Skip to content

Release 2.1.34 (2026-07-14)

Bug fixes

  • grant actions:read so CD starts with cd-release@v2.1 (#645) cd-release.yml@v2.1 now requires actions:read so its CI-evidence harvest can download the release PR's artifacts. A reusable workflow cannot request more permission than its caller grants, so cd.yml calling cd-release.yml@v2.1 without actions:read fails CD at load with startup_failure even on develop where the release job is skipped (the graph is validated at startup). Add actions:read to the top-level permissions block. Ref #643

Documentation

  • reflect epic-implement skill and Trusted Execution doctrine in site docs (#639)
  • docs-review bookend spans repos, spawns per-repo tasks (#642) Reframe the documentation-review bookend as a multi-repo sweep rather than a 1:1 docs-task-to-single-PR mapping. An epic's documentation usually spans several repos (per-repo docs, the higher-level docs repo, occasionally .github), so the review must spawn additional per-repo doc tasks — each linked under the epic and closed by a same-repo PR — rather than forcing one cross-repo close.

Updates the bookend description, workflow step 2, and the placement-law note in epic-create; makes the matching consistency fix to the terminal handoff wording in epic-implement.

  • encode the post-report-ready freeze contract in workflow skills (#646) Document the enforced freeze shipped in vergil-tooling#2346: from report-ready until submit a branch is frozen (vrg-commit and the vrg-git push path refuse new commits/branch-advancing pushes), and the only sanctioned reopen is a deliberate vrg-pr-workflow unfreeze.

  • issue-implement, issue-localize: state the frozen/hands-off contract; correcting PR prose via re-running report-ready stays allowed (metadata, not code) but does not license new commits.

  • issue-implement, issue-localize: scope base-branch rebase/force-push to the pre-report-ready window; a conflict surfacing after report-ready is resolved post-submit in pr-watch.
  • pr-watch: explain that submit lifts the freeze, which is why its reconcile commits and post-submit rebase/force-push are legitimate.
  • epic-implement: on re-entry, treat a reported-ready task as finished; do not reopen its branch.

CI Evidence: All gates passed — full audit bundle available. Download →