projecta-rrr 1.24.8 → 1.24.9
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/CHANGELOG.md +10 -0
- package/package.json +1 -1
package/CHANGELOG.md
CHANGED
|
@@ -4,6 +4,16 @@ All notable changes to RRR will be documented in this file.
|
|
|
4
4
|
|
|
5
5
|
Format follows [Keep a Changelog](https://keepachangelog.com/en/1.1.0/).
|
|
6
6
|
|
|
7
|
+
## [1.24.9] - 2026-05-13
|
|
8
|
+
|
|
9
|
+
### Fixed (Phase 92 — Pass 2 audit top 3 findings)
|
|
10
|
+
|
|
11
|
+
Audit report: `.planning/audits/2026-05-13-coordinator-pass2.md` (local-only). 24 findings total; this release lands the 3 highest-priority. Remaining 21 are operational-only and tracked for later phases.
|
|
12
|
+
|
|
13
|
+
- **`sprite-coordinator/server.mjs` rehydrate path catches up dropped trailing reviews** (HIGH). Previously, a sprite restart that crossed the `firstFiredAt + DEBOUNCE_MS` window deleted the debounce entry without firing the queued trailing review — silent data loss. Now: `rehydrateDebounce()` detects `!stillInWindow && pendingCount > 0` and fires `fireIntegrationReview()` immediately with trigger `push-webhook-trailing-rehydrate-catchup` before deletion. Emits `[debounce-rehydrate] caught up N dropped trailing review(s) on restart` for operator visibility. Fly redeploys during burst no longer lose work.
|
|
14
|
+
- **`persistDebounce()` is now async** (HIGH). Previously used `fsSync.writeFileSync + renameSync` on every webhook — sync I/O on the single event loop is a tail-latency hazard under burst. Now uses `fs.promises.writeFile + rename`. Call-sites in `handleWebhook` use fire-and-forget `.catch(() => {})` so disk hiccups don't block the webhook response. `persistJob` (NDJSON append) remains sync — atomic for small lines on POSIX per the audit's acceptance.
|
|
15
|
+
- **`scripts.mjs` synthesizer pipeline validates output shape** (MEDIUM). Previously a broken synthesizer pass silently produced a comment that said "AI review summary unavailable" with placeholder verdict — operator couldn't tell the AI pipeline broke. Now: `jq -e 'has("summary") and has("approval")'` after synth; exit 2 with `[synth-malformed]` log + raw stderr if either field is missing. Job shows up as `failed` in `/jobs` instead of posting a useless review comment.
|
|
16
|
+
|
|
7
17
|
## [1.24.8] - 2026-05-13
|
|
8
18
|
|
|
9
19
|
### Security (Phase 91 — close remaining Pass 1 audit findings)
|
package/package.json
CHANGED