v0.6.0

What's Changed

• chore: lower the code-scan ratchet to 107 open issues by @ffroliva in #76
• docs: actions follow BootUI, MCP lists action tools gated per panel by @ffroliva in #85
• docs: every review includes a maintainability pass by @ffroliva in #86
• fix: the fleet names why a box could not be created by @ffroliva in #87
• chore(deps): Dependabot batch 2026-11-09 by @ffroliva in #88
• chore(deps): bump softprops/action-gh-release from 3.0.3 to 3.0.4 by @dependabot[bot] in #77
• chore(deps): bump SonarSource/sonarqube-scan-action from 8.4.0 to 8.4.1 by @dependabot[bot] in #78
• chore(deps): bump astral-sh/setup-uv from 5.4.2 to 10.3.3 by @dependabot[bot] in #79
• chore(deps): bump the ui-dependencies group in /ui with 5 updates by @dependabot[bot] in #81
• docs: retrospective for the source-over-docs skill rules by @ffroliva in #74
• chore: repo hardening (Scorecard, zizmor and actionlint, CODEOWNERS) by @ffroliva in #71
• test: harness self-tests never write the real overhead log by @ffroliva in #89
• fix: MCP negotiates only the protocol revision it serves by @ffroliva in #90
• fix: the pytest cache never writes into the cwd mid-test by @ffroliva in #91
• ci: JUnit and overhead uploads, live split per server, docs-only skip, order-safe layout test by @ffroliva in #92
• fix: nested-run tests carry a 300 s timeout (Windows 'worker crashed' was the 60 s default) by @ffroliva in #93
• refactor: split the FastAPI introspector before it grows by @ffroliva in #94
• test: golden fixtures by version; 2.3.0 shape rules for 2.3.0 evidence by @ffroliva in #95
• refactor: split settings by family; classify every field for warnings by @ffroliva in #96
• test: BootUI 2.3.0 enumerations captured from the pinned tag by @ffroliva in #97
• docs: document every tool, setting and extra, checked by tests by @ffroliva in #98
• fix: two tests that broke parallel runs by @ffroliva in #99
• ci: dispatchable CI and a live-check aggregator by @ffroliva in #100
• test: the BootUI test catalog covers classes outside src/test by @ffroliva in #101
• ci: the full-extras leg installs every optional integration by @ffroliva in #102
• ci: uploads are scanned for planted values first by @ffroliva in #103
• test: a patched golden root still selects the fixture version by @ffroliva in #104
• perf: the linearity gate measures each size once per attempt (W0b T7) by @ffroliva in #105
• fix: the golden sanitiser is ready for BootUI 2.3.0 captures (W2a T1) by @ffroliva in #106
• perf: the mutant harness computes each unmutated base once per worker (W0b T8) by @ffroliva in #108
• feat: a guarded live BootUI capture and a machine-values leak gate (W2a T2-T3) by @ffroliva in #107
• test: BootUI 2.3.0 live goldens with a completeness test (W2a T4) by @ffroliva in #111
• test: settings and tool catalogue parity with BootUI 2.3.0 (W3 wave A) by @ffroliva in #110
• feat: a capture-hook registry with suspend and resume (W4 Wave 0) by @ffroliva in #112
• test: parity tests carry their tracker row keys (W3) by @ffroliva in #113
• refactor: rest-api advisor rules split by family (W3 B0) by @ffroliva in #114
• test: panel route parity with BootUI 2.3.0 goldens (W3 C1) by @ffroliva in #116
• chore: ci_walls, the attempt-1 CI critical-path table (W0b T1) by @ffroliva in #115
• test: REST API rule parity with BootUI 2.3.0 (W3 B) by @ffroliva in #118
• docs: the safety gate, with its exit behaviour pinned (W9 T1) by @ffroliva in #117
