Version Packages

[khan-actions-bot]

This PR was opened by the Changesets release GitHub action. When you're ready to do a release, you can merge this and the packages will be published to npm automatically. If you're not ready to do a release yet, that's fine, whenever you add more changesets to main, this PR will be updated.

Releases

review@1.7.0

Minor Changes

• f4deabf: Move the correctness-reviewer from Opus 4.8 to Fable 5 (claude-fable-5). Bug-finding recall is the workflow's load-bearing metric, and the 2026-07-20 pooled A/B's recall gain (83% to 90%, true misses down 43%) concentrated in correctness-adjacent rows, so the 2x per-token price goes to the one role where the measurement supports it. Deliberately NOT moved, per review: claim-validator stays Opus at xhigh (the Fable arm measurably did not improve the precision gate: noise 43% to 49%, one wrong blocking flag on a clean case); the opt-in whole-change reviewers (holistic, completeness, test-adequacy) stay Opus (the A/B measured the full-Fable bundle, so their contribution is unattributed, and both known consumers enable them in ROUTING so they are not free in practice); the procedural roles (orchestrator, thread-reconciler, skill-auditor, conventions) stay Opus (instruction-following over staged context, and the orchestrator is the token-heaviest agent under a 20-minute timeout); and the specialist lenses stay Opus because Fable's cyber safety classifiers can refuse benign security-focused analysis, and a refused security lens would be a silent coverage hole. first-principles already ran Fable 5. The firewall pricing pin (awf v0.27.27) and the models: cost block already cover claude-fable-5, so no sandbox or pricing change is needed.
• f9cb6a1: Close the unbounded-read blind spot found by the 2026-07-20 drift triage: the reviewer missed retention-unbounded-prune in all 6 drift samples (a query loading an entire user-sized result set via pageSize: "all"), and its own suggested fix for an adjacent bug recommended the same unbounded-read pattern, so no lens was reasoning about memory-bounded reads at all. The correctness lens now asks a mandatory bounds question for every query, fetch, or bulk-read call the diff touches (what bounds the result size; pageSize "all", missing LIMIT, fetching a whole set to act on part of it), states the expected shape (page or batch it, so a deliberately bounded per-invocation read is the fix, not a further defect), and explicitly authorizes a second finding in the same statement; the first iteration (a taxonomy item in the defect-class list) measured 0/10 on the targeted powered run because the model reported only the off-by-one in the same query and read "fetch all rows to delete them" as intentional. The caching-resource specialist gains a matching review rule and an unbounded-read-materialization tri-state hunt. Recall-affecting by design; priced by the per-PR A/B and a targeted powered run on golden-retention-lifecycle-1.

Patch Changes

• 26f70d3: Arbiter calibration harness (the tuning memo's item 7), seeded from production evidence instead of synthetic pairs: all 10 fallback accepts recorded in drift run 29724668102, hand-labeled. 4 of the 10 were wrong (three times the cap off-by-one finding accepted for retention-dedup-window-untested; once the unreachable-quotaExceeded finding accepted for quota-cache-shared-key): same file, plausible adjacency, different defect, exactly the false-accept class the arbiter's refuse-bias prompt was supposed to prevent. eval/arbiter-calibration.ts replays the labeled pairs through the real arbiter seam and reports per-pair yes-rates plus false-accept/false-reject rates (~$0.02 per run at 3 samples/pair); the deterministic suite pins the set's invariants (10 pairs, 4 mismatches, none deterministically matchable, prompt-builder compatibility). Measurement only: the arbiter prompt is unchanged, since changing it is a ruler change that the calibration numbers should justify first.
• f1e2727: Eval reports for identical-arm runs (--force-arms: the weekly drift watch and manual wobble controls) no longer read as an A/B. The single-run, multi-repeat, and aggregate renderers retitle themselves "Review wobble control (identical arms)", relabel the Baseline/Candidate columns to Arm A/Arm B, state up front that between-arm deltas are run-to-run wobble, and the aggregate leads with the noise-floor bands (on an identical-arm pool the bands are the product; the per-case table is the raw material). Motivated by the first scheduled drift report (PR review: eval drift report 2026-07-20 #265), whose baseline-vs-candidate framing over one prompt invited reading noise as a result. Also makes a contaminated noise floor a red run instead of a footnote: the drift workflow now fails (after uploading the report and opening the visibility PR) when the aggregate flags case asymmetry, i.e. the pooled samples scored different case sets because the budget skipped the corpus tail. The budget resize itself rides with the corpus-growth stack, which owns the sizing.
• 18a7a69: Eval-only: improve the discrimination power of the review eval corpus. Fixes the floor-case ground truth found by the 2026-07-20 drift triage (lifecycle-3's void prune was a real defect the reviewer was right to block, dedup-eventual-consistency's expected verdict contradicted its own premise, retention-unbounded-prune was retired as unevidenceable in-tree), repairs order-sensitive spec regexes that under-counted deterministic matches, annotates four real defects mined from the drift run's unmatched-posted noise pool, mints two mid-band retention/lifecycle cases, and raises the weekly drift budget default from 85 to 120 USD so the full corpus clears without budget skips. No change to the shipped review workflow.
• d16d28c: Eval-only: grow the corpus by seven live cases (nine across the stack, counting the two minted in the preceding corpus PR) across seven previously uncovered defect families (removed-behavior, cross-file chain, mechanical-churn needle, non-idempotent retry, check-then-act race, boundary double-count, and a 29-file cross-subsystem tree), add a mustNotFlagSpec precision probe to the churn case, and document the calibration finding in the operator guide: all nine stack cases calibrated saturated under the Opus roster across ~56 identical-arm samples, so hand-authored synthetics are family tripwires by construction and recall discrimination must be grown from real material (golden human-comment cases and production incident repros). No change to the shipped review workflow.
• cd3b55b: Quiet the re-review surface, two pieces. (1) Fix the **unknown** recap labels: staged threads.json bodies do not reliably preserve the posted markdown (on Khan/webapp#40561 every opener arrived with the ** wrapping stripped), so the accountability renderer's bold-only label parse failed on every line. parseLeadingLabel/excerptOpeningComment now also accept a plain label (decoration): form bound to the closed label vocabulary, and Step 3's staging instruction pins the verbatim-body contract. This also repairs the flip gate's keptBlockingCount input for markdown-stripped stagings, which previously undercounted kept blocking threads. (2) Shrink the recap: kept blocking threads stay visible; kept non-blocking threads fold into a collapsed <details> block with a count, so a re-review stops re-listing every open nit verbatim on every push (three recap walls in two days on webapp#40561). Accountability is unchanged; only the notification surface shrinks. A third piece (a job-level draft gate) was dropped in review: teams want reviews on draft PRs, and on push-triggered installs the gate would have left no way to request one.