PythonWoods · PythonWoods-Dev · Jul 26, 2026 · Jul 26, 2026 · Jul 26, 2026 · Jul 26, 2026
diff --git a/.bumpversion.toml b/.bumpversion.toml
@@ -2,7 +2,7 @@
 # SPDX-License-Identifier: Apache-2.0
 
 [tool.bumpversion]
-current_version = "0.25.2"
+current_version = "0.25.3"
 parse = "(?P<major>\\d+)\\.(?P<minor>\\d+)\\.(?P<patch>\\d+)((?P<pre_l>a|b|rc)(?P<pre_n>\\d+))?"
 serialize = [
     "{major}.{minor}.{patch}{pre_l}{pre_n}",
@@ -72,8 +72,8 @@ replace = "- [ ] `pyproject.toml` version matches the tag (`{new_version}`)"
 
 [[tool.bumpversion.files]]
 filename = "RELEASE.md"
-search = 'git tag -s -S -m "Release v{current_version}" v{current_version}'
-replace = 'git tag -s -S -m "Release v{new_version}" v{new_version}'
+search = 'git tag -s -m "Release v{current_version}" v{current_version}'
+replace = 'git tag -s -m "Release v{new_version}" v{new_version}'
 
 
 [[tool.bumpversion.files]]

diff --git a/.github/ISSUE_TEMPLATE/security_vulnerability.yml b/.github/ISSUE_TEMPLATE/security_vulnerability.yml
@@ -29,7 +29,7 @@ body:
     attributes:
       label: Zenzic version
       description: Output of `zenzic --version`
-      placeholder: "0.25.2"
+      placeholder: "0.25.3"
     validations:
       required: true
 

diff --git a/.pre-commit-hooks.yaml b/.pre-commit-hooks.yaml
@@ -7,7 +7,7 @@
 #
 #   repos:
 #     - repo: https://github.com/PythonWoods/zenzic
-#       rev: v0.25.2
+#       rev: v0.25.3
 #       hooks:
 #         - id: zenzic-verify    # quality gate — corrisponde a `just verify` lato zenzic
 #         - id: zenzic-guard     # fast staged-file credential scan

diff --git a/CHANGELOG.md b/CHANGELOG.md
@@ -11,13 +11,20 @@ Versions follow [Semantic Versioning](https://semver.org/).
 
 ## [Unreleased]
 
+## [0.25.3] - 2026-07-26
+
+### Added
+
+- **AST Reference Link Definition Extraction (`CORE-FIX-001`)**: Upgraded `PolyglotExtractor` to natively extract Markdown Reference Link Definitions (`[label]: dest`) with CommonMark §4.7 first-definition-wins semantics and full code fence masking (`_mask_fences`), eliminating false-positive `Z405` (Unused Asset) findings.
+- **Zensical Framework Feature Parity (`ADAPTER-002`/`ADAPTER-003`)**: Upgraded `ZensicalAdapter` with preserved static asset URL mapping, route classification for root/directory index pages (`index.md`) and dynamic blog routes (`<blog_dir>/posts/`), and theme asset metadata extraction (`favicon`, `logo`, `extra_css`, `extra_javascript`).
+
+
 ## [0.25.2] - 2026-07-26
 
 ### Fixed
 
 - **Path Traversal Security Parity (`LSP-FIX-012`)**: Hardened `Z202`/`Z203` path traversal evaluation in `IncrementalAnalysisEngine._run_urp_checks()` by replacing absolute OS filesystem depth checks (`len(path.parents)`) with `docs_root`-boundary escape detection (`os.path.normpath` + `is_relative_to(resolved_docs_root)`). This guarantees 100% security parity between CLI and LSP mode.
 
-
 ## [0.25.1] - 2026-07-26
 
 ### Added
@@ -29,7 +36,6 @@ Versions follow [Semantic Versioning](https://semver.org/).
 
 - **Inline HTML Suppression LSP Parity (`LSP-FIX-011`)**: Updated `IncrementalAnalysisEngine._run_urp_checks()` to pass the active `SuppressionTracker` when evaluating Polyglot Extractor nodes. Suppressed HTML elements (`data-zenzic-ignore`) are now correctly marked as consumed, eliminating spurious `Z603` (Dead Suppression) warnings in editor sessions.
 
