v3.18.5
What's new
A documentation-focused patch. The substance of this release is a new docs/solutions/ entry capturing a defect class that survived three independent rounds of review, plus routine dependency maintenance.
Documentation
docs(solutions) adds re-verify-carried-state-at-phase-boundaries-2026-09-15.md, a learning drawn from building the ce:review synthesis pipeline. The same defect appeared five separate times in one place: the seam where a phase hands derived state to a later phase that must re-verify it rather than trust it. Three separate passes of scrutiny — a read-only architectural review, running the pipeline against its own code, and two rounds of PR review — each found instances the others missed, and every blocking finding from the final round landed in a seam the earlier passes had already inspected.
The recurring shapes were a wire projection that dropped derived fields and forced the consumer to re-infer them; a verifier fed the very field it was testing, so a tampered value plus a matching dependent value round-tripped cleanly; joins that checked presence but not completeness, so a deleted request passed as satisfied; a "by construction" argument living inside a verifier whose entire premise is untrusted input; and two derivations over different row sets whose reconciling invariant was documented but never asserted.
The reason this matters beyond ce:review: every bad envelope was schema-valid. Strict Zod contracts and a clean typecheck caught none of them, because shape was never the problem. One case needed no adversarial input at all — any run with an unavailable reviewer emitted an artifact whose counts disagreed with its own ledger. The document states seven checkable rules with before/after excerpts from the shipped implementation, names the concrete consequence class (forged dedup identity, laundered confidence, misattributed ownership, and artifacts that do not reconcile with themselves), and describes the recognizable situations where it applies.
It was written through ce:compound in full mode. Overlap against the nearest prior art — the artifact-contract learning from #793 — scored Moderate, so this landed as a new document that cross-links to it rather than an edit to the existing one.
Also in this release
- deps:
zodupdated to v4.6.4 (#989). - deps:
fro-bot/agentupdated to v0.113.0 (#987), then to v0.113.1 (#988).