v3.13.0

What's new

Features

The review pipeline now validates its own run-level artifact instead of trusting it by convention. ce:review writes two kinds of artifact — per-persona records, which the parent has always validated before persisting, and the run-level review-summary.json, which nothing checked. An audit of 26 runs found 138 per-persona files sharing 21 shapes (111 identical), against 7 run-level artifacts with 7 distinct shapes written under two different filenames.

The run artifact now has a Zod source of truth, with the input ledger modeled as a discriminated union on record_type so admitted rows and rejected-payload summaries are machine-separable without inferring state from which keys happen to be present. A generated JSON Schema is committed and gated against drift, and validation ships as a new CLI command, systematic validate-review-artifact <path>, distinguishing four outcomes — valid, schema violation, operational failure (missing file, malformed JSON), and pre-contract legacy artifacts with no schema_version. Error output is projected through an explicit allowlist so validation failures never echo review content back into logs. The ce:review skill now requires the parent to stamp schema_version and run the validator immediately after writing, with a stated failure path: repair and re-run, never report a verdict over a failing artifact, and never delete it to dodge the check (#830).

Documentation

Project docs had drifted from the tree they describe: skills were listed as 45 against 31 on disk, agents as 51 against 37, unit tests as 20 against 59 (later corrected again to 56 to match this branch), and integration tests as 2 against 11. Two script roles were also swapped in a way that could mislead a reader following them — build-registry.ts was documented as the drift checker, when drift is actually checked by generate-registry.ts (which regenerates registry.jsonc from skill and agent frontmatter), while build-registry.ts builds the OCX packument from the already-synced file. Undocumented parts of the tree — the Pi extension entry point, the evals harness and runner, and the codegen/drift-check scripts for Pi personas, the agent-browser skill, and the review artifact schema — are now described, and a script that only exists on an unmerged branch was removed from the list. Every backticked repository path in both files was checked for existence against this branch rather than spot-checked (#831).

Continuous Integration

Renovate's package rules now give release-pipeline packages a minimum release age of three days before they're picked up, and group semantic-release and conventional-changelog-conventionalcommits major updates under a single rule so they land together rather than piecemeal. A follow-up fix adjusted the package matching to include semantic-release-export-data for more accurate dependency management (#835).

Also in this release

• build(dev): Bump conventional-changelog-conventionalcommits to v10.4.0.
• deps: Add a conventional-changelog-writer override; bump bfra-me/.github, fro-bot/agent (three releases), and github/codeql-action.
• dev: Bump @biomejs/biome, agent-browser, and typebox (twice).

Compare

v3.12.4...v3.13.0