v1.16.1

fix(auto-merge): pass -R to gh pr merge so auto-merge actually arms (no more fatal: not a git repository in the workflow_run context). Fleet fix — repin auto-merge.yml consumers to this tag.

v1.16.0 — auto-merge resolves PR from head-sha

Fixed

• auto-merge-on-green.yml resolves the PR from head-sha internally. A workflow_run caller has no github.event.pull_request, so callers previously ran a local resolve job to map commit→PR via commits/{sha}/pulls — but that job used the default GITHUB_TOKEN (contents: read), so the lookup 403'd, resolve failed, and every PR silently fell back to manual merge across the fleet. The reusable now performs the lookup itself when pr-number is empty, using the App token it already mints (which carries pull-requests access).

Consumer migration

Repin to @82e55fa008d8b2f5254ba3a2624c22b78036eeb5 # v1.16.0, delete the local resolve job, and pass only head-sha: ${{ github.event.workflow_run.head_sha }}. Backward compatible: a caller still passing pr-number is unaffected.

Also rolls up the accumulated main work since v1.15.0 (#73–#77).

v1.14.0 — private-infra-patterns secret channel

Adds an optional private-infra-patterns secret to python-quality-gate.yml, forwarded into the fitness gate step as PRIVATE_INFRA_PATTERNS, so a consumer whose tc-fitness run reads a private-infra secret-scan detector (e.g. kairix F73) can adopt the reusable without the detector silently no-opping. Backward compatible (optional, empty default). Also fixes the security-scan self-test caller (grant actions:read) so its workflow_call contract is exercised again.

v1.10.0 — diff-scoped fitness smoke

Added

• Add opt-in write-changed-files support to python-quality-gate.yml.
• Document and statically exercise tc-fitness run --changed-files-from .tc-fitness-changed-files.
• Ignore .DS_Store repo-wide.

Verification

• PR #55 was green across actionlint, yamllint, license, branch-naming, and no-attribution.

v1.8.4 — hardened arming driver

Advances @v1. loop-dispatch.yml continuous-dispatch driver with durable cross-tick governor ledger, fail-closed harness validation, and a soak window. DISARMED/dry-run by default; no live spawn until a runtime sink is wired + reviewed.

v1.8.3 — harvest gate + tree reconciler

Advances @v1. verify-and-close now distills + posts a harvest before every Done transition (fail-closed: no close without a harvest). Adds governance/loop/tree_reconciler.py (delegation-tree ⇄ Linear orphan/drift reconciler) and de-serializes example-callers so parallel reusable PRs no longer collide.

v1.8.2 — autonomous loop reusables

Advances @v1. New opt-in reusables: event-dispatch.yml (SP-C-2 failure-driven open side), require-work-item.yml (SP-C-5 no-work-without-a-work-item, fail-closed). New governance/loop: loop_governor.py (runtime guardrail enforcement), dispatcher repo-resolution accuracy. All opt-in; existing consumers unaffected until they wire them.

v1.8.1 — secret-free verify-and-close

Advances @v1. verify-and-close now fetches the Linear API key from Key Vault over WIF (inputs: linear-key-vault, linear-key-secret-name, azure-client-id/tenant-id/subscription-id) — no GitHub secret needed; the LINEAR_API_KEY secret path remains as a fallback.

v1.8.0 — Autonomous Delivery Platform reusables

Advances @v1. New reusable workflows: verify-and-close, auto-merge-on-green, independent-verifier, dependabot-automerge, security-scan, publish-pypi, capability-health-probe, sonar-new-code-reset, sonar-triage. New governance: per-agent App manifests + parametrised agent-token, affordance/harness skeletons, ADR policy + index, loop state-machine + guardrail harness, two-profile merge rulesets + merge-queue config, renovate engine-manager. meta-quality-gate now runs the no-attribution reject leg (D1) by default (uv-installed, PR-body scan advisory). Additive + guard-forward.

v1.2.0 — meta-quality-gate (framework self-CI shape)

Adds meta-quality-gate.yml@v1 (actionlint + yamllint + license + branch_naming) — the canonical self-CI shape for framework/non-Python repos — plus the license-present composite, ci-workflows dogfooding it on itself, and taz/kairix static callers of python-quality-gate.yml in example-callers. The floating v1 also points here.