[3.8.9] - 2026-08-22 — Trust Boundaries, Scan Evidence, and Strictness Controls

Added

• Project reports now expose a finding summary, severity distribution, and
  scan coverage envelope in JSON, text, Markdown, and Rich output.
• --include-tests explicitly includes only the built-in test-file exclusions;
  user-configured ignores and artifact exclusions remain intact.
• Known source files outside Python, JS/TS, and Go are reported as
  unsupported coverage rather than silently disappearing from scope.
• A labeled strictness corpus covers true alpha-renamed copies, symmetric
  comparators, declarative factories, Protocol markers, and valid context
  manager semantics.

Changed

• Rust discovery now emits root-relative paths and is parity-checked against
  Python discovery before use on Windows and other platforms.
• Excluded-file evidence preserves exact totals and reason counts while capping
  detailed paths at 200 entries, preventing dependency trees from inflating
  machine-readable reports.
• Self-calibration documentation now states the actual boundary: history and
  automatic milestone application are repository-local operational adaptation,
  not independent external validation.

Fixed

• Incompatible ML artifacts now report an explicit ml_scoring=unavailable
  capability state with schema evidence instead of failing silently.
• Dependency hygiene distinguishes undeclared imports, requirements-only
  declarations, optional imports, and unavailable runtime dependencies.
• Clone and placeholder checks no longer flag the covered intentional patterns;
  true copied logic remains detectable.
• A clean weighted deficit status no longer hides independent pattern
  findings from project-level human-readable output.

Validation

• 472 passed in the AI-SLOP-Detector Python suite.
• CuraFrame dogfooding: 186 passed in 17.02s in an isolated environment.
• P4 output-contract scripts for test exclusion, coverage, and finding
  visibility all pass. These checks do not establish an aggregate accuracy
  rate or independent external validation.

[3.8.8] - 2026-07-10 — VS Code Workflow Tightening and Packaging Metadata Cleanup

• Packaging metadata cleanup:
  • pyproject.toml now uses SPDX string form (license = "MIT")
  • deprecated license classifier removed to match current setuptools guidance
• VS Code extension workflow reliability:
  • Refresh Issues now performs a real workspace re-scan instead of only repainting the tree
  • workspace scans replace stale cached file results, so renamed or removed files no longer linger in the sidebar
  • workspace issue selection now opens the exact file path rather than matching by basename only
  • Quick Fix actions now write ignore and phantom_import_allowlist entries into .slopconfig.yaml with duplicate-entry protection
  • command/view activation was expanded so the extension wakes reliably from the Command Palette and sidebar before a supported editor is open

v3.8.7 — False-Positive Reduction Pack and Self-Dogfood Tightening

False-positive reduction release driven by cross-domain dogfooding and then verified against AI-SLOP-Detector itself.

Highlights:

• ignore .claude/** worktree snapshots by default
• fix JS/TS fallback callback-hell overreporting on JSX and object-literal braces
• fix phantom-import resolution for monorepo package roots and aliases like grpcio -> grpc / pyyaml -> yaml
• tighten clone detection with clique + size-ratio grouping and exempt simple @property accessor clusters
• skip quoted vocabulary-table literals in inflation and trivial one-line helper docstrings in docstring inflation
• require nested_complexity to exceed thresholds rather than merely meet them
• self-dogfood weighted deficit improved from 9.3892 to 6.4186, with hotspot count reduced from 8 to 3

Validation:

• python -m pytest tests/test_docstring_inflation.py tests/test_patterns/test_patterns.py tests/test_fp_reduction.py tests/test_js_analyzer.py tests/test_ddc.py tests/test_inflation.py tests/test_core.py -q
• python -m build

[3.8.6] - 2026-06-15 — Strictness Stabilization, Coherence Cleanup, and Operations Split

Added

• Strict same-file duplicate detection now surfaces in cleanup output as
  same_file_exact_duplicate, so sweep dupes and cleanup JSON can catch the
  exact-duplicate blind spot fixed in issue #45.
• The clone metric now detects files with exactly four near-identical helper
  functions instead of silently skipping them due to the previous
  MIN_FUNCTIONS_FOR_CLONE=5 threshold mismatch.

