chore: expand CHANGELOG.md to Keep-a-Changelog 1.1.0 format - #8
Conversation
|
Warning You have reached your daily quota limit. Please wait up to 24 hours and I will start processing your requests again! |
|
CodeAnt AI is reviewing your PR. Thanks for using CodeAnt! 🎉We're free for open-source projects. if you're enjoying it, help us grow by sharing. Share on X · |
|
Warning Rate limit exceeded
Your organization is not enrolled in usage-based pricing. Contact your admin to enable usage-based pricing to continue reviews beyond the rate limit, or try again in 58 minutes and 21 seconds. ⌛ How to resolve this issue?After the wait time has elapsed, a review can be triggered using the We recommend that you space out your commits to avoid hitting the rate limit. 🚦 How do rate limits work?CodeRabbit enforces hourly rate limits for each developer per organization. Our paid plans have higher rate limits than the trial, open-source and free plans. In all cases, we re-allow further reviews after a brief timeout. Please see our FAQ for further information. ✨ Finishing Touches🧪 Generate unit tests (beta)
✨ Simplify code
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
|
CodeAnt AI finished reviewing your PR. |
|
CodeAnt AI is running the review. Thanks for using CodeAnt! 🎉We're free for open-source projects. if you're enjoying it, help us grow by sharing. Share on X · |
Sequence DiagramThis PR restructures the changelog to follow the Keep a Changelog 1.1.0 format, adding standard Unreleased sections and a compare link to support clear, consistent release note preparation. sequenceDiagram
participant Developer
participant Changelog
participant ProjectUsers
Developer->>Changelog: Add upcoming changes under Unreleased sections
Developer->>Changelog: Use Unreleased compare link when preparing a release
Changelog-->>ProjectUsers: Present structured release notes for each version
ProjectUsers->>Changelog: Review Added, Changed, Deprecated, Removed, Fixed, Security items
Generated by CodeAnt AI |
|
|
||
| ### Security | ||
|
|
||
| [Unreleased]: https://github.com/KooshaPari/phenotype-tooling/compare/HEAD...HEAD |
There was a problem hiding this comment.
🟠 Architect Review — HIGH
The new [Unreleased] compare link points to HEAD...HEAD, which always yields an empty diff and cannot show changes since the last release.
Suggestion: Point [Unreleased] to compare from the latest released tag (or an explicit bootstrap tag) to HEAD, and update this link as part of each release so it remains meaningful.
Fix in Cursor | Fix in VSCode Claude
(Use Cmd/Ctrl + Click for best experience)
Prompt for AI Agent 🤖
This is an **Architect / Logical Review** comment left during a code review. These reviews are first-class, important findings — not optional suggestions. Do NOT dismiss this as a 'big architectural change' just because the title says architect review; most of these can be resolved with a small, localized fix once the intent is understood.
**Path:** CHANGELOG.md
**Line:** 25:25
**Comment:**
*HIGH: The new `[Unreleased]` compare link points to `HEAD...HEAD`, which always yields an empty diff and cannot show changes since the last release.
Validate the correctness of the flagged issue. If correct, How can I resolve this? If you propose a fix, implement it and please make it concise.
If a suggested approach is provided above, use it as the authoritative instruction. If no explicit code suggestion is given, you MUST still draft and apply your own minimal, localized fix — do not punt back with 'no suggestion provided, review manually'. Keep the change as small as possible: add a guard clause, gate on a loading state, reorder an await, wrap in a conditional, etc. Do not refactor surrounding code or expand scope beyond the finding.
Once fix is implemented, also check other comments on the same PR, and ask user if the user wants to fix the rest of the comments as well. if said yes, then fetch all the comments validate the correctness and implement a minimal fix|
CodeAnt AI finished running the review. Thanks for using CodeAnt! 🎉We're free for open-source projects. if you're enjoying it, help us grow by sharing. Share on X · |
|
CodeAnt AI is running the review. Thanks for using CodeAnt! 🎉We're free for open-source projects. if you're enjoying it, help us grow by sharing. Share on X · |
Sequence DiagramThis PR restructures the changelog to follow the Keep a Changelog 1.1.0 template, defining how upcoming changes are recorded under Unreleased sections and later promoted to versioned release notes. sequenceDiagram
participant Maintainer
participant Changelog
participant Repository
participant Reader
Maintainer->>Changelog: Record changes under Unreleased sections
Changelog-->>Maintainer: Structured list of upcoming changes
Maintainer->>Changelog: Create new version entry from Unreleased
Maintainer->>Repository: Commit changelog and tag release
Reader->>Changelog: Read versioned release notes
Generated by CodeAnt AI |
|
|
||
| ### Security | ||
|
|
||
| [Unreleased]: https://github.com/KooshaPari/phenotype-tooling/compare/HEAD...HEAD |
There was a problem hiding this comment.
