MergeWarden v0.6.0

v0.5.0 made agent detection work. This release fixes what that exposed.

With detection live, contract/missing fires on nearly every agent pull request — and it was hardcoded to error.

error blocks. Our own adoption path tells teams to graduate to mode: block at step 4, which would then have rejected every agent pull request — no coding agent emits a scope contract by default, and the scan study measured 0 of 2,204. Nothing a reviewer does to the change can resolve it.

It also ranked a missing declaration exactly as severe as workflow/permission-escalation, which fires when a workflow actually moves from contents: read to contents: write plus id-token: write. One is the absence of a convention almost nobody has adopted; the other is a privilege boundary moving.

The change

contract:
  missing_severity: warn # or: error

contract was the only rule family without severity control, so this closes an inconsistency rather than adding a special case.

Verified on real agent pull requests at mode: block:

Pull request	Before	After
Agent PR, no contract, nothing dangerous	block	warn
Agent PR, no contract, edits an agent instruction file	block	block

The tool now blocks on what a pull request did, not on a convention it did not follow.

contract/invalid, contract/out-of-scope and contract/blocked-path stay error — each fires on something a pull request did against its own declaration.

Breaking

No API breaks, but the default decision changes in one case, which is why this is a minor bump:

• On mode: block, an agent PR whose only issue is a missing contract no longer blocks. Restore with contract.missing_severity: error.
• On the default mode: warn, the decision is unchanged. Only the reported severity moves from error to warning.

Also fixed

Three strings said "an mergewarden contract", left from the v0.4.0 rename — the sentence most new installs would read first.

Full notes: docs/release-notes-v0.6.0.md

Published from signed tag v0.6.0 (verified=true) with npm provenance.