v1.4.0 - Security Hardening, Node 22, Expanded Test Suite

What's Changed

Security

• Pinned all dependency versions to exact (removed caret/tilde ranges) to prevent supply chain drift
• Fixed 3 dev dependency vulnerabilities (brace-expansion, minimatch, picomatch)
• Pinned GitHub Actions to commit SHAs to prevent tag-hijack attacks
• Added npm audit job to CI pipeline
• Added least-privilege permissions to all workflows

Added

• Expanded test suite from 10 to 48 tests (CLI, templates, security, package integrity)
• .npmrc with security defaults (save-exact, audit-on-install)
• .github/dependabot.yml for automated dependency and GitHub Actions update PRs

Changed

• Minimum Node.js version raised to 22 (dropped EOL Node 16, 18, 20)
• CI now tests on Node 22 and 24
• Updated SECURITY.md, README.md, CHANGELOG.md

Full Changelog: v1.3.1...v1.4.0

v1.3.1

Changed

• Updated test assertions to use generic PII-detection patterns for broader coverage
• Hardened .gitignore with additional security patterns (.env, *.key, *.pem, .claude/, editor swap files)

v1.3.0 — RAM, Multi-Session Memory, Git Push Directive, Zero Sycophancy

What's New

New Template: _RAM.md — Single-Session Volatile Memory

Like actual RAM in a computer. Holds the exact working state of the current session so that if the session is killed, context overflows, or work is interrupted, the next session can recover exactly where it left off.

• Written to continuously throughout the session
• Overwritten (not appended) — always reflects current state
• Deleted at session end when work is committed/saved
• Includes recovery checklist and template structure

Redefined: _SHORT-TERM-MEMORY.md — Multi-Session Context

Previously handled single-session crash recovery (now handled by _RAM.md). Redefined as multi-session temporary memory that persists across 4-10 sessions:

• Active issues being debugged or improved
• In-progress feature work spanning multiple sessions
• Temporary decisions and cross-session context
• Includes staleness rule: review entries older than 2 weeks

Three-Tier Memory Hierarchy

_RAM.md                    _SHORT-TERM-MEMORY.md       _LONG-TERM-MEMORY.md
 - Single session only      - Persists 4-10 sessions    - NEVER delete
 - Crash recovery           - Active issues & work       - Permanent knowledge
 - Written continuously     - Updated between sessions   - Accumulates over time
 - Deleted at session end   - Deleted when resolved      - Always available

New Golden Rules

Rule #5: Suggest Pushing After Major Fixes
After resolving significant bugs or completing iterated-on improvements, Claude suggests committing and pushing to the user's backup system (git, Gitea, GitHub, etc.). Suggest only — never auto-push.

Rule #6: Maintain _RAM.md Continuously
Claude must write session state to _RAM.md throughout every working session. Create when work begins, update after every meaningful action, write before risky operations.

Zero Sycophancy Rule (_VOICE-AND-TONE.md)

New core principle: every token spent flattering the user is a token NOT spent writing correct code. No "sick idea," no "brilliant," no "game-changing." Substance only.

• Expanded Words & Phrases to AVOID with comprehensive ban list organized into categories
• Core principles: never praise ideas, never editorialize about quality, spend 100% of output on substance

Updated Session Load Order

0. _RAM.md                       ← IF EXISTS: recover interrupted session
1. _SHORT-TERM-MEMORY.md         ← IF EXISTS: multi-session context
2. _VOICE-AND-TONE.md            ← Personality and language style
3-10. [rest of chain]
11. BEGIN conversation

Stats

• 11 templates (up from 10)
• 10 tests passing
• Zero PII — all templates use generic placeholders

---

Full Changelog: v1.2.0...v1.3.0

v1.2.0 — Voice & Tone + Design Preferences

Two new templates that give you fine-grained control over how Claude talks and how Claude designs. Framework now ships 10 templates.

What's new

🎙️ Voice & Tone template (_VOICE-AND-TONE.md)

Loaded as step 1 in the session load order — Claude's personality is established before it reads anything else.

Control every aspect of how Claude communicates:

• Personality settings — Formality, confidence, warmth, humor, and energy level (table format, pick your settings)
• Attitude — Define the working relationship vibe: pair-programmer, terse expert, patient teacher, whatever fits your style
• Vocabulary control — Set technical level, sentence length, contractions, and specific words/phrases to use or avoid
• Banned phrases — Pre-populated with common annoyances: "Certainly!", "Great question!", "As an AI...", "leverage", "robust", etc.
• Response structure — Lead with answer or context? Code first or prose first? Bullets or paragraphs? Length by context type
• Code comment style — Frequency, format, TODO conventions, docstring policy
• Commit message format — Conventional commits, freeform, imperative mood — your call
• Error communication — How blunt or diplomatic to be, how to handle uncertainty, how to disagree with you
• Contextual adjustments — Different tones for debugging vs. exploring vs. urgent fixes vs. code review

Every section is customizable with <!-- CUSTOMIZE --> comments and [placeholder] values.