🟠 Architect Review — HIGH
The [Unreleased] compare link uses HEAD...HEAD, which always produces an empty diff on GitHub and never shows unreleased changes.
Suggestion: Change the [Unreleased] link to compare from the latest release tag to HEAD (once a tag exists), or omit the compare link until an initial release tag is available.
Fix in Cursor | Fix in VSCode Claude
(Use Cmd/Ctrl + Click for best experience)
Prompt for AI Agent 🤖
This is an **Architect / Logical Review** comment left during a code review. These reviews are first-class, important findings — not optional suggestions. Do NOT dismiss this as a 'big architectural change' just because the title says architect review; most of these can be resolved with a small, localized fix once the intent is understood.
**Path:** CHANGELOG.md
**Line:** 25:25
**Comment:**
*HIGH: The `[Unreleased]` compare link uses `HEAD...HEAD`, which always produces an empty diff on GitHub and never shows unreleased changes.
Validate the correctness of the flagged issue. If correct, How can I resolve this? If you propose a fix, implement it and please make it concise.
If a suggested approach is provided above, use it as the authoritative instruction. If no explicit code suggestion is given, you MUST still draft and apply your own minimal, localized fix — do not punt back with 'no suggestion provided, review manually'. Keep the change as small as possible: add a guard clause, gate on a loading state, reorder an await, wrap in a conditional, etc. Do not refactor surrounding code or expand scope beyond the finding.
Once fix is implemented, also check other comments on the same PR, and ask user if the user wants to fix the rest of the comments as well. if said yes, then fetch all the comments validate the correctness and implement a minimal fix|
CodeAnt AI finished running the review. Thanks for using CodeAnt! 🎉We're free for open-source projects. if you're enjoying it, help us grow by sharing. Share on X · |
|
CodeAnt AI is running the review. Thanks for using CodeAnt! 🎉We're free for open-source projects. if you're enjoying it, help us grow by sharing. Share on X · |
Sequence DiagramThis PR restructures the changelog to follow the Keep a Changelog 1.1.0 template, standardizing how unreleased and future release notes are organized across sections like Added, Changed, Deprecated, Removed, Fixed, and Security. sequenceDiagram
participant Maintainer
participant ChangelogFile
participant ReleaseProcess
participant Reader
Maintainer->>ChangelogFile: Add upcoming changes under Unreleased sections
Maintainer->>ChangelogFile: Normalize entries in standard headings
ReleaseProcess->>ChangelogFile: Move Unreleased items to new version section
Maintainer->>ChangelogFile: Update Unreleased compare link
Reader->>ChangelogFile: Review grouped changes and upcoming updates
Generated by CodeAnt AI |
|
|
||
| ### Security | ||
|
|
||
| [Unreleased]: https://github.com/KooshaPari/phenotype-tooling/compare/HEAD...HEAD |
There was a problem hiding this comment.
🟠 Architect Review — HIGH
The [Unreleased] compare link points to HEAD...HEAD, which compares the same commit to itself and always produces an empty diff, so users clicking it cannot see unreleased changes.
Suggestion: Update the [Unreleased] link to compare the latest release tag to HEAD (e.g., vX.Y.Z...HEAD) and adjust the base tag with each release so the link consistently reflects pending changes.
Fix in Cursor | Fix in VSCode Claude
(Use Cmd/Ctrl + Click for best experience)
Prompt for AI Agent 🤖
This is an **Architect / Logical Review** comment left during a code review. These reviews are first-class, important findings — not optional suggestions. Do NOT dismiss this as a 'big architectural change' just because the title says architect review; most of these can be resolved with a small, localized fix once the intent is understood.
**Path:** CHANGELOG.md
**Line:** 25:25
**Comment:**
*HIGH: The `[Unreleased]` compare link points to `HEAD...HEAD`, which compares the same commit to itself and always produces an empty diff, so users clicking it cannot see unreleased changes.
Validate the correctness of the flagged issue. If correct, How can I resolve this? If you propose a fix, implement it and please make it concise.
If a suggested approach is provided above, use it as the authoritative instruction. If no explicit code suggestion is given, you MUST still draft and apply your own minimal, localized fix — do not punt back with 'no suggestion provided, review manually'. Keep the change as small as possible: add a guard clause, gate on a loading state, reorder an await, wrap in a conditional, etc. Do not refactor surrounding code or expand scope beyond the finding.
