fuzz_has_formatting_variation to cover all formatting properties (#1143) #1296)
• add Task Challenger adversarial questioning agent (feat(agents): add Task Challenger adversarial questioning agent #1315)
• add removed maturity tier and retire owasp-docker (feat(skills): add removed maturity tier and retire owasp-docker #1444)
• add evaluation dataset creator (feat(agents): add evaluation dataset creator #1279)
• align RAI planner with guide, remove scoring, improve UX (feat(agents): align RAI planner with guide, remove scoring, improve UX #1287)
• add PSGallery staleness check and BOM cleanup (feat(security): add PSGallery staleness check and BOM cleanup #1379)
• ISA-95 network planner agent (feat(project-planning): ISA-95 network planner agent #1177)
• auto-generate collection.md with maturity filtering (feat(collections): auto-generate collection.md with maturity filtering #1316)
• add folder-consistency check and standardize WARN outp… (feat(scripts): add folder-consistency check and standardize WARN outp… #1350)
• add synth-data-generate prompt to data-science collection (feat(prompts): add synth-data-generate prompt to data-science collection #1419)
• add canonical deck workflow and customer-card rendering for design thinking (feat(skills): add canonical deck workflow and customer-card rendering for design thinking #1413)
• add Figma MCP integration for DT artifact export (feat(dt): add Figma MCP integration for DT artifact export #1222)
• introduce owasp-docker (feat(skill): introduce owasp-docker #1245)
• replace hve-core-specific references with portable discovery-based language (feat(agents): replace hve-core-specific references with portable discovery-based language #1335)
• introduce owasp-cicd (feat(skill): introduce owasp-cicd #1246)
• add secure-by-design knowledge skill (feat(skills): add secure-by-design knowledge skill #1223)
• introduce owasp-infrastructure (feat(skill): introduce owasp-infrastructure #1244)
• introduce owasp-mcp (feat(skill): introduce owasp-mcp #1207)
• add OutputPath parameter to Invoke-LinkLanguageCheck.ps1 (feat(1004): add OutputPath parameter to Invoke-LinkLanguageCheck.ps1 #1229)
• add -OutputPath parameter to Validate-SkillStructure.ps1 (feat: add -OutputPath parameter to Validate-SkillStructure.ps1 #1225)
• add maintainer-only skip-review label guard (feat(workflows): add maintainer-only skip-review label guard #1293)
• add extension collections overview and integrate into getting started flow (feat(docs): add extension collections overview and integrate into getting started flow #950)
• add agentic workflows for automated issue triage, implementation, PR review, dependency review, and doc-staleness detection (feat(workflows): add agentic workflows for automated issue triage, implementation, PR review, dependency review, and doc-staleness detection #1219)
• consolidate package-lock.json version sync into Update-VersionFiles.ps1 (feat(scripts): consolidate package-lock.json version sync into Update-VersionFiles.ps1 #1240)
• add standards code review agent and full review orchestrator (feat(agents): add standards code review agent and full review orchestrator #1174)
• standardize pytest-mock as Python mocking framework (feat(skills): standardize pytest-mock as Python mocking framework #1170)
• add Jira backlog workflows and Jira/GitLab skills (feat(integrations): add Jira backlog workflows and Jira/GitLab skills #978)
• add centralized version bump script and supply-chain attestation (feat(build): add centralized version bump script and supply-chain attestation #1183)

