From 519acf35dd093a4503823fb4506bef626c9dc3d5 Mon Sep 17 00:00:00 2001 From: Wibias <37517432+Wibias@users.noreply.github.com> Date: Sun, 30 Aug 2026 08:40:46 +0200 Subject: [PATCH 1/7] chore: bump version to 1.3.8 --- package.json | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/package.json b/package.json index 638434be..fbcd1274 100644 --- a/package.json +++ b/package.json @@ -1,6 +1,6 @@ { "name": "github-delivery", - "version": "1.3.7", + "version": "1.3.8", "description": "Guided installer and safety tooling for GitHub Delivery workflows", "type": "module", "engines": { From 457dfb1df743f9735fe51915defe10a6c167629a Mon Sep 17 00:00:00 2001 From: Wibias <37517432+Wibias@users.noreply.github.com> Date: Sun, 30 Aug 2026 08:43:56 +0200 Subject: [PATCH 2/7] docs: add v1.3.8 changelog --- CHANGELOG.md | 16 ++++++++++++++-- 1 file changed, 14 insertions(+), 2 deletions(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index e5aa1d4e..65cb4f4a 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -4,6 +4,18 @@ All notable changes to `github-delivery` are documented here. ## [Unreleased] +## [1.3.8] - 2026-08-30 + +### Changed + +- Bumped the package version from `1.3.7` to `1.3.8`. + +### Fixed + +- Routed create-PR workflows now carry controller-owned current-user intent through the exact `create_pr` operation instead of dropping it before mutation execution. The intent remains bound to the canonical operation key, caller-controlled `explicitInstruction` stays non-authoritative, Protection mode Off performs no Authority-host authorization, and model-callable manual workflow-intent repair is rejected in Off mode (issue #400, PR #403). +- Pre-open review evidence is now bound to the exact repository, resolved base/head commits, candidate diff identity, and file count, and both the workflow controller and mutation boundary require a matching `ready` result before initial `push_code` or `create_pr`. Missing, blocked, unknown, stale, or mismatched evidence therefore stays fail-closed instead of allowing publication to continue after a wrong-scope gate (issue #402, PR #404). +- The Codex progress watchdog now gives a small bounded investigation credit to successful stable source reads that deterministically follow a dependency referenced by the immediately preceding result. Legitimate dependency tracing can therefore reach a focused regression without being pressured into a premature edit, while unrelated reads, assistant-prose claims, duplicates, volatile polling, and credit beyond the per-generation cap keep the existing evidence limits. Hook and App Server paths share the same behavior (issue #401, PR #405). + ## [1.3.7] - 2026-08-30 ### Changed @@ -269,7 +281,7 @@ All notable changes to `github-delivery` are documented here. - Moved the remaining workflow-level `actions: write` permission down to the cleanup job, kept top-level workflow permissions read-only, and added validation that rejects future top-level write scopes while still permitting explicitly allowlisted job-level writes (PR #282). - Hardened PR publication identity and retries: exact duplicate detection now binds target repository, head repository/ref, and base; qualified REST head filters prevent same-repository misses; explicit cross-repository `head_repo` identity is supported; and exact owned idempotent retries converge before the broader duplicate preflight (PR #283). -- Protected existing PR-body screenshots, videos, GitHub uploads, reference-style Markdown images, and other recognized media from accidental body rewrites. Intentional media removal requires an exact approved identity list that is included in trusted `update_pr_body` authority scope (PR #283). +- Protected existing PR-body screenshots, videos, GitHub uploads, reference-style Markdown images, and other recognized media from accidental body rewrites. Intentional media removal requires exact approved media identities that is included in trusted `update_pr_body` authority scope (PR #283). - Prevented cross-repository closing issues and unsafe display URLs from masquerading as trustworthy same-repository work-item evidence, and tightened open-work fixtures so PR-number normalization and repository boundaries are actually exercised (PR #283). ## [0.8.2] - 2026-08-17 @@ -410,7 +422,7 @@ All notable changes to `github-delivery` are documented here. ### Fixed -- Repeated grid or malformed tool-protocol placeholder output now hard-stops immediately on the first stall instead of being retried, and the offending model is quarantined across turns and `SessionEnd` so a resume with the same model is blocked before inference until the model is changed. Subagent protocol stalls no longer quarantine the parent task. +- Repeated grid or malformed tool-protocol placeholder output now hard-stops immediately on the first stall instead of being retried, and the offending model is quarantined across turns and `SessionEnd` so a resume with the same model is blocked before inference until the model changes or a new task begins. Subagent protocol stalls no longer quarantine the parent task. - Windows login auto-start is now opt-in (previously enabled by default); users explicitly consent via guided install or `npx github-delivery autostart`. ## [0.6.0] - 2026-08-14 From 0aa6cefe1c9b7210614c44816bec4ea5b41f3ef6 Mon Sep 17 00:00:00 2001 From: Wibias <37517432+Wibias@users.noreply.github.com> Date: Sun, 30 Aug 2026 08:46:08 +0200 Subject: [PATCH 3/7] docs: update README for v1.3.8 --- README.md | 24 ++++++++++++++++++++---- 1 file changed, 20 insertions(+), 4 deletions(-) diff --git a/README.md b/README.md index cea6a348..5456aa37 100644 --- a/README.md +++ b/README.md @@ -19,7 +19,7 @@ > [!NOTE] -> **1.3.7.