From 0ec5058b11758516b33648a60d94b72a3f16bb3c Mon Sep 17 00:00:00 2001 From: Sarthak Agrawal Date: Sat, 26 Sep 2026 01:00:50 +0530 Subject: [PATCH] docs: record published v1.15.0 release --- PROJECT_STATUS.md | 26 ++++++++++---------- docs/architecture/native-migration-matrix.md | 2 +- 2 files changed, 14 insertions(+), 14 deletions(-) diff --git a/PROJECT_STATUS.md b/PROJECT_STATUS.md index ef39a442..4312bc8c 100644 --- a/PROJECT_STATUS.md +++ b/PROJECT_STATUS.md @@ -38,24 +38,24 @@ separately approved safety design justify renewed investment. ## Current shipped state -- **v1.14.3 is the current published desktop release.** The protected release - workflow published the arm64 DMG, ZIP, and Sparkle appcast on 2026-09-22. - Usage coherence (#296), Review/Explore (#285), and unavailable-performance - classification (#276) are closed. See +- **v1.15.0 is the current published desktop release.** The protected release + workflow published on 2026-09-25 with the + [arm64 DMG, ZIP, and Sparkle appcast](https://github.com/Codevetter/codevetter/releases/tag/v1.15.0). + General agent Usage is retired in favor of ContextDaddy; Usage coherence (#296), + Review/Explore (#285), and unavailable-performance classification (#276) are + closed. See [surface behavior](docs/product/surfaces.md). - Review/Explore supports GitHub URL import, pinned Git source and diffs, in-process Rust navigation, virtual source windows, indexed search, TypeScript semantic definitions/references, and source-linked Unpack and evidence. VoiceOver expansion remains intentionally deferred and is not a release blocker. -- v1.14.3 includes the post-v1.14.2 code-health and native qualification - repairs. Subsequent documentation-only bookkeeping does not imply a newer - desktop release; release truth remains the published `v1.14.3` tag. -- The proposed v1.15.0 release candidate retires the general Usage workspace, +- v1.14.3 included the post-v1.14.2 code-health and native qualification + repairs. The v1.15.0 release retires the general Usage workspace, provider allowance checks, `codevetter usage`/`quota`, and the bundled `ccusage` sidecar. Retired CLI commands return a migration message pointing to ContextDaddy. Per-verification token and cost receipts and CodeVetter's - History recovery remain. This candidate has not been published or installed. + History recovery remain. - Maintenance is limited to core verification reliability, regressions, security, dependency hygiene, and evidence requested by real users. New product surfaces require an explicit change in the investment decision. @@ -63,9 +63,9 @@ separately approved safety design justify renewed investment. ## Dependencies External: -- Published v1.14.3 bundles `ccusage` 20.0.20 for local Claude/Codex/Grok usage - accounting; the unreleased v1.15.0 candidate removes that sidecar. -- Installed and authenticated Codex or Claude CLI for Work conversations; provider account policy remains external to CodeVetter. +- Published v1.15.0 does not bundle `ccusage`; the previous v1.14.3 release + included it for local Claude/Codex/Grok usage accounting. +- Installed and authenticated Codex or Claude CLI for opt-in agent-backed verification; provider account policy remains external to CodeVetter. - GitHub Releases + GitHub Actions — `auto-release.yml` cuts a `v` release on native `Shared.xcconfig` version bumps; `release.yml` signs, notarizes, qualifies, and uploads the SwiftUI app, DMG, ZIP, and Sparkle `appcast.xml`. - Cloudflare Pages — hosts the landing page (`codevetter` project, codevetter.com). - Optional `ast-grep` on PATH for structural evidence matches (no required runtime dependency). @@ -793,7 +793,7 @@ Internal (fleet): explicit and historical debt tracked in GitHub Issues. - Local-first native macOS binary: SwiftUI/AppKit presentation, Rust-owned verification and SQLite, no WebView and no server. -- Published v1.14.3 still has the general Usage workspace. The v1.15.0 candidate presents Explore, Review, Testing, Performance, Runs, and Settings; the retired Usage route is kept only for decoding legacy deep links and is not navigable. Explore contains Unpack, source navigation, graph, and history. Existing local session/work-item records and backend lifecycle code remain available for separately reviewed cleanup. +- Published v1.15.0 presents Explore, Review, Testing, Performance, Runs, and Settings; the retired Usage route is kept only for decoding legacy deep links and is not navigable. Explore contains Unpack, source navigation, graph, and history. Existing local session/work-item records and backend lifecycle code remain available for separately reviewed cleanup. The previous v1.14.3 release still had the general Usage workspace. - Testing and Performance now share a local deterministic scope planner for a human-described function/flow, an exact PR or Git change, or a bounded whole-codebase portfolio. Every plan exposes its revision, dirty state, concrete adapters/targets, uncovered paths, and limitations and requires confirmation before execution; human text is discovery input and is never run as a command. - Risk-tiered CLI review: trivial single-pass → lite product/agent passes → full sensitive path with security, product, agent specialist passes, coordinator, and dedup metadata. diff --git a/docs/architecture/native-migration-matrix.md b/docs/architecture/native-migration-matrix.md index 62e9cc16..18f51398 100644 --- a/docs/architecture/native-migration-matrix.md +++ b/docs/architecture/native-migration-matrix.md @@ -25,7 +25,7 @@ reachable in the current product. | Current surface | Current retained capability | Native destination | Current migration state | Replacement gate | | --- | --- | --- | --- | --- | -| Usage (retired) | General agent history and provider allowance | ContextDaddy, not CodeVetter | The native Usage workspace, general `codevetter usage` and `codevetter quota` commands, and bundled ccusage helper were removed locally. CodeVetter retains per-verification token/cost receipts and local History recovery. | ContextDaddy owns separate local-history, provider-allowance, Devin, and telemetry evidence with explicit unavailable states. | +| Usage (retired) | General agent history and provider allowance | ContextDaddy, not CodeVetter | The native Usage workspace, general `codevetter usage` and `codevetter quota` commands, and bundled ccusage helper were removed in v1.15.0. CodeVetter retains per-verification token/cost receipts and local History recovery. | ContextDaddy owns separate local-history, provider-allowance, Devin, and telemetry evidence with explicit unavailable states. | | Repo Unpack | Repository selection and snapshots; Overview, Handoff, Rules, Analysis, Activity, Inventory, Graph, and Delta; exports and comparisons | **Repo Unpack** workspace with an AppKit source outline and native inspectors | Native and CLI create the same persisted, model-free snapshot through the shared Rust scanner and `codevetter.unpack-scan/v1`, with supervised cancellation in the native client. The client receipt strips the raw file list and exposes separate full-scan and SQLite-persistence profiles. Native inspectors preserve repository and commit identity, history limits, outline bounds, and explicit topology/health non-proof labels. Native and CLI export the same Rust-rendered Markdown, offline HTML, graph JSON, agent-context Markdown, and repository-memory Markdown through `codevetter.unpack-export/v1`. The Graph desk and `codevetter unpack --operation query` consume one `codevetter.repo-query/v2` read-only receipt over the same structural-graph and history services used by MCP; Swift performs no ranking or traversal. Model synthesis remains available through the Rust and agent surfaces without creating a second UI authority. | Same persisted identities and exports; stable graph/history queries; large-repository bounds; no topology-as-runtime-proof regression | | Review | Exact PR/range and task intent; source-qualified findings, coverage gaps, blast radius, memory graph, deterministic manifests, executable evidence links, fix handoff, X-Ray/export, synthetic QA and intent diagnostics | **Review** verification workspace | Exact-change plan/execute/cancel/receipt runs through the Tauri-independent `codevetter.verification-command/v1` Rust application service and supervised CLI worker. One bounded request id now correlates ordered `codevetter.progress/v2` events, process-level cancellation, and the distinct preflight/final canonical receipt; native ignores foreign progress and rejects mismatched terminal receipts. Optional repository-contained Markdown specs are hashed and parsed by the Rust core; native preflight exposes their explicit requirements and requires a fresh exact selection binding before execution. Final receipts render requirement-level review/executable/verified coverage and exact evidence references. Native Review and `codevetter check --agent cross` can request independent sequential Claude and Codex passes over the same immutable target and original context. Rust never sends first-review output to the second reviewer, reconciles only exact source-qualified identities, preserves unique and conflicting findings, and fails closed without a composite claim on missing executors, target drift, incomplete coverage, or interruption. Reviewer manifests, qualified candidates, readiness, duration, and availability limits persist in `codevetter.cross-review/v1`; read-only MCP projects the same receipt without execution authority. Cross-review remains optional until provider-backed caught-bug recall, false-positive, latency, and usage benchmarking passes. The native receipt promotes Rust-qualified findings above raw JSON, preserves severity/confidence/source line/suggestion, opens only repository-contained recorded paths, and exports the unmodified canonical JSON. A separate proof map projects the canonical readiness, deterministic manifest and qualification counts, bounded memory/blast-radius context, revision-qualified structural graph, recorded QA, evidence candidates, and procedure gates while explicitly separating execution proof from navigation leads. The same Rust result now carries `codevetter.review-intent-diagnostic/v1`: native renders the captured goal, deterministic changed-surface classes, source-review and QA signals, gaps, evidence chronology, and a fail-closed closure state that always requires human disposition. Recorded QA artifacts can be explicitly revealed through validated repository-relative or existing absolute paths; a legacy QA pass is never promoted to revision-exact proof. Review now hands the exact repository, range or pull request, and discovery scope to Testing while clearing stale proof and prior execution consent. This enforces the canonical boundary that Testing owns browser execution and Review consumes its evidence instead of recreating two runner authorities. Persisted reviews can build and atomically save the same fail-closed JSON, Markdown, or offline HTML Agent PR X-Ray through native UI and `codevetter xray`; public-source confirmation, current-preview identity, the Rust sanitizer, and optional per-finding suggestion approval remain explicit gates. Selected persisted findings can also