🐛 Bug Fixes

• correct homepage spacing and equalize card grid heights (fix(docsite): correct homepage spacing and equalize card grid heights #2455)
• adds event name inference to fix missing captures (fix(hooks): adds event name inference to fix missing captures #2478)
• grant reusable-workflow caller jobs required permissions (fix(workflows): grant reusable-workflow caller jobs required permissions #2424)
• grant extension-provenance caller required write permissions (fix(ci): grant extension-provenance caller required write permissions #2408)
• execute subagent-tagged agent-behavior stimuli in the eval matrix (fix(scripts): execute subagent-tagged agent-behavior stimuli in the eval matrix #2385)
• align task-reviewer H1 heading and add missing send: true to task-researcher handoff (fix(agents): align task-reviewer H1 heading and add missing send: true to task-researcher handoff #2382)
• harden VEX drafting gate and standardize per-skill SECURITY.md models (fix(security): harden VEX drafting gate and standardize per-skill SECURITY.md models #2360)
• harden vex-draft pre-activation gates (fix(workflows): harden vex-draft pre-activation gates #2357)
• remove unused local variables flagged by CodeQL (fix(hooks): remove unused local variables flagged by CodeQL #2352)
• replace binary PPTX fixture with programmatic generator (fix(skills): replace binary PPTX fixture with programmatic generator #2081)
• PSScriptAnalyzer test mock fails version guard, running Install-PSModules on every case (fix: PSScriptAnalyzer test mock fails version guard, running Install-PSModules on every case #2325)
• harden tts-voiceover XML parser against XXE (security(skills): audit codebase for unhardened XML parsers beyond PowerPoint skill #1056) (fix(skills): harden tts-voiceover XML parser against XXE (#1056) #1695)
• harden VEX automation checkout and detection lookup (fix(workflows): harden VEX automation checkout and detection lookup #2312)
• resolve open code scanning alerts (fix(security): resolve open code scanning alerts #2282)
• skip puppeteer browser download in deploy-docs build (fix(workflows): skip puppeteer browser download in deploy-docs build #2278)
• add missing eval coverage for vex-scan and vex-triage prompts (fix(evals): add missing eval coverage for vex-scan and vex-triage prompts #2294)
• harden Jira/GitLab transports against redirect token leak (fix(skills): harden Jira/GitLab transports against redirect token leak #2245)
• remove redundant moderation requirements.txt (fix(scripts): remove redundant moderation requirements.txt #2273)
• harden homepage hero and search contrast for WCAG AA (fix(docs): harden homepage hero and search contrast for WCAG AA #2250)
• install PS modules with CurrentUser scope for copilot-setup-steps (fix(workflows): install PS modules with CurrentUser scope for copilot-setup-steps #2244)
• remove "Brought to you by" attribution (Remove "Brought to you by microsoft/hve-core" attributions #2047) (fix(skills): remove "Brought to you by" attribution (#2047) #2238)
• clarify markdownlint marker placement in PRD Builder (fix: clarify markdownlint marker placement in PRD Builder #2098)
• send API-compliant arrow widget payload (fix(mural): send API-compliant arrow widget payload #2136)
• harden powerpoint PyMuPDF integration against malformed PDFs (security(powerpoint): PyMuPDF C extension attack surface in PDF processing #1018) (fix(skills): harden powerpoint PyMuPDF integration against malformed PDFs (#1018) #1904)
• grant id-token write to docusaurus-tests callers for Codecov OIDC (fix(workflows): grant id-token write to docusaurus-tests callers for Codecov OIDC #2085)
• improve DT Coach Phase 1 initialization reliability and state schema (fix: improve DT Coach Phase 1 initialization reliability and state schema #2055)
• remediate cryptography advisories and harden PowerPoint scripts (fix(deps): remediate cryptography advisories and harden PowerPoint scripts #2037)
• npm run test:py fails when skills have uv-managed dev dependencies (fix(scripts): npm run test:py fails when skills have uv-managed dev dependencies #1938)
• enforce human review checkbox gate for backlog processing (fix(instructions): enforce human review checkbox gate for backlog processing #1920)
