Changelog¶

[Unreleased]¶

[0.2.1] - 2026-10-10¶

Added¶

• Declare Python 3.15 support and add blocking Linux and Windows test jobs. Run the Python compatibility matrix against a non-editable package installation.

Fixed¶

• Update locked urllib3 to 2.8.0 for upstream proxy TLS and streaming denial-of-service fixes in the optional Bedrock dependency chain.
• Update locked virtualenv to 21.7.13 for upstream activation-script, configuration, and seed-wheel verification security fixes in development tooling.
• Align the Hatchling 1.32.4 build and development pins with the lockfile and tooling contract.
• Raise the optional quality extra's PyTorch minimum to 2.13 to exclude older releases with known security advisories; the locked PyTorch version remains 2.14.0.
• Repair the pipx installation link in the getting-started guide.

Changed¶

• Refresh CI tooling with setup-uv 10.2.0 and uv 0.13.0, including stable Python 3.15 downloads.

[0.2.0] - 2026-09-20¶

Added¶

• Support explicit plain-message policy and a frozen plain-v1 starter; print incomplete, policy-guided drafts with commit template without changing files or Git.

• Introduce opt-in warning-rules for gradual policy adoption, with consistent schema-v1 commit reports containing severity and warning counts, and nonblocking annotations.

• Require bounded work-item references and constrain exact footer values through opt-in required-issue-prefixes and footer-values settings.

• Add frozen editable workflow starters and config show --type explanations of effective body/scope overrides, preserving the existing default starter.

• Validate proposed PR title-plus-description messages with opt-in pull-request-message, reusing full commit policy and reporting the proposed message separately.

• Allow per-type body requirements with body-policy-by-type and cap total prose with body-max-length, preserving existing defaults and independent title checks.

[0.1.2] - 2026-09-20¶

Fixed¶

• Create the GitHub Release automatically after successful PyPI publication, using the same validated distributions and the selected changelog notes.

• Honor optional Typos spelling checks for GitHub PR titles and commit messages, including the read-only Action; isolate trusted-mode spelling from ambient configuration and preserve tool errors.

Added¶

• Check standalone titles with commit check --title, clean editor comments explicitly with commit check --edit, and choose isolated local spelling with typos-config = "isolated".

• Add explicit PR-author exemptions for dependency update services and other named accounts, without changing the existing Dependabot option or bypassing event/head validation.

• Add opt-in initial-uppercase, final-period, URL wrapping, footer line-length, and exact colon trailer constraints for commit-policy consumers.

• Add a read-only trusted-default-branch commit-check Action mode with committed policy loading, exact fetched-head verification, and a same-repository Dependabot branch skip boundary.

[0.1.1] - 2026-09-19¶

Fixed¶

• Give MSYS2, Git Bash, and Cygwin users explicit shell PATH setup instructions after installation.
• Include copyable PowerShell and Bash/zsh log commands after scheduling a Windows self update.

[0.1.0] - 2026-09-19¶

First public beta release.

