Orion Code v0.3.27 — Code Review Contract & Foundation Slice

Orion Code v0.3.27 — Code Review Contract & Foundation Slice

@orion-agents/orion-code@0.3.27 · npm latest · tag v0.3.27 → 0be5b18 (#283)

First slice of the professional code review loop (plan: docs/plan/v0.3.27-plan.md,
PR0 + PR1). Runtime/CLI wiring (PR2), the Web loop (PR3) and the qualification
benchmark (PR4) are subsequent slices of the same plan and are not part of
this release.

Added

• Shared review contract (src/services/code-review/contract.ts): selectors,
  run states, terminal conclusions and findings; tighten-only budgets
  (50 files / 2 MiB body / 1 MiB diff / 50 read calls / 5 min / 100 findings /
  256 KiB result); typed finding validation; the plan §4.1 conclusion mapping as
  code — a partial, failed, cancelled or untrustworthy review can never surface
  as a green "no findings"; receipt digests verified by recomputation;
  stale-applicability annotation that never rewrites history.
• Human-annotation review-quality benchmark (12 defect + 8 clean samples
  across TypeScript/JavaScript/Python, with content digests, expected triggers,
  allowed locations and frozen scoring thresholds). Per-sample human sign-off is
  pending before any paid model run (plan §9.3); no quality numbers are
  claimed by this release.
• Shared Git snapshot reader (snapshot.ts): worktree scope records staged,
  unstaged and untracked changes as separate sources; base scope freezes
  ref/HEAD/merge-base into immutable OIDs with rename tracking and typed
  ref_unresolved / no_merge_base errors; sensitive and binary entries are
  skipped without being read; tightened budgets skip the excess with typed
  reasons; a mid-review working-file mutation fails loudly; argument arrays
  only — no shell, no external diff drivers, no textconv.
• Read-only workflow constraints (constraints.ts): deny-by-default — only
  read_file, list_files, glob, grep pass the dispatch-level guard; the
  frozen constraint digest binds receipts. Runtime/CLI wiring lands in PR2.
• Dependency hygiene: follow-redirects bumped to 1.16.1 within range,
  clearing two high advisories (GHSA-q3jh-wrc6-jgq8, GHSA-8r9p-f939-6h3c)
  published after the v0.3.26 release; npm audit reports 0 vulnerabilities.

Quality

Gate	Result
Release gate (release:check)	PASS
Dependency security audit	PASS (0 vulnerabilities after the follow-redirects bump)
Web E2E critical journey ×3 (Node 22/24/26)	PASS
Web E2E full suite three consecutive runs (3×105)	GO — attempt 3 green (119 passed, 9.7m); attempts 1–2 failed on one runner-timing flake (WEB32-P0-08 OpenAI-fixture 45s timeout), confirmed transient by rerun on identical code; the spec is not exercised by any change in this release
Node 22/24/26 exact-tgz floors	PASS
Full Jest	375/375 suites, 4528+ passed (23 new contract/integration tests)
tarball SHA-256	35a8820fc60d209141004fd973a7fa40f3bf09f0c71b4f034db8c72471b3c90a (matches the CI three-runs artifact exactly)

Install:

npm install -g @orion-agents/orion-code@latest
orion --version   # 0.3.27