0.9.0 - #40
Merged
Merged
Conversation
Twelve fragments, three of them `added`, so semver says minor. The release: cards can be read in sequence whatever kind they are, the record views keep their filters, `raised` says whether a person asked for a card or an agent derived it, and CI runs the checks a card declares and records what they proved. Every doctor finding now names the module that produced it, and the stale-filename rule reaches every kind rather than only cards. On the security side, search-local no longer ships four high advisories and a trailing strip over an uncapped body no longer backtracks. One of the twelve is `internal` and is in the release record without being in the public CHANGELOG, which is what that visibility is for. `check:release` green on this tree: 488 + 10 tests, no advisories in the workspace or in the tree a consumer resolves, and the packed tarball installs and runs as 0.9.0. The generated surfaces were regenerated after the bump rather than in a later commit, so the tag points at a tree whose version markers agree with its package.json. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01D3LTdq3mzMAQ98rwBegGjU
|
The latest updates on your projects. Learn more about Vercel for GitHub.
|
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Twelve fragments, three of them
added, so semver says minor: 0.9.0.What is in it
Added — every kind of record can be read in sequence, not only cards;
raisedsays whether a person reported a card or an agent derived it; CI runs the checks a card declares and records what they proved.Changed — every doctor finding names the module that produced it, and the stale-filename rule reaches memory records, managed documents and unreleased fragments rather than only cards.
Fixed — an explicit
--rootis checked the way a discovered one always was; the scope guard sees two agents that share an actor; the MCP byte ceiling stops overwriting a tool's own truncation flag; the hosted demo matches a search the way a real workspace does; the record views' filters survive a reload.Security — search-local no longer ships four high advisories, and a trailing strip over an uncapped record body no longer backtracks.
One of the twelve is
internal(the audit floor moving tomoderate) so it is in the release record and not in the publicCHANGELOG.md, which is what that visibility is for.Why this is a pull request rather than three commits on main
Previous releases were cut straight onto
main. This one goes through CI first because the tag is what publishes:release.ymlrunscheck:releasebeforenpm publish, so a failure there is caught — but it is caught after the tag exists, and a tag is the one thing in this pipeline that cannot be taken back cleanly. Letting the Windows and macOS runners see the tree first costs one round trip.The generated surfaces are regenerated in this commit, after the bump, rather than in a later one as in 0.8.1. That way the tag points at a tree whose version markers agree with its
package.jsoninstead of at one where they are a release behind.The gate, run locally on this exact tree
check:releasegreen: 488 + 10 tests, strict ratchet held at 474 known errorspnpm auditand the consumer-tree audit both clean atmoderateand abovedoctor0 errors 0 warningsOne thing the cut turned up
The clock rolled past
raised's cutoff date while this was being prepared, so the rule went live and a baseline test that creates a card started seeing a second, unrelated finding. The card it creates now declares--raised derived, because that test is about the baseline gate and not about provenance — and a card filed from now on says how it came to be, which is the rule reaching the CLI exactly as intended.After merging
The tag is the publish.
v0.9.0on the merge commit runscheck:releaseagain, publishes both packages to npm over OIDC, writes the MCP Registry entry, and creates the GitHub Release from the0.9.0section ofCHANGELOG.md. Say the word and I will push it.🤖 Generated with Claude Code
https://claude.ai/code/session_01D3LTdq3mzMAQ98rwBegGjU