feat(ci): orphaned-fixture + CHANGELOG-parity gates (#663)

.github/workflows/ci.yml

@@ -295,6 +295,53 @@ jobs:
       - name: Run silent-skip-gate tests
         run: bash scripts/check-silent-skips.test.sh
 
+  # Every file under a skill's evals/fixtures/ must be consumed by a grader — an
+  # eval files[] entry or a test assertion — so an ungraded suite cannot sit in
+  # the tree reading as tested. The check is repo-wide and static; existing debt
+  # is grandfathered in scripts/orphaned-fixtures-baseline.txt with a stale
+  # guard, so the gate holds the line without red-lining fixtures a member issue
+  # already owns. The self-test runs unconditionally so a broken detector cannot
+  # mask a regression behind a green gate.
+  orphaned-fixture-gate:
+    runs-on: ubuntu-24.04
+    timeout-minutes: 15
+    steps:
+      - name: Check out
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        with:
+          persist-credentials: false
+      - name: Test the orphaned-fixture detector
+        run: bash scripts/check-orphaned-fixtures.test.sh
+      - name: Check for orphaned eval fixtures
+        run: scripts/check-orphaned-fixtures.sh --check
+
+  # CHANGELOG parity: a versioned plugin must keep a CHANGELOG.md (static
+  # --check), and a PR that changes a plugin's manifest version must update that
+  # plugin's CHANGELOG.md in the same diff (--check-bump, PR-only). Existing
+  # "versioned but changelog-less" debt is grandfathered by name in
+  # scripts/changelog-parity-baseline.txt with a stale guard; the bump gate is
+  # never relaxed by the baseline. The self-test runs unconditionally so a broken
+  # gate cannot mask a regression, and the PR-diff step is event-gated.
+  changelog-parity-gate:
+    runs-on: ubuntu-24.04
+    timeout-minutes: 15
+    steps:
+      - name: Check out
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        with:
+          persist-credentials: false
+          # Full history so the PR base ref is resolvable for the bump gate.
+          fetch-depth: 0
+      - name: Test the changelog-parity gate
+        run: bash scripts/check-changelog-parity.test.sh
+      - name: Verify every versioned plugin keeps a CHANGELOG.md
+        run: scripts/check-changelog-parity.sh --check
+      - name: Verify a version bump updates the plugin's CHANGELOG.md
+        if: github.event_name == 'pull_request'
+        env:
+          BASE_REF: ${{ github.base_ref }}
+        run: scripts/check-changelog-parity.sh --check-bump "origin/$BASE_REF"
+
   # Deep plugin-contract lane and the heaviest suite (Node + Python installs,
   # every plugins/**/*.test.sh, manifest + catalog validation). A PR whose diff
   # is confined to the docs-only allowlist (scripts/docs-only-paths.txt) cannot
@@ -531,6 +578,8 @@ jobs:
       - standards-contract-sync
       - cross-plugin-source-drift
       - silent-skip-gate
+      - orphaned-fixture-gate
+      - changelog-parity-gate
       - plugin-gate
       - miro-plugin
       - runner-policy

plugins/discovery/CHANGELOG.md

@@ -1,6 +1,6 @@
 # Changelog — discovery plugin
 
-## 0.7.3 — 2026-07-19
+## [0.7.3] — 2026-07-19
 
 ### Fixed
 
@@ -11,7 +11,7 @@
   current working directory when no repo root exists. The live root stays available for resolving
   files while working; it is never echoed into the handoff, so `EXPLORE.md` stays machine-agnostic.
 
-## 0.7.2 — 2026-07-19
+## [0.7.2] — 2026-07-19
 
 ### Changed
 
@@ -21,7 +21,7 @@
   write path — replacing the dead `docs/adr/…` reference that resolves to nothing in the
   cache-isolated installed plugin. Behavior is unchanged; gitbook stays deferred and non-writable.
 
-## 0.7.0 — 2026-07-18
+## [0.7.0] — 2026-07-18
 
 ### Changed
 
@@ -34,7 +34,7 @@
   interview, so headless and CI use are possible. The ignore guard, the gitbook-deferred
   handling, and the never-edit-root-`.gitignore` rule are unchanged.
 
