Release 2.1.263 (2026-10-23)¶

Bug fixes¶

audit every uv.lock group, not just the synced dev environment (#3508) The Python audit now exports the whole frozen lock (all groups and extras, minus the project and local path packages) to .vergil/pip-audit-requirements.txt and runs pip-audit against it with --disable-pip --require-hashes, so a vulnerable docs-only pin fails the gate. pip-audit.json stays the evidence report; install, sync check and license check stay on dev. Refs #3498

rename vrg-triage-create to vrg-intake-create and link captures under the intake epic (#3503)
attach orphans to intake, retire intake kind labels, and check queue visibility in the sweep (#3504)
refuse PRs against intake and planning queue items (#3505)
add vrg-intake-route for deterministic intake routing (#3506)
add vrg-queue to view the intake and planning queues (#3507) Read-only views of the intake queue (oldest first) and the planning queue (waiting / in-progress / ready-to-close from the in-progress label and the Epic:, Docs task:, Tasks filed: markers). Ref #3471

CI Evidence: All gates passed — full audit bundle available. Download →