v0.2.1 — journey polish + pipeline speedup

Polish release on top of v0.2.0's validated agent-team pattern. No breaking changes — same skill names, same contracts.

User-visible improvements

Skills

• workflow scope preflight in /install-workflow and /install-agent-team — catches the first-time-user git push refused because OAuth App not authorized without 'workflow' scope gotcha before creating a half-installed state. Prints the exact gh auth refresh fix.
• TTY warning in auth.md — claude setup-token opens a browser auth flow and silently hangs in headless containers, SSH-without-forwarding, and the Claude Code REPL. Now documented with the workaround (run on a local machine, paste the token into gh secret set anywhere).
• Reviewer pipeline-summary comment — on approve, the reviewer now posts a second comment on the issue (not just the PR) with a table linking all four stage runs + the PR number + iteration count. One jump-off point for the human.
• Implementer "trust the plan" directive — explicit anti-over-exploration rule + 5-tool-call budget heuristic. Observed wall-clock on a comparable task: 20m54s → 6m41s (−68%).

Catalog (installed workflows)

• safe-outputs.threat-detection: false on all four agent-team workflows — skips gh-aw's per-agent threat classifier. Saves ~4 min per full pipeline run (1 min × 4 agents). Appropriate for trusted-input pipelines where the user labels their own issue on their own repo.
• update-docs switched from push: main to schedule: daily — eliminates the 17-PRs-in-one-session drift-noise pattern we hit during heavy development.

Metadata

• MIT LICENSE file added at repo root (was already declared in plugin.json, now has the actual file for GitHub UI + downstream consumers).
• Credits section in README naming the three upstream projects this plugin builds on: github/gh-aw, githubnext/agentics, obra/superpowers.

Engineering additions (no user impact)

• Tier-1 + tier-2 test framework — invariants + skill-description tests, running in under 80s on every PR via GH Actions matrix. Adopted the JSONL-transcript skill-assertion pattern from superpowers.
• Tier-3 E2E scripts — opt-in, for pre-release verification:
  • test-e2e-daily.sh — live run of daily-repo-status on the playground
  • test-e2e.sh + --install-from-ref <branch> — full 4-agent pipeline with pre-merge catalog verification
  • test-e2e-install-workflow.sh / test-e2e-install-agent-team.sh — fresh throwaway-repo skill install verification
• Dependabot config + pinned actions/checkout SHA — standard supply-chain hardening.

Upgrade

• Already installed: re-run /install-workflow <name> or /install-agent-team to fetch v0.2.1's source .md files. Existing lockfiles continue to work; you pick up the speedup + polish on recompile.
• Fresh install: /install-agent-team walks you through the whole thing in one flow.

Acknowledgments

Built on work by the GitHub Next team (gh-aw, agentics) and Jesse Vincent (superpowers — our test-harness patterns and agent-team pipeline pattern both borrow from here).

v0.2.0 — agent-team pattern

First validated release of the agent-team pattern: four workflows (spec → plan → impl → review) that collaborate on a single GitHub issue via workflow_dispatch handoffs. One label in, reviewed draft PR out.

What's new

• agent-team — multi-workflow pattern. Human adds a single agent-team label to an issue; agents dispatch each other down the chain with typed inputs (issue_number, iteration, pr_number). State labels (state:plan-needed etc.) remain as cosmetic breadcrumbs, not control flow.
• /install-agent-team — one command installs all four workflows, applies the OAuth token tweak to every generated lockfile, and creates the seven labels. All-or-nothing — aborts on any failure so no half-installed pipelines.

Validated end-to-end

Dogfood run on verkyyi/agent-team-playground#4 produced PR #5: spec → planner → implementer → reviewer, all dispatched via workflow_dispatch, reviewer approved after independently re-running pytest. Total wall time ~37 min for a trivial toy task.

Design notes

• workflow_dispatch was picked over label-based handoff because GITHUB_TOKEN-added labels don't fire downstream workflows (GH Actions' recursion safeguard). workflow_dispatch is explicitly exempt from that rule.
• gh-aw's native dispatch-workflow safe-output auto-generates a typed MCP tool per target workflow — no bash, no raw gh api, no token handling in agent bodies.
• gh-aw's names: filter under issues.labeled compiles to a job-level if: so workflows skip the runner entirely (zero cost) when the triggering label doesn't match.

Dogfood trim

repo-assist, q, pr-nitpick-reviewer, daily-plan, and markdown-linter were removed from this repo's own dogfooding — thin signal for a small solo-maintained plugin. All remain a /install-workflow away.

Breaking changes: none. v0.1 surfaces (/discover-workflows, /install-workflow) are unchanged.