@gitgov/core v3.22.0

3.22.0 (2026-08-28)

✨ Features

• core: AUDIT-J1..J3 — enums de dominio cerrado con constante primero y tipo derivado (d054c0e)
• core: FileLister declara su semantica de frescura e invalidateCache en la interfaz (cf36055)
• core: move resolveLlmProvider and CliLlmProvider to @gitgov/core/fs (c8deb8c)
• core: WTSYNC-B18/B19 — retry acotado del push ante un escritor concurrente (4ec2a20)

🐛 Bug Fixes

• cli: import filesystem implementations from @gitgov/core/fs (9a53b23)
• core,cli: bind the engine validator to a root at construction (758caea)
• core: PROJ-H3b espera antes de concluir ausencia + EARS-C1 propaga la causa del 5xx (2478555)
• core: realign test describes and headers with the renumbered spec sections (5520f60)
• core: repair the pipeline integration suite and stop excluding it from tsc (e4ef284)
• core: stop the main barrel from re-exporting filesystem implementations (9800a83)
• core: tag every backend test with its EARS id (1562745)

♻️ Refactoring

• cli,e2e: translate Spanish comments to English in three files (bd9e717)
• core,cli: drop process-traceability from comments in types, file_lister, sync_state and login (359008e)
• core,cli: inject IEngineValidator and normalize agent_runner EARS prefix (e6c6a77)
• core: invert the clean_exports guardrail to an allowlist (4a74495)
• core: remove copyAgentPrompt from the project initializer (2ff0c58)

📝 Documentation

• core: drop the ChangelogRecord commentary from the pipeline helpers (1ddf2c3)

@gitgov/core v3.21.0

3.21.0 (2026-08-05)

✨ Features

• cli,core: agent discovery + error UX + stateBranchOverride fix (s78) (bfd4092)
• cli+core: AORCH-G1/G2 agent failure warning + AORCH-P6 working-repo guard (ed01477)
• cli: AORCH-P4 persist audit-index.json + AORCH-P5 project guard (14077b2)
• cli: EARS-E8 agent update message with engine type transition (a0fbcad)
• cli: graceful bootstrap + bump private (KS11 + specs) (#160) (5cc0895), closes #6 #46
• cli: lint --strict, pull key detection, agent fail-fast, force-cloud commit (fa118bd)
• cli: LOGIN-H4 SSH alias resolution via ssh -G + AORCH-C8 git context (88aed89)
• cli: LOGIN-T1 — upload repo agent keys via syncKey agentKeys[] (18de76d)
• cli: LOGIN-T2 — diff-based agent key upload, independiente del path humano (adcad56)
• cli: LOGIN-T3 — force-cloud uploads agent key diff with downloaded canonical key (311d460)
• core,agents: FindingCategory extensible + agent distribution prep (s78) (eb1acf8)
• core+cli: identity key model P0-P2 implementation (b319a79)
• core: audit entity factories + test builders — AUDIT-F1..I3, 37/37 green (288d843)
• core: AuditFsProjection — persist audit results to .gitgov/audit-index.json (b2a1823)
• core: createFinding + EARS-U8 + GPI19 + CLI getHeadSha (s74-s75) (#164) (7a10e67)
• core: lint --strict Three Gates + agent engine validation + init warnings (2f24144)
• core: PKP-H1..H4 — repo-scoped agent keys in PrismaKeyProvider (3f9dc27)
• core: PP-C2 post-persist integrity check in PrismaRecordProjection (0a7b730)
• core: security .gitignore + addAgent homologation + SYNC_ROOT_FILES (16399fa)
• flow_verification s77 — PAF 17/17, mcp-server fix, LLM lazy detection (4d0b281)
• identity: E6 — reconcileActorRecord primitive + login force-cloud delegate (f27ee6c)
• T14: FindingRedactor required — core types + CLI DI + audit fixes (eb3be19), closes #53-54