** Stable self-update now tolerates brief GitHub/CDN gateway failures with bounded retries, and Protection mode **Off** once again means “no additional Windows Hello / trusted-authority protection” rather than “disable GitHub writes.” Normal workflow authorization and mutation safety gates still apply. See [Current state](#current-state). +> **1.3.8.** Routed create-PR intent now survives to the exact mutation boundary, pre-open review evidence is bound to the exact publication candidate, and the watchdog recognizes a small bounded amount of deterministic dependency-following investigation instead of pressuring legitimate reads into premature edits. See [Current state](#current-state). > [!IMPORTANT] > **Natural language is the public API.** The Node scripts, policy modules, evaluators, mutation broker, and optional Authority host are internal safety/evidence machinery. You normally do not invoke them yourself. @@ -100,6 +100,17 @@ For installation edge cases, backup/restore, downgrade behavior, manual recovery | **Merge / close-out** | `merge PR #32` | Final gate, exact transaction authority, head-pinned merge, verification, thanks, linked-issue close-out | | **Self-update** | `update github-delivery to the latest stable release` | Stable-release verification, lock-aware Windows recovery, optional old-backup cleanup, safe apply and postconditions | +### What changed in 1.3.8 + +`1.3.8` is a focused publication-integrity and watchdog reliability patch: + +- routed create-PR intent is carried automatically from the selected workflow into the exact `create_pr` mutation operation instead of being dropped before execution; +- that intent remains controller-owned and operation-bound: changing the mutation payload invalidates the authorization, caller-controlled `explicitInstruction` remains non-authoritative, and Protection mode **Off** still performs zero Authority-host authorization; +- pre-open evidence now binds the exact repository, resolved base/head commits, candidate diff identity, and file count, and both the controller and mutation boundary require a matching `ready` result before initial publication; +- wrong-scope, missing, blocked, unknown, stale, or mismatched pre-open evidence therefore cannot be narrated around into `push_code` or `create_pr`; +- successful stable source reads can receive a small bounded investigation credit only when the next read deterministically follows a source dependency referenced by the immediately previous result. Unrelated reads, assistant-prose claims, duplicates, volatile polling, and reads beyond the per-generation cap retain the ordinary evidence limits; +- the dependency-following behavior is shared by Codex lifecycle hooks and the App Server watchdog path. + ### What changed in 1.3.7 `1.3.7` is a focused reliability and Protection-mode semantics patch: @@ -169,7 +180,7 @@ For installation edge cases, backup/restore, downgrade behavior, manual recovery `1.3.0` brings local Git workflow and release versioning into the same delivery lifecycle: - `references/git-workflow.md` owns repository-aware branch/commit organization, logical commit boundaries, commit-message guidance, pre-commit hygiene, generated-file decisions, Git-history investigation, and evidence-backed change summaries; -- `references/versioning-release.md` owns release-delta inventory, SemVer classification by observable consumer impact, version-source consistency, human-curated changelogs, tag/version identity, and release-candidate checks; +- `references/versioning-release.md` owns release-delta inventory, SemVer classification by observable consumer impact, version-source consistency, human-curated changelogs, tag identity, and release-candidate checks; - direct commit/branch and SemVer/changelog/release-preparation requests route internally instead of handing off to `git-workflow-and-versioning`, while repository conventions and the stricter existing `GD-GIT-*` safety rules remain authoritative; - issue-linked and local-work PR publication compose the Git-workflow reference when branch/commit preparation is actually needed, preserving progressive disclosure; - release preparation remains separate from publication: a version/changelog request never grants tag, GitHub Release, npm/package-registry, merge, or other remote publication authority; @@ -457,6 +468,8 @@ GitHub Delivery treats convergence as a runtime + workflow problem rather than a Key defaults include: - evidence warning/block at **8 / 12** consecutive attempts without execution/state progress; +- up to **4** dependency-following investigation credits per state