2026-08-28 - 2026-09-04
Overview
1 Release published by 1 user
Published
v26.15.0
22 Pull requests merged by 1 user
Merged
#906 fix(876): sweep session narrative out of hooks, workflows, scripts, tests and code comments; grow the detector to the process corpus
Merged
#905 fix(869,893): re-establish the 1.25.4-dated CI claims on 1.27.1, and settle the page_statuses asymmetry from source
Merged
#903 fix(891): a sourced path is code, so every hook resolves it from its own tree
Merged
#902 fix(855): two glob dialects cannot be canonicalised into one, so model one shape and refuse the rest
Merged
#899 fix(887): the image build builds the SPA and does not test it
Merged
#898 docs(release): record the v26.15.0 release notes
Merged
#897 fix(858,859): a rule the classifier cannot read is not a rule that matches nothing
Merged
#896 fix(870): an empty timeline page is not exhaustion — the walk reads to its cap
Merged
#892 fix(880): an absent recurrence array means unrestricted, an explicit [] is rejected
Merged
#890 fix(849): the verdict gate replaces every unknown state, and proves the clauses that claim to
Merged
#889 fix(845): the verdict writer checks that the gate will honour what it just posted
Merged
#888 docs(853): workflow_dispatch can't be ref-restricted at 1.27.1 — and restricting it would close nothing
Merged
#884 fix(836): never pass --depth to a checkout that may already be complete
Merged
#883 fix(820): derive where Complete<T> is APPLIED, not just what it means
Merged
#882 fix(812): classify the narrative sites by who-benefits; keep the detector's reach
Merged
#879 fix(823,824): a scheduling NULL collection reads as UNRESTRICTED and is guarded at both read sites; the Elastic indexer gets its own mutation proof
Merged
#875 fix(819): derive the SPA page-size guard population from the git index
Merged
#874 fix(809,822): isolate the suite from the production hook-fire log by construction
Merged
#873 fix(803,664): fence the HEAD alias on the PR timeline's pull_push count
Merged
#872 fix(786,789): workflows declare their own per-job metadata; guard populations derive from it
Merged
#871 docs(796): verification code is code under test — and the proof it was claiming an exemption from
Merged
#868 fix(763): page both /statuses/{sha} reads to a validated terminator
1 Pull request proposed by 1 user
Proposed
#878 fix(830): a write failure reports to a surface that outlives the dialog that started it
29 Issues closed from 1 user
Closed
#876 docs.no-session-narrative reaches hooks and code comments, but nothing has ever swept them — 4 known sites
Closed
#893 page_statuses still terminates on its first empty page — is /statuses/{sha} subject to #870's post-pagination filtering?
Closed
#869 Finish the 1.25.4-dated CI claim sweep #747 deliberately did not complete
Closed
#891 ETV_HOOK_FIRE_LIB is SOURCED from an env-var path in 12 hooks — a decoy tree's code runs inside the gate
Closed
#855 Nothing couples ci-image.yml's push.paths to ci-image-pin's expected pathspec
Closed
#887 Every image build fails: completeAnnotations.guard.test.ts needs the git index, and the Dockerfile's exclude list is hand-maintained
Closed
#900 chore(release): cut and promote v26.15.0 on 736649b3b (main head could not build an image)
Closed
#858 pretooluse-merge-consent.sh resolves its verdict classifier from $CLAUDE_PROJECT_DIR — an env var as a security input
Closed
#859 Merge-gate branch-protection read: a malformed rule states a cause that did not happen, and the endpoint is now fetched twice
Closed
#870 The timeline walk's null terminator is defeatable: Gitea pages BEFORE it filters, so a page of inline-code comments reads as exhaustion
Closed
#880 Schedule-item recurrence fields: an omitted array means "never applies" on write but "unrestricted" on read
Closed
#849 review-verdict.yml post-write verification: three routes that leave an exemption success over a human failure
Closed
#845 post-review-verdict.sh does not check that its own account is on the gate's H10_REVIEWERS allow-list
Closed
#886 release.verdict-vocabulary-shared explains the sentinel with a set -u mechanism that measurement refutes
Closed
#853 workflow_dispatch still loads attacker YAML from an arbitrary ref — four workflows, no ref restriction
Closed
#836 :latest images ship InformationalVersion 0.0.0 — a --depth=2 fetch grafts the build job's full clone shallow
Closed
#820 Complete<T> proves its semantics but not its APPLICATION — nothing derives the set of SPA full-replace construction sites
Closed
#812 Remediate the 21 session-narrative sites #784's sweep found — 21 judgements, not a regex
Closed
#823 Scheduling collection-valued columns: is a runtime null reachable on DaysOfMonth / MonthsOfYear / DaysOfWeek?
