v0.19.4

Fixed

• A finding on a file the MR does not change is posted (#207). It used to
  fail with "file is not in the current MR diff", so its text was lost
  while the summary still counted it. It now posts as a top-level note
  headed "is outside the files this MR changes". A path that does not
  exist at the MR head is still reported as a failure. A new prompt rule
  keeps these findings tied to the MR goal: an incomplete fix, or a caller
  the change breaks.

What's Changed

• chore(ci): pin reviewer-ci to maestro-reviewer 0.19.3 by @ddtcorex in #205
• docs(review): bump the maestro-skills pin in every release by @ddtcorex in #206
• fix(review): post findings on files outside the diff as notes by @ddtcorex in #207
• chore(release): 0.19.4 by @ddtcorex in #208

Full Changelog: v0.19.3...v0.19.4

v0.19.3

Changed

• The CI image ships @ddtcorex/maestro-skills 2.18.2 (was 2.15.0). The
  profile now declares ^2.18.2; the old ^2.13.0 range never moved the
  locked version forward. 2.18.2 teaches the Hyvä review gate that Alpine
  scope follows the DOM ancestor chain.

Fixed

• The reviewer no longer reports that code cannot work while the same
  pattern works elsewhere in the repository (#202). A new prompt rule, applied to
  MR and discussion reviews, makes it check code using the same pattern
  first, drop or downgrade the finding when that code works, and quote the
  enclosing scope for a blocking or major finding of this kind.
• The reviewer sees every thread on a long MR (#203). The thread list read one
  page of 20 discussions, so newer threads and their replies were missing.
• Each own thread now carries its opening finding and every human reply,
  and fallback threads posted without a position are listed too. Before,
  only the last comment was shown, so an answered finding came back as a
  new thread, sometimes at a higher severity.
• Three prompt rules guard against the false positives authors rejected
  most: a claim about vendor behaviour the checkout cannot show is at most
  a minor question, behaviour a docblock or the docs call intended is a
  design question rather than a bug, and an answered thread stays settled
  unless new evidence appears (then as a reply, never at a higher
  severity).
• A consistency or style finding must follow what most comparable code
  does, with the count stated, and is dropped when the code is mixed and
  no configured linter rule requires it (#203).
• A fallback note for a line past the end of an added file says so,
  instead of claiming the line is not in the MR diff.
• A report with a new finding that has no code is recorded provisionally
  and goes back to the reviewer once to add codes; the resend replaces it.
  Discussion reviews are not asked, since their findings become replies.
• The thread list leaves out GitLab system notes ("changed this line in
  version N of the diff"), keeps the last three human replies at most 1000
  characters each, and stops after 20 pages of discussions.

What's Changed

• chore(pin): reviewer-ci profile installs maestro-reviewer 0.19.2 by @ddtcorex in #201
• fix(review): check working code with the same pattern before a cannot-work finding by @ddtcorex in #202
• fix(review): guard against the false positives authors rejected most by @ddtcorex in #203
• chore(release): 0.19.3 by @ddtcorex in #204

Full Changelog: v0.19.2...v0.19.3

v0.19.2

Fixed

• A /maestro command whose answer keeps failing no longer holds back newer
  commands (#199). A failed answer posts a retry note; commands with fewer
  failed attempts go first, and the third failure answers the command with
  the error.
• An unreadable discussions page no longer makes every engine finding post
  again (#199). The read fails, and the engine then posts only its blocking
  findings.

What's Changed

• chore(pin): reviewer-ci profile installs maestro-reviewer 0.19.1 by @ddtcorex in #198
• fix(review): bound command retries and keep blocking findings on read errors by @ddtcorex in #199
• chore(release): 0.19.2 by @ddtcorex in #200

Full Changelog: v0.19.1...v0.19.2

v0.19.1

Fixed

• DeepSeek thinking models behind an OpenAI-compatible gateway no longer
  fail a review now and then with The reasoning_content in the thinking mode must be passed back to the API (#196). REVIEW_LLM_CATALOG_PROVIDER
  names a provider pi-ai's catalog ships (for example opencode-go); the
  route then reuses it, so the catalog's model settings apply and
  reasoning_content is replayed on every assistant message. Set
  REVIEW_LLM_MODEL to a catalog model id (for example deepseek-v4-flash).
  The default route stays custom-openai, and a project route never
  inherits the variable.

