v0.11.0

0.11.0 (2026-09-07)

Features

• review: canonical pipeline wired into the review run (#362) (#372) (099018c)
• review: canonical review result contract + stable finding identity (#363) (7b49830)
• review: cross-run reconciliation labels (#362) (#368) (334cd70)
• review: deterministic SARIF 2.1.0 projection (#362) (#370) (ac068de)
• review: finding identity — full-span hashing with v1 compat (PR6) (#394) (59b88aa)
• review: reconciliation labels in the review comment (#362) (#379) (ed73b87)
• review: the pure merge gate decision (#362) (#369) (a2f7505)
• review: the SARIF projection gains its GitHub identity and upload consumer (PR5) (#388) (0d4044c)

Bug Fixes

• core: publication ownership — structured upsert outcome, abandoned never claims a comment (PR2) (#389) (88c246b)
• docs: refresh stale v0.5 example pins and check declared action pins (#364) (5f5dd34)
• harmonise: strip control characters from the record reason (#361) (#365) (b3d1ace)
• review: artifact containment ordered before mutation, publish made observable (PR7) (#392) (2dd777e)
• review: canonical verdict reflects coverage completeness (#405) (#410) (49e6955)
• review: declare the artifact-file output and tell the delivery truth (#418) (1f8f09a)
• review: declare the merge-group skip so the merge queue can go green (#419) (bb2f1e5)
• review: every red terminal lands a terminal review-gate check (PR3) (#390) (2f62345)
• review: name the applicability skip record by its outcome (#417) (4263002)
• review: provenance — ownLogins resolve before recovery, previousRecord ownership-tested (PR4) (#391) (c959290)
• review: reconciliation labels align by canonical identity (fix2) (#402) (75d6630)
• review: retire a previous finding only on a published passing run (#416) (d6e0192)
• review: the merge gate never passes a failing review (PR1 contract lock) (#384) (ee16f7b)
• review: the prompt states the coverage mandate the verdict enforces (#422) (7132d8b)
• review: the run artifact upload delivers the record file (fix1) (#403) (426e970)
• review: withhold findings whose anchor span certifies nothing (#411) (#420) (713f70d)
• triage: strip control characters from the record line (#366) (#371) (161cd2f)