Release v1.2.0: close all milestone issues (security, perf, features, docs)

.github/ISSUE_TEMPLATE/bug_report.md

@@ -0,0 +1,42 @@
+---
+name: Bug report
+about: Create a report to help us improve Ruby Skill Bench
+title: '[BUG] '
+labels: bug
+---
+
+## Description
+
+A clear and concise description of what the bug is.
+
+## Steps to Reproduce
+
+1. Go to '...'
+2. Run command '...'
+3. See error
+
+## Expected Behavior
+
+A clear and concise description of what you expected to happen.
+
+## Actual Behavior
+
+A clear and concise description of what actually happened.
+
+## Environment
+
+- Ruby version:
+- Ruby Skill Bench version:
+- Operating system:
+
+## Logs / Error Messages
+
+Please paste any error messages and stack traces below. If the output is long, consider using a `<details>` block.
+
+```text
+Paste logs here
+```
+
+## Additional Context
+
+Add any other context about the problem here.

.github/ISSUE_TEMPLATE/config.yml

@@ -0,0 +1,5 @@
+blank_issues_enabled: false
+contact_links:
+  - name: Questions and discussions
+    url: https://github.com/igmarin/ruby-skill-bench/discussions
+    about: Please use GitHub Discussions for questions, support, or general discussion.

.github/ISSUE_TEMPLATE/feature_request.md

@@ -0,0 +1,22 @@
+---
+name: Feature request
+about: Suggest an idea for Ruby Skill Bench
+title: '[FEATURE] '
+labels: enhancement
+---
+
+## Problem / Motivation
+
+A clear and concise description of the problem or limitation you're facing. Ex. I'm always frustrated when [...]
+
+## Proposed Solution
+
+A clear and concise description of what you want to happen.
+
+## Alternatives Considered
+
+A clear and concise description of any alternative solutions or features you've considered.
+
+## Additional Context
+
+Add any other context, screenshots, or examples about the feature request here.

.github/PULL_REQUEST_TEMPLATE.md

@@ -0,0 +1,25 @@
+## Summary
+
+Brief description of the changes in this pull request.
+
+## Related Issue
+
+Closes #
+
+## Type of Change
+
+- [ ] Bug fix
+- [ ] New feature
+- [ ] Breaking change
+- [ ] Documentation update
+- [ ] Refactoring / code cleanup
+
+## Checklist
+
+- [ ] Tests added or updated
+- [ ] `bundle exec rake test` passes
+- [ ] `bundle exec rubocop` passes
+- [ ] `bundle exec reek` passes
+- [ ] `bundle exec rake yard:coverage` passes
+- [ ] CHANGELOG.md has been updated
+- [ ] Documentation has been updated

.reek.yml

@@ -51,6 +51,7 @@ detectors:
     enabled: false
   ControlParameter:
     exclude:
+      - "SkillBench::Cli::BatchResultPrinter#self.batch_output"
       - "SkillBench::Commands::Run#validate_api_key"
       - "SkillBench::Execution::ContextHydrator#initialize"
       - "SkillBench::EvaluateCommand#print_parse_error"
@@ -128,6 +129,7 @@ detectors:
       - "SkillBench::Criteria#assign_attributes"
       - "SkillBench::Dimension#=="
       - "SkillBench::Evaluation::Runner#compute_deltas"
+      - "SkillBench::Services::SummaryFormatter#total_cost"   # Reduces a collected costs array — array manipulation is the domain
       - "SkillBench::Judge::Prompt#criteria_section"
       - "SkillBench::Judge::Response#extract_dimensions"
       - "SkillBench::CLI#handle_eval"
@@ -173,6 +175,7 @@ detectors:
       - "SkillBench::Services::RunnerService#build_client_params"       # Builder method — naturally manipulates params and provider hashes
   BooleanParameter:
     exclude:
+      - "SkillBench::Cli::BatchResultPrinter#self.call"   # summary: toggles the JSON gate — part of the documented CI signature
       - "SkillBench::Commands::Init#self.run"
       - "SkillBench::Clients::BaseUrlValidator#self.call"  # Named transport flags (has_credential/allow_insecure) — security policy inputs
   UtilityFunction:
@@ -256,4 +259,6 @@ detectors:
       - "SkillBench::Clients::RetryHandler#extract_status"   # Duck-type dispatch across Faraday error classes with different APIs
       - "SkillBench::OutputFormatter#self.format_junit"      # Duck-type dispatch for backward compatibility with legacy result format
       - "SkillBench::Services::FeedbackGenerator#self.feedback_applicable?"  # Duck-type guard for DeltaReport vs plain objects
-      - "SkillBench::Services::JUnitFormatter#self.format"   # Duck-type dispatch for backward compatibility with legacy result format
+      - "SkillBench::Services::JUnitFormatter#self.passing?"  # Duck-type dispatch for backward compatibility with legacy result format
+      - "SkillBench::Services::JUnitFormatter#self.score_for" # Duck-type dispatch for backward compatibility with legacy result format
+      - "SkillBench::Services::SummaryFormatter#delta_entry"  # Duck-type guard for DeltaReport vs results without a report