Closed
#824 ElasticSearchIndex.UpdateSong has no regression test — an Elastic-only reintroduction of the #701 mutation stays CI-green
Closed
#819 The SPA page-size guard enumerates web/src with a Vite glob while claiming completeness
Closed
#809 The production-hook-fire-log isolation guard is per-test, but its claim is per-suite
Closed
#822 test_the_suite_does_not_write_to_the_PRODUCTION_log uses global mutable state as its oracle — any concurrent session reddens it
Closed
#664 pr-changed-files.sh head binding cannot see an A→B→A force-push across its paging round-trips
Closed
#803 Head-ABA: a force-push H1->H2->H1 during paging defeats pr-changed-files.sh, and three contracts still deny it
Closed
#789 Derive the CI toolchain population from workflow-owned metadata, not TOOLCHAIN_JOBS
Closed
#786 Extend the machine-checked guard inventory to inline workflow-job guards
Closed
#796 A verification harness is itself unproven code — five false greens, each created by the fix for the last
Closed
#763 Page both /statuses/{sha} reads in review-verdict.yml — limit clamps to 50, so the post-write race check can miss a raced verdict
15 Issues created by 1 user
Opened
#870 The timeline walk's null terminator is defeatable: Gitea pages BEFORE it filters, so a page of inline-code comments reads as exhaustion
Opened
#876 docs.no-session-narrative reaches hooks and code comments, but nothing has ever swept them — 4 known sites
Opened
#877 Dismissible write failures, shape A2: the error state survives but its render site is gated by the same condition dismissal clears
Opened
#880 Schedule-item recurrence fields: an omitted array means "never applies" on write but "unrestricted" on read
Opened
#881 Mutation claims in PROSE are outside testing.mutation-claims-are-executed — 4 false ones in #812, each caught by a separate review round
Opened
#885 Same-repo pull_request runs get REGISTRY_PASSWORD from head-supplied YAML — the route #853 found under the dispatch class
Opened
#886 release.verdict-vocabulary-shared explains the sentinel with a set -u mechanism that measurement refutes
Opened
#887 Every image build fails: completeAnnotations.guard.test.ts needs the git index, and the Dockerfile's exclude list is hand-maintained
Opened
#891 ETV_HOOK_FIRE_LIB is SOURCED from an env-var path in 12 hooks — a decoy tree's code runs inside the gate
Opened
#893 page_statuses still terminates on its first empty page — is /statuses/{sha} subject to #870's post-pagination filtering?
Opened
#894 SPA lets a user build an empty recurrence set the server now rejects (#880 residual)
Opened
#895 "all N tests stayed green" claims in test comments go stale the moment anyone adds a test — 4 found, no detector
Opened
#900 chore(release): cut and promote v26.15.0 on 736649b3b (main head could not build an image)
Opened
#901 Convention: for a predicate over shell or config TEXT, pin the artifact whole — "match a shape" is the exception that must argue for itself
Opened
#904 test_docs_only_detector_clone_depth.py flakes ~8% in the CI container (measured, pre-existing on main)
4 Unresolved Conversations
Open
#761
chore(deps): update dependency meziantou.analyzer to 3.0.195
Open
#22
Dependency Dashboard
Open
#627
Re-arm the MySQL data-migration fixture in CI — the dedupe DML has no automated coverage on MySQL
Open
#830
AddItemsDialog: a failed add is silently swallowed when the dialog is closed mid-request