• remove duplicate Included Artifacts heading in collection.md generation (fix(scripts): remove duplicate Included Artifacts heading in collection.md generation #1855)
• improve contrast for badges and search hint (fix(docs): improve contrast for badges and search hint #1922)
• migrate gh-aw compiler to v0.79.4 and refresh lock files (fix(workflows): migrate gh-aw compiler to v0.79.4 and refresh lock files #1903)
• adopt Docusaurus Faster and pin 3.10.1 (fix(docs): adopt Docusaurus Faster and pin 3.10.1 #1893)
• patch Docusaurus npm vulnerabilities and extend Dependabot scope (fix(docs): patch Docusaurus npm vulnerabilities and extend Dependabot scope #1889)
• stabilize gitleaks fixture suppressions (fix(ci): stabilize gitleaks fixture suppressions #1883)
• tighten strict-tier cite-only licensing in ADR standards (fix(skills): tighten strict-tier cite-only licensing in ADR standards #1859)
• align actionlint curl download with uv step pattern (fix(ci): align actionlint curl download with uv step pattern #1870)
• update design thinking image prompt generation guidelines (fixes Design thinking agents reference dalle image generator which isn't actually bundled in #1587) (fix(instructions): update design thinking image prompt generation guidelines (fixes #1587) #1629)
• refresh Dependabot PR Review and upgrade gh-aw to v0.76.1 (fix(workflows): refresh Dependabot PR Review and upgrade gh-aw to v0.76.1 #1690)
• pin tmp >=0.2.6 to resolve GHSA-ph9p-34f9-6g65 (fix(build): pin tmp >=0.2.6 to resolve GHSA-ph9p-34f9-6g65 #1686)
• bump qs from 6.15.0 to 6.15.2 to resolve GHSA-q8mj-m7cp-5q26 (fix(deps): bump qs from 6.15.0 to 6.15.2 to resolve GHSA-q8mj-m7cp-5q26 #1650)
• resolve pip-audit findings in tts-voiceover skill lock file (fix(skills): resolve pip-audit findings in tts-voiceover skill lock file #1627)
• Exclude plugins/ from ms.date freshness check to prevent duplicate stale reports (fix(scripts): Exclude plugins/ from ms.date freshness check to prevent duplicate stale reports #1586)
• remove markdownlint exclusion for collections/*.collection.md (fix(settings): remove markdownlint exclusion for collections/*.collection.md #1372)
• bump basic-ftp override to 6.0.1 to clear high-severity advisory (fix(build): bump basic-ftp override to 6.0.1 to clear high-severity advisory #1545)
• override ip-address to 10.2.0 for GHSA-v2v4-37r5-5v8g (fix(build): override ip-address to 10.2.0 for GHSA-v2v4-37r5-5v8g #1539)
• pin uuid and postcss via overrides to resolve Dependabot alerts (fix(build): pin uuid and postcss via overrides to resolve Dependabot alerts #1491)
• pin PowerShell-Yaml to 0.4.7 across all install sites (fix(ci): pin PowerShell-Yaml to 0.4.7 across all install sites #1378)
• close fork-PR/workflow-file-PR secret-strip gap and normalize upload-artifact version (fix(workflows): close fork-PR/workflow-file-PR secret-strip gap and normalize upload-artifact version #1421)
• replace stream-based lookahead with array indexing in list-changed-files.sh (fix(skills): replace stream-based lookahead with array indexing in list-changed-files.sh #1376)
• centralize ISO 8601 timestamp regex in CIHelpers (fix(scripts): centralize ISO 8601 timestamp regex in CIHelpers #1343)
• update stale documentation date in release-process.md (fix: update stale documentation date in release-process.md #1363)
• pin basic-ftp to 5.3.0 to resolve GHSA-rp42-5vxx-qpwr (fix(build): pin basic-ftp to 5.3.0 to resolve GHSA-rp42-5vxx-qpwr #1374)
• add bot filter to dependency PR review workflow (fix(workflows): add bot filter to dependency PR review workflow #1362)
• resolve pip-audit findings in powerpoint, gitlab, and jira skill lock files (fix(skills): resolve pip-audit findings in powerpoint, gitlab, and jira skill lock files #1360)
• standardize Timestamp JSON key casing across all lint result files (fix(scripts): standardize Timestamp JSON key casing across all lint result files #1314)
• add synchronize trigger to PR Review workflow (fix(ci): add synchronize trigger to PR Review workflow #1323)
• standardize timestamp in Validate-SkillStructure.ps1 to use Get-StandardTimestamp (fix(scripts): standardize timestamp in Validate-SkillStructure.ps1 to use Get-StandardTimestamp #1280)