Changed

• Dead-code cleanup semantics now require real dead-code evidence
  (placeholder-only file or explicit dead-code pattern) instead of using
  generic high-deficit files as dead-code candidates.
• Clone wording is now consistent across code, renderers, cleanup output, and
  docs:
  • exact_duplicate_pair = exact same-file duplicates after local-name
    normalization
  • function_clone_cluster = near-identical function clusters
• operations.py was split further into focused helper modules:
  • operations_payloads.py
  • operations_cleanup.py
  • operations_architecture.py
  • with the earlier operations_manifest.py and operations_render.py
  • while keeping slop_detector.operations as a compatibility façade.
• Claude Code skill guidance now uses the canonical product surface:
  scan, review, pulse, sweep, explain, verify-governance, and
  mcp, instead of the older /slop*-centric workflow framing.
• README, roadmap, and development docs now reflect the current clone surfaces,
  operations split, and agent workflow model.

[3.8.5] - 2026-06-07 — Dual-Audience Output (Plain for Humans, Actionable for Machines)

Changed

• Human summary hides internal algorithm names. The Project Summary
  coherence row no longer leaks vr_structural (exact MST); it now reads
  Structure Coherence: 85% (Higher is more cohesive) with a plain coverage
  note (full / sampled (large project)) across the rich, text, and markdown
  renderers. Centralized in renderer_glossary.coherence_display() (OSOT).

Added

• Machine output is now patch-complete (AI-agent friendly). Project-level
  JSON / agent route / MCP output gains two additive keys:
  • next_steps — the same deterministic, prioritized action plan humans see
    (top concern, recommended sweep command, file to start with).
  • metric_guide — per-metric value / healthy direction / plain means,
    so an agent reading JSON gets the same semantics as a human reader.

Notes

• The JSON coherence_level value (vr_structural / vr_structural_approx)
  is unchanged — only the human-facing label was translated. New keys are
  additive and backward-compatible; no existing key was renamed or removed.

[3.8.4] - 2026-06-07 — Plain-Language Documentation Entry Point

Changed

• README entry point rewritten benefit-first: a three-line value proposition
  with no internal mechanism, a de-jargoned "What Is It?" list (technical terms
  kept in parentheses), plus two new sections — "Why Not Just Use a Linter?"
  (honest comparison table vs ruff / pylint / ESLint / SonarQube, with Partial
  marked where they overlap) and "When NOT to Use This".
• docs/HOW_IT_WORKS.md: added a "What the Acronyms Mean" glossary that
  decodes every diagram (LDR, Inflation/ICR, DDC, Purity, GQG, Deficit Score,
  SR9), reusing the exact wordings the CLI prints (renderer_glossary.py).
• docs/CONFIGURATION.md: added plain-language comments to every key in the
  advanced: block and glossed GQG / LEDA in the config-validation section.

Notes

• Documentation only. No code, scoring math, public API, MCP, or npm typed
  contracts were changed. MATH_MODELS.md (intentionally technical) was left
  as-is.

[3.8.3] - 2026-06-06 — Readable Output, Next Steps, VS Code Surfaces

Added

Human-friendly output (analysis -> action)

• Project and per-file reports now render a metrics table with Value,
  Healthy Direction, and What It Means columns plus a deficit-band legend
  (CLEAN <30 | SUSPICIOUS 30-50 | INFLATED 50-70 | CRITICAL >=70), so scores
  are interpretable without prior knowledge (addresses the "no way to gauge the
  scores" feedback).
• Deterministic, rule-based Next Steps: each report names the top concern,
  recommends the matching cleanup command (sweep unused-deps / dead-code +
  dupes), and points at the highest-priority file plus review scoping.
• A single renderer_glossary module is the source of truth for metric labels,
  healthy direction, plain-language meaning, and health bands; the rich, text,
  and markdown renderers all consume it for identical wording.

