carrick: v0.2.0

0.2.0 (2026-07-09)

⚠ BREAKING CHANGES

• findings: post-pr-comment relay removed; PR surfaces require the post-pr-result cloud pipeline.

Features

• compat: type-check cross-repo SOCKET edges end-to-end (#273) (153d19b)
• eval: add cross-repo metric fields to EvalRunRecord (S6 record-half) (#212) (0635707)
• eval: archive ts_check output + de-collapse projection by (key, role) (#261) (1e72fb7), closes #207
• eval: eval-oss workflow — remote corpus at pinned SHAs, dispatch-time labels (#316) (5367999)
• eval: full S4 cross-repo scorer — types/compat/deps/negatives/owner + GraphQL/socket (#223) (#225) (b3ef66f)
• eval: live cross-repo scorer — endpoint-set + match F1 (S4 thin slice) (#215) (cc868e1)
• eval: LocalDirStorage + offline two-phase cross-repo harness (S2) (#211) (4def505)
• eval: surface cross_repo_matches + type manifest + deps in EvalProjection (S1) (#209) (9f08ee6)
• eval: xrepo-corpus-3 — messy-realism cross-repo corpus + kind-aware decoy scoring (#303) (5abd14e)
• extraction: pub/sub candidates are an exhaustive checklist for the analyzer (#320) (bf9d355)
• extraction: route GraphQL/socket ops into the type pipeline (#245 Phase 1) (#251) (8253eaa)
• findings: typed findings + post-pr-result structured wire payload (#313) (a8a6e7e)
• graphql: cross-repo compat checking (edge query|order → compatible) (#278) (39d1d61)
• graphql: locate co-located consumer result types via file-analyzer hints (#268) (#298) (107f41f)
• graphql: resolve consumer bound type from client.request<T> call site (#275) (84d6d3d)
• graphql: resolve producer types from resolver functions (scanner-only) (#276) (3aa881e)
• graphql: resolve resolver-less SDL producers via co-located backing type (#248) (#296) (6d91033)
• intents: CARRICK_SKIP_INTENTS flag skips /generate-intent lambda calls (#314) (b829576)
• intents: repo-relative cloud paths, full-scan intent reuse, trivial-body gate (#312) (d8d8f1c)
• pub/sub family protocol + xrepo-corpus-2 (event-driven accuracy corpus) (#288) (5c35fba)
• pubsub: gated candidate-surfacing for pub/sub call sites (#289) (d2a8d2b)
• scanner: two-tier Signal 7 gate — shape-gate injected/inherited messaging clients (#317) (#319) (77bcc7e)
• schema: trace-rule primary_type_symbol descriptions (anchor accuracy) (#258) (9629ed8)

Bug Fixes

• compat: key type-compat verdicts per consumer, not per producer (#260) (#264) (9f3ed50)
• compat: normalize path params in the verdict-join so ts_check verdicts reach the score (#271) (a1d071e)
• engine: exclude workspace-internal packages from the synthetic type-check npm install (#308) (f251fe6)
• engine: harden synthetic type-check install — no lifecycle scripts, no non-registry version protocols (#318) (6ae0fde)
• engine: per-service cross-repo .d.ts bundles so monorepo producer types survive (#270) (195be31)
• engine: scope git invocations to repo_path (ignore ambient GIT_DIR) (#210) (32f20ea)
• eval: GraphQL/socket cross-repo edges + real type-anchor & resolution metrics (#232, #233) (#239) (b4376f5)
• eval: produce cross-repo compat verdicts in the offline harness + non-blocking §7 guard (#226) (#231) (729d9ed)
• eval: projection type-slot correctness + sidecar request-body locator convergence (#297) (a7ebb41)
• eval: resolve spurious GraphQL 'orders' query (#228) (#229) (d654417)
• extraction: deterministically extract route-descriptor endpoints (#234) (#237) (84a74a8)
• extraction: extract raw-handler GET /gateway/health producer (#227) (#230) (56e0453)
• extraction: force pubsub + data-call locator emission via schema required-ness (lever D) (#300) (e43c06d)
• extraction: resolve env-var base URLs aliased through a local const (#218) (#219) (b47e408)
• extraction: suppress non-matchable call noise (templated wrapper paths + graphql transport POSTs) (#310) (d981cb4)
• file_finder: exclude storybook stories and .storybook config from scans (#315) (3c94ffc)
• graphql: deterministic SDL type anchor for producers (#248) (#269) (d6c196b)
• graphql: scope SDL discovery to the service's own roots (#242) (#252) (ab8292b)
• hooks: isolate git env in pre-commit + block on test failure (#216) (692ed97)
• keep ts_check manifests HTTP-only so compat verdicts survive non-HTTP entries (#254) (99d57f7)
• orchestrator: resolve bare import specifiers through tsconfig paths mappings (#305) (11a7374)
• pubsub: disambiguate fan-in publisher aliases by call site (#290) (57896e7)
• scanner: gate deterministic route descriptors to real registries (#241) (#249) (dcf51d1), closes #207
• schema: require endpoint payload locators; scope type-slot to response (#274) (df4594d)
• semver-incompatible dep conflicts + drop synthetic anchor fallback (eval 85%→91%) (#279) (f20dd41)
• sidecar: drill through JSON.stringify(arg) for request-body inference (#267) (552a07b)
• sidecar: expand inferred consumer types structurally (#257) (#259) (88f83af)
• sidecar: expand resolved request-body type structurally (#272) (331e8c2)
• sidecar: follow route-registration into handler for type inference (incl. line-only anchors) (#295) (12e1464)
• sidecar: inline named member types in expanded_definition (#246) (#255) (4216a2e)
• sidecar: producer structural expansion + deterministic type anchor (#265) (61ae9bc)
• ts_check: abstain instead of false-compatible on dangling library types (MVP safety) (#302) (79059d1)
• ts_check: correct HTTP request-body assignability direction (+ eval pins) (#301) (553f0a4)
• ts_check: tag injected = unknown placeholder so genuine unknown isn't downgraded (#244) (#250) (925fd0c), closes #207
• ts_check: treat unknown as unverifiable + land consumer type shape in bundle (#235) (#238) (6361d7f), closes #207
• types: keep use-site array-ness on explicit anchor bundles (#309) (20386e2)

Refactoring

• single canonical consumer-call key (kill conflicting normalization paths) (#294) (954485c)

CI/CD

• eval: push Tier-A records to cloud eval history (#198) (479785b)
• run the ts_check test suite in CI (#280) (3045a68)