Once fix is implemented, also check other comments on the same PR, and ask user if the user wants to fix the rest of the comments as well. if said yes, then fetch all the comments validate the correctness and implement a minimal fix|
CodeAnt AI finished running the review. Thanks for using CodeAnt! 🎉We're free for open-source projects. if you're enjoying it, help us grow by sharing. Share on X · |
|
CodeAnt AI is running the review. Thanks for using CodeAnt! 🎉We're free for open-source projects. if you're enjoying it, help us grow by sharing. Share on X · |
Sequence DiagramThis PR restructures the changelog to follow the Keep a Changelog 1.1.0 template, adding standard Unreleased sections and a compare link to support consistent future release notes. sequenceDiagram
participant Developer
participant Changelog
participant ReleaseProcess
Developer->>Changelog: Record upcoming changes under Unreleased sections
Changelog-->>Developer: Provide standardized Added/Changed/Deprecated/Removed/Fixed/Security structure
ReleaseProcess->>Changelog: Read Unreleased entries for next release
Changelog-->>ReleaseProcess: Return grouped changes by category
ReleaseProcess->>Changelog: Use Unreleased compare link to compute diff
Changelog-->>ReleaseProcess: Provide changes between latest release and current head
Generated by CodeAnt AI |
|
|
||
| ### Security | ||
|
|
||
| [Unreleased]: https://github.com/KooshaPari/phenotype-tooling/compare/HEAD...HEAD |
There was a problem hiding this comment.
🟠 Architect Review — HIGH
The [Unreleased] compare link uses HEAD...HEAD, which always yields an empty GitHub diff and therefore never shows the actual unreleased changes.
Suggestion: Update the [Unreleased] link to compare from the latest released tag to HEAD (and adjust it as new releases are cut), or omit the compare link until the first release tag exists.
Fix in Cursor | Fix in VSCode Claude
(Use Cmd/Ctrl + Click for best experience)
Prompt for AI Agent 🤖
This is an **Architect / Logical Review** comment left during a code review. These reviews are first-class, important findings — not optional suggestions. Do NOT dismiss this as a 'big architectural change' just because the title says architect review; most of these can be resolved with a small, localized fix once the intent is understood.
**Path:** CHANGELOG.md
**Line:** 25:25
**Comment:**
*HIGH: The `[Unreleased]` compare link uses `HEAD...HEAD`, which always yields an empty GitHub diff and therefore never shows the actual unreleased changes.
Validate the correctness of the flagged issue. If correct, How can I resolve this? If you propose a fix, implement it and please make it concise.
If a suggested approach is provided above, use it as the authoritative instruction. If no explicit code suggestion is given, you MUST still draft and apply your own minimal, localized fix — do not punt back with 'no suggestion provided, review manually'. Keep the change as small as possible: add a guard clause, gate on a loading state, reorder an await, wrap in a conditional, etc. Do not refactor surrounding code or expand scope beyond the finding.
Once fix is implemented, also check other comments on the same PR, and ask user if the user wants to fix the rest of the comments as well. if said yes, then fetch all the comments validate the correctness and implement a minimal fix|
CodeAnt AI finished running the review. Thanks for using CodeAnt! 🎉We're free for open-source projects. if you're enjoying it, help us grow by sharing. Share on X · |
* Initial policy-contract import Co-authored-by: Codex <noreply@openai.com> * Ignore zig build cache artifacts Co-authored-by: Codex <noreply@openai.com> * Clarify partial scan failure handling Co-authored-by: Codex <noreply@openai.com> * Document apply mode restriction Co-authored-by: Codex <noreply@openai.com> * Clarify wrapper smoke usage Co-authored-by: Codex <noreply@openai.com> * Allow remediation dispatch to succeed after comment posting Co-authored-by: Codex <noreply@openai.com> * docs: mass injection of standardized Phenotype governance and worktree policies * docs: Turn 7 mass injection of standardized Phenotype governance and worktree policies * docs: Turn 10 mass synchronization - CI/Release/Docs/Dependencies * docs: Turn 10/11 mass synchronization - Governance/CI/Release/Docs/Archival * docs: Turn 12 mass synchronization - Quality/Protection/Security/Automation * docs: Turn 13 mass synchronization - Release/Dependabot/Security/Contribution * docs: Turn 14 mass synchronization - Hooks/Containers/Badges/Deployment * docs: Turn 23 mass synchronization - Structure and Environment Health * docs: Turn 23 mass synchronization - Structure and Environment Health * chore: add worktrees/ to gitignore Standardize working directory ignore patterns. Co-authored-by: kooshapari * chore: add worktrees/ to gitignore (#6) * docs: Turn 23 mass synchronization - Structure and Environment Health * docs: Turn 23 mass synchronization - Structure and Environment Health * chore: add worktrees/ to gitignore Standardize working directory ignore patterns. Co-authored-by: