Repository navigation
v3.16.3
What's new
A maintenance release: the review-artifact validator can now check artifacts that live outside a live run directory, the Fro Bot autoheal workflow actually lands its file changes instead of discarding them, and the plan corpus was refreshed.
Bug Fixes
validate-review-artifact gains a --allow-outside-artifact-root flag, wired into both the standalone CLI (src/cli.ts) and the bundled Claude Code validator entry (src/claude-code-validator.ts). Previously the resolved path had to stay inside .context/systematic/ce-review, and that directory had to exist — which meant an artifact fetched from CI, attached to an issue, or checked in as a fixture could not be validated without first being copied into a live run directory. The flag drops both requirements.
Every other guarantee stays enforced regardless of the flag: lexical .. traversal rejection, symlink rejection on every path component, realpath canonicalization before the file check, a regular-file check on the resolved target, and the no-echo guarantee that error output never contains the supplied path or file contents. Argument parsing, the usage string, and the flag constant were hoisted into src/lib/review-artifact-path.ts — the module both entries already shared for path resolution — so the two command surfaces are the same code rather than hand-maintained copies. The flag is idempotent, and a successful external-mode validation prints a distinct message so a transcript cannot mistake it for the current run's evidence.
The synthesis artifact contract doc records the flag as an external-validation mode with an explicit warning: the ce:review parent must never pass it when validating its own run's review-summary.json, since that would silently accept a mismatched or misplaced artifact as that run's evidence (#915, 690a7f1).
Continuous Integration
The Fro Bot workflow now requests branch-pr delivery for autoheal runs, so the daily autoheal cron and prompt-less autoheal dispatches land their file changes on a branch instead of discarding them. The gate mirrors the PROMPT ladder directly above it, and a test pins that the two expressions agree. Because inputs.mode defaults to autoheal, the inputs.prompt == '' guard is what keeps prompt-only dispatches — such as the release-notes narrative automation in scripts/dispatch-release-notes.sh — comment-only. PR-review, comment, workflow_call, and review-mode runs resolve to the empty string and keep their current behavior.
The autoheal prompt's code-quality list and quality-gates table now cover all four drift gates: review-schema:drift and agent-browser:drift join the existing registry:drift and schema:drift, with new assertions in tests/unit/fro-bot-workflow.test.ts. Delivery still depends on FRO_BOT_PAT scopes — an insufficient token fails closed to the previous discard behavior, so the first scheduled run's resolved-output-mode is worth checking (#912, 5f38bb9).
Documentation
A new plan covers a CI gate that resolves every shipped model identifier — OMO profile routing, config-schema.ts examples, hand-written docs, and skill-reference examples — against a committed snapshot of the models.dev registry, plus a refresh script with a drift check and a weekly workflow that opens a PR when the registry changes. A retired identifier then fails that PR's gate by name; nothing rewrites routing choices. The gate is planned to live inside content-integrity as a hard, offline pass/fail so main.yaml gains no new step, and schema examples are read from the same Zod producer that emits the published JSON Schema rather than by parsing TypeScript (#908, a0ccd3b).
Three shipped plans were marked completed — the review-artifact executable contract fix, the review-artifact contract refactor, and the OpenCode plugin load-failure fix — taking the active plan census from 10 down to 7 (#911, 58ece67).
Also in this release
- deps: update fro-bot/agent to v0.109.0 (#913)