# Changelog All notable changes to 森 (*mori*) will be documented in this file. The format follows [Keep a Changelog](https://keepachangelog.com/en/1.1.0/), and releases use [Semantic Versioning](https://semver.org/spec/v2.0.0.html). ## [Unreleased] ## [0.34.0] - 2026-09-11 ### Added - Workload planning with `mori plan` and batch baseline identity acceptance. - Exact-score optimizations and differential, CLI and resource regression gates. - Regression scenarios for modern language syntax, production selection, lower-token-floor ranking and immutable staged classification. - Explicit production/test path overrides, bound to baseline and cache policy. - Opt-in authenticated parsing reuse between workload planning and scanning, with fresh source reads, bounded private storage and safe cache misses. ### Fixed - Go expression allocation, TypeScript variance, Swift parenthesized range patterns and narrowly supported libgit2 annotation/iteration macros. - Inline positively guarded REDIS_TEST fragment selection and unsupported Flow diagnostic guidance. - Repeated small boilerplate crowding in review ranking, with structural scores and identities preserved. Concise reports disclose nested-body exclusions and active classification overrides. ### Changed - Configuration contract advances to 3. Prior managed contracts remain upgradeable without rewriting user policy. Report 22, baseline 4 and support-session 1 gain optional classification-policy evidence fields. ## [0.33.0] - 2026-09-11 ### Added - Explicit per-scan diagnostic sessions and inspectable support bundles for debugging. Collection is off by default, export is separate, and no upload service or source attachment is included. - Guided library scopes, copyable post-setup scan commands, future matching test/story exclusions, and bounded scope hints for noisy first reviews. - Production/test fragment selection, including supported Rust test attributes, with excluded-fragment counts and explicit coverage reasons. - A separate incomplete-scan artifact for candidate-pair limits, and an original provisional actionability corpus with positive and nearby negative examples. - Published documentation with focused review and support-report instructions. ### Fixed - Command argument validation and help handling, so flags after positional roots no longer silently select unintended scan paths. - JavaScript, TypeScript, TSX and Java grammar compatibility gaps, with visible parse diagnostics retained for unsupported syntax. - VS Code handling of cancelled, stale, malformed and unsaved-buffer results. - Recognition of narrowly identified generated gperf source and deterministic source snapshot handling. ### Changed - Report schema advances to 22 and configuration schema to 2. Normalization advances to 14, so prior accepted identities need explicit migration review. Supported prior official project contracts remain upgradeable. Project-contract schema stays 1, baseline schema stays 4, and receipt schema stays 2. - Support sessions introduce their own version-1 sharing contract. Existing coarse feedback sharing remains schema 1 and retains its separate consent. - Native release assets and published schemas include the support-session schema. ## [0.32.0] - 2026-09-10 ### Added - Opt-in authenticated staged analysis reuse for unchanged snapshots, with private bounded cache storage and unchanged receipt/coverage enforcement. - Explicit advisory staged review and hook policy, with strict behaviour retained by default and coverage requirements preserved in both modes. - Opt-in, project-specific local feedback with separate CI consent, bounded storage and a minimized export preview. No feedback submission or network service is included. - Actionable upgrade diagnostics for obsolete latest-release prerequisites, exhaustive review instructions and custom partial-staging restrictions. - Offline summaries of explicitly exported feedback, with separate scan and selected-finding counts and no automatic ranking changes or submission. ### Changed - Report schema advances to 21 to distinguish staged policy outcomes from analysis completeness. Hook contract advances to v2; configuration schema 1, project-contract schema 1, receipt schema 2 and baseline schema 4 remain unchanged. Normalization advances to 13 for corrected Swift optional-type/nil-coalescing grammar; affected fingerprints and prior acceptance require review. Supported prior project contracts remain upgradeable. - Agent summaries explain ranking, distinguish focused-file and background diagnostics, and summarize reasons for files without comparison fragments. - Embedded guidance preserves standing authorization and describes advisory adoption without silently changing existing enforcement. - Staged caching uses a bounded shared-location dictionary for larger reports and protected user-only Windows ACLs. CI covers all five release targets. ### Fixed - Narrow TypeScript/TSX ambient-interface import-type compatibility repair, preserving source offsets and malformed-function exclusion. - SQLite PRAGMA, STRICT, CHECK expressions, GLOB and trigger syntax; C conditional initializer branches and bounded framework macro forms; Swift cast/coalescing parsing. Grammar sources include reproducible generation provenance. - Explicit normalization 12-to-13 baseline migration preserves decisions after complete current analysis; ordinary scans still reject incompatible acceptance. - Feedback consent cannot spill into expanded changed-code scopes, and scans without findings cannot be annotated as reviewed findings. ## [0.31.0] - 2026-08-20 ### Added - Added hunk-aware changed and staged focus, so canonical staged review parses the full repository but scores only pairs that contain an exact changed-line fragment. Untracked and explicitly focused files retain whole-file focus. - Added bounded `--format agent --output ` output, which keeps the complete bounded JSON evidence outside agent context while presenting at most 25 focused identities with provenance, coverage, warnings, and receipt state. - Added a versioned `.mori-project.json` contract, deterministic schema-2 upgrade plans, safe managed-skill migration, and `mori hook pre-commit` as a thin canonical