-## 0.6.0 — 2026-07-17
+## [0.6.0] — 2026-07-17
 
 ### Changed
 
@@ -45,7 +45,7 @@
   artifacts there directly; only workers dispatched into their own checkout return findings by
   value for the parent to write.
 
-## 0.5.1 — 2026-07-15
+## [0.5.1] — 2026-07-15
 
 ### Fixed
 
@@ -54,7 +54,7 @@
   and states that durable writes still target `docs`; the skill never configures or tests a GitBook
   API, MCP, or Git Sync writer.
 
-## 0.5.0 — 2026-07-15
+## [0.5.0] — 2026-07-15
 
 ### Added
 
@@ -65,7 +65,7 @@
   doubled phase/query/source minimums (SKILL.md item 8, discipline.md's "Broad-topic
   auto-detect").
 
-## 0.4.0 — 2026-07-14
+## [0.4.0] — 2026-07-14
 
 Adopt the marketplace topic-docs convention, contract v1.0.0
 (<https://raw.githubusercontent.com/melodic-software/claude-code-plugins/main/docs/conventions/topic-docs/README.md>):

plugins/docs-hygiene/CHANGELOG.md

@@ -1,6 +1,6 @@
 # Changelog — docs-hygiene plugin
 
-## 0.7.0 — 2026-07-18
+## [0.7.0] — 2026-07-18
 
 Changed:
 
@@ -12,7 +12,7 @@ Changed:
   ambient, Git Bash on native Windows), the compress-only `markdownlint-cli2`
   requirement with its absence behavior, and the optional `caveman` backend.
 
-## 0.6.0 — 2026-07-17
+## [0.6.0] — 2026-07-17
 
 Changed:
 
@@ -24,15 +24,15 @@ Changed:
   word. The detect-script env vars moved with it:
   `DECLUTTER_REPO_ROOT` → `AUDIT_NOISE_REPO_ROOT`.
 
-## 0.5.0 — 2026-07-15
+## [0.5.0] — 2026-07-15
 
 Changed:
 
 - Renamed the `encapsulation-audit` skill → `audit-encapsulation`. Update any
   `/docs-hygiene:encapsulation-audit` invocations to `/docs-hygiene:audit-encapsulation`; the plugin ID
   (`docs-hygiene`) is unchanged, only the skill's leaf name moved.
 
-## 0.4.0 — 2026-07-15
+## [0.4.0] — 2026-07-15
 
 Added:
 
@@ -44,7 +44,7 @@ Added:
 - The "add an eval case" clause, re-added to the two Gotchas/Recheck-trigger
   bullets in rename-references/SKILL.md.
 
-## 0.3.0 — 2026-07-14
+## [0.3.0] — 2026-07-14
 
 Adopt the marketplace topic-docs convention
 (`docs/conventions/topic-docs/`, contract v1.0.0) in the declutter

plugins/knowledge/CHANGELOG.md

@@ -4,7 +4,7 @@ All notable changes to the `knowledge` plugin are recorded here. The `version` i
 `.claude-plugin/plugin.json` is the delivery vehicle — a consumer receives a change
 only after that version increases.
 
-## 0.8.0
+## [0.8.0]
 
 ### Changed
 
@@ -18,7 +18,7 @@ only after that version increases.
   scripts the ingest skills already run — pulling the prerequisite/provisioning surface onto
   the setup contract. The personal env-channel scalars are unchanged.
 
-## 0.7.1
+## [0.7.1]
 
 ### Changed
 
@@ -27,7 +27,7 @@ only after that version increases.
   the EPUB branch's `unzip` requirement (not bundled with Git Bash) —
   cross-platform declaration wave. PDF-only use needs neither extra install.
 
-## 0.7.0
+## [0.7.0]
 
 ### Changed
 
@@ -54,13 +54,13 @@ only after that version increases.
   plaintext in `~/.claude/.credentials.json` on Windows, so those secrets stay in shell env until
   keychain-backed sensitive storage lands there (documented at the course-digest auth-env site).
 
