This release adds 2 notable features for engineering teams evaluating rollout.
✓ No known CVEs patched in this version
Topics
+12 more
Summary
AI summarypr-review Step 2.8 documentation now correctly states the capital‑S Slice.ts(x) suffix rule for Redux‑slice triggers.
Changes in this release
| Type | Severity | Summary | CVE |
|---|---|---|---|
| Feature | Low |
Review surfaces now record `declined` fate for refuted-dropped BLOCK/FIX findings, completing the finding‑fate feedback loop. Review surfaces now record `declined` fate for refuted-dropped BLOCK/FIX findings, completing the finding‑fate feedback loop. Source: llm_adapter@2026-07-17 Confidence: high |
— |
| Feature | Low |
Packaged agents (code-scout, web-researcher, pattern-reviewer) now include explicit token‑economy and parallel‑dispatch contract. Packaged agents (code-scout, web-researcher, pattern-reviewer) now include explicit token‑economy and parallel‑dispatch contract. Source: llm_adapter@2026-07-17 Confidence: high |
— |
| Bugfix | Medium |
pr-review Step 2.8 documentation corrected to reflect actual suffix rule for Redux-slice detection. pr-review Step 2.8 documentation corrected to reflect actual suffix rule for Redux-slice detection. Source: llm_adapter@2026-07-17 Confidence: high |
— |
| Bugfix | Medium |
Stale trust handling adjusted: stale grants no longer trigger manual fallback unless untrusted or absent; deep-work no longer claims archetype name in untrusted envelope. Stale trust handling adjusted: stale grants no longer trigger manual fallback unless untrusted or absent; deep-work no longer claims archetype name in untrusted envelope. Source: llm_adapter@2026-07-17 Confidence: high |
— |
| Bugfix | Medium |
pr-review Step 2b and pattern-reviewer agent stopped suggesting a non-existent "suggested fallback" archetype from null-match `get_pattern_context` envelope. pr-review Step 2b and pattern-reviewer agent stopped suggesting a non-existent "suggested fallback" archetype from null-match `get_pattern_context` envelope. Source: llm_adapter@2026-07-17 Confidence: high |
— |
| Refactor | Low |
SKILL.md and deep-work frontmatter trimmed by ~7% and ~40% respectively via deduplication; no functional changes. SKILL.md and deep-work frontmatter trimmed by ~7% and ~40% respectively via deduplication; no functional changes. Source: llm_adapter@2026-07-17 Confidence: high |
— |
Full changelog
Added
- The review surfaces close the finding-fate feedback loop. pr-review Step 5b
now records a refuted-dropped BLOCK/FIX asdeclinedin the fate ledger
(previously only surfaced/acceptedand converted findings were recorded,
leaving the pr-review per-lens precision denominator permanently empty), and
all three review skills readget_finding_fate_statsback before their
firstrefute_findingbatch as an advisory, fail-open calibration:
pr-review orders refuter sends within a severity by the repo's own per-lens
refuter-survival history, receiving prioritizes a PUSH BACK on a comment
category the repo historically applies, and deep-work prioritizes a decline
that contradicts its lens's acceptance history — so the verdicts most likely
to be wrong reach the independent refuter before the 4-call budget runs out.
History never decides a fate, never gates a finding, and never appears as
evidence. - The three packaged agents (code-scout, web-researcher, pattern-reviewer)
carry an explicit token-economy and parallel-dispatch contract: independent
probes fire as one batch, the final message is the answer alone
(pattern-reviewer: the JSON alone), and quoting is capped to claim-bearing
lines.
Fixed
- pr-review Step 2.8 documented the Redux-slice co-change trigger as a
lowercase substring match ("basename CONTAINSslice", citing
sliceHelpers.tsas triggering). The engine matches the<alnum>Slice.ts(x)
capital-S suffix only, so the skill's own example was false; the text now
states the suffix rule with engine-true examples. - Stale-vs-untrusted trust handling: a
stalegrant (revalidation opt-in)
still serves profile content engine-side, but deep-work told the model to
fall back to manual reading whenevertrust_statewas nottrusted, and
receiving lumpedstalein with untrusted for plain-judgment fallback. Both
now degrade only on untrusted/absent and carry a staleness caveat otherwise;
deep-work also no longer claims the untrusted envelope returns the archetype
name (it is withheld along with the content). - pr-review Step 2b and the pattern-reviewer agent no longer suggest reading a
"suggested fallback" archetype off the null-matchget_pattern_context
envelope — that envelope carries no such field (the receiving skill already
stated this correctly).
Changed
- pr-review SKILL.md trimmed ~7% (61.1KB -> 57.0KB) by deduplicating the
Integrity/Important/Honesty restatements against the authoritative
references; deep-work's frontmatter description trimmed ~40%. No contract or
pinned invariant changed (full unit suite green).
Weekly OSS security release digest.
The CVE patches and breaking changes that affected production tools this week. One email, every Sunday.
No spam, unsubscribe anytime.
Share this release
About Chameleon
All releases →Beta — feedback welcome: [email protected]