Release 5.2.0: voice gate (sycophancy / gratitude-loop lint)

Promote the anti-sycophancy half of the 5.1 voice contract from prose guidance
to a mechanical gate, closing the caveat that the voice contract was unenforced.
Additive over 5.1; public command surface unchanged (122 skills, 40 agents).

Added:
- lib/voice-lint.js: high-precision detector for sycophancy and gratitude-loop
  filler (praising the question, thanking for the message, help-eagerness,
  hope-this-helps, forced engagement). Reusable by agents on their own output.
- Have-not U-14 (sycophancy or gratitude loop) in references/HAVE-NOTS.md, wired
  as a universal check in lib/have-nots-validator.js (warning on artifacts) with
  a good/bad worked example.
- Self-dogfood gate in scripts/static-check.js and scripts/test-voice-lint.js:
  shipped skills/ and agents/ prose must contain no gratitude-loop filler,
  enforced in CI. The surface is already clean, so this locks it in.

Counts: have-nots 157 to 158, lib modules 95 to 96.

Verified: full npm test and npm run release:check both green (voice-lint.js 100%
coverage, per-file floor, audit, surface, pack). Adversarial review run; its 6
confirmed findings fixed and re-verified: a praise-question regex false positive
on "question bank/type" (tightened with a negative lookahead) and stale have-not
counts (157) in HAVE-NOTS.md's own tally, the architecture map, and three docs,
all reconciled to 158.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

Author: hannsxpeter

ARCHITECTURE-MAP.md

@@ -640,7 +640,7 @@ godpowers/
 ├── README.md, CHANGELOG.md, LICENSE, CONTRIBUTING.md, SECURITY.md, USERS.md
 ├── ARCHITECTURE.md                <- Design doc
 ├── ARCHITECTURE-MAP.md            <- This file
-├── package.json (v5.1.0)
+├── package.json (v5.2.0)
 ├── .github/workflows/              <- CI + npm publish workflows
 │
 ├── bin/install.js                 <- CLI installer (15 runtimes)
@@ -660,7 +660,7 @@ godpowers/
 │   ├── PRD.mdx, ARCH.mdx, ROADMAP.mdx, ...
 │
 ├── references/
-│   ├── HAVE-NOTS.md               <- 157 named failure modes (canonical)
+│   ├── HAVE-NOTS.md               <- 158 named failure modes (canonical)
 │   ├── orchestration/             <- Mode/scale detection patterns
 │   ├── planning/                  <- PRD/ARCH/ROADMAP/STACK anatomies + antipatterns
 │   ├── building/                  <- Vertical slices, waves
@@ -673,7 +673,7 @@ godpowers/
 │   ├── events.v1.json
 │   └── workflow.v1.json
 │
-├── lib/                           <- Real JS runtime (95 modules)
+├── lib/                           <- Real JS runtime (96 modules)
 │   ├── state.js                   <- state model + drift detection
 │   ├── events.js                  <- OTel-shape event log + hash chain
 │   ├── router.js                  <- command routing
@@ -736,7 +736,7 @@ godpowers/
 
 ---
 
-## Numbers (as of v5.1.0)
+## Numbers (as of v5.2.0)
 
 | Component | Count |
 |-----------|-------|
@@ -747,11 +747,11 @@ godpowers/
 | Specialist agents | 40 |
 | Workflows (core YAMLs) | 13 |
 | Intent recipes | 44 |
-| Have-nots | 157 documented + 30+ mechanically validated by linter |
+| Have-nots | 158 documented + 30+ mechanically validated by linter |
 | Templates | 14 |
 | Reference documents | 39 |
 | JSON Schemas | 7 |
-| **JS runtime modules** | **95** |
+| **JS runtime modules** | **96** |
 | **External integrations** | **5** (all detect-and-delegate; none vendored): Google Labs design.md, Impeccable, awesome-design-md, SkillUI, vercel-labs/agent-browser + Playwright |
 | Hooks | 2 |
 | Dogfood scenarios | 5 |

ARCHITECTURE.md

@@ -1,6 +1,6 @@
 # Godpowers Architecture (v3 Design Target)
 