🐛 Bug Fixes

• agent-security-audit: update description for npm publish (6387e17)
• agent-semgrep: add release workflow + semantic-release config (db3d42e)
• agents: move @gitgov/core from dependencies to devDependencies (feb84b1)
• cli: defer projector resolution to command execution — state-branch override precedence (c294499)
• cli: INIT-J2b skip postInitConcerns when already a member (26fc4bd)
• core+cli: D1 fix, P1 revert, syncKey refactor — session 65 (3378d29)
• core: AUDIT-I2 test assertion — verify feedback structure not just toBeDefined (fc2bc73)
• core: listRemoteBranches per_page:100 — prevent missing branches in pagination (67d9b04)
• core: RSIG-A5 — reject empty or whitespace-only notes in RecordSigner (919cd59)
• e2e: thread sharedGitModule in shared GitHub backend helper (067dad5), closes #12
• e2e: use local PrismaClient instead of saas-api import (5e51187)

♻️ Refactoring

• cli: rename ensureActorInProject → addActor callers + mock variables (30c1606)
• core+cli: FindingRedactor required — eliminate conditional redaction (5c1db95)
• core: E6 follow-up — drop YAGNI reconcileActorKey wrapper (supervisor review) (3abbb4b)
• core: rename ensureActorInProject → addActor + EnsureActor* → AddActor* (347454b)

📝 Documentation

• inputs de producto, workflow CI y config del repo (trabajo de otras sesiones) (6db1ffc)

agent-semgrep-v1.0.0

1.0.0 (2026-08-03)

⚠ BREAKING CHANGES

• cli: audit-command.ts is now a thin wrapper around
  AuditOrchestrator.run() instead of calling SourceAuditorModule directly.

Changes:

• DI: added getAuditOrchestrator() to dependency-injection.ts
• Removed legacy flags: --target, --detector, --max-findings, --group-by, --summary
• Added --agent flag for filtering to specific agent
• Exit code from policyDecision.decision (block=1, pass=0)
• Output formatting adapted for AuditOrchestrationResult
• Waive subcommand unchanged

Code reduction: 628 → ~340 lines (-46%)
Tests: 19 passing, AORCH-C1..C6 covered

• fix(cli): audit fixes — mock type, --quiet desc, EARS-C11 getAuditOrchestrator test

• test(e2e): Block G (CG9-CG16) + Block H (CH1-CH4) — 12 new E2E tests

Block G — Audit Orchestration (CG9-CG16):

• CG9: SarifBuilder.validate() passes on agent output
• CG10: Content-based fingerprints stable across line numbers
• CG11: Flat gitgov/ property keys in SARIF results
• CG12: Multi-agent execution with dedup consolidation
• CG13: Failed agent doesn't block remaining agents
• CG14: Duplicate findings deduplicated with reportedBy[]
• CG15: Zero findings skips conditional heuristic stage
• CG16: Findings trigger subsequent detection stages

Block H — Policy Evaluation (CH1-CH4):

• CH1: ExecutionRecord type decision with BLOCK result
• CH2: ExecutionRecord type decision with PASS result
• CH3: Waived findings excluded from policy decision
• CH4: ExecutionRecord has complete structure for Ed25519 signing

All 20 E2E tests passing (8 existing + 12 new).

• fix(tests): fold E4b/P1b into parents, remove PSV2-A9 duplicate

• docs(core): clarify PolicyEvaluationResult re-export boundary in orchestrator types

• feat(core): create policy.yml during project initialization (EARS-FPI14)

FsProjectInitializer.createProjectStructure() now creates .gitgov/policy.yml
with default configuration (version: "1.0", failOn: critical).
Does not overwrite existing policy.yml on re-initialization.

2 new tests: [EARS-FPI14] create + no-overwrite. 26/26 passing.

• fix(core): FPI14 use async fs.access instead of sync existsSync, fix test mocks

• test(e2e): verify policy.yml creation during gitgov init (EARS-FPI14)

• epic: IndexerAdapter now requires cacheStore: Store
  instead of deprecated cacheStrategy/cachePath/cacheSize options.