• add parallel subagent dispatch and structured JSON contracts to code-review-full (fix(agents): add parallel subagent dispatch and structured JSON contracts to code-review-full #1304)
• standardize timestamp in SecurityHelpers.psm1 to use Get-StandardTimestamp (fix(scripts): standardize timestamp in SecurityHelpers.psm1 to use Get-StandardTimestamp #1284)
• standardize timestamps in Test-DependencyPinning.ps1 and SecurityClasses.psm1 (fix(scripts): standardize timestamps in Test-DependencyPinning.ps1 and SecurityClasses.psm1 #1282)
• derive collection artifact counts from YAML at build time (fix(docs): derive collection artifact counts from YAML at build time #1275)
• standardize timestamp in FrontmatterValidation.psm1 to use Get-StandardTimestamp (fix(scripts): standardize timestamp in FrontmatterValidation.psm1 to use Get-StandardTimestamp #1285)
• standardize timestamp in Markdown-Link-Check.ps1 to use Get-StandardTimestamp (fix(scripts): standardize timestamp in Markdown-Link-Check.ps1 to use Get-StandardTimestamp #1283)
• escape hyphens in Mermaid diagram on Collections page (fix(docs): escape hyphens in Mermaid diagram on Collections page #1262)
• add summary timestamp to PSScriptAnalyzer output (fix(linting): add summary timestamp to PSScriptAnalyzer output #1211)
• fix plugin compatibility and robustness for coding-standards code review agents (fix(agents): fix plugin compatibility and robustness for coding-standards code review agents #1289)
• standardize timestamp in Test-CopyrightHeaders.ps1 to use Get-StandardTimestamp (fix(scripts): standardize timestamp in Test-CopyrightHeaders.ps1 to use Get-StandardTimestamp #1278)
• standardize timestamp in Invoke-YamlLint.ps1 to use Get-StandardTimestamp (fix(scripts): standardize timestamp in Invoke-YamlLint.ps1 to use Get-StandardTimestamp #1270)
• standardize timestamp in Invoke-LinkLanguageCheck.ps1 to use Get-StandardTimestamp (fix(scripts): standardize timestamp in Invoke-LinkLanguageCheck.ps1 to use Get-StandardTimestamp #1264)
• fix dependency-review path filters and sparse-checkout cone mode (fix(workflows): fix dependency-review path filters and sparse-checkout cone mode #1259)
• replace invalid bare tool names with official tool identifiers (fix(agents): replace invalid bare tool names with official tool identifiers #1198)
• fix broken links and remove orphaned reference in code review docs (fix(docs): fix broken links and remove orphaned reference in code review docs #1257)
• exclude Python env dirs from skill validation warnings (fix(scripts): exclude Python env dirs from skill validation warnings #1255)
• pin happy-dom and serialize-javascript to resolve Dependabot vulnerabilities (fix(build): pin happy-dom and serialize-javascript to resolve Dependabot vulnerabilities #1253)
• remove Mermaid diagram and add missing collection cards (fix(docs): remove Mermaid diagram and add missing collection cards #1247)
• disable MCP servers by default to prevent token limit errors (fix: disable MCP servers by default to prevent token limit errors #1144)
• sync package-lock.json after pre-release version bump (fix(workflows): sync package-lock.json after pre-release version bump #1236)
• separate mermaid node declarations and add dynamic diagram generation with tests (fix(docs): separate mermaid node declarations and add dynamic diagram generation with tests #1215)
• replace anchor links in meeting-analyst with bold text references (fix(agents): replace anchor links in meeting-analyst with bold text references #1201)
• remove recursive symlinks in jira and gitlab skill directories (fix(skills): remove recursive symlinks in jira and gitlab skill directories #1233)
• validate-installation scripts now check .github/skills directory (fix: installer skill scripts validate-installation should check for .github/skills directory #1010) (fix: validate-installation scripts now check .github/skills directory (#1010) #1206)
• resolve npm audit vulnerabilities via dependency overrides (fix(build): resolve npm audit vulnerabilities via dependency overrides #1200)
• add post-release triggers to scorecard workflow (fix(workflows): add post-release triggers to scorecard workflow #1186)
• add missing .md extensions to relative links in agent documentation (fix(docs): add missing .md extensions to relative links in agent documentation #1180)

