v0.2.0

Changelog

• d7bbcef build(clispec): regenerate CLI flag stubs to match generator output
• 07f1251 build(deps): bump gavel_tools 0.3.1 -> 0.3.2
• 8932bd5 build(deps): bump gavel_tools 0.3.2 -> 0.3.3
• d92d135 build(deps): bump gavel_tools 0.3.3 -> 0.3.4
• c1ffecd build(deps): bump gavel_tools 0.3.4 -> 0.3.5
• c83ade6 build(deps): bump gavel_tools to 0.3.6
• 2533d10 build(deps): bump gavel_tools to 0.3.7
• ad564ca build(deps): bump the actions group across 1 directory with 6 updates (#31)
• 4dc9451 build(deps): bump the go group across 1 directory with 8 updates (#27)
• 3614f62 build(deps): split web npm group so majors land in their own PR (#35)
• 8e9108e build: add a safe make release driver
• 6e74064 chore(baseline): refresh coverage baselines
• 4c4e320 chore(bazel): regenerate BUILD files
• 3e51105 ci: bump actions to Node 24 versions (checkout v6, setup-go/node v6, codecov v5)
• 19586d0 ci: dogfood gavel report on gavel's own PRs
• 1a2f013 ci: give dogfood Node for web coverage, add job timeouts
• ab33825 ci: guard generated artifacts against drift
• 8e770e9 ci: onboard with the distributed binary on linux and macOS
• 17c7556 ci: pin pnpm to 9.15.4 in the drift job
• 5aeb2d3 ci: post the gavel PR comment from the dogfood job
• ce892a1 ci: prove onboarding by judging the examples on every PR
• c259e53 ci: run gavel judge as a dogfooding gate
• 17ba224 docs(brand): upload-ready social preview (re-encoded PNG + JPG fallback)
• 2740f1f docs(design): record the multi-tenancy isolation decision
• 2c172e7 docs(quickstart): declare the Bazel 8.0 floor and the hermetic-network allowlist (#22)
• 31dd8b0 docs(readme): add the judge demo as the hero
• 46f57f0 docs(readme): lead with the judicial verdict, the agent loop, and the demo
• a18ff0f feat(casefile): fail the verdict when an analyzer did not run (tool_execution)
• 075aa5d feat(catalog): add SelectedAspects for per-language tool selection
• e5b363f feat(catalog): read the tool catalog from gavel-tools instead of hardcoding
• 2d5e641 feat(catalog): select tools per language in gavel.yaml
• 1d64195 feat(cli): build GitHub Checks payload from verdicts
• 7164a39 feat(cli): publish check runs to the GitHub Checks API
• 023ec25 feat(cli): read cached verdicts for gavel report
• 3f5082d feat(cli): report posts a sticky PR comment
• 7e16723 feat(cli): scaffold gavel report command
• 29ff6b2 feat(cli): wire gavel report end to end
• ce46c4c feat(db): add tenant_id to the judicial aggregate tables (nullable)
• 09eaec8 feat(gavelspace): scope the Gavelspace aggregate by tenant
• 0aa730e feat(iam): tenant lifecycle + operator provisioning CLI (#11)
• 5bae0d0 feat(judge): add --no-baseline-update to inspect without persisting
• 2b3703c feat(judge): add --summary to print the verdict without the per-finding list (#24)
• 365aa7a feat(judge): forward bazel_config from gavel.yaml to the bazel invocation (#38)
• 3abab61 feat(judge): surface tools that analyzed zero targets instead of passing silently (#21)
• ad6fbc7 feat(mcp): surface the offending import in architecture violations
• a1a2b00 feat(pleading): scope the pleading aggregate by tenant
• 8125c8f feat(project): store the per-language tool selection
• c9a0bcf feat(project,casefile): scope the judicial aggregates by tenant
• 0cf274e feat(runner): forward aspect build flags to bazel
• 09b6f0e feat(server): secure the first-boot admin password (#10)
• 81fcf75 feat(server): version the database schema with goose migrations
• c4116a3 feat(web): lint TypeScript type-aware and fix the findings it surfaces
• 653fcfd fix(architecture): keep existing violations in the baseline ratchet
• a2c20d4 fix(baseline): preserve coverage baseline in quick mode
• 2de8e94 fix(cli): bound the GitHub Checks client with a timeout
• 13de672 fix(cli): correct malformed format-string verbs in error messages
• 7192243 fix(cli): embed the tool catalog so the distributed binary runs standalone
• a3d92a2 fix(cli): fail-safe report conclusion for non-pass verdicts
• 13f367a fix(cli): harden gavel report from the code-review backlog
• 8d2b371 fix(cli): regenerate stale judge flags.gen.go from clispec
• 841597c fix(cli): report attaches the check to the judged commit
• e3992f9 fix(clispec): restore generated flags.gen.go format
• b46cc8a fix(core): classify architecture identifiers as a set
• 6c5c606 fix(core): don't fail tool_execution on config-only SARIF notifications
• 213645d fix(core): treat error-level config-only notifications as failures
• f22bbef fix(coverage): follow the bazel-testlogs symlink when collecting coverage
• e24dbfa fix(examples): wire the rust frontend eslint config into its js_library
• f6ae665 fix(init): append lint filegroup to an existing root BUILD
• 69763dc fix(install): create GAVEL_BIN_DIR when it does not exist
• bb376a8 fix(installer): order BCR before the gavel registry in .bazelrc (#20)
• 9ef145f fix(judge): skip projects that do not own the target file
• 6d1e392 fix(judge): treat incomplete tool analysis as a warning, not a gate failure (#23)
• 3f50211 fix(mcp): make inspection tools read-only and declare it
• 2d62877 fix(mcp): steer gavel_findings truncation note to the complete counts
• f4a6b07 fix(tenant): close cross-tenant isolation gaps found in review
• b874ae9 fix(trends): return an actionable error when the server is unreachable
• 9a8ffb8 perf(coverage): bound coverage test memory to avoid OOM at scale
• 5b70161 perf(coverage): collect per-test coverage instead of bazel's combined report
• 9c51668 refactor(catalog): drop dead RuleKindsForLanguage
• 4f4cc8b refactor(catalog): drop the defaultLanguages fallback
• beb2410 refactor(cli): drop explanatory comments from the report feature
• 014cfbf refactor(cli): single tagged struct for the verdict cache contract
• f8317a4 refactor(installer): name the registry line count constant
• e3c342e refactor(judge): unify runProject interactive/non-interactive paths
• a8e31fe refactor(mcp): take version from ldflags instead of hardcoding
• 904e20a refactor(tenant): thread TenantID value object through casefile/pleading finder ports
• 67606f1 refactor: make code self-explanatory, relocate design rationale to docs
• a223e36 test(casefile): close tool_execution evidence coverage gaps
• 65cc68a test(catalog): cover the runfiles loader error paths
• 750dc17 test(ci): assert the new-vs-baseline delta on a clean box
• 3608ca3 test(cli): cover the GitHub client response-read error path
• fd5e495 test(cli): cover the new report and cache-reader branches to 100%
• 9200477 test(db): key reused test container to a migrations hash
• 20418b9 test(db): seed tenant_id in integration fixtures broken by tenant-scoped uniqueness
• b3054dd test(installer): guard the gavel_tools version against drift