VS Code extension

• Data layer now consumes the ai-slop-detector npm wrapper API and typed
  contracts instead of hand-rolled child_process calls; all backend execution
  flows through the wrapper (scan / review / pulse / sweep).
• New webview panels: 4D + deficit_breakdown (why-not-0.0), confidence-ranked
  cleanup plan, pulse health dashboard, and diff-aware changed-code review.
• Getting-started walkthrough, state-aware empty states, context-key view menus,
  and a domain-profile setting with enumDescriptions.
• npm wrapper gained options.cwd, runTextCommand, and typed function
  declarations so editor/agent consumers are fully typed.

Changed

P0 self-dogfood debt reduction

• operations.py cleanup-family assembly was split into smaller helpers for:
  • dead-code collection
  • duplicate collection
  • manifest hygiene
  • stale suppressions
  • boundary review
• operations.py manifest hygiene paths now use smaller Python / JS helper
  stages instead of monolithic scanners.
• operations.py text and markdown cleanup renderers were split into smaller
  summary/target/issue formatting helpers.
• cli_init.py init orchestration was decomposed into smaller helpers for:
  • option resolution
  • domain resolution
  • preview handling
  • existing-config skip handling
  • YAML load / merge support
• cli_init.py domain detection and language counting now use dedicated
  collection/scoring helpers rather than single monolithic functions.

Fixed

P0 self-dogfood hotspot reduction

• self-dogfood pulse weighted deficit score improved from 21.3221 to
  18.9637 after refactoring operations.py and cli_init.py.
• cli_init.py dropped out of the top self-dogfood hotspot set and now scans
  as clean at the file level.
• operations.py dead-code heuristics now avoid treating obvious CLI / script
  entrypoints as placeholder-only files.
• operations.py no longer imports tomli directly in the scoring surface;
  runtime import fallback is now used to avoid phantom-import findings on the
  compatibility path.

Dead-code family semantics

• sweep dead-code now requires real dead-code evidence (a placeholder file or
  a dead-code pattern such as pass_placeholder / not_implemented /
  interface_only_class) instead of any high deficit_score >= 30. Live
  high-deficit files (e.g. analysis_cache.py, api/server.py) are no longer
  mislabeled; self-dogfood dead-code dropped from 58 to 10 candidates.

Adaptive init no longer drops hand-written config

• --force-init combined with --apply-init-suggestions previously overwrote
  .slopconfig.yaml with the template and then merged onto that template,
  losing hand-written keys. The pre-existing config is now captured before any
  overwrite and used as the adaptive merge base.

unused-deps false positives

• Standard-library modules (abc, ast, collections, ...) are no longer
  reported as undeclared_import. Detection uses sys.stdlib_module_names with
  a sysconfig-based discovery fallback for Python 3.8 / 3.9.
• The unused-dependency check now covers main [project.dependencies] only;
  optional-dependencies (dev/test tools like black, mypy, pytest) are no
  longer flagged as unused. Self-dogfood unused-deps dropped from 64 to 20.

[3.8.2] - 2026-06-05 — Adaptive Init, Node Surface, Impact, Telemetry

Added

Adaptive --init onboarding flow

• --adaptive-init adds a second-stage repository signal scan on top of the
  existing baseline .slopconfig.yaml generator.
• --init-preview prints adaptive suggestions without writing config.
• --apply-init-suggestions opt-in merges bounded suggestions into a new or
  existing .slopconfig.yaml.
• Adaptive signal collection now gathers:
  • manifest presence
  • language counts
  • noise directories
  • Python complexity candidates
  • architecture layout markers
  • cleanup markers

