[github-actions]

🤖 I have created a release beep boop

0.48.0 (2026-10-30)

Features

• acp-practice: add ACP best-practice skill and Review checklist hook (e4fa665)
• hooks: block worktree removal until ignored files are archived (823d4e1)
• learn: require compatibility disposition and local evidence links (7012d9f)
• maintenance: integrate guarded batch reconciliation skill (8571d93)
• plan: measured effort estimates, dispatch waves and critical path in Phase 2 (596002b)
• repo-maintenance: resolve branches already on main without an owner card (7e7b17c)
• task-queue: look up open cards before filing; refuse unready intake (678e7e6)

Bug Fixes

• artifacts: keep architecture snapshots fresh across commits (fcd1c1b)
• audit: accept status strings in run trajectory metadata (3feadbd)
• build-loop: automatically repair confirmed authorized findings (d3dda1c)
• cache-sync: sync plugin caches only from main in the primary checkout (33936bb)
• cache: sync Claude plugins to their registered active installation (45266af)
• catalogs: reverify provider lifecycle pricing and evidence (131830b)
• config: validate runtime inputs and gate TypeScript changes (c3b9de0)
• coordination: distinguish fresh heartbeats from evidence progress (6d1b927)
• credential_policy: approve git clone from https://github.com over the gh helper (aa23a05)
• credential_policy: close the 7 Keychain paths from the 2026-10-25 review (b223e3a)
• credential_policy: match only real Keychain triggers and name them in refusals (e7f447f)
• credential-policy: distinguish executable lookup from launch (cbb0adf)
• evidence: bind retrospectives and telemetry to exact run identities (03746b3)
• groundwork: accept Groundwork 0.5.0 write-boundary and exchange effect fields (d45121b)
• hook-lint: heredoc bodies and quoted-command arguments are not commands (10237d0)
• hooks: add a fail-closed backstop and close round-2 review findings (09ec8d2)
• hooks: bound complete lifecycle and preserve incomplete gate decisions (7660f5f)
• hooks: bound remaining SessionStart work before host deadlines (3ad7696)
• hooks: bound startup maintenance and report Codex trust honestly (97d8b8b)
• hooks: close the 15 review findings in the worktree-removal guard (e0f5b60)
• hooks: drain completed output and guard JSON runtime (79c37df)
• hooks: emit Codex-valid PreToolUse and Stop output (9e81c06)
• hooks: emit valid startup JSON within the host deadline (815da4b)
• hooks: keep Rally and observational hooks inside Claude Code timeouts (8524b29)
• hooks: keep the rest of a double-quoted substitution whole instead of parsing its boundaries (2510b39)
• hooks: preserve explicit session when cache import fails (dc4bdfe)
• hooks: preserve manual diagnosis and handle missing modules (386bd7d)
• hooks: preserve native events and remove invalid Stop observers (69d09f7)
• hooks: preserve session identity on failure and protect literal quotes (c223d56)
• hooks: record Codex tool failures from PostToolUse (271c938)
• hooks: run plugin drift check without credential helpers (4eea859)
• hooks: worktree guard counts quoted command substitutions and archives deinitialized submodules (c61d542)
• identity: reject conflicting history and undated discovery (053a5ed)
• ingestion: guard source descriptors and preserve exact outcomes (11db0d2)
• learn: execute RossLabs LSP for applicable compatibility reviews (10d7d7d)
• learning: retain provisional source evidence and stable suppression (64157ba)
• optimize: enforce evaluator scope and keep accounting (21b77e8)
• orchestrator: move the reassess-before-retry paragraph into iterate-protocol (2986c0a)
• preserve Stop payloads and reject incomplete transcript formats (d5cdd44)
• rally: let RALLY_TOOL_ID name the native actor (80a01ec)
• rally: refuse to install git hooks into a tracked core.hooksPath dir (3ed8fec)
• reassess related failures and preserve embedding provenance (f4d113c)
• reliability: repair full-suite root causes and outcome boundaries (f196d0d)
• respect release ownership and complete direct test discovery (87ed973)
• retain usable transcript prose with explicit coverage gaps (b292560)
• review: keep unrepaired statuses blocking despite closed flags (46b3bab)
• security-scan: grade tool dispatch per site, and catch open MCP dispatch (cb2f293)
• storage: bind guarded reads to verified file identities (ff48312)
• storage: isolate corrupt records and expose partial coverage (a9a8fb2)
• storage: publish validated trace revisions and bound log scans (56fe9c4)
• storage: reject blocking sources and preserve trace contracts (d04418f)
• storage: scope canonical lookups independently of legacy faults (69571d3)
• task-queue: address Codex review round 1 (13 findings) (0ae24b6)
• task-queue: address Codex review round 2 (10 findings) (154d976)
• task-queue: address Codex review round 3 (7 findings) (ba373fd)
• tasks: share outcome validation and expose live ref inventory (1508000)
• telemetry: share bounded ingestion and preserve source attribution (5e1d305)
• transcripts: preserve discovery failures in coverage receipts (606f788)
• verification: share full-suite coverage across local and CI gates (ad35231)
• wake: preserve requested and earlier deadline bounds (de3f690)

Performance Improvements

• ingestion: stream canonical transcript events with revision-safe caching (df7392d)
• rally: cut pre-edit hook latency by deduping git lookups and lazy imports (ccf8b34)
• rally: keep the per-tool hook off the rally CLI (1,550 ms -> 180 ms) (ecc9068)

---

This PR was generated with Release Please. See documentation.

[coderabbitai]

Important

Review skipped

Bot user detected.

To trigger a single review, invoke the @coderabbitai review command.

Run configuration

• Source mode: Auto
• Repository: Unavailable
• Branch: Unavailable
• File: No configuration file from this repository applied
• Commit: Unavailable
• Layers: defaults
• Review profile: CHILL
• Plan: Advanced
• Run ID: a91337f8-0e5f-490d-bef2-8e96e60c6f25

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}