kooshapari --------- Co-authored-by: Koosha Paridehpour <koosha@phenotype.ai> * feat: add forge as a policy guardian alongside droid/codex - Add forge permissions.yaml support with commandAllowlist/Requestlist/Denylist - Add --forge-settings CLI argument - Add _apply_forge_rules() function for YAML policy application - Update render_platform_payload() to include forge platform - Update _build_success_entries() to track forge artifacts - Update resolve.py to output forge.settings.yaml * feat: add forge as a policy guardian alongside droid/codex (#7) - Add forge permissions.yaml support with commandAllowlist/Requestlist/Denylist - Add --forge-settings CLI argument - Add _apply_forge_rules() function for YAML policy application - Update render_platform_payload() to include forge platform - Update _build_success_entries() to track forge artifacts - Update resolve.py to output forge.settings.yaml Co-authored-by: Koosha Paridehpour <koosha@phenotype.ai> * feat: add forge as policy guardian and sync governance structure (#8) * docs: Turn 23 mass synchronization - Structure and Environment Health * docs: Turn 23 mass synchronization - Structure and Environment Health * chore: add worktrees/ to gitignore Standardize working directory ignore patterns. Co-authored-by: kooshapari * feat: add forge as a policy guardian alongside droid/codex - Add forge permissions.yaml support with commandAllowlist/Requestlist/Denylist - Add --forge-settings CLI argument - Add _apply_forge_rules() function for YAML policy application - Update render_platform_payload() to include forge platform - Update _build_success_entries() to track forge artifacts - Update resolve.py to output forge.settings.yaml --------- Co-authored-by: Koosha Paridehpour <koosha@phenotype.ai> * chore: replace BMAD/spec-kitty refs with AgilePlus governance in CLAUDE.md Remove BMAD plugin references, slash command instructions, and spec-kitty/openspec mentions. Add standardized AgilePlus governance block pointing to agileplus-specs/ directory and spec docs. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com> * chore: add VitePress docsite scaffold Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com> * chore: add spec documentation (PRD, ADR, FR, PLAN, trackers) Add standardized specification documents for the project: - PRD.md: Product requirements with epics and acceptance criteria - ADR.md: Architecture decision records - FUNCTIONAL_REQUIREMENTS.md: FR-prefixed SHALL statements - PLAN.md: Phased work breakdown structure - docs/reference/FR_TRACKER.md: FR implementation status - docs/reference/CODE_ENTITY_MAP.md: Code-to-requirements mapping Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com> * Auto: Sync and evaluate feat/forge-guardian-and-governance-sync (#10) * docs: Turn 23 mass synchronization - Structure and Environment Health * docs: Turn 23 mass synchronization - Structure and Environment Health * chore: add worktrees/ to gitignore Standardize working directory ignore patterns. Co-authored-by: kooshapari * feat: add forge as a policy guardian alongside droid/codex - Add forge permissions.yaml support with commandAllowlist/Requestlist/Denylist - Add --forge-settings CLI argument - Add _apply_forge_rules() function for YAML policy application - Update render_platform_payload() to include forge platform - Update _build_success_entries() to track forge artifacts - Update resolve.py to output forge.settings.yaml --------- Co-authored-by: Koosha Paridehpour <koosha@phenotype.ai> * Auto: Sync and evaluate chore/add-worktrees-gitignore (#9) * docs: Turn 23 mass synchronization - Structure and Environment Health * docs: Turn 23 mass synchronization - Structure and Environment Health * chore: add worktrees/ to gitignore Standardize working directory ignore patterns. Co-authored-by: kooshapari --------- Co-authored-by: Koosha Paridehpour <koosha@phenotype.ai> * fix: resolve all 16 baseline test failures and clean lint (#16) Core fixes to policy_lib.py: - Add evaluate_with_quality() to ConditionGroup returning (ok, partial_fail, reasons) 3-tuple; any-mode now signals partial_fail when required fails but optional passes - Fix all-mode to evaluate every item before deciding (no early exit), collecting complete reason list for diagnostic accuracy - CommandRule.evaluate uses evaluate_with_quality and emits request on partial_fail instead of falling through silently to the next rule - Fix _parse_match error message for non-string/non-dict match values sync_host_rules.py: - Map request action to cursor_deny (cursor treats request as deny in shell layer) - Include unconditional rules in wrapper_rules when include_conditional=True - _normalize_for_wrapper: generate proper wrapper entry with empty conditions group for unconditional rules instead of returning empty dict - Remove forge from _build_success_entries (not a policy-enforced platform) - Use .get() with default [] in _count_platform_rules and _managed_segment_length_after to avoid KeyError on partial renders - Fix _had_managed_segment_before forge path: call _load_json(path) instead of referencing undefined