• feat: runtime journal (W5a core) by @ffroliva in #119
• test: architecture rule parity with BootUI 2.3.0 (W3 B) by @ffroliva in #121
• chore: register W5b wave-1 panel slots (W5b lane 0) by @ffroliva in #122
• test: security rule parity with BootUI 2.3.0 (W3 B) by @ffroliva in #120
• test: security test citations name catalogued BootUI tests or say derived by @ffroliva in #123
• feat: low-footprint mode and Live Memory controls (W4 L) by @ffroliva in #125
• test: interpreter-state gate and side-effect guard for sensors (W6 S0) by @ffroliva in #124
• perf: lane-gate tests on an in-memory fake git (W0b T6) by @ffroliva in #126
• feat: startup timeline panel (W5b lane S) by @ffroliva in #127
• chore: W7 wave 0 panel slots for copilot, claude-code, github and ai by @ffroliva in #129
• feat: W6 S1 sys.monitoring tool-id allocator; swallowed.py goes through it by @ffroliva in #128
• feat: W7 A AI panel over GenAI spans and AI journal events by @ffroliva in #134
• feat: W7 S agent sessions: Copilot and Claude Code panels and session streams by @ffroliva in #136
• feat: W5b P profile diff over the app's .env. files by @ffroliva in #133
• ci: record pytest-speed fixture times and rebuild counts on every CI pytest run by @ffroliva in #135
• chore: W8 A0 action-capable panels and the W8 action settings by @ffroliva in #140
• feat: W5b E1 REST API error contract by @ffroliva in #130
• feat: W9 safety-gate docs, SARIF 2.1.0 writer, STARTUP/SHUTDOWN SQL phases by @ffroliva in #138
• chore: W5c I0 runtime-insights panel slot, 28 kind stubs, kind import rule, settings by @ffroliva in #141
• feat: W5b C scheduled tasks panel from in-process schedulers by @ffroliva in #139
• feat: W5b M metrics panel over the host Prometheus registry by @ffroliva in #131
• feat: W7 G1 GitHub dashboard from local repository state by @ffroliva in #132
• feat: runtime insights snapshot, checks and coverage (W5c I1) by @ffroliva in #143
• feat: W7 G2 GitHub refresh action (REST only) by @ffroliva in #142
• feat: W6 S2 agent-sensor floor: panels, routes, actions and tools answer BootUI's unavailable shapes by @ffroliva in #137
• fix: the insights read budget runs alone with the timing files by @ffroliva in #148
• feat: RAPI-ERR rules read the error contract (W5b E2) by @ffroliva in #146
• feat: config override layer and overrides file (W8 O1) by @ffroliva in #144
• feat: runtime insights routes, tools and the resource-profile floor (W5c I2) by @ffroliva in #147
• feat: cache clear action for in-process caches (W8 K1) by @ffroliva in #145
• feat: config override routes (W8 O2) by @ffroliva in #149
• feat: runtime insight ai-usage-by-route (W5c K9) by @ffroliva in #152
• feat: Alembic migrate action (W8 M1) by @ffroliva in #150
• feat: http journal producer (W5a P-http) by @ffroliva in #153
• fix: no_side_effects ignores pytest's cache staging dir by @ffroliva in #154
• feat: resident audit hook with processes and files sensors (W6 S3) by @ffroliva in #151
• feat: sql journal producer (W5a P-sql) by @ffroliva in #155
• chore(ci): PR CI 10.8 -> 6.7 min (sqlite heap-walk fix, shard weights); 3-5 min needs owner layout calls by @ffroliva in #156
• feat(w8): Alembic clean (downgrade base), off by default, one flight with migrate by @ffroliva in #157
• feat(w7): shared class-method wrap helper for capture integrations (E0) by @ffroliva in https://github.com/ffroli...

