From 0a755b422bd6362fd18881349351e7e348a65428 Mon Sep 17 00:00:00 2001
From: "github-actions[bot]"
 <41898282+github-actions[bot]@users.noreply.github.com>
Date: Wed, 8 Jul 2026 09:47:49 +0000
Subject: [PATCH 1/5] chore(release): cut engine v0.2.0

---
 .release-please-manifest.json           |  2 +-
 packages/gittensory-engine/CHANGELOG.md | 15 +++++++++++++++
 packages/gittensory-engine/package.json |  2 +-
 3 files changed, 17 insertions(+), 2 deletions(-)

diff --git a/.release-please-manifest.json b/.release-please-manifest.json
index d6d7671cec..0a937df43d 100644
--- a/.release-please-manifest.json
+++ b/.release-please-manifest.json
@@ -1,4 +1,4 @@
 {
   "packages/gittensory-mcp": "0.7.0",
-  "packages/gittensory-engine": "0.1.0"
+  "packages/gittensory-engine": "0.2.0"
 }
diff --git a/packages/gittensory-engine/CHANGELOG.md b/packages/gittensory-engine/CHANGELOG.md
index 31bb0d956d..ae28e79bdf 100644
--- a/packages/gittensory-engine/CHANGELOG.md
+++ b/packages/gittensory-engine/CHANGELOG.md
@@ -1,5 +1,20 @@
 # Changelog
 
+## [0.2.0](https://github.com/JSONbored/gittensory/compare/engine-v0.1.0...engine-v0.2.0) (2026-07-08)
+
+
+### Features
+
+* **review:** add REES complexity and Go/Python error-defect analyzers ([#4155](https://github.com/JSONbored/gittensory/issues/4155)) ([f5c5c52](https://github.com/JSONbored/gittensory/commit/f5c5c5237da04910688369dbf0cf2a1d9371593e))
+* **review:** per-repo opt-in to let a confident AI-judgment blocker gate the merge ([#4171](https://github.com/JSONbored/gittensory/issues/4171)) ([4664ad2](https://github.com/JSONbored/gittensory/commit/4664ad25f4c729ded6a37c3d5d6d5a56857d73e7))
+
+
+### Fixes
+
+* **engine:** fix stale test fixtures, wire the suite into test:ci ([#4150](https://github.com/JSONbored/gittensory/issues/4150)) ([5a4de69](https://github.com/JSONbored/gittensory/commit/5a4de69a67ae0d1704284d6237cd70d34ee2461a))
+
+## Changelog
+
 ## engine-v0.1.0 - 2026-07-01
 
 ### Features
diff --git a/packages/gittensory-engine/package.json b/packages/gittensory-engine/package.json
index cde57a761c..9e6b30ef25 100644
--- a/packages/gittensory-engine/package.json
+++ b/packages/gittensory-engine/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@jsonbored/gittensory-engine",
-  "version": "0.1.0",
+  "version": "0.2.0",
   "license": "AGPL-3.0-only",
   "type": "module",
   "description": "Shared deterministic engine logic for the Gittensory review stack and gittensory-miner.",

From 826b46d4c52e24d1ba4dc2eaec6bb05af3cf7293 Mon Sep 17 00:00:00 2001
From: JSONbored <49853598+JSONbored@users.noreply.github.com>
Date: Wed, 8 Jul 2026 03:04:23 -0700
Subject: [PATCH 2/5] fix: widen gittensory-engine dependency ranges past
 caret's 0.x ceiling

npm ci failed with "Missing: @jsonbored/gittensory-engine@0.1.0 from lock
file" once this PR bumped packages/gittensory-engine to 0.2.0: semver
caret ranges for 0.x versions only allow patch bumps (^0.1.0 means
>=0.1.0 <0.2.0), so gittensory-mcp's "^0.1.0" and gittensory-miner's
exact "0.1.0" pin both broke on this release's own minor bump. Widened
both to ">=0.1.0" -- these are internal, same-monorepo dependencies
whose real compatibility guarantee comes from this repo's own test
suite, not from strict semver-range enforcement against a pre-1.0
package expected to move through minor versions somewhat often.
---
 package-lock.json                      | 6 +++---
 packages/gittensory-mcp/package.json   | 2 +-
 packages/gittensory-miner/package.json | 2 +-
 3 files changed, 5 insertions(+), 5 deletions(-)