📚 Documentation

• clarify HVE Core adoption posture (docs(readme): clarify HVE Core adoption posture #2494)
• document maturity and path validation checks in collections README (docs: document maturity and path validation checks in collections README #2458)
• update scripts/README.md to document scripts/docs/ directory (docs: update scripts/README.md to document scripts/docs/ directory #2464)
• update README for untracked and working-tree files (docs: update README for untracked and working-tree files #2459)
• document accessibility coverage-matrix workflow and refresh planner/reviewer (docs: document accessibility coverage-matrix workflow and refresh planner/reviewer #2428)
• update stale documentation for DT and bump stale docs (docs: update stale documentation for DT and bump stale docs #2434)
• sync release pipeline docs with current provenance workflows (docs: sync release pipeline docs with current provenance workflows #2425)
• add Jira, GitLab, and TTS credential threat tables (docs(security): add Jira, GitLab, and TTS credential threat tables #2384)
• remediate Bundle A toolchain-freshness documentation drift (docs: remediate Bundle A toolchain-freshness documentation drift #2317)
• document #tool: syntax and align tools list with VS Code 1.109+ (docs(agents): document #tool: syntax and align tools list with VS Code 1.109+ #2319)
• align RPI methodology descriptions to four phases across docs (docs: align RPI methodology descriptions to four phases across docs #2296)
• realign stale references with current source of truth (docs: realign stale references with current source of truth #2220)
• refresh 22 stale guide pages and fix broken refs (docs(hve-guide): refresh 22 stale guide pages and fix broken refs #2207)
• update sssc-planning agent-overview for consolidated instructions (docs: update sssc-planning agent-overview for consolidated instructions #2212)
• refresh design-thinking, customization, getting-started, and scripts documentation for accuracy (docs: refresh design-thinking, customization, getting-started, and scripts documentation for accuracy #2208)
• refresh stale docs/agents pages for accuracy (docs(agents): refresh stale docs/agents pages for accuracy #2211)
• correct ADO Backlog Manager workflow documentation (docs(ado-backlog): correct ADO Backlog Manager workflow documentation #2205)
• refresh stale agent catalog, getting-started counts, and security/evals docs (docs: refresh stale agent catalog, getting-started counts, and security/evals docs #2203)
• refresh workflow, tool-checksums, and environment documentation (docs(docs): refresh workflow, tool-checksums, and environment documentation #2201)
• adopt "this" singleton naming for terraform resources and data sources (docs(instructions): adopt "this" singleton naming for terraform resources and data sources #2164)
• add content policies, refresh environment versions, drop description attribution (docs: add content policies, refresh environment versions, drop description attribution #2192)
• update docs to reflect updated changes (docs: update docs to reflect updated changes #2167)
• fix linting scripts README and instruction file gaps (docs: Linting scripts README and instructions have significant coverage gaps #1107) (docs: fix linting scripts README and instruction file gaps (#1107) #1948)
• align Transparency Note with AI Messaging Guidance (docs: align Transparency Note with AI Messaging Guidance #2039)
• fix stale linting README descriptions for Invoke-PythonTests.ps1 and Invoke-PythonLint.ps1 (docs(scripts): fix stale linting README descriptions for Invoke-PythonTests.ps1 and Invoke-PythonLint.ps1 #2017)
• expand providerAllowlist and document model field in customization guide (docs: expand providerAllowlist and document model field in customization guide #2014)
• align language-skills.md with semantic skill selection (docs(agents): align language-skills.md with semantic skill selection #1891)
• Fix stale eval:lint references in documentation (docs: Fix stale eval:lint references in documentation #1951)
• add accessibility planner and reviewer documentation (docs(agents): add accessibility planner and reviewer documentation #1736)
• remove generated footers (docs: remove generated footers #1919)
• Improve readme.md and contributing.md (docs: Improve readme.md and contributing.md #1635)
• add reactivation workflow subsection to ai-artifacts.md (docs: add reactivation workflow subsection to ai-artifacts.md #1882)
• clarify getting-started method guides (docs(docs): clarify getting-started method guides #1851)
• add Responsible AI Transparency Note (docs: add Responsible AI Transparency Note #1900)
• adopt Vally as agent and skill behavior evaluation framework (docs(adrs): adopt Vally as agent and skill behavior evaluation framework #1828)
• refresh stale documentation and update ms.date across 12 files (docs: refresh stale documentation and update ms.date across 12 files #1625)
• update ms.date frontmatter for 13 stale documentation files (docs: update ms.date frontmatter for 13 stale documentation files #1588)
• improve new user onboarding with terminology, CLI plugins, and collections clarity (docs: improve new user onboarding with terminology, CLI plugins, and collections clarity #1520)
• broaden Security Review description beyond OWASP (docs(architecture): broaden Security Review description beyond OWASP #1385)
• document maintainer advisory mode and skip-review label guard (docs(architecture): document maintainer advisory mode and skip-review label guard #1386)
• document ExcludePaths/OutputPath for Invoke-LinkLanguageCheck (docs: document ExcludePaths/OutputPath for Invoke-LinkLanguageCheck #1383)
• CLI getting-started: clarify plugin install commands as alternatives (-all vs base) (docs(docs): CLI getting-started: clarify plugin install commands as alternatives (-all vs base) #1251)

♻️ Refactoring

• consolidate brds and prds into docs/planning (refactor(docs): consolidate brds and prds into docs/planning #2291)
• replace arch-diagram-builder agent with reusable architecture-diagrams skill (refactor(skills): replace arch-diagram-builder agent with reusable architecture-diagrams skill #2068)
• consolidate RAI instructions into rai-standards and rai-planner-playbook skills (refactor(skills): consolidate RAI instructions into rai-standards and rai-planner-playbook skills #2062)
• consolidate accessibility planner phases into playbook skill (refactor(skills): consolidate accessibility planner phases into playbook skill #2021)
• migrate design-thinking tier-2 instructions to skills (refactor(skills): migrate design-thinking tier-2 instructions to skills #1857)
• align security and rai planner wording (refactor(agents): align security and rai planner wording #1854)
• align agent and prompt folder names to collection identifier (refactor(coding-standards): align agent and prompt folder names to collection identifier #1210)

