v4.8.0

Dependency work is read as dependency work. An upgrade, audit or advisory request now owns the manifests and lockfiles, package names are read whole, and misses can be recorded in the eval corpus as known gaps. solumbe eval --history replays a repository's own commits to measure the pack on real work. No command or field was removed.

Fixed

• Runtime version pins are configuration. .nvmrc, .node-version and .tool-versions carried no risk flag, so moving bashbop-api from Node 20 to 22 never asked for review even though CI and the deploy build read the file. They now classify as configuration and gate a merge.
• A dependency request implies the dependency concept. A Dependabot batch implied no concept, so convergence called the package.json and yarn.lock it changed unrequested risky drift (27/100 on a correct batch). dependency, dependencies, deps, dependabot, renovate and lockfile now imply it. upgrade, bump and package do not, because they name pricing tiers, releases and versions as often. Lockfile churn still does not gate a merge.
• Dependency requests rank manifests and lockfiles. In a dependency security sweep (2026-10-22), change_impact matched shell-quote to quote-templates.controller.ts on "quote" and declared it a required owner, pulled in every .hbs template on "handlebars", and ranked PackageSelector.tsx and EmailQuotaUpgradeModal.tsx on "package" and "upgrade". yarn.lock and package-lock.json were never listed, so a lockfile-only advisory fix grounded to no owner and convergence came back inconclusive. A multi-repo context pack ranked CHANGELOG.md and docs first. The code map now lists each repository's manifests, lockfiles and package-manager config with the package names they declare and resolve (index cache version 15). A request that upgrades, bumps, audits or patches dependencies owns them: the lockfile, and a manifest that declares a named package, are required owners and lead Primary Files; .yarnrc.yml, .npmrc and a manifest a transitive fix may not touch are supporting. A package the request names (shell-quote, @stream-io/node-sdk, tar@7.5.2, or any package a lockfile resolves) is read whole, and it and the dependency words no longer score source files, so a call-site change in the same request still ranks its file. The package manager named (yarn, npm, pnpm) picks the lockfile. Impact engine version 6, context engine version 5.

Added

• Known gaps in the eval corpus. A retrieval or gate case marked "knownGap": true runs and is reported under Known gaps ("still open", or "now passes" once fixed) without counting toward the floors, the pass counts or the exit code, so a miss can be recorded the day it is found.
• Eleven cases from the bashbop-api dependency and Node 22 work, on a new node-upgrade-api fixture and a dependency-bump gate change-set. Six pass with the fixes above, and four more with dependency-request ranking. The Node 22 .nvmrc case is still a known gap. The risk floor moves from 0.96 to 0.97 so one failing case of 28 still trips it.
• Four cases from the 2026-10-22 dependency sweep on new dependency-advisory-api, -web and -mobile fixtures, one across all three repositories, with regression tests in tests/dependency-request.test.js. Retrieval p@5 rises from 0.838 to 0.865.
• History replay eval. solumbe eval --history [repo] (npm run eval:history) replays a repository's recent commits as retrieval cases: the subject is the request, the files the commit changed are the expected files, and the pack is built on the parent tree, exported with git archive so the repository is only read. It reports hit@k, recall@k, precision@k, MRR, pack recall and the share of changed files the code map does not index, lists the misses, and skips merges, releases, bumps, bots, bulk commits and repeated subjects. The hand-labelled corpus is synthetic and fully passing; this measures the pack on real work. It is a measurement with no thresholds and is not part of npm run quality.
• Three known gaps from the first history replay, on new nav-protection-web, solumbe-hook-web and feature-flag-api fixtures: a script under public/ named almost word for word by the request, a solumbe-managed .githooks/pre-commit, and an environment's feature-flag file. All three are open; the floors and pass counts are unchanged.