generation for successful stable source reads whose next target is deterministically referenced by the immediately preceding result; credited reads still count toward total evidence telemetry; +- unrelated reads, assistant-prose claims, exact duplicate stable reads, and volatile polling never gain investigation credit; - operational process/job/worktree polling counts as **volatile evidence**, so repeating those probes cannot reset or bypass the evidence budget; - protected-stream active-work warning/hard bounds of **4k / 8k generated characters** and **1,024 / 2,048 generated output tokens** since real progress; - larger completed-plan finalization allowance of **40k / 64k characters** and **12k / 16k output tokens**; @@ -639,6 +652,7 @@ The public interface stays small even though the enforcement surface is not. Key | `scripts/lib/pr-consolidation.mjs` | Read-only competing-PR clustering/planning evidence | | `scripts/lib/multi-base-delivery.mjs` | Parallel port identities/provenance/completion | | `scripts/lib/agent-progress-watchdog.mjs` | Shared progress/evidence/tool-emission watchdog logic | +| `scripts/lib/watchdog-investigation-progress.mjs` | Bounded deterministic dependency-following evidence progress for hook/App Server paths | | `scripts/build-dist.mjs` | Deterministic versioned skill bundle build | | `scripts/prepare-release.mjs` | Release identity/checksum/SBOM/provenance preparation | @@ -648,7 +662,7 @@ The architecture uses progressive disclosure: route once, load the selected work ## Current state -`1.3.7` is a focused reliability and Protection-mode semantics patch on top of `1.3.6`: transient GitHub/CDN release-asset HTTP 502/503/504 responses receive two bounded retries, and Protection mode Off removes only the additional trusted-authority/Windows Hello requirement instead of disabling otherwise-authorized GitHub writes. +`1.3.8` is a focused publication-integrity and watchdog reliability patch on top of `1.3.7`: routed create-PR intent reaches the exact operation-bound mutation context, pre-open review evidence is bound to the exact publication candidate, and deterministic dependency-following source investigation receives a small bounded progress allowance without weakening duplicate or volatile-read controls. Stable in this release: @@ -657,6 +671,8 @@ Stable in this release: - evidence-backed SemVer classification, version metadata consistency, curated changelogs, and tag/release preparation with publication kept separately authorized; - read-only open-work and competing-PR analysis; - issue research, implementation, publication, external work-item delivery, and exact-head duplicate prevention; +- routed create-PR intent that remains controller-owned and bound to the exact canonical mutation operation instead of relying on caller-controlled request flags; +- exact-candidate pre-open publication evidence, enforced both at the workflow transition and again at the mutation boundary before initial push/PR creation; - deep current-head review with deterministic probe coverage, conditional visual evidence, and independently opt-outable no-comments/simplify hygiene passes; - explicit GitHub-native PR approval created against the exact expected head and verified against the authenticated actor, commit, approval state, and idempotency marker before success; - mutation authority, exact-effect receipts, payload-bound operation idempotency, controller-owned stale-head protection, and head-pinned merge execution; @@ -670,7 +686,7 @@ Stable in this release: - verified stable install/update with bounded release-asset gateway retries, stale owned install-lock recovery, Windows lock recovery, graceful-close prompting, and optional older-backup cleanup that preserves the fresh rollback backup; - installed workflow helpers that resolve their own skill root while retaining explicit root overrides; - generation-fenced rewrite-baseline storage with generation allocation finalized under the acquired lock; -- progress watchdog/runtime convergence controls that charge operational process/job/worktree polling as volatile evidence rather than neutral progress; +- progress watchdog/runtime convergence controls that charge operational process/job/worktree polling as volatile evidence rather than neutral progress while allowing only a capped deterministic dependency-following stable-source chain to avoid increasing the consecutive no-progress read streak; - lifecycle-hook finalization that can recognize explicit completed recommendation outcomes and close concrete authorization/blocker recovery, without treating ordinary long `Stop` narration or responses that announce another tool action as final; - live `ship-gate` capture failures that preserve bounded upstream causes, remain fail-closed, and expose retryability so deterministic GitHub capability/permission failures can terminate equivalent probing; - deterministic bundles, repository security checks, CodeQL, Dependency Review, live-fixture contracts, and release preparation. From 05e94fa404ba4f774705e8b9f6411a3ab4e6ac48 Mon Sep 17 00:00:00 2001 From: Wibias <37517432+Wibias@users.noreply.github.com> Date: Sun, 30 Aug 2026 