Skip to content

Release 2.1.271 (2026-10-26)

Chores

  • uv lock --upgrade

Features

  • ignore paad/security/ in the managed base fence (#3692) paad 2.0 writes security reports under paad/security/, which must never be committed. Add the pattern to the managed base so every language's fence ignores it, extend the frozen lossless-split pattern set, and resync this repo's own fence. The managed claude_settings.json is unchanged. Ref #3666

  • add the vrg-security-record CLI (#3693) Adds create (with attach and resume modes and the duplicate guard), list, show and retarget over lib/security_records. Advisory text reaches stdout only through show and list --details, which is refused under VRG_EPIC_SWEEP. A failure after the advisory exists prints the exact resume command and exits 1. Plan Task 3 of epic vergil-project/.github#517. Ref #3678

  • add the security-records pass to the scheduled sweep (#3694) vrg-epic-audit --close now runs a security-records pass after the orphan pass, even when the orphan pass failed, and returns the worse exit code. Each paired draft advisory follows its tracked issues (closed when all are closed, draft while any is open); broken pairs are reported by ID only and fail the run. The report-only path previews the same pass without writes. Adds sync_states and pending_syncs to lib/security_records.py. Ref #3679

  • keep the security-record link on transfer, recreate and split (#3696) A security item's advisory is retargeted to the new issue(s) before the original closes on split and recreate; a failure stops the route with the original open. A transfer retargets after the move and reports a moved-but-not-retargeted state with the exact recovery command. retarget gains a renamed= option so a transferred issue's old number is rewritten away without being unmarked. Ref #3680

  • hold a planning issue while an advisory still tracks it (#3697) vrg-queue planning no longer reports a planning issue as ready-to-close while the security advisory its body names still tracks it; it stays in-progress with a note to retarget the advisory to the fix tasks. Advisories are listed once per call, and the advisory home is resolved only when some planning item carries an advisory line, so orgs without security items are unaffected. Ref #3681.

CI Evidence: All gates passed — full audit bundle available. Download →