What's Changed

• fix(review): let the CI route name a catalog provider by @ddtcorex in #196
• chore(release): 0.19.1 by @ddtcorex in #197

Full Changelog: v0.19.0...v0.19.1

v0.19.0

Host helpers for the DSH plugin, the deferred B3 and B4 minors, and faster,
truer reviews on large checkouts (#194).

Added

• Engine helpers shared by the CI trigger and the DSH host plugin:
  answerCommands and replyToCommand (ci-commands), loadRepoSettings
  (ci-repo-settings), pinned in engine-exports with latestCompletedReview.
• A partial review comment shows ⚠️ Partial and how many files a failed
  part left unreviewed, instead of ✅ Completed.

Changed

• Fan-out is opt-in: it runs only when a REVIEW_FANOUT_* variable or
  fanout in .maestro-review.yml is set. On a checkout every part explored
  the codebase again, which measured slower and costlier than one agent.
• Review agents no longer get web_fetch or web_search (minutes per
  review, and an easy way out for what an agent reads; bash remains).
• MAGENTO-DB-WHITELIST is minor, and says why the whitelist matters.
• The model's thread list leaves out engine-made findings
  (SEC-SECRET-IN-DIFF, MAGENTO-DB-WHITELIST, CFG-CHANGED).
• Checkout redaction masks secrets only; emails and phone numbers are still
  masked in the diff. File symlinks that resolve outside the checkout or into
  .git are removed.
• The DSH host flow redacts its worktree whenever no runtime audit runs, and
  stops the review when redaction fails.

Fixed

• An open major thread no longer hides a blocking deterministic finding of
  the same code and path.
• A partial review (a failed part, a path rereview) no longer stands for its
  head in the CI push-gate and coexistence check; one cut by GitLab's diff
  file cap still does (capped in the metadata), so it is not re-run on
  every pipeline.
• A fan-out review of a capped diff is marked partial.
• A failed /maestro command answer is retried by the next job instead of
  being consumed.
• 15 s timeouts on the CI trigger's GitLab calls; a compare that timed out
  or reached GitLab's 1000 file limit is not an interdiff.
• Ignore globs match inside dot directories; usage reading never throws; a
  half-set REVIEW_DEEP_MODEL pair fails at parse time.
• review-report.json findings keep code, severity, path and line only.
• The project rules prompt and the CFG-CHANGED notice name the default
  branch.

What's Changed

• chore(pin): reviewer-ci profile installs maestro-reviewer 0.18.0 by @ddtcorex in #192
• docs(review): list the 0.18 features in the README by @ddtcorex in #193
• fix(review): close B3/B4 minors, add host helpers, faster truer large reviews by @ddtcorex in #194
• chore(release): 0.19.0 by @ddtcorex in #195

Full Changelog: v0.18.0...v0.19.0

v0.18.0

Per-project settings, redaction, an operator gate, feedback, MR commands,
framework context and a periodic report (#190, B4).