Core (Triad 1 - indexer_adapter):

• Remove FileIndexerAdapter, use IndexerAdapter with Store
• Make cacheStore REQUIRED dependency (no backward compatibility)
• Remove backup mechanism (EARS-14) - cache is regenerable data
• Simplify cache operations via Store.put/get/delete/exists
• Update all 77 tests to use mock cacheStore

CLI (Triad 2 - indexer-command):

• Remove cacheSize/cacheStrategy handling from output formatting
• Update tests to match simplified report structure (34 tests)

Store:

• Export IndexData type for external usage

Audit: Both triads verified coherent (Blueprint ↔ Code ↔ Tests)

• feat(cli): add dependency_injection_module blueprint and update tests

Triad 3 - DependencyInjectionService:

• New blueprint following module_designer_v2 template
• Update test EARS naming to block format (A1-A2, B1-B4, etc.)
• Add EARS-F1 test for validation when .gitgov exists
• 10 tests passing, 19 EARS total in blueprint

EARS coverage:

• Singleton (A1-A2): ✅ Complete
• Store Init (B1-B4): 🟡 2/4
• Adapter Factories (C1-C8): 🟡 2/8
• Bootstrap Reindex (D1-D2): ✅ Complete
• Error Handling (E1-E4): 🟡 2/4
• Validation (F1-F2): ✅ Complete

• test(cli): remove deprecated cache fields from test mocks

Remove cacheStrategy and cacheSize from IndexGenerationReport mocks
in dashboard and task command tests. These fields were removed as
part of the Store abstraction migration.

• refactor: migrate agent prompts to blueprints submodule

• Move docs/gitgov_agent_prompt.md → blueprints/02_agents/design/gitgov_agent.md
• Rename packages/core/prompts/gitgov_agent_prompt.md → gitgov_agent.md
• Update sync-prompts.ts to use new location in blueprints

This consolidates all agent definitions in the blueprints submodule.

• docs(core,cli): standardize README sections

• Add Contributing, Security, Community, License, Links sections to both
• Remove redundant implementation status sections from CLI README
• Align footer format across packages

• chore: update blueprints submodule

• refactor(core): normalize EARS IDs in ConfigManager triada

Normalized all EARS IDs from numeric to letter-block format across
Blueprint, Code, and Tests for better section association.

Changes:

• Blueprint: EARS-1..26, EARS-53 → EARS-A1..D3
• Tests: Updated all 44 test EARS references
• Code: EARS-53 → EARS-B9 (actor auto-detection)

Triada coherence verified: Blueprint ↔ Code ↔ Tests aligned.

• refactor(core,cli): migrate to createConfigManager factory function

Updated all ConfigManager instantiation from constructor to factory
function as part of ConfigStore abstraction migration.

Changes:

• IdentityAdapter: new ConfigManager() → createConfigManager()
• ContextCommand: new Config.ConfigManager() → Config.createConfigManager()
• SyncModule tests: new ConfigManager(path) → createConfigManager(path)
• DependencyInjection: new Config.ConfigManager() → Config.createConfigManager()
• Store exports: Added ConfigStore, FsConfigStore, MemoryConfigStore

Tests verified: 2349 passed.

• docs(epic): update Cycle 3 progress - ConfigManager completed

• docs(sync_module): sync triada código ↔ tests

Triada auditada y coherente:

• 58/62 EARS implementados y testeados
• 4 EARS skipped (requieren setup E2E complejo)

• docs(id): sync triadas id_generator + id_parser

id_generator:

• EARS 1-6 coherentes (generacion de IDs)

id_parser (nuevo):

• EARS A1-E2 coherentes (parsing, validacion, inferencia)
• Tests con prefijos [EARS-X]

• chore: update blueprints submodule - Progressive Disclosure epic

• refactor(lint): sync triada código ↔ tests - 37/37 EARS

• Habilitado test EARS-F2 (registros legacy sin header/payload)
• Arquitectura Store Backends: LintModule (puro) + FsLintModule (I/O)
• Todos los tests pasando (58 tests)

• chore(utils): update index exports

• feat(core): add type_guards and array_utils modules

• chore: update blueprints submodule - design docs improvements

• refactor(cli): migrate to FsLintModule architecture

• DependencyInjectionService uses FsLintModule (wrapper I/O)
• LintCommand updated for FsLintOptions/FsFixOptions types
• Tests updated for new API

• docs(epic): Cycle 3 COMPLETADO - Store Backends

• chore: add .gitmodules for blueprints submodule

Adds proper submodule configuration for packages/blueprints.

