sigmap 7.25.1 → 7.26.0

package/CHANGELOG.md

@@ -10,6 +10,27 @@ Format: [Semantic Versioning](https://semver.org/)
 
 ---
 
+## [7.26.0] — 2026-06-22
+
+Minor release — **v8.0 "The Evidence Pack & the Pivot" (E1):** the keystone artifact that makes SigMap consumable by machines instead of copy-paste.
+
+### Added
+- **Evidence Pack JSON v1 (#372):** new `sigmap evidence "<query>"` command emits a deterministic, machine-consumable signature-and-evidence map — a byte-stable JSON artifact (plus a `--markdown`/`--md` handoff rendering) that an agent or CI can ingest directly, every entry anchored to a real file, symbol, and line range. Schema v1: `{ schemaVersion, query, intent, files:[{ path, symbols, reason, confidence, sourceLines, relatedTests, riskLabel }], tokenBudget, droppedFiles, grounding:{ symbolCount, anchoredSymbols, anchorCoverage, contextHash, deterministic } }`. Composed entirely from shipped zero-dep modules (ranker, line-anchor parsing, security scanner, sha256 grounding hash). The pack carries **no wall-clock timestamp** — an unchanged repo yields byte-identical output and a stable `grounding.contextHash`, so the artifact is auditable. CLI flags: `--top`, `--budget`, `--out`; always writes `.context/evidence-pack.json`. `riskLabel` ∈ {generated, test, config, security, source} and `relatedTests` are best-effort v1 (measured test-discovery and richer labels land in v8.5).
+
+---
+
+## [7.25.2] — 2026-06-22
+
+Patch release — **Trust Hygiene (H2):** reproducible bundle build. Completes the v7.25.x "Trust Hygiene" milestone (H1+H2+H3+H4 all shipped).
+
+### Added
+- **Reproducible bundle build (#369):** `scripts/build-bundle.mjs` (`npm run build:bundle`) deterministically regenerates the embedded `__factories` of `gen-context.js` from `src/` + `packages/adapters/` — sorted and de-duplicated — between two markers, leaving the preamble and the hand-written CLI core byte-identical. `build:bundle --check` asserts the committed bundle equals a fresh build and is wired into `prepublishOnly` and CI (next to the existing standalone `bundle-smoke` test on Node 18/20/22). A new `bundle-repro` test pins byte-for-byte reproducibility.
+
+### Fixed
+- **Duplicate / missing bundled modules (#369):** the bundle carried a duplicate `./src/eval/llm-ablation` factory (124 blocks for 115 `src/` modules) because `check-bundle --fix` prepended on each run; it now regenerates the whole section via `build-bundle`, so duplicates can't recur. The `willow` adapter — silently never embedded (the integrity check only verified `src/`) — is now bundled. The canonical bundle is **125 modules, one factory each**.
+
+---
+
 ## [7.25.1] — 2026-06-21
 
 Patch release — **Trust Hygiene (H4):** document the real CLI / MCP / adapter surface. Completes the v7.25.x milestone's documentation goals (only H2, the reproducible bundle build, remains).

package/README.md

@@ -91,8 +91,8 @@ Ask → Rank → Context → Validate → Judge → Learn
 
 <!--SM:benchmarkBlock-->
 ```
-Benchmark : sigmap-v7.25-main (21 repositories, including R language)
-Date      : 2026-06-21
+Benchmark : sigmap-v7.26-main (21 repositories, including R language)
+Date      : 2026-06-22
 
 Hit@5          : 75.6%   (baseline 13.6%  — 5.6× lift)
 Token reduction: 97.0%   (across 21 repos)