🔧 Maintenance

• bump the npm-dependencies group across 3 directories with 15 updates (chore(deps): bump the npm-dependencies group across 3 directories with 15 updates #2491)
• upgrade valley to 0.9 (chore(evals): upgrade valley to 0.9 #2495)
• bump setuptools from 81.0.0 to 83.0.0 in /scripts/evals/moderation in the security-updates group across 1 directory (chore(deps): bump setuptools from 81.0.0 to 83.0.0 in /scripts/evals/moderation in the security-updates group across 1 directory #2490)
• bump axios from 1.17.0 to 1.18.1 in /docs/docusaurus (chore(deps-dev): bump axios from 1.17.0 to 1.18.1 in /docs/docusaurus #2485)
• bump the github-actions group across 1 directory with 8 updates (chore(deps): bump the github-actions group across 1 directory with 8 updates #2483)
• bump the version-updates group across 1 directory with 2 updates (chore(deps): bump the version-updates group across 1 directory with 2 updates #2481)
• bump the version-updates group across 1 directory with 5 updates (chore(deps): bump the version-updates group across 1 directory with 5 updates #2463)
• bump websocket-driver from 0.7.4 to 0.7.5 in /docs/docusaurus (chore(deps): bump websocket-driver from 0.7.4 to 0.7.5 in /docs/docusaurus #2473)
• add pre-activation gating to VEX drafting and recompile on gh-aw v0.81.6 (chore(workflows): add pre-activation gating to VEX drafting and recompile on gh-aw v0.81.6 #2340)
• bump torch from 2.12.0 to 2.12.1 in /scripts/evals/moderation in the security-updates group across 1 directory (chore(deps): bump torch from 2.12.0 to 2.12.1 in /scripts/evals/moderation in the security-updates group across 1 directory #2274)
• bump actions/checkout from 6.0.3 to 7.0.0 in the github-actions group across 1 directory (chore(deps): bump actions/checkout from 6.0.3 to 7.0.0 in the github-actions group across 1 directory #2255)
• dependabot uv moderation coverage + dependency remediation (chore(build): dependabot uv moderation coverage + dependency remediation #2237)
• bump the github-actions group with 2 updates (chore(deps): bump the github-actions group with 2 updates #2206)
• bump the npm-dependencies group across 1 directory with 5 updates (chore(deps-dev): bump the npm-dependencies group across 1 directory with 5 updates #2194)
• bump the github-actions group with 6 updates (chore(deps): bump the github-actions group with 6 updates #2197)
• bump the npm-dependencies group across 1 directory with 5 updates (chore(deps-dev): bump the npm-dependencies group across 1 directory with 5 updates #2103)
• standardize copyright headers to canonical 2026 format (chore(scripts): standardize copyright headers to canonical 2026 format #2169)
• bump actions/checkout from 6.0.2 to 7.0.0 in the github-actions group (chore(deps): bump actions/checkout from 6.0.2 to 7.0.0 in the github-actions group #2104)
• bump webpack-dev-server from 5.2.4 to 5.2.5 in /docs/docusaurus (chore(deps): bump webpack-dev-server from 5.2.4 to 5.2.5 in /docs/docusaurus #2043)
• bump torch from 2.9.1 to 2.12.0 in /scripts/evals/moderation (chore(deps): bump torch from 2.9.1 to 2.12.0 in /scripts/evals/moderation #2011)
• bump ws from 7.5.10 to 7.5.11 in /docs/docusaurus (chore(deps-dev): bump ws from 7.5.10 to 7.5.11 in /docs/docusaurus #2002)
• bump launch-editor from 2.13.1 to 2.14.1 in /docs/docusaurus (chore(deps): bump launch-editor from 2.13.1 to 2.14.1 in /docs/docusaurus #2004)
• bump the npm-dependencies group across 2 directories with 2 updates (chore(deps-dev): bump the npm-dependencies group across 2 directories with 2 updates #1952)
• refine extension prep and editor settings (chore(scripts): refine extension prep and editor settings #1852)
• add evals config and dependency foundation (chore(build): add evals config and dependency foundation #1829)
• bump the npm-dependencies group across 1 directory with 11 updates (chore(deps): bump the npm-dependencies group across 1 directory with 11 updates #1894)
• bump the github-actions group across 1 directory with 5 updates (chore(deps): bump the github-actions group across 1 directory with 5 updates #1872)
• strip attribution suffix from descriptions (chore(skills): strip attribution suffix from descriptions #1724)
• strip attribution suffix from descriptions (chore(agents): strip attribution suffix from descriptions #1723)
• strip attribution suffix from descriptions (chore(prompts): strip attribution suffix from descriptions #1722)
• strip attribution suffix from descriptions (chore(instructions): strip attribution suffix from descriptions #1721)
• bump @vscode/vsce from 3.9.1 to 3.9.2 in the npm-dependencies group (chore(deps-dev): bump @vscode/vsce from 3.9.1 to 3.9.2 in the npm-dependencies group #1871)
• bump the npm-dependencies group across 1 directory with 3 updates (chore(deps-dev): bump the npm-dependencies group across 1 directory with 3 updates #1810)
