Skip to content

Release 2.1.280 (2026-10-30)

Bug fixes

  • report version-window resolution errors as one line, not a traceback (#3856)
  • fix(cli): report version-window resolution errors as one line, not a traceback

vrg-github-repo-config (audit, diff, apply) now reports a VersionsError from resolving [ci].versions against the published window as a single ERROR line and exits 2, the could-not-complete code, like the existing vergil.toml resolution failure. vrg-ci-evidence reports it as one ERROR line with exit 1, and vrg-github-repo-init step 9 stops with a one-line error before applying anything, matching step 3. Refs #3670.

  • test(cli): pin the one-line version-window error output

Assert on the ERROR line beside the skipped-local-checks warning, check harvest writes no state, and keep imports sorted. Refs #3670.

  • look up Actions runs in the repo their check link names (#3858)
  • fix(github): look up Actions runs in the repo their check link names

gh run view resolved the cwd's repo, so vrg-pr-await (and the wait_for_checks stale-check probe) 404'd when the PR lived in another repo. run_completed now takes the owner/repo parsed from the check's job link and passes --repo. Ref #3829

  • fix(github): accept only github.com Actions job links when reading a run's repo

A link on any other host now fails loud instead of being looked up on github.com, matching the github.com-anchored job-link parser. Ref #3829

Chores

  • uv lock --upgrade

Documentation

  • name the CLAUDE.md template region in the adoption section (#3859) The packaged CLAUDE.md template no longer has a Parallel-AI-agent-development section; its worktree rules live in the Worktrees section. Ref #3837.

  • allow ignored scratch in the main clone's build/ (#3861) The main worktree stays read-only for source. Ignored scratch in the main clone's build/ is allowed, and build/.vergil-state/ is the namespace for agent state that must survive a session or a VM rebuild. The convention states the exception beside the read-only rule; the consumer CLAUDE.md template's read-only line carries it within the 60-line budget, and this repo's CLAUDE.md region is synced. A test pins the clause in the template. Ref #3860.

Features

  • remove the vrg-triage-create deprecated alias (#3857) vrg-triage-create was kept as a one-release alias of vrg-intake-create and has outlived that by about ten releases. Remove the console script, its module and tests, and its entries in the CLI tools overview and the GitHub issues standard. Ref #3827

  • add rolling-tag rulesets (#3862)

  • feat(repo-config): protect rolling vX.Y tags and forbid branches named like them

The tag-protection ruleset now covers refs/tags/v. as well as v.., so the rolling vX.Y tags consumers follow can only be moved or deleted by the repository Admin role. A new 'Rolling tag branch names' ruleset blocks creating any branch matching refs/heads/v[0-9], with no bypass, because a ref resolves to a branch before a tag. Glob includes no longer feed the classic branch-protection read. The config-audit reference lists the rulesets.

  • docs(repo-config): align the rulesets standard with the declared rulesets

The source-control standard now lists four library rulesets, the widened tag includes, the Admin bypass on Tag protection and the new rolling-tag branch-name ruleset, and links the config-audit rulesets table. The branch-before-tag wording now names Claude Code as a consumer that resolves that way, since git's own short-name lookup prefers the tag.

  • feat(repo-config): block updates and force-pushes on branches named like rolling tags

The rolling-tag branch-name ruleset now carries update and non_fast_forward rules alongside creation, with no bypass actors. It has no deletion rule, so a stray branch of that shape can still be removed. Docs and the ruleset test are updated to match.

  • refuse agents, check the target and confirm before moving a rolling tag (#3863)
  • feat(promote): refuse agents, check the target and confirm before moving a rolling tag

vrg-promote and the vrg-release promote stage now require a human identity (fail closed on any agent signal), move a rolling tag only to an existing release tag on origin/main with a published GitHub Release, and push with a compare-and-swap lease on the confirmed tag value. The vrg-promote CLI prints the origin repo and the tag move, and asks for confirmation on a terminal before it pushes. vrg-release's first-stage identity guard uses the same fail-closed check. Ref #3849

  • fix(promote): push the verified release tag to the repo the checks read

Route promote's git calls through lib/git (network retry, no terminal prompt), fetch main into refs/remotes/origin/main explicitly and check ancestry against that ref, require origin's push URLs to name the same repo as its fetch URL, verify the local release tag against the confirmed commit and push it straight to the rolling tag's ref under the lease, then update the local rolling tag. The Release read retries a 404 only in vrg-release's promote stage; a typed version is read once, and an unreadable Release is reported as such. Origin URLs are parsed case-insensitively with any ssh user and port, and printed without credentials. Docs list every exit path. Ref #3849

  • fix(promote): report a refused push and an unparseable remote without echoing the URL

A push that origin does not accept is raised as PromoteError naming the value the lease required, so git's stderr is shown once. A remote URL that is not a GitHub repository URL is refused by which URL it is (fetch or push), without printing it. The promote tests keep lib/git's token layering off the host's App credentials, pin the push argv exactly, and pin the CLI's own identity refusal. The reference no longer points at a runbook section that does not exist yet. Ref #3849

  • fix(promote): peel annotated tags on origin and keep failure detail for the release record

Ask ls-remote for the peeled ref by name, since a single exact pattern does not return it, so an annotated tag resolves to its commit. Resolve the local release tag once and use that object for the push and the local tag update. A PromoteError raised for a failed command now carries the command and its output, so the vrg-release tracking issue records them. GitHub credential errors reach the command's entry point unwrapped, and the Release read names github.com. The docs describe the agent refusal as a guard, with the rolling-tag ruleset as the enforcement.

  • fix(promote): treat a push that landed before a failed retry as the move, and tighten prompt and error handling

After a failed push, read origin's rolling tag back: when it already holds the pushed release object (an attempt landed before the connection dropped and the retry failed its lease), report the move and update the local tag. If origin cannot be read back, say so instead of reporting a refusal. Ctrl-C at the confirmation prompt is a decline. An unreadable VERSION file prints an error instead of a traceback. Release and ancestry errors no longer repeat the command output they already carry, and a not-found Release read also names an unreadable repo as a cause. The origin URL parser no longer lets ?, #, backslash or whitespace into the user part, so the matched host is the real host. The reference describes which credential errors get the guided message.

CI Evidence: All gates passed — full audit bundle available. Download →