become a bounded `codevetter.agent-fix-packet/v1` through native UI and `codevetter fix-packet`, carrying exact task/acceptance context, qualified source locations, recorded evidence to preserve, route advice, limitations, and copyable Markdown without claiming the fix is correct. Native UI, CLI, and local agent invocation now share an explicit-consent `codevetter.fix-attempt/v1`: Rust materializes the recorded head as a detached app-data worktree, supervises one selected agent, bounds the diff, runs `git diff --check`, reruns the recorded correctness target, source-qualifies a `WORKTREE` review, and classifies each selected finding as fixed, reproduced, or unchecked. The worktree remains uncommitted and retained until separately confirmed discard; there is no merge or push action. Typed decoding, exact CLI arguments, focused rendering, and true-black visual evidence are recorded. Native Plan, Execute, and Cancel expose keyboard and accessibility contracts; a Rust `no_confidence` preflight now fails closed, disables execution, names the missing binding, and cannot render an empty finding list as a green pass. A real-agent isolated-fix plus saved-flow post-fix rerun smoke remains pending; saved QA targets, repository spec discovery, and rerun preparation now live in Testing through the shared Rust QA-workspace receipt. | Equivalent Rust receipt semantics, every review state and export, source navigation, keyboard operation, cancellation, and no-confidence behavior | | Testing | Direct preview verification, saved QA workflows and targets, Playwright spec discovery, post-fix rerun setup, changed-capability checks, scenarios, portfolio planning, PR watchers, confirmation, execution progress, failures, receipts, and limitations | **Testing** verification workspace | Direct PR/range preview verification runs through `codevetter trex` with explicit network confirmation, supervised cancellation, schema and verdict/exit validation, preview identity, derived routes, an optional selected saved route and goal, journey/artifact/console evidence, raw JSON, limitations, and a Runs handoff. `codevetter.qa-workspace/v1` is shared by native Testing and `codevetter qa`; the scoped `qa_workspace_inspect` MCP tool exposes the same read-only setup. Rust projects safe legacy fields into a separate native preference, never projects credential-bearing storage-state paths, refuses arbitrary external-command execution, discovers bounded repository Playwright specs without executing them, and prepares the same-flow post-fix rerun without restoring network consent or starting the browser. The shared Rust `evidence-scope` planner is projected through `codevetter scope --consumer testing` and native Testing for deterministic flow, exact-change, and bounded codebase target portfolios. Warm changed proof runs through `codevetter warm`; differential verification runs through `codevetter differential` with a separate preparation gate and the rule that comparison evidence never creates pass evidence. Scenario authoring runs through `codevetter scenario` and the native Scenario Foundry over the incumbent Rust bridge: free/local generation creates expiring candidates, validation and dry-run remain non-persistent, acceptance rechecks the candidate hash, selected destinations, and replacement approval, and rejection writes no project files. Incoming PR watcher configuration, bounded run history, foreground polling, and exact-head recovery now share `codevetter watcher`: native scheduling lasts only for the open app session; consent is not persisted; each automatic poll looks across open PRs, executes only a newly arrived PR or an existing PR with a new head SHA, may contact GitHub, execute isolated project code and the configured agent, post commit statuses, and stays supervised until receipts persist. The Rust boundary validates and fetches the exact immutable `refs/pull//head` object without changing the user's branch, index, worktree, `FETCH_HEAD`, or durable refs; Node projects install with their declared pnpm/npm/Yarn/Bun lockfile contract; and status authentication can reuse existing `gh` authority in memory without persisting or logging the token. Automatic polls skip unchanged PR heads, while a separately confirmed CLI/native Retry action reruns one exact currently open PR and persists a replacement attempt. MCP discovery never starts these runtimes. Exact Rust/CLI/native arguments and schemas, a local bare-remote materialization test, safe non-network configuration smokes, real-repository warm/differential failure-boundary smokes, XCUITest reachability for every Testing workspace, Swift watcher rendering and supervised consent/execution contracts, dark warm/differential/scenario/watcher visual evidence, and bounded direct-preview render gates are recorded. The [shared surface-parity receipt](https://github.com/Codevetter/codevetter/blob/main/evidence/verification/native-surface-parity-2026-09-01.md) proves that one repository-owned fixture preserves the same Rust, CLI, native, and read-only MCP evidence-scope semantics. The [live watcher qualification](https://github.com/Codevetter/codevetter/blob/main/evidence/verification/native-watcher-live-qualification-2026-09-01.md) proves one explicitly approved PR head through exact fetch, pnpm install, repository lint, conservative verdict, persistence, GitHub status posting, and a second same-head explicit recovery attempt. Final owner acceptance remains pending | Same `evidence-scope/v1` resolution and canonical receipts, bounded coverage, confirmation gate, cancellation, watcher lifecycle, and browser evidence |