🎨 Design Preferences template (_DESIGN-PREFERENCES.md)

Enforces visual design rules across all UI work:

• Lighter hover colors only — NEVER darken on hover. Scoped to interactive elements only (buttons, links, clickable cards) — no hover effects on static content like headings or paragraphs
• Accessibility (MANDATORY) — WCAG AA contrast minimums, keyboard navigation, screen reader support, semantic HTML, prefers-reduced-motion respect
• Typography — Hierarchy, readability guidelines (16px minimum, 1.5+ line height, 45-75 char line length), responsive units
• Flat iconography — Tasteful, minimal, single-color icons to reinforce content/categories/steps. No 3D, no decoration-only icons. Always paired with labels
• UX principles — Consistent spacing scale, progressive disclosure, forgiving inputs, visible feedback on all interactions

📋 Updated session load order

0. _SHORT-TERM-MEMORY.md    ← IF EXISTS (resume interrupted work)
1. _VOICE-AND-TONE.md       ← READ FIRST — personality and language style
2. _GOLDEN-RULES.md         ← BINDING rules — MUST FOLLOW every session
3. _TODOS.md                ← Pending work
4. _LESSONS-LEARNED.md      ← Avoid past mistakes
5. _LONG-TERM-MEMORY.md     ← Persistent knowledge
6. _CONVERSATION-PREFERENCES.md  ← Output formatting
7. _DESIGN-PREFERENCES.md   ← Visual design and UX rules
8. _GOLDEN-RULES.md         ← Re-read (prevent context decay)
9. CLAUDE.md                ← Full project context
10. BEGIN conversation

Voice & Tone is now step 1 — it colors everything Claude says and does for the rest of the session. Golden Rules moved to step 2 as the BINDING enforcement layer that must be consumed and followed every session.

Other changes

• CLI --full mode now installs 10 templates (up from 8)
• Anchor Files Reference table updated with FIRST priority for voice/tone and BINDING for golden rules
• All tests updated and passing (10/10)
• PII scan confirms zero personal information in any template

Install / Upgrade

# New project
npx claude-anchor --full

# Existing project — add just the new templates
npx claude-anchor --full          # Won't overwrite existing files

# Full refresh — overwrite everything
npx claude-anchor --full --force

All 10 templates

#	File	Purpose
1	CLAUDE.md	Project context + session load order
2	_VOICE-AND-TONE.md	Personality, attitude, language style
3	_GOLDEN-RULES.md	Immutable security/behavior constraints
4	_TODOS.md	Priority-based task tracking
5	_LESSONS-LEARNED.md	Past mistakes with root cause + prevention
6	_CONVERSATION-PREFERENCES.md	Output formatting and display
7	_DESIGN-PREFERENCES.md	Visual design, accessibility, UX rules
8	_LONG-TERM-MEMORY.md	Persistent knowledge (NEVER delete)
9	_SHORT-TERM-MEMORY.md	Session context (delete when done)
10	_SYSTEM_ARCHITECTURE.md	Technical diagrams and system design

---

Two repos, two tools, complementary not competitive:

• Claude Anchor — the behavioral brain
• Claude Conductor — the codebase brain

v1.1.0 — Batteries Included

Batteries included! Every template now teaches Claude how to use it automatically — zero configuration needed.

What's new

Instructions for Claude in every template

All 8 templates now include an "Instructions for Claude" section that explains:

• When and how to read the file
• How to reference it during sessions
• When and how to update it
• What to do when content changes

Claude Anchor now works out of the box. Drop the files in your project and Claude knows exactly what each one is for.

Starter security rules

_GOLDEN-RULES.md ships with 4 foundational security rules:

1. No credentials in code — API keys, tokens, and secrets stay out of source control
2. No PII exposure — personal data stays out of code, logs, and documentation
3. Confirm before destructive operations — deletions, deploys, and force-pushes require confirmation
4. Validate before you trust — input validation at all system boundaries

These are universally applicable. Keep them, modify them, or add your own.

Session load order improvements

• _SHORT-TERM-MEMORY.md is now step 0 — if it exists, Claude reads it first to resume interrupted work
• _LONG-TERM-MEMORY.md is now explicitly in the load sequence
• Load order filenames fixed to match actual template names (underscore prefixes)

Other improvements

• Security-focused example added to _LESSONS-LEARNED.md (credential leak prevention)
• PII privacy warnings in memory templates
• Staleness detection guidance for short-term memory (7-day age check)
• Cross-linking between templates using relative markdown links
• Anchor Files Reference table in CLAUDE.md
• Version footers in all templates for future upgrade detection
• npx claude-anchor CLI with --full and --force flags

Upgrade from 1.0.0

npx claude-anchor --force        # Overwrite with new templates
npx claude-anchor --full --force  # All 8 templates

---

Two repos, two tools, complementary not competitive:

• Claude Anchor — the behavioral brain
• Claude Conductor — the codebase brain

v1.0.0 — Claude Anchor

First release! Claude Anchor gives Claude persistent memory, enforceable rules, and behavioral consistency across sessions.

What's in the box

7 markdown templates you copy into your project:

• CLAUDE.md -- Session load order and project context
• _GOLDEN-RULES.md -- Immutable constraints Claude must follow (read twice per session to prevent context decay)
• _TODOS.md -- Priority-based task tracking
• _LESSONS-LEARNED.md -- Problem/Cause/Solution/Prevention documentation
• _CONVERSATION-PREFERENCES.md -- Output formatting, progress bars, verbosity
• _LONG-TERM-MEMORY.md -- Persistent memory that accumulates over time (never delete)
• _SHORT-TERM-MEMORY.md -- Session context with resume checklist (delete when done)
• _SYSTEM_ARCHITECTURE.md -- ASCII diagrams, data flows, security model

How it works

Copy templates into your project, customize them, and Claude reads them at the start of every session. The mandatory load order ensures critical rules are always enforced and memory carries forward.

Design principles

• No executable code -- Pure markdown, zero dependencies
• No network requests -- Works entirely offline
• No secrets -- Templates explicitly warn against storing credentials
• Works with any project -- Language and platform agnostic

Companion project

Claude Anchor is the behavioral brain -- it tells Claude how to think and behave.
Claude Conductor is the codebase brain -- it tells Claude what your project is.

Two repos, two tools, complementary not competitive. Use one or both.

---

BSD 2-Clause licensed. Made by Super Basic Studio.