Added¶

• Add offline required-version checks and whole-file project precedence over global defaults. Project environments and automation ignore global configuration.
• Add shell and PowerShell convenience installers backed by uv, and explicit yaga self update with installation ownership checks and a dry run.
• Add a tag-triggered PyPI trusted-publishing workflow and a manual build-only release rehearsal. Publish the exact validated distributions with upload permissions isolated from source execution.
• Make PyPI installation the default onboarding path with uv, pipx, and pip instructions, PATH setup, updates, and uninstalling; keep source installs separate for development and unreleased code.
• Add the original YAGA logo to the README and documentation, and preserve the branding concept board alongside it.
• Add a light, dark, and system documentation theme with grouped navigation and a guided landing page for adopting repository checks.
• Include an ordered report-level SHA-256 fingerprint in quality JSON, text, and GitHub notices so online and offline runs can prove that they covered the same selected message set.
• Include a per-message SHA-256 fingerprint of the exact bounded quality-model input in text, JSON, and GitHub reports, making title/body coverage auditable without exposing commit text.
• Always run the quality workflow's offline cache proof even when online advisory findings occur, while preserving operational-error precedence.
• Use the quality workflow's task and model variables for both online and offline inference, keeping cache identity aligned with the actual provider selection.
• Include quality task and model identity in the Hugging Face cache key and show cache-hit state in the online workflow summary.
• Mark config init --dry-run explicitly in text and JSON reports for automation consumers.
• Add config init --dry-run to validate and report the generated policy without creating a file.
• Add regression coverage proving event-aware Dependabot skips remain valid for multiline commits.
• Clarify that config init requires lowercase commit types while keeping scopes optional and lowercased when present.
• Include aggregate character and token coverage counts in the GitHub quality notice, including complete, truncated, and unmeasured messages when per-message warnings are absent.
• Link the Agent review gate guide directly from the command reference table.
• Add a provider-neutral Agent review adapter checklist covering plan digests, multi-lens execution, evidence correlation, receipts, bounded summaries, and exit-code handling.
• Document Docker and actionlint troubleshooting, including bounded cleanup errors and safe inspection of the exact named workspace without broad Docker pruning.
• Count only parsed prose-body lines in quality coverage output, excluding recognized footer blocks.
• Include per-message body-line and model-input coverage in flagged GitHub quality annotations so complete-message versus title-only and truncation behavior is visible in CI output.
• Allow commit quality classification thresholds from 0 through 1 inclusively, including 0 for intentionally flagging every nonnegative classifier score.
• Added diagnostic line and column locations to standalone and pull-request text reports so local failures provide the same actionable position detail as JSON and GitHub output.
• Added a dedicated commit-quality guide covering input sources and modes, provider/task choices, configuration, model pinning, cache replay, and report interpretation.
• Added per-message quality input character counts and character-bound truncation metadata so provider coverage is auditable alongside token coverage.
• Made YAGA's own online and offline quality workflow explicitly select complete-message input.
• Bound the text submitted to every commit-quality provider mode to the documented 12,000 characters, including classification input and title-only mode.
• Added configurable commit-quality input-mode selection between the complete message and title only, with the selected mode included in reports.
• Added agent-review policy template to emit a complete, plan-digest-bound pending receipt scaffold for multi-lens external adapters.
• Added escaped commit-quality output to the GitHub Actions step summary for both online and offline workflow passes without masking command failures.
• Added a bounded GitHub notice summarizing quality counts and provider metadata alongside warning annotations.
• Updated the repository commit-quality workflow to use GitHub annotations for online and offline model-cache checks.
• Added GitHub warning annotations for flagged commit quality advisory results through --format github, while provider failures remain error annotations with exit 2.
• Refined the paragraph-splitting heuristic so punctuation-free one-line notes remain valid while likely sentence continuations still report body.paragraph-format.
• Added GitHub Actions guidance for installing the pinned Typos CLI when a repository enables commit-message spelling checks.
• Run the optional Typos commit-message adapter from the selected repository so --repo checks honor that checkout's _typos.toml configuration.
• Clarified the root README and command index so commit quality is described as a provider-neutral advisory with Hugging Face and Bedrock modes, and linked the detailed source, configuration, and reporting guidance.
• Added quality-provider troubleshooting guidance for CPU-only dependencies, Hugging Face cache reuse and offline replay, Bedrock credentials, and model coverage fields.
• Added a source-mode matrix and copyable examples for direct, file, stdin, single-commit, range, and default-HEAD commit quality invocations.
• Added per-message quality coverage metadata so Hugging Face text and JSON reports identify the measured input-token count and whether the configured input-token window truncated the model input.
• Added configurable Hugging Face quality input windows through max-input-tokens and --max-input-tokens, with the effective bound included in text and JSON reports.

• Added concrete passing and failing examples for the explicit paragraph-splitting check, including its continuation-aware punctuation heuristic and valid one-line notes.

• Added JSON output for agent-review policy check, including the validated lens counts, required lens order, aggregation mode, and matching plan digest.

• Added deterministic Agent review plan digests so adapter result receipts cannot be evaluated against a different lens configuration.
• Added the opt-in yaga commit quality advisory using a pinned local Hugging Face model, with offline cache support and versioned text/JSON reports.
• Extended commit quality with configurable Hugging Face classification/seq2seq tasks and an optional Amazon Bedrock Converse adapter using Nova Micro by default.
• Added strict [commit.quality] configuration defaults with per-invocation CLI overrides; secrets remain outside YAGA policy files.
• Added configurable paragraph-splitting enforcement that detects likely sentence breaks across blank lines, leaving standalone short paragraphs and list items valid.

Changed¶

• Focus the README on problems YAGA solves and routes into documentation. Move detailed contracts to provider references and add a guide for evaluating and adopting YAGA in another repository's CI.
• Run the full test suite on Windows with Python 3.12 as well as Linux with Python 3.12–3.14, including the Windows Git executable and process-containment regressions.
• Cache the verified Cargo registry used to install the pinned Typos CLI, reducing repeated network downloads without caching an executable supplied by pull-request code.
• Clarify the command synopsis so commit quality is identified as a provider-backed advisory, including the Hugging Face and Bedrock modes documented below.
• Enable the bounded Typos commit-message check in YAGA's own policy and install the pinned CLI in the hosted commit-policy and CI workflows.
• Resolve Linux quality dependencies from PyTorch's CPU wheel index so CPU-only model checks do not download the CUDA runtime stack.
• Added --format github to standalone commit check, producing bounded escaped annotations, pass/fail totals, and compact rule-count summaries for ordinary CI ranges.
• Isolated the GitHub/Codex connector under the Agent review provider namespace and routed the composite Action through a provider-neutral Agent review runtime entrypoint.
• Documented the distinction between complete selected-message line counts and the 512-token Hugging Face model input window, so quality reports are not mistaken for full semantic coverage.