• bump qs and express in /docs/docusaurus (chore(deps): bump qs and express in /docs/docusaurus #1632)
• bump tmp from 0.2.5 to 0.2.7 (chore(deps-dev): bump tmp from 0.2.5 to 0.2.7 #1687)
• bump the github-actions group with 2 updates (chore(deps): bump the github-actions group with 2 updates #1657)
• bump brace-expansion from 5.0.5 to 5.0.6 in /docs/docusaurus (chore(deps): bump brace-expansion from 5.0.5 to 5.0.6 in /docs/docusaurus #1614)
• bump webpack-dev-server from 5.2.3 to 5.2.4 in /docs/docusaurus (chore(deps): bump webpack-dev-server from 5.2.3 to 5.2.4 in /docs/docusaurus #1613)
• bump the github-actions group with 3 updates (chore(deps): bump the github-actions group with 3 updates #1601)
• bump urllib3 from 2.6.3 to 2.7.0 in /.github/skills/experimental/tts-voiceover (chore(deps): bump urllib3 from 2.6.3 to 2.7.0 in /.github/skills/experimental/tts-voiceover #1583)
• bump fast-uri from 3.1.0 to 3.1.2 in /docs/docusaurus (chore(deps): bump fast-uri from 3.1.0 to 3.1.2 in /docs/docusaurus #1548)
• bump fast-uri from 3.1.0 to 3.1.2 (chore(deps-dev): bump fast-uri from 3.1.0 to 3.1.2 #1549)
• bump markdownlint-cli2 from 0.22.0 to 0.22.1 in the npm-dependencies group (chore(deps-dev): bump markdownlint-cli2 from 0.22.0 to 0.22.1 in the npm-dependencies group #1452)
• bump the github-actions group with 3 updates (chore(deps): bump the github-actions group with 3 updates #1453)
• pre-release 3.3.101 (chore(main): pre-release 3.3.101 #1274)
• pin PSScriptAnalyzer to 1.25.0 and sync stale workflow version comments (chore(security): pin PSScriptAnalyzer to 1.25.0 and sync stale workflow version comments #1389)
• bump lxml from 6.0.2 to 6.1.0 in /.github/skills/experimental/powerpoint (chore(deps): bump lxml from 6.0.2 to 6.1.0 in /.github/skills/experimental/powerpoint #1424)
• bump @vscode/vsce from 3.7.1 to 3.9.1 in the npm-dependencies group (chore(deps-dev): bump @vscode/vsce from 3.7.1 to 3.9.1 in the npm-dependencies group #1390)
• bump the github-actions group across 1 directory with 7 updates (chore(deps): bump the github-actions group across 1 directory with 7 updates #1391)
• bump follow-redirects from 1.15.11 to 1.16.0 in /docs/docusaurus (chore(deps): bump follow-redirects from 1.15.11 to 1.16.0 in /docs/docusaurus #1356)
• upgrade Node.js from 20 to 24 and bump cspell to v10 (chore(build): upgrade Node.js from 20 to 24 and bump cspell to v10 #1353)
• bump basic-ftp from 5.2.0 to 5.2.1 (chore(deps-dev): bump basic-ftp from 5.2.0 to 5.2.1 #1324)
• update github/gh-aw-actions requirement to 536ea1bad8c6715d098a9dc1afea8d403733acfe in the github-actions group across 1 directory (chore(deps): update github/gh-aw-actions requirement to 536ea1bad8c6715d098a9dc1afea8d403733acfe in the github-actions group across 1 directory #1298)
• update security instruction attributions and compliance (chore(licensing): update security instruction attributions and compliance #1294)
• bump the npm-dependencies group with 2 updates (chore(deps-dev): bump the npm-dependencies group with 2 updates #1297)
• pre-release 3.3.41 (chore(main): pre-release 3.3.41 #1252)
• streamline RAI Planner phase structure and documentation (chore(rai-planning): streamline RAI Planner phase structure and documentation #1273)
• bump happy-dom from 20.8.8 to 20.8.9 in /docs/docusaurus (chore(deps-dev): bump happy-dom from 20.8.8 to 20.8.9 in /docs/docusaurus #1237)
• pre-release 3.3.27 (chore(main): pre-release 3.3.27 #1191)
• bump pygments from 2.19.2 to 2.20.0 in /.github/skills/gitlab/gitlab (chore(deps): bump pygments from 2.19.2 to 2.20.0 in /.github/skills/gitlab/gitlab #1234)
• bump path-to-regexp from 0.1.12 to 0.1.13 in /docs/docusaurus (chore(deps): bump path-to-regexp from 0.1.12 to 0.1.13 in /docs/docusaurus #1226)
• bump the github-actions group with 4 updates (chore(deps): bump the github-actions group with 4 updates #1231)
• add missing folders and alphabetize location lists (chore(settings): add missing folders and alphabetize location lists #1193)
• bump brace-expansion (chore(deps): bump brace-expansion #1224)
• bump handlebars from 4.7.8 to 4.7.9 in /docs/docusaurus (chore(deps-dev): bump handlebars from 4.7.8 to 4.7.9 in /docs/docusaurus #1217)
• bump brace-expansion from 5.0.3 to 5.0.5 in /docs/docusaurus (chore(deps): bump brace-expansion from 5.0.3 to 5.0.5 in /docs/docusaurus #1213)
• pre-release 3.3.10 (chore(main): pre-release 3.3.10 #1187)
• bump markdownlint-cli2 from 0.21.0 to 0.22.0 in the npm-dependencies group (chore(deps-dev): bump markdownlint-cli2 from 0.21.0 to 0.22.0 in the npm-dependencies group #1175)
• bump the github-actions group with 3 updates (chore(deps): bump the github-actions group with 3 updates #1176)
• pre-release 3.3.1 (chore(main): pre-release 3.3.1 #1165)

