@codacy/verity-cli 0.35.0-experimental.9fc6b77 → 0.35.0

package/CHANGELOG.md

@@ -64,6 +64,80 @@ installs are untouched.
   which is the ordinary case for someone whose first Verity install *is* the
   plugin.
 
+## [0.35.0] — 2026-10-30
+
+**A new first run: sign in, answer two questions, and work with your team's Standard.**
+
+### 🚀 `verity init`
+
+- **Sign-in comes first.** Then init asks two questions: when Verity reviews
+  (each turn, each commit, each push; all three by default), and, when the
+  service writes project rules for you, whether to send a profile of the
+  repository for them.
+- **Your team's Standard.** When the service has one, init offers it, or a new
+  one (`--standard use|new`). It never pushes a Standard over a team's Standard
+  that it could not read or write.
+- **"Not finished" means it.** When no usable Standard could be set up, init
+  says why and exits 1, so scripts and the plugin stop there.
+- **Trivy is the static analysis**, configured by Verity
+  (`.verity/static-analysis.json`), on new and existing projects: secrets,
+  malicious packages, and critical and high vulnerabilities. ESLint and
+  Semgrep no longer run.
+- **The analyzer comes with Verity.** Its first run on a machine downloads
+  Trivy's vulnerability database (about 1.5 GB on disk). Init starts it in
+  the background. A review waits for the analyzer at most 45 s, then says
+  that static analysis did not run.
+- **Re-running init removes a `.codacy/` config that an older Verity
+  wrote**, and stages the removal. It prints the command that restores it.
+- **Formal verification is on for new projects.** The Lean toolchain downloads
+  in the background.
+- **Telemetry** is one question, for the whole machine.
+
+### 📐 Standards
+
+- **`verity standard pull`** writes your team's Standard into
+  `.verity/standard.yaml`, and keeps a copy of your file.
+- **Your own fields stay.** A field that Verity does not read is kept as you
+  wrote it, at every level of the Standard.
+- **`verity standard push` sends only a Standard.** The file is checked before
+  anything is sent.
+- **`verity config moments`** sets when Verity reviews.
+
+### 📊 Usage
+
+- **`verity usage`** shows your review budgets and your team's reviews. **`verity
+  upgrade`** opens the plans page.
+- **A limit never blocks your work.** When a plan limit stops a review, Verity
+  says which limit and when it resets, and the commit or the push goes on.
+
+### 🔧 Fixes
+
+- Includes security and privacy fixes.
+
+## [0.34.4] — 2026-10-26
+
+**A formal finding is checked before it blocks a push, and formal looks for security bugs.**
+
+### 🛡️ Formal verification
+
+- **A reproduced counterexample is checked before it blocks.** A replay proves
+  that a failing order runs against stubs of your code. It does not prove that
+  the order can happen in production. Verity now investigates each reproduced
+  counterexample with the read-only tools of the agent review. It follows the
+  code to its entry point and looks for what prevents the order: a lock, a
+  unique constraint, a transaction, an idempotency key. Two independent checks
+  run, and the more cautious answer governs. A finding is lowered only when
+  every quote of the check appears in your code: PREVENTED and ARTIFACT show as
+  checked and never block, and REAL-LOW is reported without blocking. A check
+  that does not finish leaves the finding as it was.
+  `VERITY_FORMAL_VERIFY=off` turns the check off.
+- **Formal looks for security bugs.** The ranker gives each target a lens
+  (security or reliability) and up to three concrete hypotheses. A security
+  target is modelled from the attacker's side: isolation between tenants,
+  revocation, flow binding, event order, and check-then-use.
+- **Generation sees the push.** The lines that your push changed are marked in
+  the code that formal models, so it looks first for a bug that the change made.
+
 ## [0.34.3] — 2026-10-21
 
 **`verity usage` shows the reviews of each member of your org.**