v0.56.0

Added

• lean: a repository's Lean proofs build. A repository that tracks a lakefile.toml or lakefile.lean gets a gate that runs lake build --wfail in each Lake project's directory, so a proof that uses sorry, or any other warning, fails it. A lake on PATH is used as it is; without one, as on a CI runner, the gate installs elan v4.2.4, checked against its published SHA-256, under the user's cache directory, and elan fetches the toolchain the project's lean-toolchain names. A repository with no Lake project skips the gate.

v0.55.0

Added

• platform-via-sdk: a client reaches the platform through the Go SDK. In a repository that sets platform_via_sdk.enabled, a string that names a platform route fails the gate: /v1/ and a segment the platform origin serves, such as agents, account or storage, read through concatenation, the module's own constants in any package, and fmt formats. So does a net/http request or a url.URL addressed to a platform route or to api.latere.ai. Test files and the SDK's own module are not read. Each finding names the file, the line and the route, and the call of SDK v0.7.0 that makes it, or says to add the call to latere.ai/x/sdk-go. platform_via_sdk.allow takes a route with the reason it is not a call to the platform; an entry no finding needs fails the gate.

Upgrading

• Nothing changes for a repository that does not set platform_via_sdk.enabled: the gate is skipped with that reason. A client turns it on once its calls go through the SDK.

Fixed

• Built with Go 1.27.3, which fixes GO-2026-6809, a flaw in the
  standard library's certificate verification that this code can reach.

v0.54.0

Added

• container-labels: a package that imports testcontainers-go imports reap. The containers watch sees only containers and networks carrying the reap labels, so a helper that never adopted the contract leaked as before while the suite reported nothing left behind. The new gate reads every Go package of the tree, test files included, and names each one that imports a testcontainers-go package and no file of which imports latere.ai/x/ci-gate/reap. It applies once a package imports testcontainers-go, and is skipped with that reason before. A nested checkout under the tree, such as an agent's worktree, is another repository and is not read.

Upgrading

• A repository whose tests start containers through testcontainers-go and do not use reap fails container-labels. Adopt the contract in the helper, as the containers section of docs/gates.md shows, or write a dated waiver while it is behind.

v0.53.0

Added

• containers covers networks. A network a test helper makes with network.WithLabels(reap.Labels()) is swept once its owner process has exited, after that owner's containers, and a network a run leaves is named, removed and fails the suite beside its containers. reap.Sweep counts the networks it removed.

Upgrading

• A helper that puts its containers on a network of its own labels the network too. Until it does, a killed run's network stays on the engine; it holds no memory, but nothing removes it.

v0.52.0

Added

• containers: the suite leaves no container behind. A test helper that starts a container labels it with reap.Labels() and sweeps with reap.Sweep(ctx), from the new package latere.ai/x/ci-gate/reap. The suite then sweeps what exited test binaries left on the machine, names its run in LATEREGATE_RUN, and after go test exits removes every container still carrying the run's label and fails on it. A container is removed when its owner process is gone, never for its age. This covers what testcontainers' Ryuk covers, a panic on -timeout, a kill, a package with no TestMain, on engines where Ryuk cannot start, such as Podman. With no engine socket the suite runs as before and says nothing was watched. containers folds into suite; a waiver on it turns the watch off.

Upgrading

• A helper that starts containers adopts both calls, and stops the container a failed start returns along with its error. Until it does, its containers carry no label, and the suite neither sweeps nor checks them.

v0.51.0

Changed

• The lint gate runs golangci-lint v2.14.0. v2.13.1 is built against a golang.org/x/tools that cannot read the export data Go 1.27.2 writes, so on Go 1.27.2 it failed every package with "export data version 5 is greater than maximum supported version 4". v2.14.0 also brings the stringscut modernizer, which asks for strings.Cut, strings.CutLast and the like over an index and two slices.

Security

• Built with Go 1.27.2 and golang.org/x/net v0.60.0 (GO-2026-6611, GO-2026-6612, GO-2026-6613, GO-2026-6617).