Added

• .maestro-review.yml, read from the project's default branch: profile,
  extra ignore globs, project rules, minimum severity to post, comment
  language, fan-out thresholds. An MR that edits it gets CFG-CHANGED.
• Redaction before the model: private keys, AWS, GitLab, GitHub and
  OpenAI style tokens, JWTs, KEY=value and PHP array secrets, emails and
  international phone numbers in diffs, the CI checkout, listed thread
  replies and commit titles. A secret added by the MR gets
  SEC-SECRET-IN-DIFF (blocking for token formats, major for KEY=value).
• gl-code-quality-report.json artifact and codequality report, and the
  operator gate REVIEW_GATE=blocking: every review job, skips included,
  exits 3 while the MR has an open blocking review thread or the review was
  partial. Resolving the thread is the override.
• /maestro dismiss [CODE]: a code dismissed by Developers in 3 of the last
  50 MRs is muted for the project (never blocking findings, never SEC-*).
  Inline findings show their code.
• /maestro explain, /maestro fix (a GitLab suggestion block) and
  /maestro rereview [path], answered by the next review job.
• Framework context (Magento, Hyvä, PHP from composer at the head) in the
  prompt, and MAGENTO-DB-WHITELIST for a schema change without whitelist.
• A scheduled report job: periodic-report.json and .md over
  REVIEW_REPORT_DAYS (default 7, at most 30), with tool calls.

Changed

• Findings outside the diff are resolvable threads instead of plain notes.
• Child review reports are kept 30 days (was 1 week).
• Anything an agent writes to GitLab has HTML comments escaped.
• yaml is a runtime dependency.
• Engine: ReviewEngine.answer(); ReviewForge gains feedback and
  readFile; EngineRunOptions gains repo and carryFindings.

What's Changed

• chore(pin): reviewer-ci profile installs maestro-reviewer 0.17.0 by @ddtcorex in #182
• fix(review): gate on open blocking threads, and close the bypasses by @ddtcorex in #190
• chore(release): 0.18.0 by @ddtcorex in #191

Full Changelog: v0.17.0...v0.18.0

v0.17.0

CI review performance (#180): measured telemetry, less text to the model,
better prefix caching, interdiff re-reviews and fan-out for large MRs.

Added

• review-report.json carries stages (boot, fetch, clone, agent, post in
  ms) and usage per agent run (input, output and cached tokens, from the
  DSH session); the review metadata carries the summed usage and the MR
  base SHA.
• Pre-model diff filter: lock files, minified assets, source maps,
  generated/, pub/static/, var/, snapshots and i18n CSVs are kept
  from the diff tools; REVIEW_IGNORE_GLOBS adds globs. Skipped paths are
  listed in the comment; an MR with nothing left gets one "Nothing
  reviewable" note and no model call.
• Fan-out: above REVIEW_FANOUT_FILES (25) or REVIEW_FANOUT_BYTES
  (150000) the MR is reviewed in at most 6 parallel parts
  (REVIEW_FANOUT_CONCURRENCY, 3), grouped by module with high risk files
  apart, findings merged and posted once. REVIEW_DEEP_MODEL_PROVIDER and
  REVIEW_DEEP_MODEL pick the model of high risk parts (dropped on a
  project route).

Changed

• With REVIEW_ON_PUSH=1 a re-review sees only the interdiff when the MR
  base is unchanged; a rebase, a partial prior review, a prior review
  without a recorded base, a collapsed file or a deep request reviews the
  whole MR. The first re-review after upgrading is therefore full.
• The CI review worktree is one fixed path and the per-MR parts of the
  reviewer prompt come last, so the provider's cached prefix covers the
  runtime context and the skills reminder.
• Engine: ReviewForge gains reviewScope and restrictToInterdiff;
  EngineRunOptions gains ignoreGlobs, fanout and deepModel (fan-out
  only runs when fanout is passed).

What's Changed

• chore(pin): reviewer-ci profile installs maestro-reviewer 0.16.0 by @ddtcorex in #179
• perf(review): telemetry, diff filter, stable prefix, interdiff and fan-out by @ddtcorex in #180
• chore(release): 0.17.0 by @ddtcorex in #181

Full Changelog: v0.16.0...v0.17.0

v0.16.0

Lighter review tool surface and per-tool call counts in the report (#177).

Added

• review-report.json (and ReviewResult) carries toolCalls: attempted
  calls per tool name across the run's agents, denied ones included, to decide
  from real reviews which tools are worth keeping.

