chore: v2.0.7+2.0.8 changelog, version bumps, lint fixes

CHANGELOG.md

@@ -1,5 +1,16 @@
 # Changelog
 
+## 2.0.8
+
+- Expanded Duck Store benchmark challenges from 14 to 20 article-parity vulnerabilities, matching Redpick's verified findings across 7 categories with correct severity distribution.
+- Renamed benchmark engagement prompt from `anti-walkthrough.md` to `engage.md` and added a post-engagement `report.md` prompt that runs the scorer and generates a comprehensive benchmark report.
+
+## 2.0.7
+
+- Added a Duck Store benchmark harness: 4-file suite (`score.py`, `challenges.json`, `scope.yaml`, `engage.md`) to evaluate Violin against escape.tech's Duck Store with repeatable, evidence-gated scoring.
+- Rewrote `score.py` with 8 evidence-gated fixes from the first benchmark run: corrected PTT path (`state/ptt.md`), hypothesis status per-block parsing, word-boundary pattern matching, HTTP proof-signature quality gate, auditable per-challenge output, honest compliance reporting (empty history reports UNKNOWN), calibration dry-run mode, and coverage-vs-quality split in output.
+- Added explicit model section to `config.yaml`; profiles do not inherit the default model configuration.
+
 ## 2.0.6
 
 - Resolved the current CodeQL standard quality findings by making intentional exception fallbacks explicit and removing unused test and hypothesis variables.

distribution.yaml

@@ -1,24 +1,25 @@
-# violin - supervised agentic Hermes pentest profile
 name: violin
-version: 2.0.6
-description: "A supervised agentic Hermes penetration testing profile for authorised Kali/Parrot-based security assessment, reconnaissance, exploit validation, and reporting workflows."
-hermes_requires: ">=0.18.0"
-author: "Violin contributors"
+version: 2.0.8
+description: A supervised agentic Hermes penetration testing profile for authorised
+  Kali/Parrot-based security assessment, reconnaissance, exploit validation, and reporting
+  workflows.
+hermes_requires: '>=0.18.0'
+author: Violin contributors
 license: MIT
 env_requires: []
 distribution_owned:
-  - distribution.yaml
-  - README.md
-  - CHANGELOG.md
-  - LICENSE
-  - SOUL.md
-  - .hermes.md
-  - CONTRIBUTING.md
-  - SECURITY.md
-  - config.yaml
-  - pyproject.toml
-  - skills/
-  - scripts/
-  - plugins/
-  - assets/
-  - .github/
+- distribution.yaml
+- README.md
+- CHANGELOG.md
+- LICENSE
+- SOUL.md
+- .hermes.md
+- CONTRIBUTING.md
+- SECURITY.md
+- config.yaml
+- pyproject.toml
+- skills/
+- scripts/
+- plugins/
+- assets/
+- .github/

plugins/violin_guard/plugin.yaml

@@ -1,31 +1,32 @@
 name: violin-guard
-version: "2.0.6"
-description: Typed scope guards and an execute-and-record boundary with bounded synchronization windows.
+version: 2.0.8
+description: Typed scope guards and an execute-and-record boundary with bounded synchronization
+  windows.
 kind: standalone
 provides_tools:
-  - violin_check_command
-  - violin_record_ptt
-  - violin_record_hypothesis
-  - violin_exec
-  - violin_exec_status
-  - violin_exec_cancel
-  - violin_review_batch
-  - violin_rebind_pending_batch
-  - violin_heartbeat_done
-  - violin_exec_burst
-  - violin_target
-  - violin_status
-  - violin_search_exploit
-  - violin_httpx
-  - violin_nuclei
-  - violin_ffuf
-  - violin_listener
+- violin_check_command
+- violin_record_ptt
+- violin_record_hypothesis
+- violin_exec
+- violin_exec_status
+- violin_exec_cancel
+- violin_review_batch
+- violin_rebind_pending_batch
+- violin_heartbeat_done
+- violin_exec_burst
+- violin_target
+- violin_status
+- violin_search_exploit
+- violin_httpx
+- violin_nuclei
+- violin_ffuf
+- violin_listener
 hooks:
-  - pre_tool_call
-  - post_tool_call
-  - pre_llm_call
-  - on_session_reset
-  - on_session_finalize
+- pre_tool_call
+- post_tool_call
+- pre_llm_call
+- on_session_reset
+- on_session_finalize
 toolsets:
   violin_guard:
     description: Violin engagement guard tools