08:50:53 +0200 Subject: [PATCH 4/7] docs: restore unchanged changelog history --- CHANGELOG.md | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index 65cb4f4a..b51e6562 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -281,7 +281,7 @@ All notable changes to `github-delivery` are documented here. - Moved the remaining workflow-level `actions: write` permission down to the cleanup job, kept top-level workflow permissions read-only, and added validation that rejects future top-level write scopes while still permitting explicitly allowlisted job-level writes (PR #282). - Hardened PR publication identity and retries: exact duplicate detection now binds target repository, head repository/ref, and base; qualified REST head filters prevent same-repository misses; explicit cross-repository `head_repo` identity is supported; and exact owned idempotent retries converge before the broader duplicate preflight (PR #283). -- Protected existing PR-body screenshots, videos, GitHub uploads, reference-style Markdown images, and other recognized media from accidental body rewrites. Intentional media removal requires exact approved media identities that is included in trusted `update_pr_body` authority scope (PR #283). +- Protected existing PR-body screenshots, videos, GitHub uploads, reference-style Markdown images, and other recognized media from accidental body rewrites. Intentional media removal requires an exact approved identity list that is included in trusted `update_pr_body` authority scope (PR #283). - Prevented cross-repository closing issues and unsafe display URLs from masquerading as trustworthy same-repository work-item evidence, and tightened open-work fixtures so PR-number normalization and repository boundaries are actually exercised (PR #283). ## [0.8.2] - 2026-08-17 @@ -422,7 +422,7 @@ All notable changes to `github-delivery` are documented here. ### Fixed -- Repeated grid or malformed tool-protocol placeholder output now hard-stops immediately on the first stall instead of being retried, and the offending model is quarantined across turns and `SessionEnd` so a resume with the same model is blocked before inference until the model changes or a new task begins. Subagent protocol stalls no longer quarantine the parent task. +- Repeated grid or malformed tool-protocol placeholder output now hard-stops immediately on the first stall instead of being retried, and the offending model is quarantined across turns and `SessionEnd` so a resume with the same model is blocked before inference until the model is changed. Subagent protocol stalls no longer quarantine the parent task. - Windows login auto-start is now opt-in (previously enabled by default); users explicitly consent via guided install or `npx github-delivery autostart`. ## [0.6.0] - 2026-08-14 From f59bee2ab590e267861900d2eb873980a780911a Mon Sep 17 00:00:00 2001 From: Wibias <37517432+Wibias@users.noreply.github.com> Date: Sun, 30 Aug 2026 08:53:04 +0200 Subject: [PATCH 5/7] docs: restore unchanged README history --- README.md | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/README.md b/README.md index 5456aa37..b6870210 100644 --- a/README.md +++ b/README.md @@ -180,9 +180,9 @@ For installation edge cases, backup/restore, downgrade behavior, manual recovery `1.3.0` brings local Git workflow and release versioning into the same delivery lifecycle: - `references/git-workflow.md` owns repository-aware branch/commit organization, logical commit boundaries, commit-message guidance, pre-commit hygiene, generated-file decisions, Git-history investigation, and evidence-backed change summaries; -- `references/versioning-release.md` owns release-delta inventory, SemVer classification by observable consumer impact, version-source consistency, human-curated changelogs, tag identity, and release-candidate checks; +- `references/versioning-release.md` owns release-delta inventory, SemVer classification by observable consumer impact, version-source consistency, human-curated changelogs, tag/version identity, and release-candidate checks; - direct commit/branch and SemVer/changelog/release-preparation requests route internally instead of handing off to `git-workflow-and-versioning`, while repository conventions and the stricter existing `GD-GIT-*` safety rules remain authoritative; -- issue-linked and local-work PR publication compose the Git-workflow reference when branch/commit preparation is actually needed, preserving progressive disclosure; +- issue-linked and local-work PR publication compose the Git-workflow reference when branch/commit preparation is needed, preserving progressive disclosure; - release preparation remains separate from publication: a version/changelog request never grants tag, GitHub Release, npm/package-registry, merge, or other remote publication authority; - native approval is a dedicated `approve_pr` authority action: generic `post_review` cannot encode approval, explicit approval intent remains mandatory, Windows Authority binds the semantic approval action, and self-approval is rejected before the GitHub approval write; - Git/versioning requests now enter the mandatory one-shot