Skip to content

Release 2.1.277 (2026-10-28)

Bug fixes

  • refuse a frozen (reported-ready) branch (#3784) vrg-reword now runs the shared post-report-ready freeze check (lib.pr_workflow.freeze.check_worktree) before any guard, rebase or push, with the same refusal wording and read-error warning as vrg-commit. Previously it could rewrite a reported commit and force-push it past the vrg-git push gate, so origin no longer matched the recorded head_sha.

  • fail closed on malformed hook input (#3785) Inside a managed repo, vrg-hook-guard now refuses a call it cannot check (unreadable or empty stdin, invalid or non-object JSON, missing tool_input.command string) with exit code 2 and a stderr message naming the problem, instead of allowing it. Well-formed input and the no-vergil.toml pass-through are unchanged; malformed input is scoped by the process cwd. The guard.sh shim's jq fallback (template and this repo's copy) agrees, and also fails closed when jq is missing. Ref #3773.

  • count-aware plurals in the security-records summary line (#3789) The security-records summary now makes each noun agree with its count (1 advisory state synced, 2 advisory states synced, 1 broken pair, 0 broken pairs), using the same small conditional as the planning hold note (#3736). Tests and the security-record reference page are updated, and a test covers the two-broken-pairs case.

Documentation

  • reflect several advisories per issue in the closing docs review (#3778) Closing docs review for epic vergil-project/.github#573. The GitHub Issues standard now describes the move and planning-hold rules for an issue that names several advisories (every advisory retargeted on transfer and recreate, a split of several refused, each advisory handed to the task or tasks that fix it, the security label removed only with the last advisory). The CLAUDE.md vrg-intake-route entry says the same. The agent VM guide notes that vrg-vm keeps a declared marketplace ref when it registers marketplaces (#3751). Refs #3725.

  • steering and settings sweep (epic 558) (#3781)

  • docs(claude-md): trim CLAUDE.md to the steering essentials and move reference detail to site docs

Steering sweep for epic 558 task 5a: CLAUDE.md drops from 456 to 143 lines, the CLI catalogue, package architecture, CI, container and deployment-target detail moves to the docs site, and AGENTS.md is removed with its one live rule kept in Key Constraints.

  • docs(claude-md): limit vrg-reword to before report-ready

  • document every console script on the CLI Tools Overview (#3788) Add the 35 missing vrg-* entries, each written from the command's source and --help. Give vrg-triage-create its own deprecated-alias entry and retitle the validate_common section, which is an internal module rather than a command on PATH. Add a test that cross-checks [project.scripts] against the page's command headings in both directions and names any offenders.

Features

  • allow the read-only symbolic-ref form (#3777) Allow symbolic-ref with exactly one ref and only -q/--quiet/--short; refuse setting a ref, -d/--delete, -m and every other flag. agentic-review resolves the default branch with 'git symbolic-ref refs/remotes/origin/HEAD'. The other git commands agentic-review 2.0.2 names (diff, rev-parse, log, ls-files) were already allowed. Updates the --help text and the permission-model guide. Refs #3722.

  • ignore paad/code-reviews/ in the managed base (#3780) Add paad/code-reviews/ to the managed .gitignore base after paad/security/, so the agentic-review gate's report files never show in a worktree. Pin it with base and every-language compose tests, add it to the legacy pattern set, and resync this repo's own fence. Task 2 of epic vergil-project/.github#568; refs #3740.

  • add the [trusted_authors] configuration and vrg-trusted-authors (#3782)

  • feat(trusted-authors): add the [trusted_authors] configuration and vrg-trusted-authors

The logins whose issues and comments automation may trust are configuration, never hard-coded. An optional [trusted_authors] stanza (human, agents) in identities.toml is parsed and validated, vrg-vm delivers it into every VM as ~/.config/vergil/trusted-authors.toml on create, start, restart, rebuild, the cloud credentials stage and update (and removes the file when the host has none), and vrg-trusted-authors reads it, failing loudly when nothing is configured. Documented in the account-setup guide and the CLI overview.

Refs vergil-project/vergil-tooling#3741 (Task 4 of epic vergil-project/.github#568).

  • fix(trusted-authors): name the table literally in the identities.toml type error

Resolves a CodeQL finding on this PR. Ref #3741

  • push a rebased branch with a lease on the recorded head after unfreeze (#3790) After a deliberate unfreeze, report-ready now pushes with --force-with-lease=refs/heads/:, so the unfreeze, rebase, re-report recovery needs no manual force-push. An origin branch that moved anywhere else is refused with nothing recorded. A first report, a frozen re-run (drift is still refused) and a branch not yet on origin keep the plain push. Ref #3783

Testing

  • make the self-fence drift guard say how to resync from source (#3787) The existing flagship drift guard already fails vrg-validate when this repo's .gitignore fence is stale after a fragment edit, but its bare assertion gave no hint that the installed vrg-gitignore-sync cannot fix it. Assert the gitignore module loads from this worktree's src/, add a failure message with the PYTHONPATH=src resync command, and document it in config-audit.md. Refs #3774.

CI Evidence: All gates passed — full audit bundle available. Download →