-> Status: STABLE v5.1.0 (concierge surface, first-run guidance, sandbox demo, surface control, compact next commands, surface contraction, core default install profile, verb dispatchers, one-directional state authority, generated state views, executable tier gates, executable proof, adoption metrics, dogfood, host guarantees, MCP companion tools, release surface sync, request-trace review, release hardening, maintenance hardening, security and drift hardening, deliverable progress tracking, accountability hardening, extension authoring, parser hardening, external CLI canaries, Codex host proof studies, prompt-size guardrails, coverage gating, Phase 2 blocker fixes, release documentation cleanup, the evidence producer that writes the verification records the gate consumes, enforced executed evidence on the build and harden gates, the can-close gate the orchestrator consults before closing a sub-step, the quarterback entry router that refuses new work on red and right-sizes ceremony, the work report play-by-play from the evidence ledger, structured reflections recorded after each significant action, a durable key/value memory store, a reusable lessons store that auto-records from reflections, bounded outcome retry loops that record each iteration and verdict, the read-only MCP tools work_report, route, and verification_history, the optional one-time .mythify/ ledger importer that complete the Mythify fusion, a codeauditor-grade scored code audit with an audit-remediation loop that drives findings to zero, a default greenfield arc that runs a whole-codebase code audit after the build and a documentation pass after harden so the one-shot product ships audited and documented, sibling superskill interop that detects and imports .godplans/PLAN.mdx and .godaudits/AUDIT.mdx for plan-aware arcs and GA-task remediation dispatch with sync-back companion files and staleness drift checks, mdx-first artifacts with legacy .md read fallback, and an MDX-safety artifact lint backed by the U-13 have-not)
+> Status: STABLE v5.2.0 (concierge surface, first-run guidance, sandbox demo, surface control, compact next commands, surface contraction, core default install profile, verb dispatchers, one-directional state authority, generated state views, executable tier gates, executable proof, adoption metrics, dogfood, host guarantees, MCP companion tools, release surface sync, request-trace review, release hardening, maintenance hardening, security and drift hardening, deliverable progress tracking, accountability hardening, extension authoring, parser hardening, external CLI canaries, Codex host proof studies, prompt-size guardrails, coverage gating, Phase 2 blocker fixes, release documentation cleanup, the evidence producer that writes the verification records the gate consumes, enforced executed evidence on the build and harden gates, the can-close gate the orchestrator consults before closing a sub-step, the quarterback entry router that refuses new work on red and right-sizes ceremony, the work report play-by-play from the evidence ledger, structured reflections recorded after each significant action, a durable key/value memory store, a reusable lessons store that auto-records from reflections, bounded outcome retry loops that record each iteration and verdict, the read-only MCP tools work_report, route, and verification_history, the optional one-time .mythify/ ledger importer that complete the Mythify fusion, a codeauditor-grade scored code audit with an audit-remediation loop that drives findings to zero, a default greenfield arc that runs a whole-codebase code audit after the build and a documentation pass after harden so the one-shot product ships audited and documented, sibling superskill interop that detects and imports .godplans/PLAN.mdx and .godaudits/AUDIT.mdx for plan-aware arcs and GA-task remediation dispatch with sync-back companion files and staleness drift checks, mdx-first artifacts with legacy .md read fallback, and an MDX-safety artifact lint backed by the U-13 have-not)
 > Authors: Godpowers Team
 > Last updated: 2026-07-03
 

