mergen-verdict 2.1.3

Archival release. No behaviour change and nothing fixed: Zenodo mints a DOI on a release event rather than on a version that already exists, so a citable archive identifier costs a version number. The concept DOI it produces is recorded in CITATION.cff in the commit that follows.

Full changelog: https://github.com/OnourImpram/mergen/blob/main/CHANGELOG.md

Mergen Verdict 2.1.2

2.1.1 shipped a CLI that could not verify.

From a plain pip install mergen-verdict, thirteen of seventeen verbs exited 2 on a missing file:

$ mergen verify --help
can't open file '...\site-packages\scripts\verify_core.py': [Errno 2] No such file or directory

verify, verify-lint, dashboard, status, issues, trends, graph, replay, impacted, pack, calibrate, adapter, and sign all failed the same way. The distribution declared two top-level modules and carried none of the scripts those verbs shell out to.

Fixed

• The wheel carries what the CLI runs. scripts/, core/, dist/, and effort-mode/ now travel inside the mergen_payload package and are located by payload_root, which still prefers a checkout so an editable install runs the code being edited. No source file moved — the trees stay at the repository root, so CI, the install scripts, and every documented python scripts/... line are unchanged. (#44)
• A version literal frozen in a test. test_milestone_contracts.py asserted Status: v2.1.1 — a fifth version source validate_version.py could not see, which would have broken every future release. It now derives the expected version from pyproject.toml. (#46)

Changed

• check_no_reference_text.py skips build output and virtualenvs. It had begun scanning copies of its own source under build/ and reading its own fingerprint list as a finding. dist stays in scope, because dist/native and dist/speckit are sources in this repository. (#44)
• The pinned CodeQL init and analyze steps are back on a single SHA after Dependabot split the pair, and a stray second setup-python pin was swept. (#45)

Verified

Installed from PyPI into a clean virtualenv with no repository in reach: all thirteen verbs respond, and mergen verify writes a schema_version 1.0 report with its .sha256 sidecar.

Mergen Verdict 2.1.1

[2.1.1] - 2026-07-25

Changed

• The published distribution is now mergen-verdict. The name mergen on PyPI
  belongs to an unrelated time-domain astronomy package, so pip install mergen
  never installed this project and never could. Nothing inside the project moves:
  the import package and the mergen and mergen-supervise commands are
  unchanged, and no released version was ever published under the old
  distribution name, so no existing installation breaks.
• The product is named Mergen Verdict, after what it returns. It does not perform
  verification; it adjudicates evidence produced elsewhere and renders a verdict,
  which is why a name built on "verify" would misdescribe it.

Mergen 2.1.0

[2.1.0] - 2026-07-25

Added

• Independent milestone verification is now the primary Mergen product identity.
  The standalone mergen-supervise entry point consumes externally produced
  verification evidence, reproduces deterministic checks, applies the Governor
  risk floor, and returns a fail-closed advancement decision without owning the
  external implementation workflow.
• The versioned milestone decision 1.1 contract with pass, conditional_pass,
  fail, and unverifiable verdicts, plus the corresponding advance,
  human_review_required, return_for_remediation, and hold actions.
• Evidence classes, fresh deterministic reproduction, source-state and decision
  hashes, exact-report human approval binding, Markdown rendering, professional
  issue forms, support guidance, contribution guidance, and verification-focused
  security documentation.

Changed

• The existing specification-driven command suite and /mergen-agent lifecycle
  orchestrator are retained as compatibility tooling. External executors own
  planning, implementation, remediation, and progression. Mergen owns independent
  milestone verification.
• Repository presentation, package metadata, charter, principles, citation
  metadata, and pull request intake now use the independent verification boundary.

Verification

• The complete GitHub Actions matrix passed across supported Python versions and
  Windows, together with Ruff, strict mypy, coverage, version consistency, schema
  validation, renderer sync, phantom-completion dogfood, CodeQL, dependency review,
  and gitleaks.

mergen v2.0.0

First public release of mergen, the execution backbone for AI coding agents. Maximum reasoning effort, Workflow orchestration, and adversarial verification, governed so the ceremony scales to the risk.

Tier 0 is pure Python standard library: no network, no model, deterministic. Mergen judges how much care a task deserves (the Governor) and proves the work was actually done and no larger than it needed to be (the verify gate). It pairs with mneme across one seam to form the Agent Continuity Stack.

Highlights

• Deterministic verify harness with three lenses (file existence, tests pass, git consistency) and a strict exit gate that refuses phantom or unverified work.
• A non-downgradable Governor risk floor: it can raise the required ceremony, never silently lower it.
• A single path-validation chokepoint that fences the verifier against option and path injection, with a bounded test timeout.
• Drop-in CI gates (verify, govern-diff, PR Guardian) that fail the build on phantom, proofless, or unsigned high-trust reports.
• Built entirely from public Claude Code extension points (slash commands, hooks, settings.json). It does not patch or modify the Claude Code binary.

Status: v2.0.0, beta. Apache-2.0. Independent community tool, not affiliated with Anthropic.