tp-kit blog

toothpaste-kit 0.5.0

Tue, 27 Oct 2026 00:00:00 GMT

Version 0.5.0 is a MINOR release under docs/releasing.md. The licence moves to Apache 2.0, with REUSE compliance and a Developer Certificate of Origin sign-off. The ACMM L2, L3 and L4 files arrive, scripts/gates.sh goes from ten gates to fourteen, and branch and tag names get one rule. No skill is added, and no skill revision is BREAKING.

A new licence

From this release the kit is under the Apache License 2.0, and LICENSE is the unmodified official text. Releases 0.1.0 to 0.4.0 were published under MIT and stay under it: their tags and assets are not rewritten, and what MIT granted for them is not revoked.

Every file now declares its copyright and licence, by an SPDX header or, for files that cannot hold one, in REUSE.toml. scripts/compliance.sh runs reuse lint with a planted-file selftest, and a CI workflow runs it with a pinned reuse. scripts/gates.sh still needs nothing installed.

Signing off contributions

Contributions now need a Developer Certificate of Origin sign-off. CONTRIBUTING.md gains a licence and sign-off section, covering git commit -s, how to add a missing sign-off, and the pause when someone else may own the work. .github/workflows/dco.yml fails a pull request that contains a commit with no sign-off for its author. No contributor licence agreement is asked.

The ACMM files

ACMM L2: CLAUDE.md, .github/copilot-instructions.md and .cursor/rules/agents.mdc point at AGENTS.md; docs/prompts/README.md catalogs the skills; and docs/corrections.md with an empty corrections.jsonl gives the Correction Protocol's records a format.
ACMM L3: the pull request acceptance metric in docs/metrics.md, the review rubric in docs/review-rubric.md, a test matrix on Linux and macOS, and the quality dashboard in docs/quality.md.
ACMM L4 part a: SECURITY-AI.md, the AI security policy; change classification in docs/risk-tiers.md; pull requests labelled by path; the gates selftest every night; and docs/reflections/, filed cross-session lessons.

docs/acmm.md indexes the levels, naming the file that meets each criterion and the pull request that added it.

Branch and tag names, and more gates

scripts/check-branch-name is the one definition of an allowed name: <prefix>/<words> from a fixed prefix list, 40 characters at most, and v<major>.<minor>.<patch> for tags. .githooks/pre-push runs it before a push, and gate 13 selftests it. Among the other new gates, gate 12, scripts/check-hooks.py, checks that each rule in hooks/ parses and that each blocking rule fires on its planted cases. Gate 14 runs .githooks/commit-msg, which now also refuses Assisted-by: and Agent-<name>: trailers, against its test cases.

Also new

orchestration/rounds.md, the rounds protocol, by which work is checked by a seat other than its author before it reaches the maintainer.
docs/glossary.md, each term of art with the file that defines it, and docs/concepts.md, a concepts index.
scripts/reorient names what it skips, and it now parses under bash 3.2.

Sources

Every claim above comes from the "0.5.0 (2026-10-27)" section of CHANGELOG.md.

toothpaste-kit 0.4.0

Tue, 13 Oct 2026 00:00:00 GMT

Version 0.4.0 is a MINOR release under docs/releasing.md. It adds three skills and three scripts, each script with a gate, and it carries the fix for issue #11, which includes one BREAKING skill change.

Three new skills

skills/merge-proxy/ lets an agent run and push a merge into a trunk, for the session it is invoked in, on a repository whose remote is internal or absent. It first explains the whole plan and halts for approval of each merge, and it never runs on a GitHub or other internet remote. The decision stays the person's; only the typing moves.
skills/weekly-review/ is a once-a-week pass over a task board's slower lanes: each Waiting blocker chased, carried work named by its count, the Done lane read back against each task's own verification, and one important task given a day, never a due date.
skills/monthly-review/ is a once-a-month pass: each Someday/Maybe item adopted, kept or rejected, long-stalled Waiting work questioned, and the archive candidates chosen by the person. It is the only review that archives a task the board has been holding.

The two reviews propose and ask; they move nothing the person did not answer.

Three new scripts, each with a gate

scripts/remote-level.sh is the remote classifier that merge-proxy runs first. It reports none, internal or external from where a repository's remotes point, and external whenever a host cannot be proven internal.
scripts/reorient is the observing half of skills/orient/, which shipped without it. Mail is off unless REORIENT_INBOX_REPO is set.
scripts/check-workspace-stubs.py checks that the stubs in examples/workspace/ match the files docs/standing-documents.md describes.

Installing, and a shorter quickstart

docs/installing.md is a new installing guide: where each part of the kit goes among Claude Code's features, symlink or copy, enabling the hooks, updating, removing, and how a workspace grows. docs/quickstart.md is now one path in six steps, each ending with what you should now see. It copies the new example workspace, examples/workspace/. Both were reported in issue #11.

How skills are versioned

docs/releasing.md gains three sections. Skill revisions: a skill's vN lives only in its own CHANGELOG.md, and each release names the skills whose revision moved. A skill's interface: six surfaces, and what counts as breaking, labeled BREAKING before 1.0. Deprecation: announced in one release and removable no earlier than the second after it.

One BREAKING change

skills/session-close/ v5 writes provenance to the layer the tree's CLAUDE.md names, instead of a path from the tree it was written in. Where CLAUDE.md names none, the skill now stops and asks instead of writing to agents/claude/context/. To migrate, name your provenance layer in your CLAUDE.md. The change skips the deprecation window as a safety fix: the old default could put session reasoning in a repository that later gains a public remote.

Also fixed

The em dash and private task ID gates in scripts/gates.sh searched .git, and passed when grep could not run at all. Both now fail on a grep error.

Sources

Every claim above comes from the "0.4.0 (2026-10-13)" section of CHANGELOG.md.

toothpaste-kit 0.3.0

Tue, 29 Sep 2026 00:00:00 GMT

Version 0.3.0 is a MINOR release under docs/releasing.md. It adds one skill and a release cadence, and it changes documentation and skill files only: no script changed.

A daily review

The new skill, skills/daily-review/, is a once-a-day pass over a task board's lanes:

the Inbox is clarified to empty;
carried work is counted;
finished work is offered for close;
priority is read as an Eisenhower quadrant;
and the day's order is proposed.

It proposes and asks, and it moves nothing the person did not answer. It assumes a lane-board tool, and it says what that tool must print. README.md and docs/project-state.md now list fifteen skills, with daily-review among those a person invokes.

A release cadence

docs/releasing.md has a new Cadence section. A release review happens every two weeks on a Tuesday, with a Friday cutoff and a Monday final review, and there is a release only when the review admits one.

Citing the kit

CITATION.cff now lists only the concept DOI, which is the one to cite. Each version DOI is recorded under "Where releases stand" in docs/releasing.md by the release after it, so a release no longer needs a follow-up pull request to record its DOI. Steps 3 and 7 of docs/releasing.md say so.

Also changed

In docs/quickstart.md, the example CLAUDE.md names the provenance layer and the file that lists the standing files, which the loop skills look for before writing.

Sources

Every claim above comes from the "0.3.0 (2026-09-29)" section of CHANGELOG.md.