diff --git a/package-lock.json b/package-lock.json
index 98c7ab69dc..c649bc9cea 100644
--- a/package-lock.json
+++ b/package-lock.json
@@ -15864,7 +15864,7 @@
     },
     "packages/gittensory-engine": {
       "name": "@jsonbored/gittensory-engine",
-      "version": "0.1.0",
+      "version": "0.2.0",
       "license": "AGPL-3.0-only",
       "dependencies": {
         "yaml": "^2.9.0"
@@ -15899,7 +15899,7 @@
       "version": "0.7.0",
       "license": "AGPL-3.0-only",
       "dependencies": {
-        "@jsonbored/gittensory-engine": "^0.1.0",
+        "@jsonbored/gittensory-engine": ">=0.1.0",
         "@modelcontextprotocol/sdk": "1.29.0",
         "zod": "^4.4.3"
       },
@@ -15915,7 +15915,7 @@
       "version": "0.1.0",
       "license": "AGPL-3.0-only",
       "dependencies": {
-        "@jsonbored/gittensory-engine": "0.1.0"
+        "@jsonbored/gittensory-engine": ">=0.1.0"
       },
       "bin": {
         "gittensory-miner": "bin/gittensory-miner.js"
diff --git a/packages/gittensory-mcp/package.json b/packages/gittensory-mcp/package.json
index 20ffe8a77f..a151506f8a 100644
--- a/packages/gittensory-mcp/package.json
+++ b/packages/gittensory-mcp/package.json
@@ -38,7 +38,7 @@
     "build": "node --check bin/gittensory-mcp.js && node --check lib/local-branch.js && node --check scripts/gittensor-score-preview.mjs"
   },
   "dependencies": {
-    "@jsonbored/gittensory-engine": "^0.1.0",
+    "@jsonbored/gittensory-engine": ">=0.1.0",
     "@modelcontextprotocol/sdk": "1.29.0",
     "zod": "^4.4.3"
   },
diff --git a/packages/gittensory-miner/package.json b/packages/gittensory-miner/package.json
index fa11aa7ad3..5edb6da7f3 100644
--- a/packages/gittensory-miner/package.json
+++ b/packages/gittensory-miner/package.json
@@ -34,7 +34,7 @@
     "build": "node --check bin/gittensory-miner.js && node --check lib/cli.js && node --check lib/deny-check.js && node --check lib/run-state-cli.js && node --check lib/update-check.js && node --check lib/opportunity-fanout.js && node --check lib/ci-poller.js && node --check lib/run-state.js && node --check lib/deny-hooks.js && node --check lib/event-ledger.js && node --check lib/event-ledger-cli.js && node --check lib/claim-ledger.js && node --check lib/claim-ledger-expiry.js && node --check lib/portfolio-queue.js && node --check lib/portfolio-queue-cli.js && node --check lib/portfolio-discovery.js && node --check lib/opportunity-ranker.js && node --check lib/plan-store.js && node --check lib/plan-store-cli.js && node --check lib/rejection-templates.js && node --check lib/governor-ledger.js && node --check lib/governor-ledger-cli.js && node --check lib/manage-status.js && node --check lib/manage-poll.js && node --check lib/status.js && node --check lib/laptop-init.js && node --check lib/replay-objective-anchor.js && node --check lib/replay-task-generation.js && node --check lib/calibration-types.js && node --check lib/calibration.js"
   },
   "dependencies": {
-    "@jsonbored/gittensory-engine": "0.1.0"
+    "@jsonbored/gittensory-engine": ">=0.1.0"
   },
   "engines": {
     "node": ">=22.13.0"

From 199d46605351ffd8f3ba2d6dbe138988ad1c9c25 Mon Sep 17 00:00:00 2001
From: JSONbored <49853598+JSONbored@users.noreply.github.com>
Date: Wed, 8 Jul 2026 03:20:27 -0700
Subject: [PATCH 3/5] fix(engine): derive ENGINE_VERSION instead of
 hand-syncing it

Same root cause as the package-lock.json/dependency-range fixes already
pushed to this branch: ENGINE_VERSION was a hardcoded literal that
test/unit/engine-version.test.ts correctly caught as stale against this
release's package.json bump. See fix/release-please-lockfile-sync (#4179)
for the full story and verification.
---
 packages/gittensory-engine/src/version.ts    | 19 ++++++++++++++-----
 test/unit/gittensory-engine-scaffold.test.ts |  2 +-
 2 files changed, 15 insertions(+), 6 deletions(-)

