v0.2.0
Routine dependency PRs no longer land in your review queue, plus an installer polish.
Fixed
- Escalation now fires only when a human is genuinely needed. dep-steward used to assign you and add
needs-human-reviewwhenever the Claude review produced no verdict — even on the minor/patch group PRs the deterministic gate auto-merges on its own. Now group PRs (the gate's domain) are never escalated; only singleton/major PRs, which the gate can't merge without a verdict, reach your queue on a missing one. The classic false alarm — anactions-minor-patchbump that touches the review workflow itself and trips claude-code-action's OIDC self-modification refusal — no longer pings you on a PR that auto-merges seconds later. Implemented as a new unprivilegedGATE_MODE=classifyin the gate (single source of truth for which branches are groups).
Changed
- The installer's "Done" output no longer prints the optional
/dep-steward-summaryinstall aside; mid-install it read as a confusing tangent. The command is still documented in the README.
Added (design only — not yet implemented)
docs/design/autonomous-fix.md— the design for autonomous FIX-AND-MERGE: a fixer LLM writes a bounded fix, an independently-scoped adversarial reviewer (blind to the injection vector) tries to refute it, and the deterministic gate merges only if it survives.
Upgrading an existing install: the fix lives in the files dep-steward renders into your repo, so re-run the installer to refresh them, then commit:
sh -c "$(curl -fsSL https://raw.githubusercontent.com/raphaelcm/dep-steward/main/install.sh)"
git add -A && git commit -m "Update dep-steward" && git push
The one-liner always installs from main, so new installs already include everything above — this tag is a milestone marker, not a gate.