@codacy/verity-cli 0.32.0-experimental.f0746f7 → 0.32.0

package/CHANGELOG.md

@@ -5,6 +5,43 @@ All notable changes to Verity are documented here. This project follows
 
 ## [Unreleased]
 
+**Verity ships as a Claude Code plugin.** `/plugin marketplace add codacy/verity`
+then `/plugin install verity@codacy` gives a working gate with nothing else to
+install — the plugin carries the CLI as a pinned dependency, and Claude Code
+installs and updates it for you.
+
+### 🔌 The plugin
+
+- **Eight skills, namespaced** — `/verity:analyze`, `/verity:status`,
+  `/verity:learn`, `/verity:memory`, `/verity:reflect` are available to Claude
+  directly; `/verity:setup`, `/verity:insights` and `/verity:feedback` are yours
+  to invoke and are not offered to the model at all. The whole plugin adds about
+  500 tokens to a session (`claude plugin details verity`).
+- **All six hooks come from the plugin**, so nothing is written to your
+  `.claude/settings.json`.
+- **One gate decision per turn.** A project carrying both the plugin and the
+  hooks `verity init` used to write no longer reviews each turn twice: when the
+  plugin is present it owns the hooks, and the settings.json copy stands down.
+  `verity init` detects the plugin and removes the duplicate wiring.
+
+### 🚪 A project that was never set up is left alone
+
+Every hook now asks the same question the same way. `verity analyze` used to run
+in a project that had never seen `verity init`, create `.verity/` there, and then —
+with no baseline to compare against — review nothing. It now stands down like the
+other hooks always have, so installing Verity no longer scatters state through
+directories you merely opened. On the first session in such a project, Claude is
+told once that the gate is off here and can offer `/verity:setup` (or `verity init`
+on an npm install). Works correctly from linked git worktrees.
+
+### ⚙️ Git-moment gating moved into the project
+
+`verity guard` now reads `.verity/config.json` instead of taking its moments from
+which hook was wired, because a plugin's hooks are the same for everyone. **The
+default gates nothing** — set it with `verity config git-moments commit,push`, or
+answer the question in `verity init`. An explicit `--on` still wins, so existing
+installs are untouched.
+
 ### 🎯 Setup finishes in one command
 
 - **`verity init` now derives the Standard itself.** When the service has nothing
@@ -97,7 +134,6 @@ those is now an assertion.
   before exiting: raw mode left on outlives the process and makes the user's next
   shell prompt unusable.
 
-## [Unreleased]
 
 ### 🤝 Joining a project that already has a Standard
 
@@ -141,7 +177,6 @@ those is now an assertion.
 - The setup skill learned the same case — Standard present, analysis config
   missing — and writes only the config rather than re-synthesizing the Standard.
 
-## [Unreleased]
 
 **Setup is one command.** `verity init` and `/verity-setup` were two half-flows
 that overlapped — and the overlap was not harmless: init wired the Stop hook,
@@ -218,6 +253,26 @@ with one entry point.
   terminal (Ctrl+D, a pty that ends) falls back to the default instead of
   crashing init between copying the skills and wiring the hooks.
 
+## [0.31.3] — 2026-09-03
+
+**After a rebase, Verity reviewed the wrong code.** When a branch was rebased
+onto an updated main, the gate could treat all of the upstream changes as the
+session's own work and block the push on findings in code the session never
+touched. The cause was that the review baseline was trusted by whether its commit
+still existed rather than whether it was still part of the current history, so a
+rewritten baseline kept anchoring every diff.
+
+- **The push gate reviews exactly what the push publishes** — the commits the
+  remote does not yet have — so a rebase, a force-push, a first push, or
+  re-pushing an already-published commit each review only their real new work.
+- **The stop-hook baseline is trusted only while it is an ancestor of HEAD.** A
+  rewritten baseline is discarded and re-derived from the commits actually made
+  since, so upstream changes are never attributed to the session.
+- **A commit made during a merge reviews only the files you resolved**, not the
+  whole incoming branch.
+- **A slash command such as `/login` is no longer treated as a task or a goal**,
+  so the review is graded against what you were actually working on.
+
 ## [0.31.1] — 2026-08-27
 
 **Verity stops repeating itself.** A finding it had already closed could keep