variable policy wrappers/policy-wrapper-dispatch.sh: - emit_fallback: output sys.argv[2] (decision) not sys.argv[3] (reason) as fallback wrappers/zig/src/main.zig: - Exit with code 1 on bad usage and invalid bundle JSON (was returning 0) - Always overwrite best_error when a higher-rank rule wins (was keeping stale error from a lower-rank rule that errored) tests/test_policy_contract.py: - Fix test_wrapper_allow_and_request_rule_parity: call _run_wrapper_with_command with local command variable instead of _run_wrapper (which used self.command) - Fix test_wrapper_action_precedence_with_omitted_on_mismatch_fields: same fix for both sub-test assertions; correct second expectation from request to deny (deny rank > request rank when both match unconditionally) - Remove unused EXIT_CODE_ARG import (ruff F401) .github/workflows: add job-level permissions block to governance job lint: add noqa E402 with justification for sys.path-before-import pattern Co-authored-by: Claude Code <claude@anthropic.com> Co-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com> * docs: add comprehensive feature comparison matrix (#17) Co-authored-by: Claude Code <claude@anthropic.com> * docs(spec): expand PRD, FUNCTIONAL_REQUIREMENTS, and ADR with real content (#19) Replace sparse stubs with substantive spec docs grounded in the actual codebase. PRD adds target-user table, full acceptance criteria for all four epics (scope resolution, conditional rules, host sync, governance validation), and explicit non-goals. FUNCTIONAL_REQUIREMENTS expands from 13 to 24 FRs across six categories (FR-RES, FR-COND, FR-HOST, FR-GOV, FR-SCHEMA) with implementation file references. ADR expands from 4 to 7 records adding decisions for policy hash design, Python-as- reference-resolver, and snapshot-based drift detection. Co-authored-by: Claude Code <claude@anthropic.com> Co-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com> * docs(spec): add USER_JOURNEYS.md with 6 real end-to-end flows (#20) Adds USER_JOURNEYS.md covering the six primary actor journeys: CI pipeline policy resolution, conditional rule authoring, harness artifact application, snapshot drift detection, schema validation, and cross-language wrapper evaluation. Each journey includes ASCII flow diagrams and FR traceability. Co-authored-by: Claude Code <claude@anthropic.com> Co-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com> * chore: update docs and configs * chore: sync * chore: add docs gitignore and update playwright config Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com> * chore: commit working changes from work-audit session 2026-03-28 * docs: add docs-site scaffold and verification harness (#21) Co-authored-by: Claude Code <claude@anthropic.com> Co-authored-by: Codex <codex@phenotype.dev> * feat: apply phenotype governance standards - Add CODEOWNERS with @KooshaPari as sponsor - Add AGENTS.md extending phenotype-governance - Add issue/PR templates for task discovery - Add linter configs where applicable - Add CI workflow for automated quality gates * feat: add TEST_COVERAGE_MATRIX.md Added: - TEST_COVERAGE_MATRIX.md - test coverage tracking Stabilization complete * docs: add SPEC.md and PLAN.md * chore: add AgilePlus scaffolding * docs: add journeys, stories, and traceability documentation * chore(infra): add standardized infrastructure files * feat(policy): standardize error codes to kebab-case across all wrappers * ci: migrate to reusable workflows from template-commons - Use reusable-rust-ci.yml, reusable-python-ci.yml, reusable-typescript-ci.yml - Add security scanning with reusable-security-scan.yml - Add governance validation with validate-governance.yml * feat: migrate federation tools from agentops-policy-federation * ci(legacy-enforcement): add legacy tooling anti-pattern gate (WARN mode) Adds legacy-tooling-gate.yml monitoring for anti-patterns per CLAUDE.md. Refs: CLAUDE.md Technology Adoption Philosophy * feat: complete federation merge - add cli, extensions, policies, schemas, scripts, tests * chore(ci): pin floating external actions to SHAs in sast.yml (#2) * chore(ci): pin floating external actions to SHAs in security-deep-scan.yml (#3) * chore(ci): pin floating external actions to SHAs in security-guard.yml (#4) * chore(ci): pin floating external actions to SHAs in security.yml (#5) * chore: add OpenSSF Scorecard workflow (audit #256) (#6) * chore(deps-dev): bump postcss (#1) Bumps the npm_and_yarn group with 1 update in the / directory: [postcss](https://github.com/postcss/postcss). Updates `postcss` from 8.5.8 to 8.5.10 - [Release notes](https://github.com/postcss/postcss/releases) - [Changelog](https://github.com/postcss/postcss/blob/main/CHANGELOG.md) - [Commits](postcss/postcss@8.5.8...8.5.10) --- updated-dependencies: - dependency-name: postcss dependency-version: 8.5.10 dependency-type: indirect dependency-group: npm_and_yarn ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * docs(agents): harmonize AGENTS.md to thin pointer - Consolidates governance guidance into canonical hierarchy - Points to ~/.claude/AGENTS.md, /repos/CLAUDE.md, repo