0.44.0

Added

• A review-result body may carry a fenced ```findings block of YAML — entries of {file, line, category, severity, verdict, origin, message}, where file, category, severity and message are required and an unwritten origin reads as undecided. aep artifact new parses it and refuses a malformed one with the body line it is wrong on; aep artifact show --format json returns it as a findings array; aep artifact validate reports a review-result that states its findings as prose only, without failing. severity is blocker|warning|note, verdict the adversary's CONFIRMED|NEEDS-CHANGE|INFEASIBLE or a critic's approve|needs-revision, origin introduced|pre-existing|undecided. Before this, a review's findings were sentences: the next round of the same reviewer started from nowhere.
• aep artifact findings <artifact-id> [--from <review-result-id> --to <review-result-id>] says what the second review of an artifact found that the first did not — carried, new, resolved over the two most recent review-result records that reviews it, or the two named. A finding is the same finding when its file, its category and its normalised message match and its line is within three, so a finding that moved because somebody added an import is carried rather than new. The reviewer is printed and never matched on. Always exits 0.
• Evidence kind review_outcome, and the two flags it is made of: aep artifact evidence <reviewed-id> --kind review_outcome --review <review-result-id> --outcome no-op|fixed|escalated. A review is immutable once recorded, so what became of it is a later record naming it rather than an edit to it. Refused when that review declares no reviews edge to the artifact, when either flag is given without the kind, and when the kind is given without both. aep artifact show <review-result-id> prints every outcome recorded against it, and aep artifact validate --outcome-within <days> (14 by default) reports a review older than that which nothing says happened to — reported, not failed on.
• aep artifact review-value [--since <YYYY-MM-DD>] prints one row per reviewer — the review-result's owner, or a reviewer: key its document carries — with reviews, findings, no-op, fixed, escalated, and what the runs behind them cost where a run manifest named by one of the review's --ref values said so. No score, no ranking and no percentage: the position aep eval matrix takes, for the same reason. A cost nobody recorded prints as unknown, never as 0.
• Planning stories carry scope: — the surfaces a story lands on, each entry a path and a confidence of cited (read out of the artifact, a diff or a file somebody opened) or inferred (worked out and not read anywhere). aep artifact scope <id> --add <path> [--inferred] and --remove <path> are the doors; show prints the list and show --format json carries it as an array. Story only. A path already declared is replaced rather than doubled, one command is one write and one revision, and the write is journalled like every other mutation. Nothing is normalised: crates/x and crates/x/src/lib.rs are two surfaces on purpose.
• aep artifact waves derives which stories may be implemented at once, from scope and depends_on and nothing else. Inside a wave no two stories share a scope path; a story is never in the same wave as anything it depends on, nor before it, including through a story that was not itself placed. Every pair sharing a path prints as collision: <a> <b> <path>, marked (inferred) when either side worked the path out rather than reading it. A story with no scope prints under unassessed and is never placed — an unassessed story reads exactly like a safe one, which is the defect. A depends_on cycle prints its own ids and exits 2. --kind defaults to story and --status narrows to one part of the board. It reads and prints: choosing the wave stays the operator's.
• aep artifact validate lists every story past its ladder's first rung and short of its end that declares no scope. Reported, never failed on, and deliberately not a --strict class: 24 of 40 stories would have gone red on the day it landed, which is how a check gets muted.
• aep reverse openapi drafts a relations: block on every type whose schema states one. Two signals and no others: a property whose schema is a $ref to a schema that becomes an entity (cardinality: one, or many when the property is an array of that $ref), and a property named <x>_id or <x>Id whose type is the type of entity X's own identity property. Every relation is kind: references — an OpenAPI document says a payload carries a reference and says nothing about whose life bounds whose, so owns is never inferred and every relation read from an id field carries an UNMAPPED: ownership line. A property that states its target two ways, such as oneOf: [Carrier, [Carrier]], is emitted with UNMAPPED: cardinality over the placeholder cardinality: one; a property with neither signal produces nothing at all, and a schema with no signal carries no block. The second adopter's plan defect was an undecided domain relation, and this puts the ones the contract does state into the draft with the undecided half named.

Fixed

• aep artifact new --ref <provider>:<key> writes the reference to the document. It was accepted, echoed in the result and dropped, so no artifact created with it carried the reference and aep artifact list --ref could not find it. On a review-result this was the only door — set is refused on an immutable kind — which is why no review could name the run manifest its cost is read from. Shipped broken in 0.41.0.