carrick: v0.2.8

0.2.8 (2026-07-12)

Features

• persist per-pair ts_check verdicts into CloudRepoData (#351 part 1) (#362) (55904e5)

Bug Fixes

• extraction: deterministic guards for request-type borrow + graphql-over-http target (#361) (#363) (2ed6762)

carrick: v0.2.7

0.2.7 (2026-07-12)

Bug Fixes

• canonicalize literal-origin consumer call keys + suppress self-calls (#354) (47b1d45)
• corpus-1: label audit-webhook call + add resolveOrders resolver (#358) (418f106)
• extraction: normalize spurious .ts on type_import_source deterministically (flake pattern 1) (#360) (b68fc85)
• suppress intra-repo pub/sub self-loops in cross-repo projection (#353) (47cb1c1)

carrick: v0.2.6

0.2.6 (2026-07-11)

Bug Fixes

• sidecar: anchor call_result from the explicit call generic when the client type is untyped (#348) (2831d6f)

carrick: v0.2.5

0.2.5 (2026-07-11)

Bug Fixes

• sidecar: tolerate SWC 1-based spans when binding a call_result locator (#346) (c8b74e4)

carrick: v0.2.4

0.2.4 (2026-07-11)

Bug Fixes

• sidecar: recover the consumer array depth for multi-line call sites (#344) (041e084)

carrick: v0.2.3

0.2.3 (2026-07-11)

Bug Fixes

• comment: polish contract-risk rows: runner paths, stray quote, declared param names (#340) (c844fc9)
• engine: drop duplicate same-key producer manifest entries and dedup identical findings rows (#342) (d763245)
• extraction: sanitize LLM-emitted route paths and re-anchor them to the registration literal (#343) (1033890), closes #332
• matching: a param segment never matches an empty or whitespace segment (#338) (3e012be), closes #333
• sidecar: report element anchor + array_depth on call_result inference (#341) (fb6e8bb)
• sidecar: trailing comma no longer defeats matchByText, reverse match needs 50% coverage (#339) (fd999e1), closes #335

CI/CD

• build carrick-match wasm artifact on release and dispatch pin bump to carrick-cloud (#329) (5975ebf)

carrick: v0.2.2

0.2.2 (2026-07-10)

Refactoring

• matching: extract carrick-match crate (paths_match + is_param_segment) with wasm feature (#327) (ecdbcfc)

carrick: v0.2.1

0.2.1 (2026-07-10)

Bug Fixes

• action: launch polish — fail loudly on missing id-token permission, stream scan output live (#322) (3fbfe6c)

carrick: v0.2.0

0.2.0 (2026-07-09)

⚠ BREAKING CHANGES

• findings: post-pr-comment relay removed; PR surfaces require the post-pr-result cloud pipeline.

Features

• compat: type-check cross-repo SOCKET edges end-to-end (#273) (153d19b)
• eval: add cross-repo metric fields to EvalRunRecord (S6 record-half) (#212) (0635707)
• eval: archive ts_check output + de-collapse projection by (key, role) (#261) (1e72fb7), closes #207
• eval: eval-oss workflow — remote corpus at pinned SHAs, dispatch-time labels (#316) (5367999)
• eval: full S4 cross-repo scorer — types/compat/deps/negatives/owner + GraphQL/socket (#223) (#225) (b3ef66f)
• eval: live cross-repo scorer — endpoint-set + match F1 (S4 thin slice) (#215) (cc868e1)
• eval: LocalDirStorage + offline two-phase cross-repo harness (S2) (#211) (4def505)
• eval: surface cross_repo_matches + type manifest + deps in EvalProjection (S1) (#209) (9f08ee6)
• eval: xrepo-corpus-3 — messy-realism cross-repo corpus + kind-aware decoy scoring (#303) (5abd14e)
• extraction: pub/sub candidates are an exhaustive checklist for the analyzer (#320) (bf9d355)
• extraction: route GraphQL/socket ops into the type pipeline (#245 Phase 1) (#251) (8253eaa)
• findings: typed findings + post-pr-result structured wire payload (#313) (a8a6e7e)
• graphql: cross-repo compat checking (edge query|order → compatible) (#278) (39d1d61)
• graphql: locate co-located consumer result types via file-analyzer hints (#268) (#298) (107f41f)
• graphql: resolve consumer bound type from client.request<T> call site (#275) (84d6d3d)
• graphql: resolve producer types from resolver functions (scanner-only) (#276) (3aa881e)
• graphql: resolve resolver-less SDL producers via co-located backing type (#248) (#296) (6d91033)
• intents: CARRICK_SKIP_INTENTS flag skips /generate-intent lambda calls (#314) (b829576)
• intents: repo-relative cloud paths, full-scan intent reuse, trivial-body gate (#312) (d8d8f1c)
• pub/sub family protocol + xrepo-corpus-2 (event-driven accuracy corpus) (#288) (5c35fba)
• pubsub: gated candidate-surfacing for pub/sub call sites (#289) (d2a8d2b)
• scanner: two-tier Signal 7 gate — shape-gate injected/inherited messaging clients (#317) (#319) (77bcc7e)
• schema: trace-rule primary_type_symbol descriptions (anchor accuracy) (#258) (9629ed8)

Bug Fixes

• compat: key type-compat verdicts per consumer, not per producer (#260) (#264) (9f3ed50)
• compat: normalize path params in the verdict-join so ts_check verdicts reach the score (#271) (a1d071e)
• engine: exclude workspace-internal packages from the synthetic type-check npm install (#308) (f251fe6)
• engine: harden synthetic type-check install — no lifecycle scripts, no non-registry version protocols (#318) (6ae0fde)
• engine: per-service cross-repo .d.ts bundles so monorepo producer types survive (#270) (195be31)
• engine: scope git invocations to repo_path (ignore ambient GIT_DIR) (#210) (32f20ea)
• eval: GraphQL/socket cross-repo edges + real type-anchor & resolution metrics (#232, #233) (#239) (b4376f5)
• eval: produce cross-repo compat verdicts in the offline harness + non-blocking §7 guard (#226) (#231) (729d9ed)
• eval: projection type-slot correctness + sidecar request-body locator convergence (#297) (a7ebb41)
• eval: resolve spurious GraphQL 'orders' query (#228) (#229) (d654417)
• extraction: deterministically extract route-descriptor endpoints (#234) (#237) (84a74a8)
• extraction: extract raw-handler GET /gateway/health producer (#227) (#230) (56e0453)
• extraction: force pubsub + data-call locator emission via schema required-ness (lever D) (#300) (e43c06d)
• extraction: resolve env-var base URLs aliased through a local const (#218) (#219) (b47e408)
• extraction: suppress non-...

carrick: v0.1.40

0.1.40 (2026-06-24)

Bug Fixes

• analyzer: canonical endpoint/call ordering + cassette hard gate (#195) (49f94cf)