@codacy/verity-cli 0.34.3 → 0.34.4

package/CHANGELOG.md

@@ -64,6 +64,30 @@ installs are untouched.
   which is the ordinary case for someone whose first Verity install *is* the
   plugin.
 
+## [0.34.4] — 2026-10-26
+
+**A formal finding is checked before it blocks a push, and formal looks for security bugs.**
+
+### 🛡️ Formal verification
+
+- **A reproduced counterexample is checked before it blocks.** A replay proves
+  that a failing order runs against stubs of your code. It does not prove that
+  the order can happen in production. Verity now investigates each reproduced
+  counterexample with the read-only tools of the agent review. It follows the
+  code to its entry point and looks for what prevents the order: a lock, a
+  unique constraint, a transaction, an idempotency key. Two independent checks
+  run, and the more cautious answer governs. A finding is lowered only when
+  every quote of the check appears in your code: PREVENTED and ARTIFACT show as
+  checked and never block, and REAL-LOW is reported without blocking. A check
+  that does not finish leaves the finding as it was.
+  `VERITY_FORMAL_VERIFY=off` turns the check off.
+- **Formal looks for security bugs.** The ranker gives each target a lens
+  (security or reliability) and up to three concrete hypotheses. A security
+  target is modelled from the attacker's side: isolation between tenants,
+  revocation, flow binding, event order, and check-then-use.
+- **Generation sees the push.** The lines that your push changed are marked in
+  the code that formal models, so it looks first for a bug that the change made.
+
 ## [0.34.3] — 2026-10-21
 
 **`verity usage` shows the reviews of each member of your org.**