diff --git a/.changeset/calm-risk-receipts.md b/.changeset/calm-risk-receipts.md deleted file mode 100644 index 8a44f548..00000000 --- a/.changeset/calm-risk-receipts.md +++ /dev/null @@ -1,7 +0,0 @@ ---- -"@windyroad/risk-scorer": patch ---- - -Prevent Codex pipeline scorers from recursively delegating, require explicit -checkout-bound pipeline commands, preserve valid scores across hidden-workdir -mismatches, and reap expired pending receipts. diff --git a/.changeset/close-inbound-issues-on-our-own-tracker.md b/.changeset/close-inbound-issues-on-our-own-tracker.md deleted file mode 100644 index f840e5ed..00000000 --- a/.changeset/close-inbound-issues-on-our-own-tracker.md +++ /dev/null @@ -1,11 +0,0 @@ ---- -"@windyroad/itil": patch ---- - -Close provenance-proven issues on your own tracker - -When a problem ticket closed on evidence the agent had gathered itself, we stopped short of closing the originating GitHub issue — on both the issue we filed on someone else's repository and the report someone filed on ours. The reasoning was that the close belonged to the reporter. - -That was right for one of those and wrong for the other. A report filed on your own repository is your tracker. It should say what you believe, and the reporter can reopen after reading the lifecycle comment. Before any issue operation, the inbound path now requires one exact issue-channel match in the committed discovery cache. Missing, ambiguous, discussion, advisory, repository-mismatched, or wrong-ticket provenance fails closed without reading or mutating an issue. - -The proven inbound issue now closes whether the local close came from confirmation or cited evidence. An issue filed elsewhere stays open on local evidence alone because its maintainers hold their own triage; their confirmation can authorize closure. Pull requests remain comment-only. diff --git a/.changeset/evidence-backed-closure-agent-authorised.md b/.changeset/evidence-backed-closure-agent-authorised.md deleted file mode 100644 index 0ee23d09..00000000 --- a/.changeset/evidence-backed-closure-agent-authorised.md +++ /dev/null @@ -1,16 +0,0 @@ ---- -"@windyroad/itil": minor -"@windyroad/retrospective": patch ---- - -Close verification-pending problems on evidence, instead of waiting for the maintainer - -A problem ticket whose fix has shipped sits in Verification Pending until someone confirms the fix works. Until now "someone" meant you, personally, on every ticket — four skills reserved that transition for the maintainer's return. So an agent could run your test suite, watch the fix pass, and still decline to close the ticket. The queue had no exit path that did not route through you, and it only ever grew. - -Evidence-backed closure is now the agent's call. When it can point at something it actually observed that meets a ticket's own close criterion — a test run and its outcome, a commit whose diff covers the fix, a skill or hook invocation that behaved as the fix contracts — it closes the ticket and records what it saw. The unattended `/wr-itil:work-problems` run drains the verification queue the same way, in a pass of its own, so verification still never competes with development work for a priority slot. - -The half worth keeping is kept. Absence of evidence is not evidence: a fix nobody exercised stays open however old it is, and neither "the code is on disk" nor "a release shipped it" is an observation. Contested evidence and partial fixes still come to you. So does anything carrying a do-not-close marker — that is now a mechanical check (`wr-itil-is-close-blocked`) rather than a line of prose the next agent has to notice, and it outranks any evidence. - -If the ticket came from an issue you filed on someone else's repository, closing it locally on your evidence no longer closes that issue. The upstream comment posts and the issue stays open unless its maintainer confirms closure. - -Every close reports how to undo it, and `/wr-itil:transition-problem` now accepts the two backward moves that make it true: ` known-error` reopens a closed ticket, and the same command flips a verifying ticket back when a fix proves incomplete. diff --git a/packages/itil/.claude-plugin/plugin.json b/packages/itil/.claude-plugin/plugin.json index bbca895d..ca2a2342 100644 --- a/packages/itil/.claude-plugin/plugin.json +++ b/packages/itil/.claude-plugin/plugin.json @@ -497,5 +497,5 @@ } }, "name": "wr-itil", - "version": "2.0.0" + "version": "2.1.0" } diff --git a/packages/itil/.codex-plugin/plugin.json