-
 ## [0.25.0] - 2026-07-25
 
 ### Added

diff --git a/CITATION.cff b/CITATION.cff
@@ -15,7 +15,7 @@ abstract: >-
   performs deterministic static analysis using a two-pass reference
   pipeline and a RE2-backed credential scanner, with zero subprocess
   calls and full SARIF 2.1.0 support for CI/CD integration.
-version: 0.25.2
+version: 0.25.3
 date-released: 2026-07-26
 url: "https://zenzic.dev"
 repository-code: "https://github.com/PythonWoods/zenzic"

diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md
@@ -22,7 +22,7 @@ Zenzic is structured across three independent, dedicated repositories:
 
 **If you want to contribute to the core analysis engine** (new checks, adapters, bug fixes, CLI features, or performance improvements) — you are in the right place!
 
-> **Brand System** — The visual identity and color palette reference live at  
+> **Brand System** — The visual identity and color palette reference live at
 > <https://zenzic.dev/assets/brand/zenzic-brand-system.html>
 
 ---

diff --git a/README.md b/README.md
@@ -143,7 +143,7 @@ Zenzic Core is headless and emits standardized **SARIF** JSON, ensuring seamless
       "tool": {
         "driver": {
           "name": "zenzic",
-          "version": "0.25.2",
+          "version": "0.25.3",
           "rules": [
             {
               "id": "Z101",
@@ -215,7 +215,7 @@ uv tool upgrade zenzic
 To run a specific version ephemerally without altering your global environment:
 
 ```bash
-uvx zenzic@0.25.2 check all
+uvx zenzic@0.25.3 check all
 ```
 
 ---

diff --git a/RELEASE.md b/RELEASE.md
@@ -8,7 +8,7 @@
 
 | Field    | Value      |
 | :------- | :--------- |
-| Version  | v0.25.2     |
+| Version  | v0.25.3     |
 | Codename | Magnetite   |
 | Date     | 2026-07-26 |
 | Status   | Stable |
@@ -21,7 +21,7 @@ Before tagging, every item must be green:
 - [ ] `zenzic lab all` — all 20 scenarios exit with expected code
 - [ ] `zenzic score --stamp` committed — badge in README.md reflects current score
 - [ ] `zenzic check all .` — zero findings in the repo root
-- [ ] `pyproject.toml` version matches the tag (`0.25.2`)
+- [ ] `pyproject.toml` version matches the tag (`0.25.3`)
 - [ ] `CITATION.cff` version and date updated
 - [ ] `CHANGELOG.md` — `[Unreleased]` section moved to the new version heading
 - [ ] Update SECURITY.md support table (Add new release, demote previous to Critical/EOL).
@@ -53,12 +53,12 @@ git checkout main
 git pull origin main
 
 # 3. Tag the main branch and push
-git tag -s -S -m "Release v0.25.2" v0.25.2
+git tag -s -m "Release v0.25.3" v0.25.3
 git push origin main --tags
 
 ```
 
-- [ ] Create GitHub Release from the tag, using the `## [0.25.2]` CHANGELOG section as the release body.
+- [ ] Create GitHub Release from the tag, using the `## [0.25.3]` CHANGELOG section as the release body.
 
 ## Changelog Reference
 

diff --git a/docs/blog/posts/2026-07-25-zenzic-v0250-lsp-stabilization.md b/docs/blog/posts/2026-07-25-zenzic-v0250-lsp-stabilization.md
@@ -69,11 +69,13 @@ class BaseAdapter(ABC):
 If you maintain a custom third-party adapter subclassing `BaseAdapter`:
 
 1. Update your class definition to override `watched_config_files`:
+
    ```python
    @property
    def watched_config_files(self) -> frozenset[str]:
        return frozenset({"my-framework.config.json"})
    ```
+
 2. First-party adapters (`MkDocsAdapter`, `ZensicalAdapter`) have been updated natively.
 
 ---

diff --git a/docs/developers/how-to/contribute/index.md b/docs/developers/how-to/contribute/index.md
@@ -80,7 +80,6 @@ In this section, we guide you through our processes.
 