.rubocop.yml

@@ -19,6 +19,7 @@ Metrics/MethodLength:
 
 Metrics/ParameterLists:
   Max: 6
+  CountKeywordArgs: false
 
 Metrics/AbcSize:
   Max: 50

CHANGELOG.md

@@ -12,16 +12,30 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 > In progress — the v1.2.0 quality program (security, performance, documentation, examples). The release date is set when the version is tagged.
 
 ### Added
+- `skill-bench validate` (alias `doctor`): a pre-flight check that validates `criteria.json` via `CriteriaValidator`, schema-checks `skill-bench.json`, and reports missing provider API keys — all without running an eval or hitting the network (#45).
+- `--format html`: a self-contained HTML report rendering the delta-score table and the baseline/context iteration timelines, with all dynamic text escaped (#44).
+- Per-run token & cost accounting: agent token usage is threaded through the run, an estimated USD cost is shown in the human report (`Tokens: N | Est. Cost: $X.XXXX`) and exposed in JSON output; new `Services::CostCalculator` with a per-model price table (#40).
+- Opt-in content-addressed response caching via `--cache` / `SKILL_BENCH_CACHE`: identical agent/judge calls — notably `compare`'s twice-run skill-less baseline — reuse a cached response instead of hitting the network. Default off (#42).
+- Batch CI surfaces: a `--summary` JSON gate (aggregate pass/fail counts, summed tokens/cost, worst-delta eval) and per-eval `<testcase>` aggregation in JUnit output, plus a top-level composite `action.yml` so downstream repos can gate skill changes with `uses: igmarin/ruby-skill-bench@v1` (#46).
+- Mistral provider, an OpenAI-compatible client subclass (#47).
+- `skill-bench init --mock` scaffolds a ready-to-run offline `mock` config (`{"provider":"mock","max_execution_time":30}`) (#53).
+- Community-health files: `CODE_OF_CONDUCT.md` (Contributor Covenant 2.1), issue templates, and a pull-request template (#38).
 - Runnable, fully offline `examples/offline-quickstart/` that demonstrates a complete eval with the built-in `mock` provider — no API keys, no network (#49).
 - Example files are now tracked: removed the blanket `examples/` rule from `.gitignore` (#48).
 
+### Security
+- Documented that the command allowlist authorizes only the base token, so any allowlisted wrapper binary (`rake`, `rspec`, `make`, `find`, `git`) is equivalent to arbitrary host execution, and tied this to the fail-closed host-execution model. Added an optional, default-off `command_argument_constraints` hook to constrain high-risk allowed commands (#21).
+
 ### Performance
+- Provider resolution now parses `skill-bench.json` at most once per run via an mtime-memoized load, removing a redundant per-run file read + parse (#31).
 - Baseline and context agent runs now execute concurrently, roughly halving the dominant agent phase of a run. The previously unused `parallel` dependency is now wired into the active `RunnerService` path (#26).
 
 ### Fixed
+- An explicit `{"provider":"mock"}` config no longer prints a misleading "Config load failed" warning on a clean offline run; genuine load failures (missing/broken config) still warn (#54).
 - `Judge::Prompt` no longer emits an empty `## Skill Context` section on baseline (skill-less) runs. The empty header had caused the `mock` provider to score baseline and context identically (delta 0); baseline prompts are now cleaner and offline scoring is correct (#58).
 
 ### Documentation
+- `docs/architecture.md` now shows the correct `.skill-bench-trends.json` filename and notes the `.skill-bench-trends.json.bak` auto-backup (#39).
 - Corrected the evaluation-history filename throughout the README and docs: the engine writes `.skill-bench-trends.json`, not the previously-documented `.skill-bench-history.json` (#34).
 