---

Managed automatically by pre-release workflow.

[github-actions]

Dependency Review

✅ No vulnerabilities or license issues or OpenSSF Scorecard issues found.

OpenSSF Scorecard

Scorecard details

Package	Version	Score	Details
pip/atheris	3.0.0	🟢 6.1	Details Check Score Reason Code-Review 🟢 7 Found 23/30 approved changesets -- score normalized to 7 Dangerous-Workflow 🟢 10 no dangerous workflow patterns detected Maintained ⚠️ 2 3 commit(s) and 0 issue activity found in the last 90 days -- score normalized to 2 Token-Permissions 🟢 10 GitHub workflow tokens follow principle of least privilege Packaging ⚠️ -1 packaging workflow not detected Binary-Artifacts 🟢 10 no binaries found in the repo SAST ⚠️ 0 no SAST tool detected CII-Best-Practices ⚠️ 0 no effort to earn an OpenSSF best practices badge detected Fuzzing 🟢 10 project is fuzzed Signed-Releases ⚠️ -1 no releases found License 🟢 10 license file detected Security-Policy 🟢 10 security policy file detected Branch-Protection ⚠️ 0 branch protection not enabled on development/release branches Pinned-Dependencies ⚠️ 0 dependency not pinned by hash detected -- score normalized to 0
pip/colorama	0.4.6	Unknown	Unknown
pip/coverage	7.14.1	Unknown	Unknown
pip/iniconfig	2.3.0	Unknown	Unknown
pip/packaging	26.2	Unknown	Unknown
pip/pluggy	1.6.0	Unknown	Unknown
pip/pygments	2.20.0	Unknown	Unknown
pip/pytest	9.0.3	Unknown	Unknown
pip/pytest-cov	7.1.0	Unknown	Unknown
pip/ruff	0.15.16	Unknown	Unknown
pip/tomli	2.4.1	Unknown	Unknown
npm/hve-core	4.1.330	Unknown	Unknown

Scanned Files

• package.json
• plugins/hve-core-all/hooks/shared/telemetry/uv.lock
• plugins/hve-core/hooks/shared/telemetry/uv.lock

[codecov-commenter]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 82.70%. Comparing base (53ddf1a) to head (461aaa3).

Additional details and impacted files

@@            Coverage Diff             @@
##             main    #1476      +/-   ##
==========================================
- Coverage   82.76%   82.70%   -0.06%     
==========================================
  Files         154      142      -12     
  Lines       20853    20763      -90     
  Branches       13        0      -13     
==========================================
- Hits        17259    17173      -86     
+ Misses       3592     3590       -2     
+ Partials        2        0       -2     

Flag	Coverage Δ
docusaurus	?
pester	86.26% <ø> (-0.02%)	⬇️

Flags with carried forward coverage won't be shown. Click here to find out more.
see 13 files with indirect coverage changes

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[bindsi]

Automated review (bindsi batch). Routine release-please pre-release version bump (3.3.101 → 4.1.150). Version strings updated consistently across marketplace.json, plugin.json files, package.json, package-lock.json, extension template, and release-please manifest. No breakage observed. LGTM.

[bindsi]

Automated batch review: no actionable findings.

[bindsi]

Automated batch re-review: no actionable findings. Routine release-please pre-release bump; version updates are consistent across package, lockfile, manifest, extension template, and plugin metadata.

[bindsi]

Approved: this release-please update is a mechanical version and metadata bump with the expected generated files updated consistently. I did not find actionable issues in the release changes.

[bindsi]

Approved: this is a mechanical release-please prerelease update with version and metadata changes applied consistently. I did not find actionable issues.

[bindsi]

Approved: this release-please prerelease update applies version and generated metadata changes consistently. No actionable issues found.

[bindsi]

Approved: this release-please prerelease update applies version and generated metadata changes consistently. I did not find actionable issues.

[bindsi]

Approved: this release-please prerelease update applies version and generated metadata changes consistently. I did not find actionable issues.

[github-actions]

Eval Execution

⚠️ No eval summary was produced.