Skip to content

Release 2.1.275 (2026-10-27)

Bug fixes

  • keep the marketplace ref when registering marketplaces (#3754) _marketplace_sources dropped an extraKnownMarketplaces entry's ref, so Claude Code 2.1.306 refused the add as not matching the declared source and vrg-vm update failed. A github source with a ref now yields @, a git URL source with a ref yields #, and sources without a ref are unchanged.

Chores

  • uv lock --upgrade

Documentation

  • add the Claude config ownership model page (#3750) New guide docs/site/docs/guides/claude-config-ownership.md: the placement rule and ownership table, the 11 platform facts with citations (verified 2026-10-27), unused scopes, the local-settings rule and its known limit, and the recurring review. Linked from the nav and from permission-model, config-audit and consuming-repo-setup. Corrects the Claude Code 2.1.195 comments in vm_guest.py and test_vm_guest.py to match the changelog (comments only). Task 1 of epic vergil-project/.github#558.

  • replace the Local Settings section with the local-settings rule (#3759) State that a loadable .claude/settings.local.json must be absent or exactly {}, name the chokepoints that enforce it (agents refused, humans warned), and link the ownership model. Drop the example allow list and the stale grep 'local allow' row. Ref #3755.

Features

  • guard the agent chokepoints against non-empty .claude/settings.local.json (#3752) Add lib/local_settings with local_settings_paths, find_violations, in_scope and enforce, plus identity_mode.any_agent_signal. vrg-commit, report-ready and vrg-container-run (host-side, before any container starts) now refuse an agent identity, and warn a human, while any copy Claude Code may load (the invoking directory and its ancestors up to the worktree root, and the main checkout root) is not absent or exactly {}. The guard acts only in the three in-scope orgs; a git rev-parse failure inside one is an error, never a pass. Task 2b of epic vergil-project/.github#558.

  • show the released version in the vrg-release summary (#3756) The completion line now reads 'vrg-release v complete' and both consumer-refresh headers name the tag. The version comes from ReleaseContext.version, which preflight sets. run_pipeline takes an optional success_label callable, resolved after the stages, so a stage can supply it. A run with no context, and every with-errors line, keep the old wording. Refs #3753.

  • new CLAUDE.md and settings templates with a bridged audit (#3757) Replace the managed CLAUDE.md template region (60 lines) and the .claude/settings.json template (no extraKnownMarketplaces) with their new shapes. The config audit now requires the settings file to equal the template after JSON parsing, and accepts the previous template of either file with a deprecation warning until the bridge-removal PR (#3728). render_claude_settings no longer seeds a marketplace ref and render_claude_md no longer writes a Validation section outside the markers. This repo's CLAUDE.md region, trimmed body and settings file move to the new shape in the same change because its nightly audit runs from source. Ref #3724

CI Evidence: All gates passed — full audit bundle available. Download →