-## 0.6.1
+## [0.6.1]
 
 ### Changed
 
 - References to the renamed `/planning:plan` skill (was `/planning:architect`, planning 0.13.0 breaking rename) retargeted. Version bumped so existing installs receive the rewritten prompts.
 
-## 0.6.0
+## [0.6.0]
 
 ### Changed
 
@@ -72,23 +72,23 @@ only after that version increases.
   unaffected (`.work/<watch-epic>/...` layout is unchanged); resume with
   `/knowledge:youtube-digest resume <video-slug>`.
 
-## 0.5.6
+## [0.5.6]
 
 ### Added
 
 - Revisit condition in the README recording when the bundled `youtube` skill would
   graduate into a standalone plugin (once its vendored `video-digestion` package is
   independently distributable).
 
-## 0.5.5
+## [0.5.5]
 
 ### Fixed
 
 - **Lossless WebVTT transcript extraction.** Cue cleanup still strips complete WebVTT tags in one
   linear pass, but now preserves an unmatched literal less-than tail instead of truncating the rest
   of programming, mathematics, or other tolerant transcript text.
 
-## 0.5.4
+## [0.5.4]
 
 ### Fixed
 
@@ -101,7 +101,7 @@ only after that version increases.
   clone option parsing is terminated explicitly; and WebVTT/entity cleanup uses bounded,
   single-pass transformations that cannot turn nested malformed input into active markup.
 
-## 0.5.3
+## [0.5.3]
 
 ### Changed
 
@@ -115,7 +115,7 @@ only after that version increases.
   now records that the `verification/` lane name matches the convention's canon. Docs-only —
   no paths or behavior change; the `library_dir` seam is untouched.
 
-## 0.5.2
+## [0.5.2]
 
 ### Fixed
 
@@ -141,7 +141,7 @@ only after that version increases.
   forces `--no-playlist`; and a passing key-frame quality-audit row now requires a
   substantive evidence note (an omitted note no longer bypasses the gate).
 
-## 0.5.1
+## [0.5.1]
 
 ### Changed
 
@@ -153,7 +153,7 @@ only after that version increases.
   into `${CLAUDE_PLUGIN_DATA}` is unchanged. Internal restructure — no consumer-facing behavior
   change; the version bump delivers the moved source (and the new install fingerprint) to consumers.
 
-## 0.5.0
+## [0.5.0]
 
 ### Added
 
@@ -189,7 +189,7 @@ only after that version increases.
 - `repo-analysis` and `video-digestion` are now vendored by both the youtube and
   course-digest skills. Deduplication of the two copies is tracked separately.
 
-## 0.4.0
+## [0.4.0]
 
 ### Changed
 
@@ -208,15 +208,15 @@ only after that version increases.
   land, restoring the stronger wording softened while the seam was unwired
   (`book-distill` remains the documented exception).
 
-## 0.3.0
+## [0.3.0]
 
 ### Changed
 
 - **`setup` skill** — retrofit `library_dir` precedence resolution and portability
   hardening so synthesized artifacts land at the configured library directory in the
   consuming repo.
 
-## 0.2.0
+## [0.2.0]
 
 ### Added
 
@@ -237,6 +237,6 @@ only after that version increases.
   dependencies resolve from `${CLAUDE_PLUGIN_DATA}` (NODE_PATH is CommonJS-only and
   does not apply).
 
-## 0.1.1
+## [0.1.1]
 
 - Prior baseline: `book-distill` and `setup` skills.

plugins/playbooks/CHANGELOG.md

@@ -4,7 +4,7 @@ All notable changes to the `playbooks` plugin are recorded here. The `version` i
 `.claude-plugin/plugin.json` is the delivery vehicle — a consumer receives a change
 only after that version increases.
 
-## 0.2.0
+## [0.2.0]
 
 ### Changed
 
@@ -17,7 +17,7 @@ only after that version increases.
   drift-check mechanics now point at the renamed pack path. Only the wrapper skill
   name (directory, frontmatter `name`, and references) changed.
 
-## 0.1.0
+## [0.1.0]
 
 ### Added