Upgrading

• A consumer moving to this release on Go 1.27.2 may see new stringscut findings; go run github.com/golangci/golangci-lint/v2/cmd/golangci-lint@v2.14.0 run --fix ./... rewrites them.

v0.50.3

Fixed

• lateregate prepush lets the first push to an empty remote through. A
  branch the remote lacks was diffed against its merge base with
  origin/main, and a remote with no main has none, so the hook refused
  the push that would have created it. With no merge base the hook now
  lints the packages of every Go file the pushed commit holds, says so, and
  runs nothing when the commit holds no Go file.
• The coverage floor leaves out Go source under node_modules. A
  JavaScript package that ships a Go package, as flatted does, was
  instrumented by -coverpkg=./... and judged at 0%, so suite and
  cover failed on every workstation with the frontend's dependencies
  installed and passed on a runner without them. The profile's rows and
  the list of packages that must be measured both skip the directory, as
  modernize already did.

Changed

• docs/gates.md says the rule that compares a started spec with its
  dependencies runs only when spec.started is set, and that Latere's
  repositories leave it unset: a spec's status records its own criteria
  and review holds the order depends_on states. This repository's own
  .lateregate.yaml drops started and keeps settled for the identity
  gate. No behavior changed.

v0.50.2

Fixed

• lateregate hook applies the outbound HTTP client rule to the staged
  files the otel-client gate reads, and no others. It checked every
  staged Go file, so a commit that touched a file under a directory
  otel_client.skip names, such as a command-line tool with no inbound
  trace to continue, was refused although the full gate passes it. The
  hook now leaves out what the gate's walk leaves out: a directory the
  skip list names anywhere on the path, and .claude, node_modules and
  testdata. A commit refused for that reason alone now goes through.

v0.50.1

Fixed

• lateregate prepush checks the changelog section of a release tag
  whatever the local ref is called. It read only lines whose local ref was
  under refs/tags/, but git push origin HEAD:refs/tags/v1.2.3 hands the
  hook the local ref HEAD, and a commit sha pushed straight to the tag
  hands it the sha, so a release tag with no section went through
  unchecked. The remote ref now decides, as it does for the lint: every
  push to a release tag is checked at the pushed commit, and a tag deletion
  or a push to a branch still checks nothing. A tag push that went through
  before can now be refused until its commit has a section.

v0.50.0

Added

• A release.stamp entry takes an optional placeholder: a literal that
  stands for no release yet, such as newTag: unreleased in a deploy
  overlay no tag has pinned. The cut replaces it inside the match as it
  replaces a version, so the first release pins itself; the pattern matches
  both states (newTag: (v\d+\.\d+\.\d+|unreleased)). An overlay that
  carried a never-cut v0.0.0 only so the first cut had a version to move
  can name unreleased instead. Without the key nothing changes: a match
  with no vX.Y.Z still refuses the cut, and with it a match holding
  neither the version nor the placeholder does.

Changed

• The README covers adopting the bar and the gate list; the reference moved
  to docs/: every gate in docs/gates.md, every command and the two hooks
  in docs/commands.md, .lateregate.yaml in docs/configuration.md, and
  cutting a release in docs/releasing.md. CONTRIBUTING.md is new. No
  behavior changed.

Fixed

• Several release.stamp entries naming one file all land. The cut planned
  each entry from the file as committed and wrote the file once per entry,
  so the last entry's write dropped every earlier stamp without a word.
  Entries on one file now apply in the order listed, each to the file as the
  entries before it left it, and each pattern must still match exactly once.
  A single pattern spanning two markers to work around this can become one
  entry per marker.
• lateregate prepush lints a push to a branch whatever the local ref is
  called. It read only lines whose local ref was under refs/heads/, but
  git push origin HEAD:main from a worktree, and the push lateregate release makes, hand the hook the local ref HEAD, so the hook printed
  "no branch pushed; nothing to lint" and let the push through unlinted. The
  remote ref now decides: every commit pushed to refs/heads/* is linted,
  and a tag push or a branch deletion still lints nothing. A push that went
  through before can now be refused for findings in the packages it
  changes.