GiviLoop 0.8.2 — Explicit review identity for finding writes

GiviLoop 0.8.2 — Explicit review identity for finding writes

Community feedback asked whether a new automatic review could cause an agent to update findings in the wrong review. Reviews already had separate run IDs and ledgers, but omitting the run ID selected the latest run for both reads and writes. That default was ambiguous when finishing an earlier assessment after another review had started.

What changed

• givi findings add and update now require --run-id RUN_ID. The MCP tool givi_record_finding requires runId in its schema and at runtime. Missing or invalid IDs fail before a ledger is changed; there is no latest-run fallback for finding writes.
• A finding is addressed by (runId, findingId). IDs not present in the selected run are rejected. Titles/claims remain immutable and decisions append to the existing history.
• Automatic-review instructions and completion messages explicitly carry the returned run ID through reads, finding writes and reports. A new task with a changed snapshot creates its own review, leaving earlier findings intact. Same-task/snapshot deduplication is unchanged. Outstanding findings do not suspend new reviews; incomplete or failed delivery does.
• Read-only commands retain their latest-run convenience for manual use. Agents should pass the review ID throughout the whole assessment.

What was reproduced

With completed reviews A and B, and B marked latest, an omitted run ID allowed a finding intended for A to be added to B. An update carrying an ID found only in A was already rejected against B's ledger: this was not a demonstrated arbitrary cross-review overwrite. The patch removes implicit write selection entirely. Tests also deliberately give two ledgers the same local finding ID and verify that explicit run selection keeps their histories separate.

Upgrade

Existing ledgers need no migration. Scripts that omitted the run ID when adding or updating findings must now supply it. Preserve the original ID returned by the review; do not look up latest later. Restart the MCP server to load the new tool schema. To refresh the managed AGENTS.md instructions, run auto-review enable again (with --client codex when appropriate), after confirming the saved reviewer is the destination you intend to authorize. The runtime write guard applies even with older instructions.

Validation

The regression failed against 0.8.1 and passes with the patch. Tests cover CLI and actual MCP transport with two completed reviews, refusal of omitted/invalid IDs without changing either ledger, explicit updates to an older review after latest changes, simulated equal finding IDs across runs, and two automatic reviews while earlier findings remain unverified. Automatic transport tests use a loopback model fixture; no new live-provider or model-quality result is claimed.

The installed package passes 225 unit/integration tests and 53 real-browser fixture tests; npm audit reports zero production dependency vulnerabilities. The release artifact is taken from successful CI for the published commit. Existing web-provider, desktop and instruction-driven activation limits remain unchanged.

Verified commit: 5d2e785. Successful CI run: 225 unit tests, 53 browser tests, zero production dependency vulnerabilities. The tarball below is the exact CI artifact. finding-run-regression-before.tap intentionally records the regression failing against 0.8.1. finding-run-regression-after.tap records the 36 passing focused tests after the fix. Finding writes now require an explicit review ID; existing ledgers need no migration.