Features

• add core packages and CLI implementation (5904320)
• add project configuration files (38dd8b6)
• agents: add GDPR audit agent with formatted output (#80) (6fe884c)
• agents: security-audit agent with configurable pipeline and SARIF output (#117) (0fb2e70)
• agents: security-audit identity and integration — Cycle 2 (#118) (b167370)
• cicd: separate release workflows for cli and core packages (631046a)
• cli,core: add cycle remove-task and move-task commands (#29) (a2f2ba8), closes #1758521733
• cli,core: gitgov agent add + agent runner createRequire + cleanup old schema (74581b4)
• cli/core: EARS-27/28/43/61 sync improvements and UX fixes (#65) (0d44c85), closes #1763344405 #1763344405 #1763344405 #1763344405 #1763344405
• cli/task: implement long description support with --description-file flag (#36) (dd46f82)
• cli+core: AORCH-G1/G2 agent failure warning + AORCH-P6 working-repo guard (ed01477)
• cli: add --show-archived flag to diagram command (#26) (0126746), closes #1758517322
• cli: add actor commands + move key storage to .gitgov/keys/ (cd7f035)
• cli: add exec, feedback, actor commands and init --type extension (16badb9)
• cli: add governance E2...

agent-security-audit-v1.0.1

1.0.1 (2026-08-03)

Bug Fixes

• agent-security-audit: update description for npm publish (6387e17)

@gitgov/core v3.20.0

3.20.0 (2026-05-16)

✨ Features

• gate: configurable state branch + E2E test isolation (#159) (f4485a4)

@gitgov/core v3.19.0

3.19.0 (2026-05-10)

✨ Features

• core: ICiReporter — startCheckRun externalId + postOrUpdateComment re-throws (05d8c9e)

♻️ Refactoring

• core,cli: rename GitGov Gate → GitGov Audit in Check Runs and PR comments (1794e36)

@gitgov/core v3.18.0

3.18.0 (2026-05-08)

✨ Features

• core: add ref to AuditOrchestrationOptions — PR-scoped scanning (6216fb1)
• core: D-EARS file_lister readBatch + shared/github rate limit helpers (31c1397)

🐛 Bug Fixes

• core: audit.prisma — checkRunId Int? → BigInt? (drift correction) (b287383)
• core: update clean_exports test paths after shared/ refactor (94afb58)

♻️ Refactoring

• core: ISP — AgentRecordReader replaces RecordStore in orchestrator deps (7aeeff6)

@gitgov/core v3.17.0

3.17.0 (2026-05-06)

✨ Features

• core,agents,e2e: session 40 — registry pattern, Two-Tier agents, shared/ refactor, E2E Prisma local (ce01ce1)
• core,agents: G18 LLM provider abstraction + review-advisor refactor (69a2368)
• core,cli: Gate Cycle 3+4 — ProjectModule, signed scans, webhook PR handler (#155) (5bc1650)
• core,cli: PROJ-B4 — register default AgentRecord during init (ada0c36)
• core,cli: RLDX-E1 pure runner, CLI L1 persistence, PI12 getHeadSha (8f33926)

🐛 Bug Fixes

• core,agents,e2e: complete session 40 changes — modified files (4457d2a)
• core: PROJ-G1 cache branchExists in GitHubProjectInitializer (cabdb63)
• e2e: import RecordProjectorDependencies from barrel, PrismaClient from saas-api (67dc069)

📝 Documentation

• translate Spanish docs to English in public repo (636d563)

@gitgov/core v3.16.0

3.16.0 (2026-04-29)

✨ Features

• core,cli: Gate Cycle 1 — audit --ci, ICiReporter, formatAuditResult, G20 agent new (#152) (46ea47e), closes #87

@gitgov/core v3.15.0

3.15.0 (2026-04-29)

✨ Features

• core: Identity Module v2 — RecordSigner + IdentityModule + callsite migration (#151) (9eab152)