 ## [1.1.0] - 2026-06-23

CODE_OF_CONDUCT.md

@@ -0,0 +1,133 @@
+# Contributor Covenant Code of Conduct
+
+## Our Pledge
+
+We as members, contributors, and leaders pledge to make participation in our
+community a harassment-free experience for everyone, regardless of age, body
+size, visible or invisible disability, ethnicity, sex characteristics, gender
+identity and expression, level of experience, education, socio-economic status,
+nationality, personal appearance, race, religion, or sexual identity
+and orientation.
+
+We pledge to act and interact in ways that contribute to an open, welcoming,
+diverse, inclusive, and healthy community.
+
+## Our Standards
+
+Examples of behavior that contributes to a positive environment for our
+community include:
+
+* Demonstrating empathy and kindness toward other people
+* Being respectful of differing opinions, viewpoints, and experiences
+* Giving and gracefully accepting constructive feedback
+* Accepting responsibility and apologizing to those affected by our mistakes,
+  and learning from the experience
+* Focusing on what is best not just for us as individuals, but for the
+  overall community
+
+Examples of unacceptable behavior include:
+
+* The use of sexualized language or imagery, and sexual attention or
+  advances of any kind
+* Trolling, insulting or derogatory comments, and personal or political attacks
+* Public or private harassment
+* Publishing others' private information, such as a physical or email
+  address, without their explicit permission
+* Other conduct which could reasonably be considered inappropriate in a
+  professional setting
+
+## Enforcement Responsibilities
+
+Community leaders are responsible for clarifying and enforcing our standards of
+acceptable behavior and will take appropriate and fair corrective action in
+response to any behavior that they deem inappropriate, threatening, offensive,
+or harmful.
+
+Community leaders have the right and responsibility to remove, edit, or reject
+comments, commits, code, wiki edits, issues, and other contributions that are
+not aligned to this Code of Conduct, and will communicate reasons for moderation
+decisions when appropriate.
+
+## Scope
+
+This Code of Conduct applies within all community spaces, and also applies when
+an individual is officially representing the community in public spaces.
+Examples of representing our community include using an official e-mail address,
+posting via an official social media account, or acting as an appointed
+representative at an online or offline event.
+
+## Enforcement
+
+Instances of abusive, harassing, or otherwise unacceptable behavior may be
+reported to the community leaders responsible for enforcement at
+[ismael.marin@gmail.com](mailto:ismael.marin@gmail.com).
+
+All complaints will be reviewed and investigated promptly and fairly.
+
+All community leaders are obligated to respect the privacy and security of the
+reporter of any incident.
+
+## Enforcement Guidelines
+
+Community leaders will follow these Community Impact Guidelines in determining
+the consequences for any action they deem in violation of this Code of Conduct:
+
+### 1. Correction
+
+**Community Impact**: Use of inappropriate language or other behavior deemed
+unprofessional or unwelcome in the community.
+
+**Consequence**: A private, written warning from community leaders, providing
+clarity around the nature of the violation and an explanation of why the
+behavior was inappropriate. A public apology may be requested.
+
+### 2. Warning
+
+**Community Impact**: A violation through a single incident or series
+of actions.
+
+**Consequence**: A warning with consequences for continued behavior. No
+interaction with the people involved, including unsolicited interaction with
+those enforcing the Code of Conduct, for a specified period of time. This
+includes avoiding interactions in community spaces as well as external channels
+like social media. Violating these terms may lead to a temporary or
+permanent ban.
+
+### 3. Temporary Ban
+
+**Community Impact**: A serious violation of community standards, including
+sustained inappropriate behavior.
+
+**Consequence**: A temporary ban from any sort of interaction or public
+communication with the community for a specified period of time. No public or
+private interaction with the people involved, including unsolicited interaction
+with those enforcing the Code of Conduct, is allowed during this period.
+Violating these terms may lead to a permanent ban.
+
+### 4. Permanent Ban
+
+**Community Impact**: Demonstrating a pattern of violation of community
+standards, including sustained inappropriate behavior, harassment of an
+individual, or aggression toward or disparagement of classes of individuals.
+
+**Consequence**: A permanent ban from any sort of public interaction within
+the community.
+
+## Attribution
+
+This Code of Conduct is adapted from the [Contributor Covenant][homepage],
+version 2.1, available at
+[https://www.contributor-covenant.org/version/2/1/code_of_conduct.html][v2.1].
+
+Community Impact Guidelines were inspired by
+[Mozilla's code of conduct enforcement ladder][Mozilla CoC].
+
+For answers to common questions about this code of conduct, see the FAQ at
+[https://www.contributor-covenant.org/faq][FAQ]. Translations are available
+at [https://www.contributor-covenant.org/translations][translations].
+
+[homepage]: https://www.contributor-covenant.org
+[v2.1]: https://www.contributor-covenant.org/version/2/1/code_of_conduct.html
+[Mozilla CoC]: https://github.com/mozilla/diversity
+[FAQ]: https://www.contributor-covenant.org/faq
+[translations]: https://www.contributor-covenant.org/translations