@codacy/verity-cli 0.32.5 → 0.32.6

package/CHANGELOG.md

@@ -64,6 +64,44 @@ installs are untouched.
   which is the ordinary case for someone whose first Verity install *is* the
   plugin.
 
+## [0.32.6] — 2026-09-14
+
+**The knowledge base is no longer committed to git.**
+
+- **`.verity/memory/` is machine-local now.** It used to be git-tracked by
+  design, which put Verity's generated notes into every diff and pull request —
+  so teams ended up reviewing the knowledge base in GitHub as if they had
+  written it. New projects ignore it from the first run. The files stay on disk,
+  and for a signed-in project the service syncs them back into any worktree
+  that is missing them.
+
+- **Projects that already commit their graph are not changed.** A `.gitignore`
+  rule cannot remove a file that is already tracked, so the switch is offered
+  rather than imposed. `verity memory untrack` converts (files stay on disk,
+  the deletions are staged for you to commit); `verity memory track` records
+  that you commit it on purpose and stops anything asking again. `verity
+  doctor` reports which way your project is set up, `verity init` offers the
+  conversion, and a once-per-project session notice mentions it — including on
+  npm-global installs, not just under the plugin.
+
+- **`verity init --yes` declines and says so.** An unattended run has asked
+  nobody, so it will not record a team-wide decision on your behalf.
+
+- **If you are not signed in, the graph is local-only.** Restoring nodes from
+  the service mirror needs an authenticated run, so an anonymous project's
+  graph lives only in its own working tree — it is not committed, and it is not
+  rebuilt elsewhere.
+
+- **Memory nodes now record what produced them.** Each node carries the session,
+  task and run it came from, in both the stored row and the markdown — so a node
+  that arrives from a parallel session can be told apart from this branch's own
+  work. Provenance is recorded by the server only; a value sent by a client is a
+  claim, not evidence, and is never written.
+
+- **Work is scoped to the session that is doing it.** Task continuity now draws
+  candidates from the asking session's own tasks, so one Claude Code session can
+  no longer continue — or be judged against — another session's line of work.
+
 ## [0.32.5] — 2026-09-11
 
 **`/verity:init` fixes, reported from its first runs.**

package/README.md

@@ -98,6 +98,32 @@ npm install -g @codacy/verity-cli@latest
 
 Existing projects keep working — new compound features (knowledge extraction, graph memory, pre-work injection) activate automatically.
 
+### 0.32.6: the knowledge graph is no longer committed
+
+`.verity/memory/` used to be git-tracked. That put Verity's generated notes into
+every diff and pull request, so teams ended up reviewing the knowledge base in
+GitHub as if they had written it. New projects now ignore it — the files stay on
+disk, and for a signed-in project the service syncs them back into any worktree
+that is missing them.
+
+**If you are not signed in, the graph is local-only.** Restoring nodes from the
+service mirror requires an authenticated run, so an anonymous project's graph
+lives only in its own working tree: it is not committed, and it is not rebuilt
+elsewhere. That is a deliberate trade — anonymous runs write nothing durable to
+a shared store — but it means `verity memory untrack` on an anonymous project
+leaves you with one copy, on one machine.
+
+**Projects that already commit their graph are not changed.** A `.gitignore` rule
+cannot remove a file that is already tracked, so the switch is offered rather than
+imposed:
+
+```bash
+verity memory untrack   # keeps every file on disk, stages their removal from git
+verity memory track     # keep committing it on purpose, and stop being asked
+```
+
+`verity doctor` reports which way your project is set up.
+
 ### Coming from GATE.md (`@codacy/gate-cli`)?
 
 GATE.md is now Verity. One-time switch:
@@ -144,6 +170,8 @@ No re-setup needed: your token, Standard, and run history all carry over.
 | `verity reflect` | Trigger knowledge extraction for current task |
 | `verity reflect --user-input "..."` | Save a human reflection as a knowledge node |
 | `verity reflect --kind decision` | Specify the node kind |
+| `verity memory untrack` | Stop committing `.verity/memory/` — the graph stays on disk and leaves your diffs |
+| `verity memory track` | Commit the graph on purpose, and record that so nothing offers to change it |
 | **Feedback** | |
 | `verity feedback message "text"` | Send general feedback |
 | `verity feedback finding <run-id> <pattern-id> <action>` | Per-finding feedback |