workflow-packet/controller runtime, full-review intent keeps precedence over broad Git/version keywords in attributed repository text, and execution packets advertise only actions present in the mutation registry; From 4ee97640570e64b2f373c56ec4f16acfc701a9ae Mon Sep 17 00:00:00 2001 From: Wibias <37517432+Wibias@users.noreply.github.com> Date: Sun, 30 Aug 2026 08:57:22 +0200 Subject: [PATCH 6/7] docs: restore README release history wording --- README.md | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/README.md b/README.md index b6870210..50bba749 100644 --- a/README.md +++ b/README.md @@ -171,7 +171,7 @@ For installation edge cases, backup/restore, downgrade behavior, manual recovery `1.3.1` is a focused recovery and concurrency patch for the 1.3.0 runtime: -- exclusive skill and Windows Authority install locks can reclaim only a github-delivery-owned PID + nonce lock whose recorded process is provably gone; live, malformed, and permission-uncertain locks remain fail-closed; +- exclusive skill and Windows Authority install locks can reclaim only a github-delivery-owned PID + nonce lock whose recorded process is provably gone; live, malformed, or permission-uncertain locks remain fail-closed; - `scripts/policy-bundle.mjs` and `scripts/workflow-brief.mjs` default to the installed skill root derived from their own location, so agents can load workflow packets while remaining in the target repository; explicit root overrides are unchanged; - rewrite-baseline generation allocation is finalized after the exclusive store lock is acquired, closing the window where a waiting writer could reuse a generation that another writer published immediately before releasing the lock while preserving the existing stale-takeover generation fence. @@ -182,7 +182,7 @@ For installation edge cases, backup/restore, downgrade behavior, manual recovery - `references/git-workflow.md` owns repository-aware branch/commit organization, logical commit boundaries, commit-message guidance, pre-commit hygiene, generated-file decisions, Git-history investigation, and evidence-backed change summaries; - `references/versioning-release.md` owns release-delta inventory, SemVer classification by observable consumer impact, version-source consistency, human-curated changelogs, tag/version identity, and release-candidate checks; - direct commit/branch and SemVer/changelog/release-preparation requests route internally instead of handing off to `git-workflow-and-versioning`, while repository conventions and the stricter existing `GD-GIT-*` safety rules remain authoritative; -- issue-linked and local-work PR publication compose the Git-workflow reference when branch/commit preparation is needed, preserving progressive disclosure; +- issue-linked and local-work PR publication compose the Git-workflow reference when branch/commit preparation is actually needed, preserving progressive disclosure; - release preparation remains separate from publication: a version/changelog request never grants tag, GitHub Release, npm/package-registry, merge, or other remote publication authority; - native approval is a dedicated `approve_pr` authority action: generic `post_review` cannot encode approval, explicit approval intent remains mandatory, Windows Authority binds the semantic approval action, and self-approval is rejected before the GitHub approval write; - Git/versioning requests now enter the mandatory one-shot workflow-packet/controller runtime, full-review intent keeps precedence over broad Git/version keywords in attributed repository text, and execution packets advertise only actions present in the mutation registry; From 2b55046232bcaf187b1a4c12a559f70e0438d6f2 Mon Sep 17 00:00:00 2001 From: Wibias <37517432+Wibias@users.noreply.github.com> Date: Sun, 30 Aug 2026 08:59:32 +0200 Subject: [PATCH 7/7] docs: restore exact README release history --- README.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/README.md b/README.md index 50bba749..c7216eed 100644 --- a/README.md +++ b/README.md @@ -171,7 +171,7 @@ For installation edge cases, backup/restore, downgrade behavior, manual recovery `1.3.1` is a focused recovery and concurrency patch for the 1.3.0 runtime: -- exclusive skill and Windows Authority install locks can reclaim only a github-delivery-owned PID + nonce lock whose recorded process is provably gone; live, malformed, or permission-uncertain locks remain fail-closed; +- exclusive skill and Windows Authority install locks can reclaim only a github-delivery-owned PID + nonce lock whose recorded process is provably gone; live, malformed, and permission-uncertain locks remain fail-closed; - `scripts/policy-bundle.mjs` and `scripts/workflow-brief.mjs` default to the installed skill root derived from their own location, so agents can load workflow packets while remaining in the target repository; explicit root overrides are unchanged; - rewrite-baseline generation allocation is finalized after the exclusive store lock is acquired, closing the window where a waiting writer could reuse a generation that another writer published immediately before releasing the lock while preserving the existing stale-takeover generation fence.