 </div>
 
-
   [report a bug]: report-a-bug.md
   [report a docs issue]: report-a-docs-issue.md
   [request a change]: request-a-change.md

diff --git a/docs/developers/how-to/contribute/report-a-bug.md b/docs/developers/how-to/contribute/report-a-bug.md
@@ -72,7 +72,6 @@ the issue.
 | :material-close: __Unclear__ | Anchor validation doesn't work |
 | :material-close: __Useless__ | Help |
 
-
 ### Context <small>optional</small> {#context}
 
 Provide additional context to help us understand what you were trying to

diff --git a/docs/developers/reference/ast-foundations.md b/docs/developers/reference/ast-foundations.md
@@ -17,23 +17,23 @@ Zenzic replaces text matching with a **Lossless Abstract Syntax Tree (AST) Compi
 
 <div class="grid cards" markdown>
 
--   :material-text-search:{ .lg .middle } **Unstructured Text Linter**
+- :material-text-search:{ .lg .middle } **Unstructured Text Linter**
 
     ---
 
-    - Treats Markdown as plain text regex lines
-    - Cannot verify cross-file link targets or heading anchors
-    - Fails to track directory indexes or navigation topology
-    - Produces false positives and non-reproducible runs
+  - Treats Markdown as plain text regex lines
+  - Cannot verify cross-file link targets or heading anchors
+  - Fails to track directory indexes or navigation topology
+  - Produces false positives and non-reproducible runs
 
--   :material-graph-outline:{ .lg .middle } **Zenzic Topological Graph Engine**
+- :material-graph-outline:{ .lg .middle } **Zenzic Topological Graph Engine**
 
     ---
 
-    - Compiles Lossless ASTs and computes a Directed Graph (VSM)
-    - Verifies link targets, anchor references, and nav contracts statically
-    - Enforces hard security boundaries (SAST credential scanner)
-    - Delivers 100% bit-for-bit deterministic execution across platforms
+  - Compiles Lossless ASTs and computes a Directed Graph (VSM)
+  - Verifies link targets, anchor references, and nav contracts statically
+  - Enforces hard security boundaries (SAST credential scanner)
+  - Delivers 100% bit-for-bit deterministic execution across platforms
 
 </div>
 

diff --git a/docs/developers/reference/zenzic-style.md b/docs/developers/reference/zenzic-style.md
@@ -67,6 +67,7 @@ Every icon in the documentation MUST be rendered using native Material for MkDoc
 ```
 
 Examples:
+
 - `:material-bug-outline:`
 - `:material-file-document-edit-outline:`
 - `:material-sparkles:`
@@ -79,7 +80,6 @@ Examples:
 - **Semantic consistency**: If an icon represents "Contribute" on one page, it must be the same icon on every page.
 - **Uniform syntax**: Every icon in a card grid uses native `:material-*: / :octicons-*:` shortcodes.
 
-
 ---
 
 ## 4. Anchor ID Protocol (ZRT-DOC-004) {#anchor-ids}

diff --git a/docs/editor/vscode.md b/docs/editor/vscode.md
@@ -57,7 +57,6 @@ If you use a custom virtual environment or isolated installation, configure `zen
 }
 ```
 
-
 ### Supported Settings
 
 | Setting | Type | Default | Description |

diff --git a/docs/explanation/architecture.md b/docs/explanation/architecture.md
@@ -74,7 +74,6 @@ flowchart TD
 !!! note "ADR-084 Invariant: Centralized Core Governance"
     `directory_policies` and `per_file_ignores` are evaluated centrally in `zenzic.core.governance` to ensure bit-for-bit parity between CLI and LSP verification suites.
 
-
 ### Pass 1 -- Harvest and Credential Scan {#pass-1}
 
 Pass 1 reads every `.md` and `.md` file under `docs/` and performs three coordinated operations:

diff --git a/docs/explanation/community-index.md b/docs/explanation/community-index.md
@@ -61,7 +61,6 @@ ecosystem tools referenced in this documentation are third-party projects.
 