CHANGELOG.md

@@ -7,6 +7,31 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+## [5.2.0] - 2026-07-04
+
+Voice gate release. Promotes the anti-sycophancy half of the 5.1 voice contract
+from prose guidance to a mechanical gate: a new have-not (U-14) backed by a
+phrase detector, wired into both the artifact linter and a self-dogfood check on
+the framework's own shipped prose.
+
+### Added
+
+- `lib/voice-lint.js`: a high-precision detector for sycophancy and
+  gratitude-loop filler (praising the question, thanking for the message,
+  help-eagerness, hope-this-helps, forced engagement). Reusable by agents on
+  their own drafted output.
+- Have-not **U-14 (sycophancy or gratitude loop)** in `references/HAVE-NOTS.md`,
+  wired as a universal check in `lib/have-nots-validator.js` (warning severity on
+  generated artifacts) with a good/bad worked example.
+- Self-dogfood gate in `scripts/static-check.js` and `scripts/test-voice-lint.js`:
+  the shipped `skills/` and `agents/` prose must contain no gratitude-loop filler,
+  enforced in CI. The current surface is already clean, so this locks it in.
+
+### Changed
+
+- Have-not count moves from 157 to 158; lib module count from 95 to 96. No public
+  command, agent, workflow, or recipe surface change.
+
 ## [5.1.0] - 2026-07-04
 
 Craft and connectors release. Adopts a set of proven agent-prompting patterns as

README.md

@@ -2,7 +2,7 @@
 
 [![CI](https://github.com/hannsxpeter/godpowers/actions/workflows/ci.yml/badge.svg)](https://github.com/hannsxpeter/godpowers/actions/workflows/ci.yml)
 [![License: MIT](https://img.shields.io/badge/License-MIT-yellow.svg)](LICENSE)
-[![Version](https://img.shields.io/badge/version-5.1.0-blue)](CHANGELOG.md)
+[![Version](https://img.shields.io/badge/version-5.2.0-blue)](CHANGELOG.md)
 [![npm](https://img.shields.io/npm/v/godpowers.svg)](https://www.npmjs.com/package/godpowers)
 
 **Ship fast. Ship right. Ship everything. Ship accountably.**

RELEASE.md

@@ -1,38 +1,36 @@
-# Godpowers 5.1.0 Release
+# Godpowers 5.2.0 Release
 
-> Status: Published
+> Status: Ready to publish
 > Date: 2026-07-04
 
-[DECISION] Godpowers 5.1.0 is the craft and connectors release. It adopts a set of proven agent-prompting patterns (drawn from studying a current Anthropic system prompt) as a single shared voice and craft contract, and extends the 5.0 connector work with a capability priority ladder.
-[DECISION] The release is additive over 5.0. Surface counts are unchanged: 122 slash commands, 40 specialist agents, 13 workflows, 44 recipes, 95 lib modules, 157 have-nots. The `@godpowers/mcp` companion stays at nine read-only tools. No project migration is required.
+[DECISION] Godpowers 5.2.0 is the voice gate release. It promotes the anti-sycophancy half of the 5.1 voice and craft contract from prose guidance to a mechanical gate, closing the caveat that the voice contract was prompt-level and unenforced.
+[DECISION] The release is additive over 5.1. Public command surface is unchanged: 122 slash commands, 40 specialist agents, 13 workflows, 44 recipes. Counts that move: have-nots 157 to 158, lib modules 95 to 96. The `@godpowers/mcp` companion stays at nine read-only tools. No project migration is required.
 
-## What's new in 5.1.0
+## What's new in 5.2.0
 
-- [DECISION] Voice and craft contract (`references/shared/VOICE.md`), wired globally as Core Principle 15 in `SKILL.md`. Every agent adopts it alongside the have-nots. It defines: constraint tiers (Guideline / Requirement / HARD LIMIT, with the have-nots as the hard-limit tier), an honest anti-sycophancy voice (no gratitude loops, no forced engagement, accountability without self-abasement, scoped uncertainty), minimal formatting for human-facing output, an example-driven-rules convention, and silent application of memory and lessons.
-- [DECISION] Worked good/bad example pairs on the highest-traffic have-nots (U-01 substitution, U-02 three-label, U-05 rubber-stamp) so the most-misread rules are resolved by example, not restated.
-- [DECISION] Connector capability ladder: `connectors.pickConnector(capability)` walks a priority order (for example Linear then GitHub for issue work) and stops at the first available, enabled connector. A disabled connector is skipped. Documented in `/god-connect`.
-- [DECISION] Silent-memory wiring at the memory site: `skills/god-extract-learnings.md` documents applying recalled lessons without narrating the recall, pointing at `VOICE.md`.
+- [DECISION] `lib/voice-lint.js`: a high-precision detector for sycophancy and gratitude-loop filler (praising the question, thanking merely for the message, help-eagerness such as "happy to help", a "hope this helps" sign-off, and forced engagement such as "let me know if you" or "feel free to reach out"). It keeps false positives low by matching only phrases that are almost always filler in engineering communication. Agents can run it on their own drafted output before sending.
+- [DECISION] Have-not U-14 (sycophancy or gratitude loop) in `references/HAVE-NOTS.md`, wired as a universal check in `lib/have-nots-validator.js`. It flags generated artifacts at warning severity and carries a good/bad worked example. This is the mechanical enforcement of the honest-voice section of `references/shared/VOICE.md`.
+- [DECISION] Self-dogfood gate: `scripts/static-check.js` and `scripts/test-voice-lint.js` assert that the framework's own shipped `skills/` and `agents/` prose contains no gratitude-loop filler, enforced in CI. The current surface is already clean, so the gate locks in the clean state going forward. References that intentionally quote the filler as examples (`VOICE.md`, `HAVE-NOTS.md`) are out of scope for the self-dogfood scan.
 