b/packages/itil/.codex-plugin/plugin.json index 7d2bef90..19ce161f 100644 --- a/packages/itil/.codex-plugin/plugin.json +++ b/packages/itil/.codex-plugin/plugin.json @@ -1,6 +1,6 @@ { "name": "wr-itil", - "version": "2.0.0", + "version": "2.1.0", "description": "ITIL problem-management workflows for AI coding agents", "author": { "name": "Windy Road Technology", diff --git a/packages/itil/CHANGELOG.md b/packages/itil/CHANGELOG.md index 059f03b9..85059a9a 100644 --- a/packages/itil/CHANGELOG.md +++ b/packages/itil/CHANGELOG.md @@ -1,5 +1,31 @@ # @windyroad/problem +## 2.1.0 + +### Minor Changes + +- 471e320: Close verification-pending problems on evidence, instead of waiting for the maintainer + + A problem ticket whose fix has shipped sits in Verification Pending until someone confirms the fix works. Until now "someone" meant you, personally, on every ticket — four skills reserved that transition for the maintainer's return. So an agent could run your test suite, watch the fix pass, and still decline to close the ticket. The queue had no exit path that did not route through you, and it only ever grew. + + Evidence-backed closure is now the agent's call. When it can point at something it actually observed that meets a ticket's own close criterion — a test run and its outcome, a commit whose diff covers the fix, a skill or hook invocation that behaved as the fix contracts — it closes the ticket and records what it saw. The unattended `/wr-itil:work-problems` run drains the verification queue the same way, in a pass of its own, so verification still never competes with development work for a priority slot. + + The half worth keeping is kept. Absence of evidence is not evidence: a fix nobody exercised stays open however old it is, and neither "the code is on disk" nor "a release shipped it" is an observation. Contested evidence and partial fixes still come to you. So does anything carrying a do-not-close marker — that is now a mechanical check (`wr-itil-is-close-blocked`) rather than a line of prose the next agent has to notice, and it outranks any evidence. + + If the ticket came from an issue you filed on someone else's repository, closing it locally on your evidence no longer closes that issue. The upstream comment posts and the issue stays open unless its maintainer confirms closure. + + Every close reports how to undo it, and `/wr-itil:transition-problem` now accepts the two backward moves that make it true: ` known-error` reopens a closed ticket, and the same command flips a verifying ticket back when a fix proves incomplete. + +### Patch Changes + +- fe8f645: Close provenance-proven issues on your own tracker + + When a problem ticket closed on evidence the agent had gathered itself, we stopped short of closing the originating GitHub issue — on both the issue we filed on someone else's repository and the report someone filed on ours. The reasoning was that the close belonged to the reporter. + + That was right for one of those and wrong for the other. A report filed on your own repository is your tracker. It should say what you believe, and the reporter can reopen after reading the lifecycle comment. Before any issue operation, the inbound path now requires one exact issue-channel match in the committed discovery cache. Missing, ambiguous, discussion, advisory, repository-mismatched, or wrong-ticket provenance fails closed without reading or mutating an issue. + + The proven inbound issue now closes whether the local close came from confirmation or cited evidence. An issue filed elsewhere stays open on local evidence alone because its maintainers hold their own triage; their confirmation can authorize closure. Pull requests remain comment-only. + ## 2.0.0 ### Major Changes diff --git a/packages/itil/package.json b/packages/itil/package.json index 46ed727a..ce7fb829 100644 --- a/packages/itil/package.json +++ b/packages/itil/package.json @@ -1,6 +1,6 @@ { "name": "@windyroad/itil", - "version": "2.0.0", + "version": "2.1.0", "description": "ITIL-aligned IT service management for Claude Code and Codex", "bin": { "windyroad-itil": "./bin/install.mjs" diff --git a/packages/retrospective/.claude-plugin/plugin.json b/packages/retrospective/.claude-plugin/plugin.json index 62e9f77c..cc2c782e 100644 --- a/packages/retrospective/.claude-plugin/plugin.json +++ b/packages/retrospective/.claude-plugin/plugin.json @@ -78,5 +78,5 @@ } }, "name": "wr-retrospective", - "version": "0.27.4" + "version": "0.27.5" } diff --git