 </div>
 
-
 ## License {#license}
 
 <!-- SPDX-FileCopyrightText: 2026 PythonWoods <dev@pythonwoods.dev> -->

diff --git a/docs/how-to/configure-ci-cd.md b/docs/how-to/configure-ci-cd.md
@@ -61,7 +61,6 @@ Zenzic enforces a non-negotiable exit code contract across all operating systems
 
 === "GitHub Action Wrapper (Recommended)"
 
-
     The official [`PythonWoods/zenzic-action`](https://github.com/PythonWoods/zenzic-action) provides zero-config integration with automatic SARIF upload:
 
     ```yaml title=".github/workflows/zenzic.yml"

diff --git a/docs/how-to/install.md b/docs/how-to/install.md
@@ -82,7 +82,6 @@ environment. They are not needed. The linting environment has one dependency: `z
 uvx zenzic check all
 ```
 
-
 !!! note "Third-party engine adapters"
     Third-party adapters (e.g. a hypothetical `zenzic-hugo-adapter`) are separate
     installable packages — not extras of `zenzic` itself. No extra is required for

diff --git a/docs/index.md b/docs/index.md
@@ -12,7 +12,7 @@ description: "Zenzic is a deterministic document integrity engine and SAST for M
 <!-- SPDX-FileCopyrightText: 2026 PythonWoods <dev@pythonwoods.dev> -->
 <!-- SPDX-License-Identifier: Apache-2.0 -->
 
-## Treat your Markdown documentation like production code.
+## Treat your Markdown documentation like production code
 
 Zenzic detects broken links, orphaned pages, credential leaks, and structural integrity issues before they reach production. Every run is bit-for-bit deterministic, zero-LLM, and backed by a non-backtracking RE2 regex engine.
 
@@ -26,7 +26,6 @@ Zenzic is structured into three dedicated delivery mechanisms to support your en
 - **[VS Code Extension](https://github.com/PythonWoods/zenzic-vscode)**: Real-time LSP client providing sub-50ms inline diagnostics, automated Quick Fixes, and DQS status bar streaming.
 - **[GitHub Action](https://github.com/PythonWoods/zenzic-action)**: Zero-config CI/CD quality gate with SARIF upload directly to GitHub Code Scanning and PR annotations.
 
-
 ---
 
 ## 🚀 Deterministic 3-Step Quickstart (< 60 Seconds)
@@ -59,13 +58,17 @@ FAILED: Hard errors detected. Exit code 1 is mandatory.
 ## 🛡️ Why Zenzic?
 
 ### 100% Determinism
+
 Every Zenzic run is a pure function of its inputs. Given the same repository state and `.zenzic.toml`, the output — finding codes, severity levels, exit code, SARIF structure — is **bit-for-bit identical** across machines, platforms, and time. No probabilistic guessing, no LLM sampling, no network dependencies.
 
 ### Documentation Security (SAST)
+
 Zenzic treats documentation as a **security surface**. The tiered code model enforces a hard boundary between quality findings (suppressible, exit 1) and security findings (non-suppressible, exit 2/3):
+
 - **Z201 — Credential Scanner:** Hardcoded tokens, API keys, and secret patterns detected before reaching PRs.
 - **Z202 / Z203 — Path Traversal Guard:** Filesystem boundary security violations caught at scan boundaries.
 - **Suppression CAP:** Configurable ceiling on total active `zenzic:ignore` suppressions.
 
 ### Zero Hallucinations
+
 Zenzic reports only what is **statically verifiable** in the repository at scan time. Every finding is a falsifiable, reproducible fact — suitable as audit evidence for security reviewers and compliance teams.
diff --git a/docs/reference/cli.md b/docs/reference/cli.md
@@ -128,7 +128,6 @@ Select a command tab to view its execution flags, default behaviors, and usage e
 
 ## Shared Execution Flags
 
-
 ## Global flags {#global-flags}
 
 These flags control Zenzic's signal-to-noise profile across routine scans, CI gates,

diff --git a/docs/reference/suppression-policy.md b/docs/reference/suppression-policy.md
@@ -19,23 +19,23 @@ Zenzic replaces unmonitored ignore tags with a **Managed Technical Debt Governan
 
 <div class="grid cards" markdown>
 
--   :material-shield-check:{ .lg .middle } **Managed Technical Debt (Clean/Bounded)**
+- :material-shield-check:{ .lg .middle } **Managed Technical Debt (Clean/Bounded)**
 