Removed

• maestro_search_files: the native grep and glob tools of dsh-base
  cover it.
• maestro_get_skills: nothing used it any more; load skills with the native
  skill tool. maestro_load_review_profile stays.
• The legacy presets/maestro-coder directory preset (DSH stopped reading
  directory presets on 2026-09-29; no row shipped it), and the dead
  maestro_write_file entry of the review tool deny list.

Fixed

• gitlab_get_mr_diff told the agent to read the spilled diff with
  maestro_read_file, a tool that no longer exists; it now names read.

What's Changed

• chore(pin): reviewer-ci profile installs maestro-reviewer 0.15.1 by @ddtcorex in #176
• refactor(review)!: drop unused review tools and count tool calls by @ddtcorex in #177
• chore(release): 0.16.0 by @ddtcorex in #178

Full Changelog: v0.15.1...v0.16.0

v0.15.1

Temporary opt-out for installations without a dedicated bot user (#174).

Added

• REVIEW_ACCEPT_PRIVILEGED_BOT=1 (reviewer project variable): the two bot
  role checks of 0.15 (Developer or above on the config project, Maintainer
  or above on the reviewer project) only log a warning. For installations
  that cannot create a dedicated bot user yet; it accepts the risk those
  checks guard against. Administrators stay refused; every other check stays.

What's Changed

• chore(pin): reviewer-ci profile installs maestro-reviewer 0.15.0 by @ddtcorex in #173
• feat(review): allow a privileged bot temporarily with an explicit opt-out by @ddtcorex in #174
• chore(release): 0.15.1 by @ddtcorex in #175

Full Changelog: v0.15.0...v0.15.1

v0.15.0

External pipeline config so Developers can trigger reviews, the
REVIEW_GITLAB_TOKEN rename, and a full setup guide (#171).

Fixed

• Developers could not trigger a review. GitLab only lets a user trigger
  a protected downstream branch when they can push or merge it, and 0.14
  required the reviewer branch to be Maintainers only, so a Developer's MR
  bridge failed with insufficient_bridge_permissions and got no review.

Changed

• BREAKING: the reviewer pipeline file lives in a separate config project.
  The reviewer project's Custom CI config path must name
  <file>@<group>/<config project>[:<branch>]; resolve checks that the
  config branch is protected for Maintainers only (push and merge, no force
  push, no per-user or per-group grants) and that the bot is below Maintainer
  there, and no longer requires the reviewer branch to be Maintainers only, so
  Developers may merge it and therefore trigger it. Everyone who triggers the
  reviewer, and the bot, needs Reporter on the config project. The config
  path is parsed the way GitLab resolves it (remote URLs and anything that is
  not a lowercase .yml/.yaml file in another project are refused), the
  reviewer repository may not hold a file at that literal path, and every
  protection rule matching the config branch, wildcards included, must be
  Maintainers only.
• BREAKING: the bot's roles are checked. resolve refuses a bot that is
  Developer or above on the config project or Maintainer or above on the
  reviewer project (counting inherited and shared-group access), or a GitLab
  administrator, so a reviewer Maintainer's personal token no longer works.
• CI skip messages use a comma instead of a dash
  (another review is running, skipping).
• BREAKING: MAESTRO_GITLAB_TOKEN is now REVIEW_GITLAB_TOKEN, so every
  reviewer project variable shares the REVIEW_ prefix. The old name is not
  read.

Docs

• docs/ci-reviewer-setup.md rewritten: GitLab setup in click order, an
  access matrix, and a reference of every variable with its scope, flags,
  default and effect. Removed the Telegram variables, which the CI flow never
  read.

What's Changed

• chore(pin): reviewer-ci profile installs maestro-reviewer 0.14.0 by @ddtcorex in #170
• feat(review)!: external pipeline config, REVIEW_GITLAB_TOKEN, full setup docs by @ddtcorex in #171
• chore(release): 0.15.0 by @ddtcorex in #172

Full Changelog: v0.14.0...v0.15.0