# Changelog

All notable changes to HermesGate will be documented here.

The format follows Keep a Changelog, and the project uses Semantic Versioning.

## [Unreleased]

### Fixed

- A CodeRabbit run that reports `No fresh detailed file review was performed` (a reused
  prior result) is now `REVIEW_UNAVAILABLE`, not a clean `PASS`. A reused result that still
  carries material findings keeps failing.
- Stored review PASS receipts whose captured CodeRabbit stdout says `No fresh detailed file
  review was performed` are no longer honored by `review`, `boundary push`, or PR boundaries.
  Detailed reviews and other providers are unaffected.

### Added

- `hermes-gate review --fresh` asks the CodeRabbit provider for a new detailed review
  (appends `--fresh` to its command) and does not reuse a stored review receipt. With any
  other review provider it stops with an error instead of silently ignoring the flag.

## [0.1.7] - 2026-09-18

### Added

- A GitHub Marketplace composite action at the repository root. It installs the
  released HermesGate CLI, then runs an explicit `fast`, `full`, `review`, or
  `doctor` command in the selected checkout directory. The action remains a
  receipt runner and does not grant merge or release authorization.
- An Agent Plugins 1.0.0 manifest at `claude-plugin/plugin.json`. That
  specification resolves a plugin manifest at the plugin root, and
  `.claude-plugin/` is not one of its recognized locations, so external plugin
  registries could not read the Claude Code plugin at all. The Claude Code
  manifest at `claude-plugin/.claude-plugin/plugin.json` is unchanged apart from
  its version, and Claude Code still loads the plugin exactly as before.

### Changed

- `scripts/verify_release.py` now fails the release closed when the two plugin
  manifests disagree on `name`, `version`, `description`, or `license`, when
  either drifts from the packaged version, or when the root manifest carries a
  `$schema` or a top-level field that Agent Plugins 1.0.0 does not define.
- The Claude Code plugin manifest version tracks the packaged version again; it
  was left at `0.1.6` when the project moved to `0.1.7`.

## [0.1.6] - 2026-09-17

### Fixed

- `hermes-gate init` now preserves the no-Gate pre-push behavior of repositories
  that have never adopted Hermes Gate. The generated hook remains active and
  fail-closed once a repository has a Gate profile; a never-adopted repository
  continues through without an unrelated completion-receipt requirement.

## [0.1.5] - 2026-09-17

### Added

- `hermes-gate delegate-judge`: a hidden CLI adapter for the NousResearch
  Hermes Agent quality-gate seam. It reads one JSON request object from
  stdin, runs the repository's configured `fast` gate against the request's
  `workspace` using the existing internal engine (no shell, no API-backed
  review), and writes one JSON `{"verdict", "feedback"}` object to stdout.
  Gate `PASS`/`NOT_APPLICABLE` maps to `pass`. `attempt` is one-based (the
  first attempt is `1`) and `max_retries` counts the allowed correction turns
  after that first attempt, so a material `FAIL` maps to `retry` while
  `attempt <= max_retries`, else `reject` — a `max_retries: 1` profile still
  retries the first failure. An invalid request, a missing profile, an
  unavailable tool, or an internal error all map to `error`. Feedback is
  bounded and never includes raw command output, diffs, or source content.
  The validator accepts the Agent's emitted v1 shape: `previous_feedback` as
  an array of strings (or a string, or `null`), `subagent_id` and `workspace`
  as nullable strings, and an optional boolean `workspace_isolated`; a `null`
  workspace returns a fixed `error` feedback rather than a schema failure.
  See README "Hermes Agent quality-gate seam".

### Fixed

- An unsupported `review.provider` is now a profile error instead of a permanent
  `REVIEW_UNAVAILABLE`. Any provider name other than `coderabbit` ran its `argv`
  verbatim, its output was parsed as CodeRabbit agent JSONL, and the resulting
  `provider exited N` was reported as a retryable infrastructure outcome, so a
  profile such as `provider = "hermes-pr-review"` with
  `argv = ["hermes-pr-review"]` failed on every `review` call while `fast` kept
  passing. `load_config` now rejects it, so `fast`, `review`, `full`, `repair`,
  and `boundary` all return `ERROR: invalid profile: review.provider …` naming
  the supported set. `review.argv[0]` may still name any compatible executable.
- `hermes-gate doctor` reports an invalid profile as overall `ERROR` (was
  `NOT_CONFIGURED`) and probes the review executable the profile names, resolved
  the way `review` launches it (`PATH` or repository-relative), instead of a
  fixed `coderabbit`/`cr` lookup. The `provider` block gains `name` and `argv0`;
  an installer copy under `~/.local/bin` that is not on `PATH` is reported as
  such rather than as available.