CLAUDE.md - Reduces per-repo guidance duplication - Maintains ~23-line pointer format for easy scanning Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com> * fix(tests): unblock wrapper import errors via conftest mocks Mock opencode, codex, cursor, kilo, forgecode, droid wrapper libraries and their submodules in conftest.py to prevent ModuleNotFoundError during test discovery. Tests can now be discovered and executed. Previously: test collection failed immediately at import. Now: test discovery succeeds; 3+ tests pass (failures due to mocked impls). Enables CI/CD test execution. Traces to: GOVERNANCE — test blockage * test(pyo3): add end-to-end PolicyStack ↔ policy-engine integration tests Added tests/test_pyo3_integration.py: comprehensive integration test suite for PyO3 bindings. Covers: - RuleEvaluator construction and rule addition (FR-SHARED-007) - Metadata assignment and tracking (FR-SHARED-005, 003) - ConditionGroup and context evaluation (FR-SHARED-002) - MatcherKind and OnMismatchAction enum variants (FR-SHARED-001, 004) - Decision creation and traced evaluation (FR-SHARED-006) - Multi-rule evaluation and rule clearing - Primary integration scenario: ACL rule evaluation against user context All 12 tests passing. Binding now verified for PolicyStack consumption. Traces to: W-51 (Phase-1 consolidation complete) Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com> * docs(changelog): enrich unreleased section with concrete features and fixes Mined commit history (b981c9b..f6b552f) and categorized 10 commits into: - Added: federation merge, PyO3 integration tests, spec docs, docsite, AgilePlus - Changed: error code standardization, governance standards, reusable workflows - Fixed: baseline test suite, PyO3 import errors - Security: legacy tool enforcement gate Total: 7 Added, 3 Changed, 2 Fixed, 1 Security entries documented with commit hashes. Co-Authored-By: Claude Haiku 4.5 <noreply@anthropic.com> * chore(release): v0.1.0 — federation merge + PyO3 integration + governance standards * docs(readme): add Install section with Python setup instructions * chore(codeql): pin actions to SHA Pin GitHub Actions references for the PinnedDependencies wave. Validation: - CodeRabbit passed/skipped - GitGuardian passed - Socket passed - SonarCloud passed - Semgrep passed Co-authored-by: Codex <noreply@openai.com> * docs(coc): add Contributor Covenant 2.1 (#8) * chore: pin Python 3.12 via .python-version (#9) * chore: refresh GitHub Actions workflow cache * chore: add least-privilege permissions to workflows (#10) * chore(ci): add least-privilege permissions to benchmark.yml * chore(ci): add least-privilege permissions to ci.yml * chore(ci): add least-privilege permissions to coverage.yml * chore(ci): add least-privilege permissions to legacy-tooling-gate.yml * chore(ci): add least-privilege permissions to phenotype-quality-gate.yml * chore(ci): add least-privilege permissions to quality-gate.yml * chore(ci): add least-privilege permissions to sast.yml * chore(ci): add least-privilege permissions to scorecard.yml * chore(ci): add least-privilege permissions to security-deep-scan.yml * chore(ci): add least-privilege permissions to security-guard.yml * chore(ci): add least-privilege permissions to traceability.yml * chore(docs): trigger Pages workflow rebuild * chore: add FUNDING.yml (#11) * fix(ci): repair pages-deploy.yml workflow-file parse error * fix(pages): point pages-deploy at vitepress outDir (.vitepress-dist not docs/.vitepress/dist) * fix(ci): repair legacy tooling gate yaml Restore the malformed action steps so GitHub can parse and run the WARN-mode legacy tooling scan. Co-authored-by: Codex <noreply@openai.com> * fix(ci): run policystack checks locally Replace unreachable reusable workflow references with local docs build, smoke test, and governance validation steps. Co-authored-by: Codex <noreply@openai.com> * fix(ci): avoid editable package discovery Install only pytest for CI smoke tests because the repo flat layout is not packaged for editable installs. Co-authored-by: Codex <noreply@openai.com> * chore(deps): regenerate lockfiles for Dependabot advisories (2 alerts) (#12) * fix(ci): restore workflow yaml syntax (#13) Repair workflow steps whose pinned action comments swallowed step boundaries, restore valid with/env/if blocks, add a minimal permissions-audit job, and fix the stacked-PR audit argument handling flagged by actionlint. Validation: - actionlint -color=false .github/workflows/*.yml - git diff --check - uv run --with pytest --with pyyaml --with jsonschema pytest tests/test_resolve_cli_governance.py tests/test_policy_common.py tests/test_smoke_dispatch_host_hook.py -q (fails: pre-existing setuptools flat-layout package discovery) Co-authored-by: Codex <noreply@openai.com> * chore(deps): regenerate lockfiles for Dependabot advisories (2 alerts) (#14) * ci: add CodeQL Rust analysis (security scanning) (#15) Co-authored-by: Codex <noreply@openai.com> * docs: add canonical worklog ledger (#16) docs: add canonical worklog ledger Add the missing chronological worklog entry point