Skip to content

Renma v0.36.1

Choose a tag to compare

View all tags
@KazuCocoa KazuCocoa released this 24 Aug 03:13
· 29 commits to main since this release
v0.36.1
b3dafb5

Renma v0.36.1 includes 28 changelog entries across changed.

This release covers changes from v0.36.0 to v0.36.1.

Highlights

Changed

  • Narrowed 27 security-analysis helper types to their owning modules. Their
    definitions and the function signatures that use them are unchanged, while
    unsupported internal deep-import surfaces no longer expose local-only names.
  • Narrowed body-policy lexical exports to the completed patterns and
    recognizers used by neighboring analyzers. Regex vocabulary fragments used
    only to assemble those patterns now remain private to their owner module;
    diagnostic behavior is unchanged.
  • Narrowed internal security-command dependencies to import destination
    analysis functions and types from their owning modules instead of routing
    through the security-destination subsystem entrypoint. Public exports and
    runtime behavior remain unchanged.
  • Simplified the security-destination subsystem entrypoint so bindings used
    only for forwarding are re-exported directly from their owners. The cohesive
    entrypoint and all destination-analysis consumers remain unchanged.
  • Moved the public JSON schema inventory from production commands to test
    support, its only consumer. Compatibility tests still derive every identifier
    from its runtime owner, while the unused production module is no longer built
    or packaged.
  • Folded the single-consumer Markdown source-to-visible offset projection into
    MarkdownSecurityView. The standalone implementation module and its exported
    working types were removed without changing Markdown parsing or diagnostic
    source mapping.
  • Replaced the single-consumer rule-engine abstraction with a local function
    registry in rules.ts. Eleven decorative registry IDs, object wrappers, and
    the unreachable optional-config guard were removed without changing finding
    IDs, evaluation order, or diagnostics.
  • Removed two destination-analysis composition wrappers that were used only by
    tests. Production consumers continue to use the underlying typed analysis and
    intent projections directly; test-only convenience stays in test code.
  • Enabled TypeScript's unused-local and unused-parameter checks across source
    and tests, and removed the nine unused imports, locals, parameters, and test
    helpers they exposed. Runtime behavior and test coverage remain unchanged.
  • Removed the remaining cross-owner internal type re-exports from executable
    inventory, body-policy clause analysis, and security-command working types.
    Consumers now import those contracts from their defining modules; intentional
    public facades and cohesive subsystem entrypoints remain unchanged.
  • Made 63 command- and CLI-local types module-private after verifying that they
    have no cross-file consumers. Cross-module command contracts and every public
    package entrypoint remain unchanged.
  • Narrowed the internal runtime surface by making 33 helpers module-private
    after verifying that they have no cross-file consumers. Public package
    entrypoints, schema identities, and type contracts remain unchanged.
  • Removed five zero-consumer internal declarations: the historical Agent Skill
    name-validation wrapper, three unused derived types, and one unused body-policy
    test projection helper.
  • Consolidated internal module ownership by removing cross-owner re-exports
    from metadata parsing, discovery, repository paths, and security diagnostics.
    Internal consumers now import metadata definitions, Skill path contracts,
    helper-command evidence, and destination analysis from their cohesive owners;
    the supported renma/discovery public surface remains unchanged.
  • Removed the internal AGENT_SKILLS_TOP_LEVEL_FIELDS re-export from
    agent-skills.ts; internal contract tests now import the metadata definition
    owner directly.
  • Removed the unused internal CanonicalSecurityOperationalField re-export
    from security-policy.ts; its definition remains owned by
    metadata-definitions.ts.
  • Removed the one-line internal context-language-diagnostics.ts facade;
    catalog analysis now imports its implementation owner directly.
  • Removed the internal AssetOwnership re-export from model.ts; command
    consumers now import the cohesive governance type owner directly.
  • Removed Catalog Finding compatibility re-exports from scanner.ts; the
    ordered definition registry and diagnostic conversion remain owned only by
    catalog-findings.ts.
  • Removed internal result-type and renderer compatibility re-exports from the
    inspect and suggest-metadata command modules. Internal consumers now import
    the evidence, decision, and renderer owners directly.
  • Removed the final internal dependency-layer exception by keeping the
    single-use classification index projection inside repository snapshot
    construction instead of a higher-layer evidence module.
  • Removed the unused internal src/types.ts compatibility facade and updated
    tests to import cohesive type owners directly. The supported renma/types
    package export remains owned by src/public-types.ts and is unchanged.
  • Froze the Renma 1.0 release-candidate top-level JSON schema identities while
    retaining the existing whole-document, published-schema, semantic-contract,
    and public TypeScript API compatibility checks. The experimental execution
    contract and internal working models remain outside the freeze.
  • Made normalized scan diagnostics the canonical internal
    ScanResult.diagnostics collection behind the v2 serializer. Renamed the
    producer-level collection to internal rawDiagnostics and moved scan
    normalization and review bundling from the version-named module to
    scan-diagnostics without changing public output.
  • Replaced the three overlapping pre-1.0 scan JSON projections with the
    renma.scan.v2 contract. Active results now use one normalized diagnostics
    array, suppressed results use suppressedDiagnostics, and the wire-level
    findings, suppressedFindings, and diagnosticsV2 fields were removed.
  • Made diff and ci-report collect each archived repository revision once.
    CI now applies its fail-closed endpoint boundary while building the shared
    target snapshot, then derives both semantic diff and CI policy output from
    that snapshot instead of rediscovering the target revision.
  • Reduced prose-only safeguard-bypass, risky-failure-suppression,
    instruction-hierarchy, and untrusted-content inference to explicit local
    line or clause evidence and advisory severity. Structural POSIX shell,
    PowerShell, and Windows batch analysis remains in place.
  • Documented the Renma 1.0 stabilization boundary, including retention of the
    existing ci-report GitHub Actions workflow and the separation between
    structural command evidence and incomplete natural-language review aids.

Upgrade

npm install
npm run build
npm test

If using the published package:

npm install -g renma@0.36.1

Validation

Validated with:

npm test
npm run build
npm run verify:api
node dist/index.js scan . --fail-on high --strict
node dist/index.js catalog . --format markdown
node dist/index.js readiness . --format markdown
node dist/index.js graph . --focus skill.release-prep --format mermaid
node dist/index.js diff . --from v0.36.0 --to HEAD --format markdown
node dist/index.js ci-report . --from v0.36.0 --to HEAD --format markdown

Summary

v0.36.1 includes 28 changelog entries across changed.

Assets 2
Loading