@codacy/verity-cli 0.29.4 → 0.30.0

package/CHANGELOG.md

@@ -3,6 +3,139 @@
 All notable changes to Verity are documented here. This project follows
 [Semantic Versioning](https://semver.org/).
 
+## [0.30.0] — 2026-08-13
+
+**Verity feels smarter, and tuned to the session you're in.** The theme of 0.30
+is fit and restraint. There are far fewer false positives — the gate no longer
+flags its own installed files, no longer conjures findings from a plan it never
+saw as code, and honours a disagreement you've already reasoned through instead
+of re-raising it every turn. Blocking is more intelligent: the gate forces
+another turn only when it can show that turn might actually help, which also
+makes infinite FAIL loops impossible. And the advisory notes on passing turns
+now ride a per-session budget rather than interrupting on every one. Suppression,
+notes, and plan approval are each scoped to the conversation they belong to — so
+the gate reads the session the way you do, and gets out of your way when it has
+nothing useful to add. The net effect is less noise, fewer dead ends, and a
+review that feels adjusted to what you're actually doing.
+
+```bash
+npm install -g @codacy/verity-cli
+verity init   # re-run once per repo — see Migrating
+```
+
+### 🗣️ Findings can be disputed — and stay disputed
+
+- **Dispute a finding with reasoning and it stays suppressed** on later runs —
+  no more re-litigating the same disagreement every turn. Suppression is bound
+  to the file's exact bytes: edit the file and the finding is reconsidered.
+- **Security findings take two rounds.** One pushback is never enough to
+  silence a security claim; the gate holds its ground once before accepting a
+  repeated, reasoned dispute.
+
+### 🔁 Blocking must earn it
+
+- **Infinite FAIL loops are impossible.** One gate now owns the blocking exit
+  code, and it only blocks when there is evidence another attempt can help:
+  code was actually reviewed, something moved since the last block, the same
+  problem hasn't exhausted its fix attempts, and a hard ceiling of 5
+  consecutive blocks backstops everything.
+- **Released findings are still reported** — when the gate stops forcing
+  turns, it says what remains OPEN rather than going quiet.
+
+### 📉 Advisory notes ride a budget
+
+- A note on a PASS is a forced turn in disguise. Notes now ride an episode
+  budget — **1 on PASS, 2 on WARN** — that resets when *you* type, on a FAIL,
+  at a task boundary, or after a 30-minute lull. Long-lived autonomous agents
+  get one note per task instead of one per turn.
+- Refusals, intent judgements, and verdict downgrades are never budgeted.
+
+### 📋 Plans are reviewed as plans
+
+- **Plan approval now reaches the reviewer** — including on the turn after you
+  approve, when there is no accompanying prompt to carry it.
+- A report *about* completed work is no longer mistaken for a plan, and plan
+  feedback can never ratchet into blocking.
+
+### 🪞 Verity never reviews itself
+
+- **Verity's own installed files** (its skills, `.codacy/` configs,
+  `.claude/settings.json`, `VERITY.md`) **never enter review** — the gate no
+  longer FAILs your session over its own installer's files. Every such
+  exclusion is named in the run's coverage ledger, never silent.
+- **`.verity/.snapshot/` is gitignored at `verity init`** — the snapshot holds
+  byte copies of analyzed files (including any secret the gate just flagged)
+  and must never be committable. Snapshot copies of deleted files are now
+  purged, and `/verity-setup` writes a whitelist-form `.verity` gitignore
+  block so future state files are covered by construction.
+
+### 🐛 Fixes
+
+- **Valid Unicode is no longer mangled into false positives.** Every analyze
+  request was being decoded as Latin-1, so correct UTF-8 — em dashes, accented
+  letters, middots — arrived as mojibake (`—` became `—`), and the reviewer
+  flagged the garbled text with a suggested fix identical to what your file
+  already contained. The mis-decode reached the model itself, not just the
+  finding text. Requests are now decoded as UTF-8. *(reported from the field)*
+- **Work done by subagents and workflows is actually reviewed.** The gate looked
+  for delegated work in the wrong directory and did not recognise `Workflow` /
+  `SendMessage` as delegation, so files a subagent authored were attributed to
+  no one — and a session that delegated its real work could pass **unreviewed**.
+  On one real session this recovered 36 of 42 authored files — an order portal,
+  its auth, and a PII warning — that had been reviewed zero times.
+- **Disputing a finding actually suppresses it now.** The suppression ledger was
+  inert — a dispute was cancelled by the very request that recorded it, so a
+  finding you had reasoned away came back on every later turn.
+- **No more phantom "STILL OPEN" findings.** A finding could be raised from a
+  plan's prose and then haunt later runs as still-open on a file that was never
+  edited — or never existed. A finding now requires the file's actual bytes to
+  have been under review.
+- **An approved plan is treated as approved.** The approval was dropped on the
+  turn right after you gave it, so the reviewer graded the plan as if you had
+  not approved it.
+- **A report of finished work is no longer mistaken for a plan.**
+- **Verity stops FAILing sessions over its own files.** The gate could review
+  the files its own installer wrote and fail your turn on them — once even
+  prescribing that you disable its own secret scanning.
+- **A deleted secret no longer lingers in the snapshot.** The analysis snapshot
+  kept a byte-for-byte copy of a flagged file after you deleted it, in a
+  directory that was not gitignored — one `git add -A` away from being committed.
+- **Windows: paths outside the repo are filtered correctly.** A drive-letter
+  path (`C:\…`) was read as repo-relative, so scratch files outside the project
+  could slip into the review scope.
+
+### 🔒 Security hardening
+
+A pre-release security review of the whole product closed a set of standing
+issues (present before this release, not introduced by it). Updating is recommended.
+
+### 🤖 Model
+
+- Default reviewer model is now **gpt-5.6-luna** (was gpt-5.4-mini) — faster
+  and smarter per analysis.
+
+### Internal
+
+- The analyze pipeline is refactored into 14 named phases with a
+  characterization net — verified zero behavior change.
+- Statement anchors carry content identity (`file_sha256`) and admission
+  requires the file's bytes to have been under review — findings can no longer
+  be raised into durable state from plan prose alone.
+
+### Migrating
+
+1. `npm install -g @codacy/verity-cli`
+2. `verity init` once per already-configured repo — it adds the
+   `.verity/.snapshot/` gitignore entry (idempotent; your hooks and standard
+   are untouched).
+3. If `git ls-files .verity` shows tracked files, untrack the machine state
+   once — the snapshot may hold copies of previously analyzed files, which
+   should never be in history:
+   ```bash
+   git rm -r --cached .verity
+   git add .verity/standard.yaml .verity/memory
+   ```
+
 ## [0.29.0] — 2026-08-07
 
 **Phase 1 of the Road to 1.0: identity and context.** One login now covers every