diff --git a/packages/gittensory-engine/src/version.ts b/packages/gittensory-engine/src/version.ts
index be6f0b62b7..600d231e01 100644
--- a/packages/gittensory-engine/src/version.ts
+++ b/packages/gittensory-engine/src/version.ts
@@ -1,5 +1,14 @@
-/**
- * Published semver of `@jsonbored/gittensory-engine`. Keep in lockstep with `package.json` `version`
- * (enforced by `test/unit/engine-version.test.ts`).
- */
-export const ENGINE_VERSION = "0.1.0";
+import { readFileSync } from "node:fs";
+import { fileURLToPath, URL } from "node:url";
+
+// Read at runtime instead of a hand-synced literal -- works identically from src/version.ts
+// (source, under vitest) and dist/version.js (compiled output): package.json is always the
+// direct parent of both directories, and this is a plain file read, not a compile-time import,
+// so it isn't subject to tsconfig's rootDir: "src" restriction. URL imported explicitly from
+// node:url (not the ambient global) -- they've subtly diverged in this @types/node version
+// (Symbol.dispose on URLSearchParamsIterator), which fileURLToPath's overloads reject otherwise.
+const ownPackageJsonPath = fileURLToPath(new URL("../package.json", import.meta.url));
+const ownPackageJson = JSON.parse(readFileSync(ownPackageJsonPath, "utf8")) as { version: string };
+
+/** Published semver of `@jsonbored/gittensory-engine`, derived from this package's own package.json. */
+export const ENGINE_VERSION: string = ownPackageJson.version;
diff --git a/test/unit/gittensory-engine-scaffold.test.ts b/test/unit/gittensory-engine-scaffold.test.ts
index 5307c6ca31..b7da0b3fbb 100644
--- a/test/unit/gittensory-engine-scaffold.test.ts
+++ b/test/unit/gittensory-engine-scaffold.test.ts
@@ -7,7 +7,7 @@ import enginePkg from "../../packages/gittensory-engine/package.json";
 describe("gittensory-engine package scaffold", () => {
   it("declares the published package identity", () => {
     expect(enginePkg.name).toBe("@jsonbored/gittensory-engine");
-    expect(enginePkg.version).toBe("0.1.0");
+    expect(enginePkg.version).toMatch(/^\d+\.\d+\.\d+$/);
     expect(enginePkg.type).toBe("module");
     expect(enginePkg.license).toBe("AGPL-3.0-only");
     expect(enginePkg.publishConfig?.access).toBe("public");

From 3d64fdee067ca757aa2eff9f816ca6b03d7f47c6 Mon Sep 17 00:00:00 2001
From: JSONbored <49853598+JSONbored@users.noreply.github.com>
Date: Wed, 8 Jul 2026 03:39:14 -0700
Subject: [PATCH 4/5] fix: cap engine dependency ranges below 1.0.0, use
 compile-time JSON import

Two fixes squashed onto this branch, both already landed on
fix/release-please-lockfile-sync (#4179):

- Superagent correctly flagged >=0.1.0 as overly permissive (unbounded
  above, would accept a future major/compromised version with no review).
  Capped at ">=0.1.0 <1.0.0" -- tolerates all current and future 0.x
  releases without needing a re-bump, while still rejecting 1.0.0+.
- ENGINE_VERSION's readFileSync approach broke the Workers runtime test
  suite (no real filesystem in the workerd sandbox). Switched to a
  compile-time JSON import, matching src/services/mcp-compatibility.ts's
  existing pattern -- Node's ESM loader resolves it at runtime for real
  installs, while the Worker's own esbuild bundling inlines it at build
  time for the bundled path, so neither consumer ever does runtime file I/O.
---
 package-lock.json                         |  4 ++--
 packages/gittensory-engine/src/version.ts | 12 +-----------
 packages/gittensory-mcp/package.json      |  2 +-
 packages/gittensory-miner/package.json    |  2 +-
 4 files changed, 5 insertions(+), 15 deletions(-)

