paqad-ai 1.63.1 → 1.63.3

package/CHANGELOG.md

@@ -1,5 +1,59 @@
 # paqad-ai
 
+## 1.63.3
+
+### Patch Changes
+
+- eb1fa9a: fix(#401): spec freeze now runs the spec-quality review it always claimed to require
+
+  `paqad-ai spec freeze` told you, in both the rule pack and the workflow contract, that
+  freezing enforces "no critical spec-review defects". It never did: the CLI evaluated the
+  freeze with no review attached, so that clause was enforced nowhere. Agents closed the gap by
+  hand-running `compliance review`, which left a stray `.paqad/compliance/<slug>/spec-review.json`
+  behind that was neither part of the change's evidence bundle nor git-ignored.
+
+  Freeze now runs the review itself and blocks on a critical defect like any other blocker, so
+  there is no second command to run and no stray artifact. On a clean freeze the defect summary
+  is folded into the bundle's `specification.json`, so the review evidence travels with the spec
+  of record. Non-critical findings never block.
+
+  Two related fixes: `spec freeze` and `compliance review` now reject a spec file that resolves
+  outside the project root and record `spec_file` as a project-relative posix path, and the
+  managed `.paqad/.gitignore` covers `compliance/` so a compliance artifact can never surface as
+  an untracked, committable file.
+
+## 1.63.2
+
+### Patch Changes
+
+- 462e891: Keep one change in one evidence bundle when the session id rotates mid-change (#404).
+
+  The active feature is tracked per session, so when the host session id rotated partway
+  through a change — an app relaunch, a resumed conversation, a rotated `SE_SESSION` — the
+  new session read a fresh control, found nothing active, and minted a second
+  `change-<ULID>`. The bundle the change was already recorded in got orphaned, and the
+  stages recorded before the rotation had to be re-recorded by hand.
+
+  A session's control is now reconciled before anything mints: when its active pointer
+  names no evidence, it is repointed at the in-flight bundle **for the current branch**.
+  This runs on both the write and the read paths, and from the SessionStart hook so a
+  rotation is carried over before the agent records anything. It never mints a bundle,
+  never adopts when two or more changes are in flight on the branch, and never resumes a
+  feature the session paused.
+
+  The branch is what makes this usable. "In flight" alone means real stage rows and no
+  close row, and that set only grows — an abandoned change and a change shipped without a
+  passing verdict never get a close row either, so a real repo accumulates them (this one
+  held 13). Scoped that way, an "exactly one in flight" rule could never fire. A session id
+  rotates within a change and a change is built on one branch, so the branch identifies the
+  rotated session's own work, with no clock heuristic and no tunable window. The branch is
+  stamped on the bundle's `open` row and falls back to the branch `delivery.json` already
+  recorded; a bundle with no knowable branch is never adopted while on one.
+
+  `closeActiveFeature` also stamps a `close` row on the bundle now. Releasing one session's
+  pointer was previously the only record that a change had finished, which no other session
+  could see — so adoption would have resurrected it.
+
 ## 1.63.1
 
 ### Patch Changes