for PolicyStack governance maintenance and record the current workflow syntax baseline. Validation: - actionlint .github/workflows/*.yml - npm run docs:build - pre-push hook completed successfully Co-authored-by: Codex <noreply@openai.com> * chore(deps): pin docs vite toolchain (#17) chore(deps): pin docs vite toolchain Resolve PolicyStack docs Dependabot alerts by overriding Vite and esbuild to patched versions while keeping VitePress at the current release. Validation: - npm audit --omit=optional - npm run docs:build - actionlint .github/workflows/*.yml - pre-push hook completed successfully Co-authored-by: Codex <noreply@openai.com> * chore(pages): add CNAME for policystack.phenotype.space (#18) * chore: add CITATION.cff (#19) Co-authored-by: Koosha Pari <koosha@phenotype.space> * renovate-config (#20) * Add Python Taskfile tasks (#21) Co-authored-by: Codex <noreply@openai.com> * add language-aware taskfile (#22) Co-authored-by: Codex <noreply@openai.com> * taskfile (#23) Add quality and docs build tasks for the existing language-aware Taskfile.\n\nCo-authored-by: Codex <noreply@openai.com> * Tune PolicyStack Taskfile tasks (#24) Co-authored-by: Codex <noreply@openai.com> * Tune PolicyStack Taskfile tasks (#25) Co-authored-by: Codex <noreply@openai.com> * polish PolicyStack taskfile common tasks (#26) Co-authored-by: Codex <noreply@openai.com> * Refine PolicyStack Taskfile common tasks (#27) Centralize the scratch temp directory used by Python build and test tasks so the language-aware Taskfile remains easier to maintain.\n\nValidation:\n- task build\n- task test\n- task lint\n\nCo-authored-by: Codex <noreply@openai.com> * Refine PolicyStack Taskfile build coverage (#28) Derive Python compile targets from tracked files while keeping the existing scripts exclusion boundary for generated/auxiliary scripts. Validation: - task build - task test - task lint - task clean Co-authored-by: Codex <noreply@openai.com> * Expose Taskfile language detection (#29) Add a small language task so the detected primary repo language can be checked directly alongside the common build, test, lint, and clean tasks. Co-authored-by: Codex <noreply@openai.com> * Refine PolicyStack Taskfile lint (#30) Co-authored-by: Codex <noreply@openai.com> * Refine PolicyStack Taskfile Python tasks (#31) Keep Python bytecode caches inside the Taskfile temp directory and put the repository root on PYTHONPATH for build, test, and lint tasks. Co-authored-by: Codex <noreply@openai.com> * Refine Taskfile clean cache coverage Include Python type-checker cache directories in the common clean task so Taskfile cleanup covers the repo's current validation tools. Co-authored-by: Codex <noreply@openai.com> * Add PolicyStack Taskfile common tasks (#33) Detected PolicyStack as Python-first and aligned the Taskfile build/test/lint/clean targets with the repository governance validation surface. Co-authored-by: Codex <noreply@openai.com> * Harden Taskfile common tasks (#34) Co-authored-by: Codex <noreply@openai.com> * Refine Taskfile language detection (#35) Detect Python from uv.lock and detect Node projects from common lockfiles while continuing to prefer primary repo manifests over secondary docs tooling. Co-authored-by: Codex <noreply@openai.com> * Refine Taskfile clean cache coverage (#36) Co-authored-by: Codex <noreply@openai.com> * Refine Taskfile clean artifacts (#37) Co-authored-by: Codex <noreply@openai.com> * Refine Taskfile clean coverage (#38) Include nested docs dependencies in the common clean task so Taskfile cleanup covers the repo's secondary docs package. Co-authored-by: Codex <noreply@openai.com> * Refine Taskfile clean coverage (#39) Include nested docs dependencies in the common clean task so Taskfile cleanup covers the repo's secondary docs package. Co-authored-by: Codex <noreply@openai.com> * docs: add PR template (#40) * ci: add trufflehog secrets scanning (#42) * chore: pin actions to immutable SHA * ci: expand pytest to full test suite + ruff lint gate - Replace single-file smoke test run with full `pytest tests/ -q --tb=short` - Add `ruff check .` and `ruff format --check .` gates - Consolidate pip install into one step for ruff + pytest Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com> * chore: pin all GitHub Actions to commit SHAs Pins all GitHub Actions to immutable commit SHAs. * ci: add trufflehog secrets scanning --------- Co-authored-by: Claude Opus 4.7 <noreply@anthropic.com> * chore: pin all GitHub Actions to commit SHAs (#41) * chore: pin actions to immutable SHA * ci: expand pytest to full test suite + ruff lint gate - Replace single-file smoke test run with full `pytest tests/ -q --tb=short` - Add `ruff check .` and `ruff format --check .` gates - Consolidate pip install into one step for ruff + pytest Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com> * chore: pin all GitHub Actions to commit SHAs Pins all GitHub Actions to immutable commit SHAs. --------- Co-authored-by: Claude Opus 4.7 <noreply@anthropic.com> * chore: pin all GitHub Actions to commit SHAs (#41) (#43) * chore: pin actions to immutable SHA * ci: expand pytest to full test suite + ruff lint gate - Replace single-file smoke test run with full `pytest tests/ -q --tb=short` - Add `ruff check .