 ## Changes
 
-- [DECISION] One new shared reference (`references/shared/VOICE.md`) and its index entry in `references/shared/README.md`. No new skill, agent, workflow, recipe, or lib module, so public surface counts are unchanged.
-- [DECISION] `lib/connectors.js` gains `CAPABILITY_LADDER` and `pickConnector(...)`, covered by new cases in `scripts/test-connectors.js`.
-- [DECISION] `SKILL.md` adds Core Principle 15 (Voice and Craft). `references/HAVE-NOTS.md`, `skills/god-connect.md`, and `skills/god-extract-learnings.md` are updated accordingly.
-- [DECISION] `package.json` and `packages/mcp/package.json` publish the 5.1.0 version; CHANGELOG, roadmap, reference, architecture, the architecture map, MCP docs, security supported-versions, and the surface docs now reflect 5.1.0.
+- [DECISION] One new runtime module (`lib/voice-lint.js`; lib module count 95 to 96) with a dedicated test (`scripts/test-voice-lint.js`) wired into `scripts/run-tests.js`.
+- [DECISION] One new documented have-not (U-14; count 157 to 158). `lib/have-nots-validator.js` registers U-14 as a universal check and updates its header count.
+- [DECISION] `package.json` and `packages/mcp/package.json` publish the 5.2.0 version; CHANGELOG, roadmap, reference, architecture, the architecture map, MCP docs, security supported-versions, and the surface docs now reflect 5.2.0.
 
 ## Validation
 
 - [DECISION] `npm test` passes across all command groups (the full `scripts/run-tests.js` suite, 0 failures).
 - [DECISION] The offline release gate passes: `npm run coverage:lib` (90% lines / 75% branches aggregate, per-file floors), `node scripts/check-per-file-coverage.js`, `git diff --check`, `npm run pack:check`, `npm run pack:mcp:check`, and `npm run test:surface`. The registry-only step (`npm audit --omit=dev`) runs in the tag-triggered publish workflow's `release:check`.
-- [DECISION] `node scripts/test-doc-surface-counts.js` passes public surface docs for version 5.1.0 with 122 skills, 40 agents, 13 workflows, 44 recipes, and 95 lib modules.
+- [DECISION] `node scripts/test-doc-surface-counts.js` passes public surface docs for version 5.2.0 with 122 skills, 40 agents, 13 workflows, 44 recipes, and 96 lib modules.
 
 ## Upgrade
 
-- [DECISION] Use `npm install -g godpowers@5.1.0` or `npx godpowers@5.1.0`.
-- [DECISION] Upgrading from 5.0 needs no artifact-format change. Re-run `npx godpowers install` (or your runtime flags, e.g. `npx godpowers --claude --global`) so installed runtimes pick up the refreshed contracts.
-- [DECISION] The voice contract and connector ladder are behavioral: they change how agents communicate and choose connectors, not the command surface or on-disk artifacts.
+- [DECISION] Use `npm install -g godpowers@5.2.0` or `npx godpowers@5.2.0`.
+- [DECISION] Upgrading from 5.x needs no artifact-format change. Re-run `npx godpowers install` (or your runtime flags, e.g. `npx godpowers --claude --global`) so installed runtimes pick up the refreshed contracts and the new have-not.
+- [DECISION] The voice gate is additive: it flags gratitude-loop filler in generated artifacts (warning) and blocks it in the framework's own shipped prose (CI). No existing project artifact changes until it is re-linted.
 