NPM thin wrapper surface

• Added a dedicated npm-wrapper/ package for Node-first distribution.
• Added a thin launcher:
  • bin/ai-slop-detector.js
• Added wrapper runtime contract tests and CI coverage.
• Added explicit install story for:
  • npm
  • pnpm
  • yarn
  • bun
• Added package-local wrapper README and backend prerequisite documentation.
• Added version-pinned TypeScript contract exports at
  ai-slop-detector/types for scan, review, pulse, sweep, and
  explain JSON outputs.
• Added a programmatic Node API surface at the package root for:
  • scanProject
  • reviewChanges
  • computeHealth
  • runCleanupFamily
• Added an agent workflow guide covering JSON-first review, cleanup, health,
  and MCP-assisted usage patterns.

Local impact and opt-in telemetry

• Added repo-local impact tracking commands:
  • slop-detector impact enable
  • slop-detector impact
  • slop-detector impact disable
• Impact snapshots are stored in gitignored .slop-detector/impact.json and
  summarize trend deltas across repeated runs.
• Added telemetry control commands:
  • slop-detector telemetry status
  • slop-detector telemetry enable
  • slop-detector telemetry disable
  • slop-detector telemetry inspect --example
• Added anonymized telemetry payload construction and local queueing.
• Added inspect-first telemetry mode:
  • AI_SLOP_DETECTOR_TELEMETRY=inspect
  • prints a real payload without queueing or sending it

Changed

• Adaptive suggestions stay conservative and evidence-backed:
  • ignore suggestions skip patterns already covered by defaults/profile rules
  • god_function.domain_overrides suggestions are exact-name and capped
  • architecture remains stay_disabled unless layered evidence is strong
• Existing-config init flow remains idempotent by default and only merges
  adaptive changes with explicit opt-in.
• README, CLI usage, and configuration docs now describe baseline init,
  adaptive preview, and explicit merge as distinct flows.
• npm wrapper documentation now states explicitly that Node is a transport
  surface over the Python core, not a second implementation.
• Impact and telemetry surfaces are kept out of the scoring path:
  scoring remains deterministic, while adoption observability is opt-in and
  separately controlled.

[3.8.1] - 2026-06-04 — Absorption Chapter: Cleanup Confidence, Manifest Hygiene, Architecture Review

Added

Absorption chapter: cleanup planning and architecture review

• Cleanup-family output now extends each issues[] item with:
  • confidence
  • action_class
  • evidence
• Cleanup confidence reuses existing signals instead of inventing a detached
  model:
  • deficit_score
  • churn
  • coverage
  • cleanup-local evidence
• unused-deps now includes project-level manifest hygiene for:
  • pyproject.toml
  • package.json
• New cleanup issue types:
  • manifest_unused_dependency
  • undeclared_import
• boundary-violations now supports an opt-in architecture review path with a
  layered preset and explicit layer_boundary_violation findings.

Changed

• Architecture review remains cycle-only by default; layered boundary rules are
  opt-in through .slopconfig.yaml.
• Layered preset evidence now includes matched importer/importee patterns and
  the exact allow/forbid rule that triggered the finding.
• README, CLI, architecture, and configuration docs now describe the
  v3.8.1 operational surface.

[3.8.0] - 2026-06-04 — Canonical CLI Surface & Dogfood Stability

Added

Canonical CLI verbs

• slop-detector scan <target> is now the preferred stable analysis entry point.
• slop-detector review <target> is now the preferred changed-code review surface.
• slop-detector pulse <target> is now the preferred repository health surface.
• slop-detector sweep <family> <target> is now the preferred cleanup-family surface.
• Legacy command forms such as audit, health, and direct cleanup-family verbs remain supported for compatibility.

Fixed

Dogfood hotspot prioritization stability

• prioritization.py no longer assumes every AST body is a list while estimating executable lines for coverage overlays.
• health and audit now survive lambda-heavy files and other non-list AST body shapes during self-analysis.

Changed

• README and CLI docs now present the canonical CLI surface first and treat earlier mixed flag/verb paths as compatible legacy entry points.