a/packages/retrospective/CHANGELOG.md b/packages/retrospective/CHANGELOG.md index 7bdd9a24..1a648fe6 100644 --- a/packages/retrospective/CHANGELOG.md +++ b/packages/retrospective/CHANGELOG.md @@ -1,5 +1,21 @@ # @windyroad/retrospective +## 0.27.5 + +### Patch Changes + +- 471e320: Close verification-pending problems on evidence, instead of waiting for the maintainer + + A problem ticket whose fix has shipped sits in Verification Pending until someone confirms the fix works. Until now "someone" meant you, personally, on every ticket — four skills reserved that transition for the maintainer's return. So an agent could run your test suite, watch the fix pass, and still decline to close the ticket. The queue had no exit path that did not route through you, and it only ever grew. + + Evidence-backed closure is now the agent's call. When it can point at something it actually observed that meets a ticket's own close criterion — a test run and its outcome, a commit whose diff covers the fix, a skill or hook invocation that behaved as the fix contracts — it closes the ticket and records what it saw. The unattended `/wr-itil:work-problems` run drains the verification queue the same way, in a pass of its own, so verification still never competes with development work for a priority slot. + + The half worth keeping is kept. Absence of evidence is not evidence: a fix nobody exercised stays open however old it is, and neither "the code is on disk" nor "a release shipped it" is an observation. Contested evidence and partial fixes still come to you. So does anything carrying a do-not-close marker — that is now a mechanical check (`wr-itil-is-close-blocked`) rather than a line of prose the next agent has to notice, and it outranks any evidence. + + If the ticket came from an issue you filed on someone else's repository, closing it locally on your evidence no longer closes that issue. The upstream comment posts and the issue stays open unless its maintainer confirms closure. + + Every close reports how to undo it, and `/wr-itil:transition-problem` now accepts the two backward moves that make it true: ` known-error` reopens a closed ticket, and the same command flips a verifying ticket back when a fix proves incomplete. + ## 0.27.4 ### Patch Changes diff --git a/packages/retrospective/package.json b/packages/retrospective/package.json index 87277339..f1fa1403 100644 --- a/packages/retrospective/package.json +++ b/packages/retrospective/package.json @@ -1,6 +1,6 @@ { "name": "@windyroad/retrospective", - "version": "0.27.4", + "version": "0.27.5", "description": "Session retrospectives that update briefings and create problem tickets", "bin": { "windyroad-retrospective": "./bin/install.mjs" diff --git a/packages/risk-scorer/.claude-plugin/plugin.json b/packages/risk-scorer/.claude-plugin/plugin.json index fb726b1f..c0639a44 100644 --- a/packages/risk-scorer/.claude-plugin/plugin.json +++ b/packages/risk-scorer/.claude-plugin/plugin.json @@ -310,5 +310,5 @@ } }, "name": "wr-risk-scorer", - "version": "0.18.16" + "version": "0.18.17" } diff --git a/packages/risk-scorer/.codex-plugin/plugin.json b/packages/risk-scorer/.codex-plugin/plugin.json index 310c212c..5b62c3f2 100644 --- a/packages/risk-scorer/.codex-plugin/plugin.json +++ b/packages/risk-scorer/.codex-plugin/plugin.json @@ -1,6 +1,6 @@ { "name": "wr-risk-scorer", - "version": "0.18.16", + "version": "0.18.17", "description": "Pipeline risk scoring, commit/push gates, and secret leak detection", "author": { "name": "Windy Road Technology", diff --git a/packages/risk-scorer/CHANGELOG.md b/packages/risk-scorer/CHANGELOG.md index d8c17325..71bd81b8 100644 --- a/packages/risk-scorer/CHANGELOG.md +++ b/packages/risk-scorer/CHANGELOG.md @@ -1,5 +1,13 @@ # @windyroad/risk-scorer +## 0.18.17 + +### Patch Changes + +- e67183a: Prevent Codex pipeline scorers from recursively delegating, require explicit + checkout-bound pipeline commands, preserve valid scores across hidden-workdir + mismatches, and reap expired pending receipts. + ## 0.18.16 ### Patch Changes diff --git a/packages/risk-scorer/package.json b/packages/risk-scorer/package.json index 102f4e6d..dea4ccbc 100644 --- a/packages/risk-scorer/package.json +++ b/packages/risk-scorer/package.json @@ -1,6 +1,6 @@ { "name": "@windyroad/risk-scorer", - "version": "0.18.16", + "version": "0.18.17", "description": "Pipeline risk scoring, commit/push gates, and secret leak detection", "scripts": { "prepack": "node scripts/sync-codex-skills.mjs --pack",