• Clarified body.paragraph-format diagnostics so failures identify the likely sentence split across blank lines instead of reporting an arbitrary paragraph count.

• Expanded Agent review documentation with the digest-bound adapter handoff, receipt lifecycle, generic preset-label semantics, and GitHub-format publishing example.

• Replaced the confusing numeric consecutive-single-line paragraph setting with explicit body-paragraph-splitting = "skip" | "check" configuration.
• Agent review plan digests are now visible in text plans and evaluation summaries as well as JSON.
• Quality reports now state how many body lines were included in each model invocation, making title-only and multiline checks distinguishable without printing the full commit message.
• Documented the classification, seq2seq, and Bedrock quality modes, including Hugging Face cache reuse, offline replay, credential boundaries, and configuration precedence.
• Aligned the repository and hosted workflows on uv 0.12.7, the runtime supported by Dependabot.
• Kept the public review lifecycle provider-neutral as the Agent review gate while retaining provider-specific adapters behind configurable presets and named lenses.

Fixed¶

• Serve the README logo from public documentation and use absolute package-description links. Validate the rendered wheel description during the package build.
• Restore the documentation error page's skip-to-content target.
• Accept uv 0.12.7 and newer for local development while keeping CI's exact tool pin. Document the external tools required by the full development gate.
• Select only pull-request commits in the quality workflow, use an exact commit for manual runs, and treat unexpected process exits as operational failures.
• Resolve quality defaults for the selected provider, so Bedrock does not inherit a Hugging Face model or revision, and render empty-message assessments without crashing.
• Normalize deeply nested and invalid-Unicode Agent review receipts to formatted operational errors with exit 2.
• Keep one release-history source, correct model revision examples, and make checkout quick-start messages pass the repository's required-body policy.
• Include a bounded sanitized Docker cause when actionlint container or workspace cleanup fails, making daemon and resource-state errors actionable in local and CI reports.
• Count body lines correctly in commit-quality reports when messages use Windows CRLF line endings.
• Reject invalid Bedrock seq2seq quality configuration while loading policy files instead of waiting until the advisory command runs.
• Keep Bedrock quality reports free of Hugging Face model revisions, which the Bedrock adapter does not consume.
• Refined paragraph enforcement to catch likely blank-line sentence splitting without treating every one-line prose paragraph as a failure; the check uses punctuation and paragraph-shape clues.
• Added a bounded findings-by-rule summary to GitHub commit-policy output so failed rule codes are visible in workflow logs and step summaries.

Security¶

• Reject Windows command scripts as Git executables and reject path selectors in commit and range inputs before launching Git.
• Enforce Typos output limits during execution and contain its process tree, including input backpressure and descendant-held pipes, within the timeout and bounded cleanup window.
• Reject configured lens policies in the retained GitHub review adapter because it cannot execute their instructions or bind its completion evidence to their plan digest. Provider-neutral plan/template/evaluate commands remain available to external adapters.
• Require full 40-character Hugging Face commit revisions rather than accepting short hexadecimal names that can resolve as mutable references.
• Updated the optional Hugging Face transformers extra to the patched 5.x line and refreshed the lockfile, closing the active model-initialization and model-save security advisories.

This page is the single release-history source, linked from the root CHANGELOG.md. It follows Keep a Changelog 1.1.0 and uses Semantic Versioning for releases.

How entries are organized¶

Keep an ## [Unreleased] section at the top while work is in progress. Group notable changes under the standard headings:

Write entries for users and integrators, not one line per commit. Explain the observable behavior, the affected command or configuration surface, and any migration or security consequence. Keep entries concise, linkable, and in reverse chronological release order. Use ISO 8601 dates (YYYY-MM-DD) when a version is released.

YAGA release workflow¶

See Releasing YAGA for trusted-publisher setup, rehearsals, and publication checks.

Before a release:

1. Review the Unreleased entries against the merged changes and remove implementation noise.
2. Move the entries into a version heading such as ## [0.1.0] - 2026-09-10.
3. Add a fresh empty Unreleased section above the release.
4. Add comparison links at the bottom once the tag exists.
5. Run uv run make ci, verify the exact built artifact, and publish only when explicitly authorized.

The changelog complements commits and GitHub Releases: commits explain implementation steps, whereas this file summarizes the notable result for people adopting a version.