## [0.1.4] - 2026-09-09

### Fixed

- The generated quality workflow now checks out with `persist-credentials: false`.
  `actions/checkout` stores the workflow token in `.git/config` by default, where
  every later step and every declared gate stage could read it; the gate only
  reads the checkout and never needed it. The repository's own tracked workflow
  is regenerated accordingly. Existing generated rails need `hermes-gate init
  --force` (or the same one-line edit) to pick this up.
- An explicitly empty base is now a clear error instead of silently selecting
  the local worktree scope. `--base ""`, `--base=`, and a `HERMES_GATE_BASE`
  that is set but blank all exit 2 naming the empty source, and the `run()` entry
  point reports `ERROR` for an empty `base`. A hosted rail whose base expression
  resolved to nothing would otherwise have reviewed a pristine checkout. An
  omitted base still selects the local scope, a valid base still works, and an
  explicit `--base` still overrides the environment.

## [0.1.3] - 2026-09-09

### Fixed

- The repository runner no longer reports a pass over zero bytes in a hosted
  checkout. `actions/checkout` produces a pristine tree, so the worktree, index
  and untracked scope selected nothing and a file-driven stage returned PASS
  having read nothing. A file-driven stage with no selection is now recorded as
  `NOT_APPLICABLE` with its own reason, and a run in which no stage executed
  reports `NOT_APPLICABLE` rather than PASS.
- `full` now runs every declared stage and aggregates the failures instead of
  returning at the first non-PASS check, so a multi-stage profile can no longer
  hide later stages behind an early failure. `fast` is unchanged: it keeps both
  its first-failure exit and its selection guard, so a stage whose globs match
  nothing is still skipped outright and the local budget still holds.
- A stage that cannot be launched at all - missing, not executable, or the wrong
  binary format - is that stage's failure rather than the whole gate's, and the
  remaining declared stages still run. Unusable `argv` declarations, including a
  scalar where an array is required, are reported as that stage's error instead
  of raising out of the run, and the run names every unusable and failed stage.

### Added

- The runner accepts an explicit review range: `--base REV` (or
  `HERMES_GATE_BASE`) compares the merge base of that revision with HEAD, and
  `--all` reviews every committed byte against the empty tree. The two are
  mutually exclusive, and a base that is not present in the checkout is a hard
  error naming `fetch-depth: 0` rather than a silently empty change set. With no
  base supplied, local behaviour is unchanged: worktree, index and untracked
  bytes. The resolved range is published to child stages through
  `HERMES_GATE_RANGE`, is used by `diff-check`, and is recorded as `range` on the
  receipt.
- The test suite isolates itself from the gate that runs it: pytest is a declared
  gate stage, so `HERMES_GATE_BASE` and `HERMES_GATE_RANGE` are cleared before
  each test and set explicitly where a test needs them. Without that, fixture
  repositories would inherit the enclosing repository's base revision and the
  runner regressions would fail under CI while passing locally.
- `hermes-gate init` now generates a workflow that checks out with
  `fetch-depth: 0`, passes the pull request base to the gate, and sweeps every
  committed byte with `--all` outside pull requests, so a generated rail reviews
  real bytes on a hosted runner.
- Release checks bind the GitHub tag, package and runner versions, tracked runner,
  wheel/sdist metadata, and packaged source bytes before build and again before PyPI upload.
- The quickstart now includes installation from the published PyPI package.

### Changed

- Package author metadata now uses the current Hermes Labs address
  `roli@hermes-labs.ai`, matching every other published Hermes Labs package.
  Published 0.1.2 metadata on PyPI is immutable and permanently keeps the
  legacy address; 0.1.3 is the release that exposes the corrected value.

## [0.1.2] - 2026-09-06

### Fixed

- Fast checks now skip deleted paths instead of invoking file-based checks on
  files that no longer exist in the worktree.

## [0.1.1] - 2026-09-06

### Fixed

- Generated whitespace checks now cover selected working-tree, staged, and
  untracked files.
- The copied runner bounds concurrent stdout/stderr capture and reports when
  output was truncated.
- Hermes Gate's own profile checks its maintained runner.

## [0.1.0] - 2026-08-08

### Added

- Bounded `fast`, `review`, and `full` workflows with digest-bound receipts.
- Repository initialization, rollback, diagnostics, and Codex lifecycle integration.
- Zero-dependency repository-native runner.
- Canonical stdlib `gate-result/v1` loader and validator.
- Optional isolated PyGate 0.2.0+ and QuickGate.js 0.2.3+ adapters.
- Git-internal runtime state, command-version receipts, OSS policy files, and package schema data.

[Unreleased]: https://github.com/hermes-labs-ai/hermes-gate/compare/v0.1.7...HEAD
[0.1.7]: https://github.com/hermes-labs-ai/hermes-gate/releases/tag/v0.1.7
[0.1.6]: https://github.com/hermes-labs-ai/hermes-gate/releases/tag/v0.1.6
[0.1.5]: https://github.com/hermes-labs-ai/hermes-gate/releases/tag/v0.1.5
[0.1.4]: https://github.com/hermes-labs-ai/hermes-gate/releases/tag/v0.1.4
[0.1.3]: https://github.com/hermes-labs-ai/hermes-gate/releases/tag/v0.1.3
[0.1.2]: https://github.com/hermes-labs-ai/hermes-gate/releases/tag/v0.1.2
[0.1.1]: https://github.com/hermes-labs-ai/hermes-gate/releases/tag/v0.1.1
[0.1.0]: https://github.com/hermes-labs-ai/hermes-gate/releases/tag/v0.1.0