diff --git a/package-lock.json b/package-lock.json
index c649bc9cea..b472807276 100644
--- a/package-lock.json
+++ b/package-lock.json
@@ -15899,7 +15899,7 @@
       "version": "0.7.0",
       "license": "AGPL-3.0-only",
       "dependencies": {
-        "@jsonbored/gittensory-engine": ">=0.1.0",
+        "@jsonbored/gittensory-engine": ">=0.1.0 <1.0.0",
         "@modelcontextprotocol/sdk": "1.29.0",
         "zod": "^4.4.3"
       },
@@ -15915,7 +15915,7 @@
       "version": "0.1.0",
       "license": "AGPL-3.0-only",
       "dependencies": {
-        "@jsonbored/gittensory-engine": ">=0.1.0"
+        "@jsonbored/gittensory-engine": ">=0.1.0 <1.0.0"
       },
       "bin": {
         "gittensory-miner": "bin/gittensory-miner.js"
diff --git a/packages/gittensory-engine/src/version.ts b/packages/gittensory-engine/src/version.ts
index 600d231e01..2a4c8fbbab 100644
--- a/packages/gittensory-engine/src/version.ts
+++ b/packages/gittensory-engine/src/version.ts
@@ -1,14 +1,4 @@
-import { readFileSync } from "node:fs";
-import { fileURLToPath, URL } from "node:url";
-
-// Read at runtime instead of a hand-synced literal -- works identically from src/version.ts
-// (source, under vitest) and dist/version.js (compiled output): package.json is always the
-// direct parent of both directories, and this is a plain file read, not a compile-time import,
-// so it isn't subject to tsconfig's rootDir: "src" restriction. URL imported explicitly from
-// node:url (not the ambient global) -- they've subtly diverged in this @types/node version
-// (Symbol.dispose on URLSearchParamsIterator), which fileURLToPath's overloads reject otherwise.
-const ownPackageJsonPath = fileURLToPath(new URL("../package.json", import.meta.url));
-const ownPackageJson = JSON.parse(readFileSync(ownPackageJsonPath, "utf8")) as { version: string };
+import ownPackageJson from "../package.json" with { type: "json" };
 
 /** Published semver of `@jsonbored/gittensory-engine`, derived from this package's own package.json. */
 export const ENGINE_VERSION: string = ownPackageJson.version;
diff --git a/packages/gittensory-mcp/package.json b/packages/gittensory-mcp/package.json
index a151506f8a..f623d7bca7 100644
--- a/packages/gittensory-mcp/package.json
+++ b/packages/gittensory-mcp/package.json
@@ -38,7 +38,7 @@
     "build": "node --check bin/gittensory-mcp.js && node --check lib/local-branch.js && node --check scripts/gittensor-score-preview.mjs"
   },
   "dependencies": {
-    "@jsonbored/gittensory-engine": ">=0.1.0",
+    "@jsonbored/gittensory-engine": ">=0.1.0 <1.0.0",
     "@modelcontextprotocol/sdk": "1.29.0",
     "zod": "^4.4.3"
   },
diff --git a/packages/gittensory-miner/package.json b/packages/gittensory-miner/package.json
index 5edb6da7f3..f05833fcc8 100644
--- a/packages/gittensory-miner/package.json
+++ b/packages/gittensory-miner/package.json
@@ -34,7 +34,7 @@
     "build": "node --check bin/gittensory-miner.js && node --check lib/cli.js && node --check lib/deny-check.js && node --check lib/run-state-cli.js && node --check lib/update-check.js && node --check lib/opportunity-fanout.js && node --check lib/ci-poller.js && node --check lib/run-state.js && node --check lib/deny-hooks.js && node --check lib/event-ledger.js && node --check lib/event-ledger-cli.js && node --check lib/claim-ledger.js && node --check lib/claim-ledger-expiry.js && node --check lib/portfolio-queue.js && node --check lib/portfolio-queue-cli.js && node --check lib/portfolio-discovery.js && node --check lib/opportunity-ranker.js && node --check lib/plan-store.js && node --check lib/plan-store-cli.js && node --check lib/rejection-templates.js && node --check lib/governor-ledger.js && node --check lib/governor-ledger-cli.js && node --check lib/manage-status.js && node --check lib/manage-poll.js && node --check lib/status.js && node --check lib/laptop-init.js && node --check lib/replay-objective-anchor.js && node --check lib/replay-task-generation.js && node --check lib/calibration-types.js && node --check lib/calibration.js"
   },
   "dependencies": {
-    "@jsonbored/gittensory-engine": ">=0.1.0"
+    "@jsonbored/gittensory-engine": ">=0.1.0 <1.0.0"
   },
   "engines": {
     "node": ">=22.13.0"

From c38e0bb1b55cfd360c0653c414b8d8ef0b52c989 Mon Sep 17 00:00:00 2001
From: JSONbored <49853598+JSONbored@users.noreply.github.com>
Date: Wed, 8 Jul 2026 03:51:49 -0700
Subject: [PATCH 5/5] chore: force re-scan (dependency range fix already
 verified correct)

packages/gittensory-mcp and packages/gittensory-miner both already pin
@jsonbored/gittensory-engine to >=0.1.0 <1.0.0 (in package.json and
package-lock.json). Superagent's check-run on this branch is stuck
reporting the pre-fix finding; this empty commit forces a clean
re-scan.