v0.11.4

0.11.4 (2026-09-08)

Bug Fixes

• docs: stop promising triage the workflow_dispatch its runtime refuses (#466) (9c99b2d)

v0.11.3

0.11.3 (2026-09-08)

Bug Fixes

• triage: the dogfood sheet classifies accepted-risk (#460) (#461) (86fbbfd)

v0.11.2

0.11.2 (2026-09-08)

Bug Fixes

• ci: run check-action-pins in automation and hold releases to the floating pin line (#455) (83f9a46)
• triage,harmonise: reject provider-truncated answers (#451) (f45b6b6)

v0.11.1

0.11.1 (2026-09-08)

Bug Fixes

• review: reject provider-truncated review answers (#445) (3317221)
• review: retire the oversized skip; capacity refusal is never reclassified (#441) (0460d49)
• review: strip control bytes before they reach a comment or a log (#443) (d0af851)

v0.11.0

0.11.0 (2026-09-07)

Features

• review: canonical pipeline wired into the review run (#362) (#372) (099018c)
• review: canonical review result contract + stable finding identity (#363) (7b49830)
• review: cross-run reconciliation labels (#362) (#368) (334cd70)
• review: deterministic SARIF 2.1.0 projection (#362) (#370) (ac068de)
• review: finding identity — full-span hashing with v1 compat (PR6) (#394) (59b88aa)
• review: reconciliation labels in the review comment (#362) (#379) (ed73b87)
• review: the pure merge gate decision (#362) (#369) (a2f7505)
• review: the SARIF projection gains its GitHub identity and upload consumer (PR5) (#388) (0d4044c)

Bug Fixes

• core: publication ownership — structured upsert outcome, abandoned never claims a comment (PR2) (#389) (88c246b)
• docs: refresh stale v0.5 example pins and check declared action pins (#364) (5f5dd34)
• harmonise: strip control characters from the record reason (#361) (#365) (b3d1ace)
• review: artifact containment ordered before mutation, publish made observable (PR7) (#392) (2dd777e)
• review: canonical verdict reflects coverage completeness (#405) (#410) (49e6955)
• review: declare the artifact-file output and tell the delivery truth (#418) (1f8f09a)
• review: declare the merge-group skip so the merge queue can go green (#419) (bb2f1e5)
• review: every red terminal lands a terminal review-gate check (PR3) (#390) (2f62345)
• review: name the applicability skip record by its outcome (#417) (4263002)
• review: provenance — ownLogins resolve before recovery, previousRecord ownership-tested (PR4) (#391) (c959290)
• review: reconciliation labels align by canonical identity (fix2) (#402) (75d6630)
• review: retire a previous finding only on a published passing run (#416) (d6e0192)
• review: the merge gate never passes a failing review (PR1 contract lock) (#384) (ee16f7b)
• review: the prompt states the coverage mandate the verdict enforces (#422) (7132d8b)
• review: the run artifact upload delivers the record file (fix1) (#403) (426e970)
• review: withhold findings whose anchor span certifies nothing (#411) (#420) (713f70d)
• triage: strip control characters from the record line (#366) (#371) (161cd2f)

v0.10.0

0.10.0 (2026-09-05)

Features

• adopt @ecoma-io/archkeep 0.25.0 and re-measure the boundary gate contracts (#349) (2fc9833)
• harmonise: refuse candidates whose script does not match the target language (#354) (#357) (6fcfd4e)
• review: record refused and failed artifacts at the red boundary (#355) (#360) (f3d4dc9)

Bug Fixes

• harmonise: pin every token's first occurrence in the restoration order walk (#358) (#359) (30fea63)
• harmonise: refuse transposed protected placeholders (#351) (#352) (022d0ce)
• harmonise: write a failed run record at declared red terminals (#347) (326aad6)

v0.9.0

0.9.0 (2026-09-05)

Features

• core: default request-timeout-ms to 120 s (#342) (2a4c58b), closes #341
• review: a general-purpose review eligibility policy (#339) (458c140)

v0.8.4

0.8.4 (2026-09-05)

Bug Fixes

• harmonise: sanitise and cap the run record's terminal reason (#336) (5d70c61), closes #332
• triage: the record validator refuses a verification block the contract does not specify (#334) (fa00a9e)

v0.8.3

0.8.3 (2026-09-05)

Bug Fixes

• triage,harmonise: close the record retention and accounting gaps (#327) (72bc708)
• triage,harmonise: gates refuse the dead entry, the contract tells the truth (#329) (dbdd227)
• triage: bind every write to a verified op — the signal included (#325) (fb44af2)

v0.8.2

0.8.2 (2026-09-04)

Bug Fixes

• review,harmonise: record abandonment, dry-run and every harmonise run (#297) (#310) (1227cf9)
• review: carry the policy SHA in artifacts and skip records (#291) (#311) (f770bfd)
• review: rename skip-record classification 'skipped' -> 'skip' (#309) (991b74b)