Skip to content

Release 2.1.39 (2026-10-23)

Bug fixes

  • emit required docs / docs check via reusable ci-docs.yml (#679) The develop ruleset requires the docs / docs status check (publish.docs defaults to true), but ci.yml ran a bespoke inline mkdocs-build job named 'quality / mkdocs-build' and never emitted docs / docs. That required-but-never-emitted context left every PR MERGEABLE but BLOCKED. Replace the inline job with the fleet-standard reusable ci-docs.yml@v2.1 (as every peer repo uses), so the plugin emits docs / docs and PRs can merge.

Chores

  • reconcile .gitignore to baseline + add ops.yml (#684) (#685) Rollout for epic #311: superset of the centralized .gitignore baseline + self-policing scheduled ops.yml (staggered per-repo cron).

  • sync .gitignore to the canonical baseline (#687) Append the baseline lines this repo was missing so .gitignore is a verbatim superset of vergil_tooling.data/gitignore.baseline again. Existing local entries are preserved. Part of epic vergil-project/.github#322.

  • sync the vergil-managed .gitignore block (#689) Convert this repo's .gitignore to the composed vergil-managed block (base + primary language) — epic vergil-project/.github#325. Foreign-language ignore rules are removed; genuine repo-local entries are preserved outside the fence. Produced by the fleet migration sweep (task #2927).

  • turn off Claude Code co-author attribution (#698) Add "attribution": { "commit": "", "pr": "" } to .claude/settings.json so Claude Code no longer asks agents for a Co-Authored-By trailer, per the decision in vergil-project/vergil-tooling#3200. Fix stale docs: docs/repository-standards.md and docs/site/docs/hooks/index.md no longer claim vrg-commit resolves a co-author trailer, and the hooks page drops the removed --agent flag.

  • add the report-only dependabot.yml (#702)

Documentation

  • complete the site skills catalogue (#676) The published skills catalogue listed only 7 of the plugin's 15 skills. Add at-a-glance rows and full What/When/Status sections for the 8 missing skills — issue-deploy, issue-validate, triage-capture, triage-review, migrate-repo, memory-init, memory-audit, handoff — matching the existing entry format so the page reflects the full suite.

  • identify the retrospective task by label, not title (#680) The retrospective preflight matched the retrospective bookend by its title convention (Retrospective: ). Now that vrg-issue-create --kind retrospective stamps a retrospective label (tooling 2.1.167), prefer that label for identification — mechanical matching is more robust than string-matching a title — keeping the title convention as a fallback for epics created before the label existed.

  • clarify PR batching is per-repository (#681) epic-implement step 4 read as a single consolidated cross-repo batch, but vrg-submit-pr takes a branch list within one repo. Clarify that the unit of submission is a repo's ready set: submit a repo's ready branches as soon as all its currently-ready tasks reach report-ready, independently of slower repos. Safe because concurrently-runnable tasks are non-interdependent by construction, so interdependent tasks are never in the same batch.

  • capture subagent sandbox-bypass finding as a report (#682) Move the 2026-05-02 subagent sandbox-bypass finding out of the issue tracker and into a dated security report under docs/security/. Preserve the evidence tables and observations verbatim, record current status (historical measurement, mechanism not re-run in this capture), and cross-reference the live guard-integrity issue vergil-tooling#1340.

  • capture OpenSSF Scorecard as dated snapshot docs (#683) Move the OpenSSF Scorecard out of the issue tracker and into an append-only snapshot log under docs/security/. Preserve the 2026-05-19 baseline (4.6/10) as the first entry and add a fresh 2026-08-12 run (5.0/10, commit f304ca9d, Scorecard v5.5.0) captured with vrg-scorecard, with a trend table, re-run instructions, and a per-run changelog. Remediation stays tracked in epic vergil-project/.github#54 / vergil-tooling#828.

  • drop stale v2.1 Transition note (#693) The v2.1 human-gated PR workflow (vrg-submit-pr / vrg-finalize-pr with the pre-merge provenance check) has shipped (vergil-tooling 2.1.218, plugin 2.1.39) and is the current daily dev flow. The note claiming the 2.1 skills were authored but not yet wired into daily dev, and directing readers to submit the 2.0 way, is obsolete; the Ship a change steps above it already describe the live workflow. Ref vergil-project/vergil-claude-plugin#692.

  • repoint links off the deleted git-hooks-and-validation page (#700)

  • docs(hooks): repoint links off the deleted git-hooks-and-validation page

vergil-tooling#3375 deletes docs/git-hooks-and-validation.md. Point the hooks page at its replacements on the vergil-tooling docs site (Validation Matrix guide and Hook Guard reference) and drop the references to the pre-commit git hook, which no longer exists. Ref #699

  • docs(hooks): describe what vrg-commit actually checks

The per-edit validation section claimed vrg-commit runs the pre-commit git hook, which no longer exists. Describe the branch and worktree checks vrg-commit performs instead, and note that validation runs in vrg-validate and PR CI, not at commit time. Ref #699

Features

  • replace triage skills with intake-capture and intake-review; track epic-create through planning issues (#704) Task 8 of epic vergil-project/.github#176. Ref vergil-project/vergil-claude-plugin#703 and vergil-project/vergil-tooling#2482.

Refactoring

  • drop the hardcoded matrix inputs from ci.yml (#691)

CI Evidence: All gates passed — full audit bundle available. Download →