ReviewReady 1.0.17

[1.0.17] - 2026-09-08

Fixed

• Replace overlapping raw-HTML regular expressions with a deterministic,
  operation-budgeted scanner and verify the compiled engine, CLI, and Action
  runner under a hard process deadline.
• Validate actual inline and reference-style Markdown link targets for
  version-bound package documentation, including mixed-version and
  comment-only decoys.
• Exercise post-release and release-candidate baseline states independently so
  the next candidate can pass without weakening mixed-version checks.

ReviewReady 1.0.16

[1.0.16] - 2026-09-08

Fixed

• Align the readiness input specification with the strict parser and add a
  complete executable normalized-input example.
• Require packaged README Action, schema, and product-document references to use
  the package's own semantic version instead of the previous release.
• Fail release verification when GitHub does not report an immutable Release or
  when the exact candidate commit lacks the required Node 22, Node 24 bundle, and
  CodeQL checks.

Documentation

• Record the TA-2 dogfood replay as integrity-verified while preserving its
  repository-audit result as incomplete.
• Remove stale release numbers from durable security and architecture wording.

ReviewReady 1.0.15

[1.0.15] - 2026-09-08

Changed

• Update the runtime schema dependency from Zod 4.4.3 to 4.5.4 and rebuild the
  committed Action bundle from the same dependency graph.
• Update the development toolchain, including @vercel/ncc 0.45.0, and adapt
  source and test expressions to the current TypeScript ESLint rules.

Fixed

• Preserve visible Markdown link and code contexts while rejecting hidden or raw
  HTML as pull-request evidence; malformed link-like input remains bounded and
  fails closed.
• Treat valid empty inline links and defined empty reference links as empty
  evidence, while preserving unresolved reference text and valid multiline
  reference definitions.
• Keep fenced-code content, reference-title continuations, and indented heading
  boundaries from hiding or consuming evidence outside their Markdown context.
• Check public baseline prose, structured version coordinates, capability
  boundaries, and trusted workflow pins together, with regression cases that
  reject mismatched versions, pins, and capability status.
• Verify candidate README versions and installed-package documentation against
  the exact tarball, separately from online release verification.

Documentation

• Distinguish immutable release tags and packages from the mutable v1 and npm
  latest aliases, and retain release evidence as historical observations.
• Separate package versions from verified Action examples, label fixture commands
  as repository-only, and link unshipped documentation to GitHub.
• Rename the trusted workflow display to ReviewReady trusted evidence, preserving
  readiness, and document manual readiness reruns after later CI-only reruns.

ReviewReady 1.0.14

[1.0.14] - 2026-09-04

Documentation

• Establish the ReviewReady Evidence Protocol identity and publish a
  machine-readable public coordinate baseline for the stable v1.0.13 release,
  post-release main, and the advisory-versus-authoritative boundary.

Fixed

• Pin the vulnerable fast-uri transitive dependency to the patched 3.1.7
  release in the development dependency tree.

ReviewReady 1.0.13

[1.0.13] - 2026-08-25

Documentation

• Replace version-specific release-candidate wording with provider-authoritative
  release coordinates and retain verified v1.0.12 evidence.

ReviewReady 1.0.12

[1.0.12] - 2026-08-25

Documentation

• Clarify that the checked-in workflow is advisory, that hosted external
  enforcement is not shipped, and that authoritative enforcement remains an
  adopter-owned boundary.

ReviewReady 1.0.11

[1.0.11] - 2026-08-17

Fixed

• Include generated JavaScript and declaration source maps in the published
  package so packaged runtime references remain verifiable by consumers.

ReviewReady 1.0.10

[1.0.10] - 2026-08-16

Fixed

• Anchor workflow action-reference detection to the YAML uses key so a
  permission such as statuses: read cannot create a false
  ACTION_REF_NOT_PINNED audit finding.
• Add a regression test for the false-positive workflow audit boundary while
  preserving fail-closed behavior for genuinely unpinned actions.

ReviewReady 1.0.9

[1.0.9] - 2026-08-15

Fixed

• Accept GitHub's canonical last/first pagination metadata on an empty
  bounded probe page instead of misclassifying a complete pull-request file
  set as incomplete.
• Preserve fail-closed behavior for non-empty probe pages, unexpected next
  links, and contradictory last-page metadata.

ReviewReady 1.0.8

[1.0.8] - 2026-08-15

Added

• Publish the deterministic audit collect and offline audit replay evidence
  surface, including the frozen v1 bundle contract and the versioned v2
  ruleset-semantics extension.
• Preserve modeled GitHub pull-request and required-status ruleset semantics
  without changing readiness or public readiness JSON contracts.

Changed

• Allow the trusted main-bound TA-2 promotion entrypoint to accept validated
  evidence bundle v2 and prove the live App-token collection/replay path.
• Document the bounded evidence, replay, promotion, and release coordinates for
  the next verified package release.

Security

• Move pull-request template instructions outside required Testing and Risk
  sections so the current parser does not treat untouched HTML comments as visible
  evidence while the full Markdown-boundary fix is tracked in issue #12.
• Document the historical Check Runs boundary and v1 report-json compatibility
  issue; v1.0.4 records the corresponding fail-closed and schema fixes.
• Document that base-SHA policy loading does not protect a caller workflow loaded
  from the pull-request merge ref. Trusted workflow enforcement is tracked in
  issue #35, and the ordinary pull_request example is now explicitly advisory.
• Install CI dependencies without lifecycle scripts and make high-severity npm
  advisories fail the primary quality job explicitly.
• Generate and check in third-party license notices for dependencies bundled into
  the distributed JavaScript Action.
• Treat indented Markdown code blocks as non-visible evidence, and reject unsafe
  policy text containing control, format, bidi, or multiline characters.
• Fail closed at Check Run/status and rename-path expansion boundaries, with one
  bounded GitHub retry that respects rate-limit headers.
• Reject empty inline/reference Markdown link markers and incomplete anonymous
  actionable reviews instead of treating their shape as visible evidence.
• Fail closed on ambiguous Link pagination metadata and probe partial audit pages
  for hidden continuation data; keep runtime policy descriptions aligned with
  the strict policy text schema.
• Correct the canonical Action repository examples and bind the release audit
  checkout to the selected commit before running any release gate.

Documentation

• Fix agent guidance after the completed v1 execution plan moved out of the active
  plan directory.
• Clarify npm artifact verification, historical mirror cleanup, review freshness,
  and current GitHub evidence-completeness limitations.
• Harden the Action workflow example with job-level least-privilege permissions,
  immutable pinning guidance, provider identity, and a clear distinction between
  advisory and authoritative deployment.
• Document editor schema options for repositories consuming ReviewReady.