77 lines
4.8 KiB
Markdown
77 lines
4.8 KiB
Markdown
# Changelog
|
|
|
|
All notable changes to this project are documented here. The format follows
|
|
[Keep a Changelog](https://keepachangelog.com/en/1.1.0/), and the project uses
|
|
[Semantic Versioning](https://semver.org/spec/v2.0.0.html).
|
|
|
|
## [Unreleased]
|
|
|
|
## [1.0.0] - 2026-09-21
|
|
|
|
First public release. `ai-incidents` began as a nightly job in a private set of scheduled agent
|
|
scripts, where it had been running since July 2026 and had filed 44 incidents. This release
|
|
extracts it into a standalone tool with no dependency on that environment.
|
|
|
|
### Added
|
|
- `ai-incidents run`: scan transcripts, gate, judge, write the ledger, commit, record. A run with
|
|
no candidates makes no model call.
|
|
- `ai-incidents scan`, `init`, `reindex` and `config` commands.
|
|
- `--dry-run` (no model call, no writes), `--dry-run --with-judge` (model call, still no writes),
|
|
and `--backfill` to judge existing history instead of taking a baseline on a first run.
|
|
- One TOML configuration file for transcript locations, judge, ledger, git, state, privacy and
|
|
hooks. Unknown keys are rejected.
|
|
- opencode 1.x support: sessions are read from its SQLite store, opened read-only.
|
|
- Judge backends: the Claude Code CLI (all tools and MCP servers disabled, no session
|
|
persistence), any OpenAI-compatible endpoint for local models, or an arbitrary command.
|
|
- Structured verdicts: the judge answers in JSON, which is validated before anything is written;
|
|
the ledger, report and index are rendered by the tool, not edited by the model.
|
|
- Secret redaction of candidates before they reach the judge and of verdicts before they reach the
|
|
ledger.
|
|
- `WriteGuard`: every file write is checked against the ledger directory and the state file.
|
|
- Optional hooks (`notify_cmd`, `on_success_cmd`, `on_failure_cmd`, and `--notify-cmd`) in place
|
|
of built-in notification and heartbeat services.
|
|
- Optional plain-text seen-list export, for transcript-cleanup jobs that must not delete
|
|
sessions before they are judged.
|
|
- A run lock, so overlapping runs cannot race on the state file.
|
|
- Examples for a systemd user timer and cron, a full configuration reference, and a curated sample
|
|
ledger and run report.
|
|
- Test suite (pre-filter, both transcript formats, state semantics, judge backends, ledger
|
|
writer, redaction, permission envelope, git) and GitHub Actions CI on Python 3.11 to 3.13.
|
|
|
|
### Changed (from the private sweep)
|
|
- **Renamed and folded.** The collector (`ai-incidents-collect` plus `_scan_incidents.py`), the
|
|
gate (`ai-incidents-gate`), the agent job definition, and the publisher
|
|
(`ai-incidents-publish`) are now one program, `ai-incidents run`. The pre-filter lives in
|
|
`prefilter.py`, transcript reading in `sources.py`, the judge rubric in `prompts/judge.md`, and
|
|
ledger writing in `ledger.py`.
|
|
- **The judge no longer edits files.** It used to be an agent with Read, Write and Edit tools and
|
|
a scoped shell; it now receives text and returns JSON, with no tools at all. The tool writes the
|
|
ledger itself.
|
|
- **Severity-ranked ledger.** `incidents.md` is ordered most severe first, newest first within a
|
|
severity (it was newest first). `order = "newest"` restores the old order.
|
|
- **`state.json` in the ledger is now `index.json`.** It is still derived from `incidents.md` on
|
|
every write and uses the same fingerprints, so existing `first_seen` dates carry over. The name
|
|
`state.json` now belongs to the tool's own run state, kept outside the ledger by default.
|
|
- **Two-phase seen-state is kept, in one process.** Sessions with candidates are recorded as judged
|
|
only after the verdict is written and committed; clean sessions immediately. The separate
|
|
`--promote` step is gone.
|
|
- **Talkative sessions are cut once instead of split across runs.** A session with more candidates
|
|
than the per-run budget used to be re-emitted on every run and never finished; it is now capped
|
|
at `max_per_session` candidates, with its behaviour block always kept.
|
|
- **Tracebacks from the agent's own inline scripts** (`python -c`, stdin heredocs) no longer count
|
|
as notable failures on their own.
|
|
- **Only shell commands are checked for destructive patterns**, not file paths passed to read or
|
|
edit tools.
|
|
- **Git writes are narrower.** Commits name their paths explicitly (`git commit -- <paths>`), so
|
|
other staged or untracked files in the ledger repository are never swept in. The hard-coded
|
|
remote check became the optional `expected_remote_url`.
|
|
|
|
### Removed
|
|
- Multi-host collection over SSH. Run one instance per machine instead.
|
|
- Built-in ntfy notification, the dead-man's-switch heartbeat, quota-retry scheduling and the
|
|
unattended-agent runner: use hooks, your scheduler's own retry, and `on_success_cmd`.
|
|
- Hard-coded paths, host names and repository names.
|
|
|
|
[Unreleased]: https://github.com/sudolulo/ai-incidents/compare/v1.0.0...HEAD
|
|
[1.0.0]: https://github.com/sudolulo/ai-incidents/releases/tag/v1.0.0
|