v0.5.0

What's Changed

• docs: screenshot catalog of every panel, light and dark by @ffroliva in #51
• chore(deps): bump pypa/gh-action-pypi-publish from 1.14.2 to 1.14.3 by @dependabot[bot] in #42
• chore(deps): bump SonarSource/sonarqube-scan-action from 8.3.0 to 8.4.0 by @dependabot[bot] in #46
• chore(deps): bump actions/checkout from 4.4.0 to 7.0.1 by @dependabot[bot] in #43
• chore(deps): bump actions/setup-node from 4.4.0 to 7.1.0 by @dependabot[bot] in #47
• chore(deps): bump actions/upload-artifact from 4.6.2 to 7.0.2 by @dependabot[bot] in #45
• chore(deps): bump actions/download-artifact from 4.3.0 to 8.0.2 by @dependabot[bot] in #44
• chore(deps): bump the ui-dependencies group in /ui with 4 updates by @dependabot[bot] in #48
• test: measure the lazy-load budget in many short rounds by @ffroliva in #56
• test: overhead noise is how far the minimum moves between run halves by @ffroliva in #57
• chore: lower sonar-baseline.txt to 116 by @ffroliva in #55
• fix: CodeQL alerts (workflow permissions, e2e regex escape) by @ffroliva in #52
• perf: faster test suite (template git repo, in-process pytester) by @ffroliva in #49
• feat: D3 drift check for pools, threads, health and alembic by @ffroliva in #53
• docs: sharpit design system spec by @ffroliva in #61
• chore: faster CI, lint job, more shards, fresh shard weights by @ffroliva in #63
• chore: sbx cloud fleet for a fast Linux full-suite check by @ffroliva in #64
• fix: ruff security rules on src; vulnerability base URIs must be http or https by @ffroliva in #70
• feat: design system, console hardening, docs theme by @ffroliva in #69
• chore: parallel test rule, sbx fleet that never lets a box loose, split heavy shard files by @ffroliva in #72
• docs: source-over-docs, worst-case trace and claim-to-test steps in skills by @ffroliva in #73
• test: masking redesign, CI runs by @ffroliva in #62
• chore: release 0.5.0 by @ffroliva in #58
• docs: sharpit 0.5.0 plan (full BootUI 2.2.0 parity) by @ffroliva in #54

New Contributors

• @dependabot[bot] made their first contribution in #42

Full Changelog: v0.4.0...v0.5.0

v0.4.0

What's Changed

• chore: lower the Sonar baseline to 122 by @ffroliva in #27
• docs: 0.3.0 retrospective and the rules it hardens by @ffroliva in #28
• test: e2e for per-finding dismiss and restore by @ffroliva in #29
• docs: every CI job and how to run it locally by @ffroliva in #30
• sharpit 0.4.0: coordinated lanes into main by @ffroliva in #40
• fix: SQL Trace never shows a double-quoted value or secret with capture off by @ffroliva in #41
• chore: release 0.4.0 by @ffroliva in #50

Full Changelog: v0.3.0...v0.4.0

v0.3.0

What's Changed

• sharpit 0.3.0: findings you can gate CI on by @ffroliva in #25
• chore: release 0.3.0 by @ffroliva in #26

Full Changelog: v0.2.0...v0.3.0

v0.2.0

What's Changed

• Run the test suite in parallel and speed up the inactive 404 sweep by @ffroliva in #5
• sharpit 0.2.0: runtime panels, REST API advisor and HTTP probe by @ffroliva in #7
• Add SonarCloud analysis and README badges by @ffroliva in #8
• Clear the last four Sonar reliability issues by @ffroliva in #9
• Point CI, docs, skills and badges at main by @ffroliva in #10
• Add a MkDocs Material documentation site by @ffroliva in #11
• Enforce module boundaries and performance rules by @ffroliva in #13
• chore: ratchet code shape and Sonar, one condition per assert by @ffroliva in #14
• Docs: list the MCP tools with a short description by @ffroliva in #12
• feat: add the perf-audit skill for sharpit's runtime overhead by @ffroliva in #15
• test: stop the overhead budget tests from failing on a busy machine by @ffroliva in #16
• chore: release 0.2.0 by @ffroliva in #17

Full Changelog: v0.1.0...v0.2.0

v0.1.0

What's Changed

• sharpit MVP: FastAPI adapter, engine, UI, MCP by @ffroliva in #1
• chore: release 0.1.0 by @ffroliva in #2
• fix: point links at github.com by @ffroliva in #3
• Publish releases from CI on a signed tag by @ffroliva in #4

New Contributors

• @ffroliva made their first contribution in #1

Full Changelog: https://github.com/ffroliva/sharpit/commits/v0.1.0