Changelog

March 31, 2026 · View on GitHub

All notable changes to this project will be documented in this file.

The format is based on Keep a Changelog, and this project adheres to Semantic Versioning.

1.4.0 - 2026-03-31

Pinned all dependency versions to exact (removed caret ranges) to prevent supply chain drift
Fixed 3 dev dependency vulnerabilities (brace-expansion, minimatch, picomatch) via audit fix
Pinned GitHub Actions to commit SHAs to prevent tag-hijack attacks
Added npm audit job to CI pipeline (production deps enforced, all deps informational)
Added top-level permissions: contents: read to all workflows (least privilege)

Expanded test suite from 10 to 48 tests covering CLI, templates, security, and package integrity
.npmrc with security defaults (save-exact, audit-on-install)
.github/dependabot.yml for automated dependency and GitHub Actions update PRs
Security Audit job in CI workflow

Minimum Node.js version raised to 22 (dropped EOL Node 16, 18, 20)
CI now tests on Node 22 and 24
Updated SECURITY.md to accurately reflect project dependencies and security controls

Updated test assertions to use generic PII-detection patterns
Hardened .gitignore with additional security patterns (.env, *.key, *.pem, .claude/, editor swap files)

_RAM.md - New single-session volatile memory template. Like actual RAM - holds the working state of the current session so that if the session is killed, context overflows, or work is interrupted, the next session can recover exactly where it left off. Written to continuously, deleted at session end.
Golden Rule #5: Suggest pushing after major fixes - After resolving significant bugs or completing iterated-on improvements, Claude now suggests committing and pushing to the user's backup system (git, Gitea, GitHub, etc.) to protect completed work.
Golden Rule #6: Maintain _RAM.md continuously - Claude must write session state to _RAM.md throughout every working session for crash recovery.
Zero Sycophancy Rule in _VOICE-AND-TONE.md - Establishes anti-sycophancy as a core framework principle. No flattery, no hype language, no performative enthusiasm. Every token spent on substance, not validation.
Framework now ships 11 templates (up from 10) in --full mode

_SHORT-TERM-MEMORY.md redefined - Previously single-session context for resuming interrupted work. Now serves as multi-session temporary memory (4-10 sessions) for active issues, in-progress improvements, and near-term notes. _RAM.md now handles single-session crash recovery.
Session load order updated - _RAM.md is now step 0 (crash recovery, read first if exists), _SHORT-TERM-MEMORY.md is step 1 (multi-session context)
Memory hierarchy expanded - Three tiers: RAM (single session, volatile), Short-Term (4-10 sessions, temporary), Long-Term (permanent, never delete)
Words & Phrases to AVOID expanded in _VOICE-AND-TONE.md - Comprehensive ban list organized into categories: sycophantic openers, hype language, filler/hedging, corporate buzzwords
Golden Rules step references updated to match new load order
CLI updated to include _RAM.md in full template set
All version footers updated to v1.3

_VOICE-AND-TONE.md - New template for controlling Claude's personality, attitude, language style, vocabulary, response structure, commit message style, and error communication. Loaded as step 1 in the session load order so Claude's personality is established before anything else.
_DESIGN-PREFERENCES.md - New template for visual design rules: lighter hover colors on interactive elements only (never dark), WCAG AA accessibility, keyboard/screen reader support, typography hierarchy, flat iconography, spacing scale, and UX principles.
Framework now ships 10 templates (up from 8) in --full mode
Updated session load order: Voice & Tone is step 1, Golden Rules is step 2
Hover state rules explicitly scoped to interactive elements only - no hover effects on static content

Session load order reordered: _VOICE-AND-TONE.md now loads first (step 1), _GOLDEN-RULES.md loads second (step 2) as the BINDING enforcement layer
Anchor Files Reference table updated with new priority column values: FIRST for voice/tone, BINDING for golden rules
CLI help text updated to reflect 10 templates

CLI: npx claude-anchor installs templates into your project
- Essential mode (default): 3 core templates
- Full mode (--full): all 8 behavioral templates
- Force mode (--force): overwrite existing files
- Colored output with progress indicators
Instructions for Claude: Every template now includes an "Instructions for Claude" section explaining how Claude should use, reference, and update each file automatically
Starter security rules in _GOLDEN-RULES.md: No credentials in code, no PII exposure, confirm destructive operations, validate inputs
Security examples in _LESSONS-LEARNED.md: Credential leak example with prevention steps
Cross-linking: Templates reference each other with relative markdown links
Anchor Files Reference table in CLAUDE.md listing all templates with purpose, lifecycle, and priority
Memory files in load order: _SHORT-TERM-MEMORY.md and _LONG-TERM-MEMORY.md now included in session startup sequence
PII privacy warnings in _LONG-TERM-MEMORY.md and _SHORT-TERM-MEMORY.md
Staleness detection guidance for _SHORT-TERM-MEMORY.md (7-day age check)
Version footers () in all templates
10 automated tests including PII detection scan

Load order filenames now use correct underscore prefix (_GOLDEN-RULES.md not GOLDEN-RULES.md)