v1.4.0

What's changed

appmap-gold-traces: coverage comes from the recordings

• expect and expect_labels are gone from manifest entries. They asked the author to type, per entry, which functions and labels the recording must contain. The recording already holds that in its class map, the compare already reports a call that disappears, and a hand-kept list drifts on every rename. A manifest that still has the fields parses as before and gets a one-line note to delete them.
• The duplicate check now compares what the recordings actually run. discover prints its facts without a verdict; the recording-based coverage delta is the only duplicate check.
• New engine command covers --name <part of a class or method name> lists the committed baselines that run a matching code object, spelled as the recordings spell it. This answers "does a gold trace already run this?" without recording anything. covers --fresh searches the recordings under appmap_dir instead and names each by its test metadata.
• New warning: a recording that stays inside one project class and makes no SQL or HTTP calls reads like a unit test. The overlap warning now says to keep an entry that drives a branch its nearest neighbour does not, and that the engine compares functions, not branches.
• New section, "Finding the test for a code path": run covers on the code object, then on its caller, then hand a subagent the prompt in assets/find-candidates.md to walk the call chain upward, and as a last resort record a test directory. Every candidate is then measured with discover, and the smallest recording wins.
• Maintain is now a six-step release flow where every step is a command except the two marked as a decision. Branch coverage is the test suite's job; only a security gate earns a trace for its refused branch.
• Fix: a dotted packages[].path (Java, Python) never matched a source path, so nothing counted as project code and every entry looked like a duplicate. The coverage comparison now falls back to all code objects when the filter matches nothing.
• The hand-written YAML reader is replaced by js-yaml 5.4.1, vendored under assets/vendor with its MIT license. The manifest and appmap.yml are standard YAML now: same-line comments, flow lists, anchors, and gem: entries all work.

Verified on a real Rails project at two historical revisions. The flow reproduced the real bless commits with identical digests.

appmap-review: decide coverage from the recordings

The Coverage Matrix no longer guesses from test names. A feature behind a trace that changed in the compare is covered by that trace. For a feature whose traces did not change, the review asks the gold-traces engine's covers whether any baseline runs its code. For each gap, the report names the existing test to discover, or says a focused test is needed and what it must drive, instead of printing a record command.

appmap-setup: the record commands live in the manifest

Setup no longer writes docs/appmap.md or imports it from CLAUDE.md. Every line of that file duplicated something a tool already reads. Setup now ends by seeding gold_traces/manifest.yaml with its commands block filled and an empty entries list, verified with plan and one smoke recording. Project-specific lessons go as comments next to the thing they describe.

appmap-setup-review

The replay phase cherry-picks a "commands" commit instead of a "docs" one, and the gold-traces phase follows the new "Finding the test for a code path" section.

Upgrading

Delete expect and expect_labels from existing manifest entries. Nothing else changes; committed baselines stay valid.

Full changelog: v1.3.1...v1.4.0