     ---
 
-    - Explicitly declared exceptions with audit trails
-    - Bounded by the strict `suppression_cap` ceiling
-    - Emits `[MANAGED DEBT]` audit status in CLI & CI
-    - Deducts Quality Score points to reflect true visibility
+  - Explicitly declared exceptions with audit trails
+  - Bounded by the strict `suppression_cap` ceiling
+  - Emits `[MANAGED DEBT]` audit status in CLI & CI
+  - Deducts Quality Score points to reflect true visibility
 
--   :material-alert-decagram:{ .lg .middle } **Uncontrolled Architectural Drift**
+- :material-alert-decagram:{ .lg .middle } **Uncontrolled Architectural Drift**
 
     ---
 
-    - Unmonitored ignore tags scattered across codebases
-    - Hidden security vulnerabilities (credentials, path traversals)
-    - Zero audit trails or visibility into debt growth
-    - Causes silent PR breakages and customer-facing 404s
+  - Unmonitored ignore tags scattered across codebases
+  - Hidden security vulnerabilities (credentials, path traversals)
+  - Zero audit trails or visibility into debt growth
+  - Causes silent PR breakages and customer-facing 404s
 
 </div>
 

diff --git a/mkdocs.yml b/mkdocs.yml
@@ -224,7 +224,7 @@ extra:
   # ADR-037: No hardcoded SemVer in any .html or .md source.
   # CI pipeline passes the current version at build time, e.g.:
   #   uv run mkdocs build --extra zenzic_version=0.14.1
-  zenzic_version: "0.25.2"  # release sync
+  zenzic_version: "0.25.3"  # release sync
   social:
     - icon: fontawesome/brands/github
       link: https://github.com/PythonWoods/zenzic

diff --git a/pyproject.toml b/pyproject.toml
@@ -13,7 +13,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "zenzic"
-version = "0.25.2"
+version = "0.25.3"
 description = "Deterministic Document Integrity Engine and SAST for Markdown/MDX graphs."
 readme = "README.md"
 requires-python = ">=3.10"

diff --git a/src/zenzic/__init__.py b/src/zenzic/__init__.py
@@ -2,5 +2,5 @@
 # SPDX-License-Identifier: Apache-2.0
 """Zenzic — engine-agnostic static analyzer and credential scanner for Markdown documentation."""
 
-__version__ = "0.25.2"
+__version__ = "0.25.3"
 __version_name__ = "Basalt"  # Release codename stored separately from the package version.
diff --git a/src/zenzic/cli/_standalone.py b/src/zenzic/cli/_standalone.py
@@ -1588,7 +1588,7 @@ def _scaffold_plugin(repo_root: Path, plugin_name: str, force: bool) -> None:
 description = "Custom Zenzic plugin rule package"
 readme = "README.md"
 requires-python = ">=3.11"
-dependencies = ["zenzic>=0.25.2"]
+dependencies = ["zenzic>=0.25.3"]
 
 [project.entry-points."zenzic.rules"]
 {project_slug} = "{module_name}.rules:{class_name}"
-Original file line number
+Diff line change
@@ Expand Up / @@ -80,7 +80,6 @@ In this section, we guide you through our processes. @@
     </div>
       [report a bug]: report-a-bug.md
       [report a docs issue]: report-a-docs-issue.md
       [request a change]: request-a-change.md
@@ Expand Down @@
Original file line number	Diff line number	Diff line change
Expand Up		@@ -61,7 +61,6 @@ ecosystem tools referenced in this documentation are third-party projects.

		</div>


		## License {#license}

		<!-- SPDX-FileCopyrightText: 2026 PythonWoods <dev@pythonwoods.dev> -->
Expand Down
Original file line number	Diff line number	Diff line change
Expand Up		@@ -61,7 +61,6 @@ Zenzic enforces a non-negotiable exit code contract across all operating systems

		=== "GitHub Action Wrapper (Recommended)"


		The official [`PythonWoods/zenzic-action`](https://github.com/PythonWoods/zenzic-action) provides zero-config integration with automatic SARIF upload:

		```yaml title=".github/workflows/zenzic.yml"
Expand Down
Original file line number	Diff line number	Diff line change
Expand Up		@@ -128,7 +128,6 @@ Select a command tab to view its execution flags, default behaviors, and usage e

		## Shared Execution Flags


		## Global flags {#global-flags}

		These flags control Zenzic's signal-to-noise profile across routine scans, CI gates,
Expand Down