staged-review adapter. ### Changed - The embedded review skill is now a concise router with task-specific references, one-scan evidence reuse, and local project-upgrade guidance. - Unsupported staged assets are recorded as focused path evidence without creating an `other` warning solely because canonical staged review included them for coverage accounting. - Machine-readable reports advance to schema 20 for `focused_only` and exact changed-line evidence. Baseline schema remains 4 and normalization remains 12. - The preferred release toolchain advances to Go 1.26.6 for the current standard-library security fixes. ## [0.30.0] - 2026-08-13 ### Added - Added `mori review staged check` and `mori review staged acknowledge` as one canonical immutable-index workflow. Both commands now share focused-file inclusion and complete focused-coverage policy by construction, so hooks and one-commit acknowledgments cannot silently select different staged universes. - Added a deterministic staged-review lifecycle dogfood gate to `make check`, covering ignored staged source, strict coverage, acknowledgment, compatible enforcement, and stale-index rejection. - Staged-review receipt schema 2 records the focused inclusion and coverage contract and reports safe field-level differences when that contract drifts. Schema-1 receipts remain readable but fail stale across the Mori-version boundary. Report schema remains 19, baseline schema remains 4, and normalization remains 12. ### Changed - The earlier `mori review acknowledge --staged ...` form remains compatible but now points users toward the canonical staged-review workflow. ## [0.29.0] - 2026-08-11 ### Added - Baseline schema 4 adds `false-positive` as a durable review classification. Schema-3 baselines remain readable for suppression with their profile evidence intact, but require explicit migration before mutation. - Added local staged-review receipts, stored under private Git metadata by default and owner-only on POSIX filesystems, that bind an explicit focused finding acknowledgment to the exact HEAD, Git-index digest, scan profile, Mori and normalization versions, and complete sorted finding identities. Compatible receipts change only focused-match policy exit status; findings remain visible. Machine-readable reports advance to schema 19 to expose compatible receipt evidence. - Added original MIT Swift calibration cases for presentation chains and memberwise initializer shapes, including a renamed positive and reviewed unrelated false positives. They document the current structural limit; normalization remains version 12 because identifier or literal heuristics would not justify a safe scoring change. ## [0.28.1] - 2026-08-11 ### Fixed - Staged scans now load configured or explicit baselines from the same stage-zero Git-index snapshot as source, ignore rules, and configuration. Missing, external, non-regular, oversized, or malformed staged baselines fail closed instead of falling back to working-tree bytes. Report schema remained 18, baseline schema remained 3, and normalization remained 12. ## [0.28.0] - 2026-08-10 ### Added - Added immutable `--staged` scans that read tracked source, ignore rules, and configuration from one Git-index snapshot, record its digest, and exclude unstaged and untracked content by construction. - Added `--include-focused` and `--require-focused-coverage`, with per-path analyzed, deleted, excluded, unsupported, resource-limited, or undiscovered evidence and coverage exit status `4`. - Added named `.mori.json` scopes, compact one-line-per-group output, and `mori project upgrade --check|--dry-run|--apply` for coordinated local version-pin and Agent Skill maintenance with recoverable backups. ### Changed - Review ranking no longer treats generic entry-point, constructor, or anonymous callable names as distinctive same-name evidence. - Source discovery now prunes ignored build trees before loading irrelevant nested ignore files while retaining deterministic negation behavior. - Machine-readable reports now use schema version 18 for immutable input provenance, named scope evidence, and exact focused-file coverage. Baseline schema remains version 3 and normalization remains version 12. ## [0.27.0] - 2026-08-10 ### Added - Added guided `mori setup` and `mori configure` flows with safe previews, explicit writes, strict answer files, and a read-only JSON protocol for project coding agents. - Added `mori doctor`, `mori inspect`, `mori config validate`, and provenance- aware effective-configuration output for first-run diagnosis and ongoing maintenance. - Added `mori explain`, self-contained HTML reports, restrained terminal color, and opt-in deterministic `--redact-paths` placeholders for reports that cross a project boundary. - Added a bounded local Language Server Protocol implementation and a packaged, dependency-free VS Code reference client for diagnostics on unsaved buffers. - Added C, C++, Dart, GDScript, Kotlin, Lua, Luau, PowerShell, and Ruby parsing, function-boundary extraction, ABI checks, editor activation, documentation, and calibrated cross-language positive and nearby-negative fixtures. - Added checksum-pinned Homebrew, Scoop, and WinGet release manifests, an SPDX source-dependency SBOM, and signed GitHub/Sigstore attestations for release assets and the checksum manifest. - Added a compact new-user README, task-oriented documentation, a Mori favicon, and responsive forest-themed project artwork. ### Changed - Normalization now uses version 12, with canonical mappings required by the newly supported grammars. Existing baselines require deliberate review and regeneration because scores and fingerprints can change. Report schema remains version 17 and baseline schema remains version 3. - Release verification now checks native archives, the portable Agent Skill, the JSON Schema, the VS Code package, package-manager metadata, checksums, and representative provenance attestations before completion. ## [0.26.0] - 2026-08-10 ### Added - Added PHP support for `.php` and `.phtml` using the official Tree-sitter PHP grammar, covering implemented functions, methods, anonymous functions, and arrow functions. - Added Hack support for `.hack` and bounded legacy `