 ## Notes
 
-- [DECISION] The publish targets are npm `godpowers@5.1.0`, npm `@godpowers/mcp@5.1.0`, and GitHub release `https://github.com/hannsxpeter/godpowers/releases/tag/v5.1.0`.
-- [DECISION] Publishing is tag-triggered: pushing the `v5.1.0` tag runs `.github/workflows/publish.yml`, which runs `npm run release:check` and publishes both `godpowers` and `@godpowers/mcp` to npm with provenance. Do not `npm publish` by hand; the tag path carries provenance and the release gate.
+- [DECISION] The publish targets are npm `godpowers@5.2.0`, npm `@godpowers/mcp@5.2.0`, and GitHub release `https://github.com/hannsxpeter/godpowers/releases/tag/v5.2.0`.
+- [DECISION] Publishing is tag-triggered: pushing the `v5.2.0` tag runs `.github/workflows/publish.yml`, which runs `npm run release:check` and publishes both `godpowers` and `@godpowers/mcp` to npm with provenance. Do not `npm publish` by hand; the tag path carries provenance and the release gate.

SECURITY.md

@@ -73,7 +73,8 @@ When using Godpowers in a sensitive context:
 
 | Version | Supported |
 |---------|-----------|
-| 5.1.x   | Yes |
+| 5.2.x   | Yes |
+| 5.1.x   | Security fixes only |
 | 5.0.x   | Security fixes only |
 | 4.0.x   | Security fixes only |
 | 3.14.x  | Security fixes only |

USERS.md

@@ -1,6 +1,6 @@
 # Users and Community
 
-Godpowers is at v5.1.0. Stable release.
+Godpowers is at v5.2.0. Stable release.
 
 ## Track record
 

docs/ROADMAP.md

@@ -3,7 +3,7 @@
 > Status: ACTIVE
 > Model: Pure-skill for durable work. CLI provides install plus read-only status helpers.
 > Last updated: 2026-07-03
-> Current shipped: v5.1.0
+> Current shipped: v5.2.0
 
 This roadmap tracks releases, what's shipped, and what is frozen during the
 3.x public adoption window. Everything user-facing remains slash-command based.

docs/agent-specs.md

@@ -329,7 +329,7 @@ Each agent has these fields:
 | **Inputs** | Any artifact in `.godpowers/<tier>/`; for preflight mode, repo structure, org context, docs, tests, CI, deploy, and agent instruction signals |
 | **Outputs** | `.godpowers/preflight/PREFLIGHT.mdx` (preflight) OR `.godpowers/AUDIT-REPORT.mdx` (full audit) OR PASS/FAIL verdict (gate check) |
 | **Downstream consumers** | Orchestrator (for routing decisions), tier agents (for gate checks) |
-| **Artifact awareness** | All 157 have-nots; all tier artifact contracts; preflight lens for arc-ready, pillars, Godpowers, suite, and refactor risk |
+| **Artifact awareness** | All 158 have-nots; all tier artifact contracts; preflight lens for arc-ready, pillars, Godpowers, suite, and refactor risk |
 | **Handoff** | Returns score per artifact + prioritized remediation. |
 | **Standards check** | This IS the standards check |
 

docs/concepts.md

@@ -103,7 +103,7 @@ is preparation context for PRD, ARCH, ROADMAP, STACK, and docs. It does not
 replace those artifacts.
 
 ### Have-nots
-157 named failure modes. ~30 are mechanical (regex-checkable);
+158 named failure modes. ~30 are mechanical (regex-checkable);
 the rest are interpretive. Examples:
 - P-01: Generic problem statement (passes substitution test)
 - A-04: ADR without flip point