` and `ruff format --check .` gates - Consolidate pip install into one step for ruff + pytest * chore: pin all GitHub Actions to commit SHAs Pins all GitHub Actions to immutable commit SHAs. --------- Co-authored-by: Claude Opus 4.7 <noreply@anthropic.com> * docs: add journey-traceability + iconography implementation (#44) Co-authored-by: Phenotype Agent <agent@phenotype.ai> * fix(PolicyStack): add missing closing parens on lines 60-61 Both stall_count and breach_count calls were missing one ) to close int(_num(...)) Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com> * ci: SHA-pin GitHub Actions (normalize to canonical SHAs) Pin all action refs to immutable SHAs across workflow files: - checkout@v4 → @11bd71901bbe5b1630ceea73d27597364c9af683 - checkout@v6 → @de0fac2e4500dabe0009e67214ff5f5447ce83dd - setup-node@v4/v5, setup-python@v4/v5, setup-go@v5 - upload-artifact@v4/v7, download-artifact@v4 - cache@v3/v4, github-script@v7 - configure-pages@v5/v6, deploy-pages@v4/v5 - upload-pages-artifact@v3/v5, dependency-review-action@v4 Fixes version-tag normalization (add v4/v5 tags where missing). Fixes double-SHA corruption artifacts from prior patching rounds. Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com> * lint(PolicyStack): autofix F401, COM812, I001, format ruff --fix 705 errors auto-fixed via ruff --fix and ruff format: - F401: removed unused imports (ASK_MODE_REVIEW, delegate/config_loader fns) - COM812: trailing commas added throughout - I001/I002: import blocks sorted/formatted - RUF022: __all__ sorted - T201/T204: print statements replaced with logging Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com> * fix(PolicyStack): apply --unsafe-fixes (1085 auto-fixes applied) Resolves all F401 (unused import), T201 (bare print), I001 (sort), COM812 (trailing comma), RUF022 (__all__ sort) in cli/ and tests/. Remaining 51 errors: pre-existing style/complexity only. Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com> * chore(security): bootstrap deny.toml (#46) * chore: remove policystack README stub prior to subtree merge --------- Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: Codex <noreply@openai.com> Co-authored-by: Koosha Paridehpour <koosha@phenotype.ai> Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com> Co-authored-by: Claude Code <claude@anthropic.com> Co-authored-by: Codex <codex@phenotype.dev> Co-authored-by: Forge <forge@phenotype.dev> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: Koosha Pari <koosha@phenotype.space> Co-authored-by: Phenotype Agent <agent@phenotype.ai>
User description
Expands stub CHANGELOG.md to full Keep-a-Changelog 1.1.0 skeleton with all standard sections (Added/Changed/Deprecated/Removed/Fixed/Security). Companion to #209 CODEOWNERS expansion pattern.
Note
Low Risk
Low risk documentation-only change that does not affect runtime behavior or tooling configuration.
Overview
Updates
CHANGELOG.mdto follow the Keep a Changelog 1.1.0 template, rewriting the intro and expanding the[Unreleased]section to include the standard headings (Added/Changed/Deprecated/Removed/Fixed/Security).Also normalizes existing
Addeditems into consistent bullet formatting and adds the[Unreleased]compare link.Reviewed by Cursor Bugbot for commit 9a8fc51. Bugbot is set up for automated code reviews on this repo. Configure here.
CodeAnt-AI Description
Expand the changelog to the standard Keep a Changelog layout
What Changed
Impact
✅ Clearer release notes✅ Easier tracking of upcoming changes✅ Consistent changelog format🔄 Retrigger CodeAnt AI Review
Details
💡 Usage Guide
Checking Your Pull Request
Every time you make a pull request, our system automatically looks through it. We check for security issues, mistakes in how you're setting up your infrastructure, and common code problems. We do this to make sure your changes are solid and won't cause any trouble later.
Talking to CodeAnt AI
Got a question or need a hand with something in your pull request? You can easily get in touch with CodeAnt AI right here. Just type the following in a comment on your pull request, and replace "Your question here" with whatever you want to ask:
This lets you have a chat with CodeAnt AI about your pull request, making it easier to understand and improve your code.
Example
Preserve Org Learnings with CodeAnt
You can record team preferences so CodeAnt AI applies them in future reviews. Reply directly to the specific CodeAnt AI suggestion (in the same thread) and replace "Your feedback here" with your input:
This helps CodeAnt AI learn and adapt to your team's coding style and standards.
Example
Retrigger review
Ask CodeAnt AI to review the PR again, by typing:
Check Your Repository Health
To analyze the health of your code repository, visit our dashboard at https://app.codeant.ai. This tool helps you identify potential issues and areas for improvement in your codebase, ensuring your repository maintains high standards of code health.