chore: release - #1489
Conversation
PR Quality Gate Summary
Blocking issues
|
tangletools
left a comment
tangletools
left a comment
There was a problem hiding this comment.
🟢 Value Audit — sound
| Verdict | sound |
| Coverage | 2 of 2 lenses (value, usefulness) |
| Concerns | 0 (none) |
| Heuristic | 0.0s |
| Duplication | 0.0s |
| Interrogation | 38.8s (2 bridge agents) |
| Total | 38.8s |
💰 Value — sound
A routine, fully-automated release-plz version bump across 21 crates (manifests + workspace deps + Cargo.lock + changelogs, zero source changes) that exactly matches the repo's established release pipeline; ship.
- What it does: Bumps 21 workspace crates one alpha version each (e.g. blueprint-sdk 0.2.0-alpha.13 -> 0.2.0-alpha.14, cargo-tangle 0.5.0-alpha.14 -> 0.5.0-alpha.15, blueprint-qos 0.2.0-alpha.14 -> 0.2.0-alpha.15), synchronizes the matching version references in the root Cargo.toml [workspace.dependencies] block, refreshes Cargo.lock, and prepends generated CHANGELOG.md entries ('update Cargo.toml dependencies' /
- Goals it achieves: Cuts the release train since the last release PR (#1478, commit 3a0d1a8, 2026-08-02): the dependency/MSRV churn merged since then (#1484 cargo-generate + MSRV 1.91->1.93, dependabot bumps like #1471-#1475) is currently unpublished and unversioned. Merging stamps it into versioned alpha releases so crates.io consumers and the manual batch publish (publish-crates.yml) can pick it up.
- Assessment: Good on its merits. This is the repo's own release machinery doing exactly what it was built for: .github/workflows/release-plz.yml opens these PRs on push to main, release-plz.toml defines the changelog parsing (CI/docs commits correctly skipped, dep commits grouped under 'Other'), and the git log shows the identical pattern recurring (#1431, #1435, #1456, #1458, #1464, #1470, #1478). Version sel
- Better / existing approach: none — this is the right approach. Searched for alternatives: the repo already runs the two alternatives people typically reach for (cargo-release via dist-workspace.toml for binaries, release-plz for crates), and this PR is the output of the existing release-plz pipeline, not a reinvention. Reusing/extending that tooling is exactly what it does.
- Model: opencode/zai-coding-plan/glm-5.2
- Bridge attempts: 2
- Bridge warning: opencode/kimi-for-coding/k2p7: opencode: opencode error
🎯 Usefulness — sound
Routine release-plz version bump across 21 crates (Cargo.toml + Cargo.lock + CHANGELOG), no functional changes; matches the established release pattern used in prior PRs.
- Integration: All bumped crates are wired through [workspace.dependencies] in Cargo.toml (Cargo.toml:127-219) and consumed by each other and by the cargo-tangle binary; versions stay internally consistent (verified: 44 workspace-dep lines match per-crate Cargo.toml versions). Downstream consumers pull these from crates.io on publish. Nothing is added or removed — pure metadata.
- Fit with existing patterns: Follows the exact release-plz pattern of prior releases (commit 3a0d1a8 #1478, b06d18d #1470, d4854f8 #1464 have identical file/line shape). release-plz.toml at repo root configures this flow (publish=false, batch manual publish). No competing release mechanism exists.
- Real-world viability: No behavioral code changes — only version strings and changelog entries. Nothing to break under concurrency, error paths, or edge inputs. semver_check=false in config, so no compatibility verification, but all bumps are alpha patch increments within the same 0.2.0-alpha line.
- Model: opencode/zai-coding-plan/glm-5.2
- Bridge attempts: 1
No concerns — sound change, no better or existing approach found. ✅
What this audit checks
It judges the change on its merits — not whether it was tasked out in an issue. Unticketed, fast-moving work is fine; the question is whether the change is good and whether a better or existing approach should be used instead.
| Pass | What it asks |
|---|---|
| Heuristic | Vague title? Whitespace-only or cruft-bearing diff? (content signals only) |
| Duplication | Do added function/class names already exist elsewhere in the repo? |
| Value Audit | What does it do? What goal does it achieve? Is it good? Better architecture or already-exists? |
| Usefulness Audit | Does it integrate and fit? Will it hold up in real use and actually get used? |
Findings are concerns, not blocks — the human reviewer decides what to do with them.
✅ No Blockers —
|
| opencode GLM 5.2 | opencode DeepSeek v4 Pro | opencode DeepSeek v4 Flash | aggregate | |
|---|---|---|---|---|
| Readiness | 92 | 92 | 92 | 92 |
| Confidence | 95 | 95 | 95 | 95 |
| Correctness | 92 | 92 | 92 | 92 |
| Security | 92 | 92 | 92 | 92 |
| Testing | 92 | 92 | 92 | 92 |
| Architecture | 92 | 92 | 92 | 92 |
Reviewer score is advisory once the run is complete and the verdict has no blockers.
Full multi-shot audit completed 8/8 planned shots over 44 changed files. Global verifier still owns final merge decision. | Full multi-shot audit completed 8/8 planned shots over 44 changed files. Global verifier still owns final merge decision. | Full multi-shot audit completed 8/8 planned shots over 44 changed files. Global verifier still owns final merge decision.
🟡 LOW Changelog entry text does not match actual diff — crates/chain-setup/anvil/CHANGELOG.md
The 0.2.0-alpha.14 entry says 'update Cargo.toml dependencies', but the only Cargo.toml change is the version bump 0.2.0-alpha.13 -> 0.2.0-alpha.14; no dependency lines changed. This is release-plz auto-generated boilerplate and harmless, but if a maintainer greps changelogs for meaningful changes they will be misled. Fix is optional: either note the version bump explicitly or accept the tool-generated line.
🟡 LOW CHANGELOG body text does not match the actual change — crates/clients/evm/CHANGELOG.md
The entry says 'update Cargo.toml dependencies' but the only Cargo.toml delta in this release is the version field bump from 0.2.0-alpha.7 to 0.2.0-alpha.8; no dependency rows changed. This is cargo-release template boilerplate, not a hand-written claim, so impact is cosmetic. No fix required for merge; flagging only because the changelog is technically inaccurate as documentation.
🟡 LOW Changelog entry describes a dependency update that did not occur — crates/clients/evm/CHANGELOG.md
The 0.2.0-alpha.8 entry says '- update Cargo.toml dependencies', but the Cargo.toml diff in this commit changes only the package version (0.2.0-alpha.7 -> 0.2.0-alpha.8); no dependency entries or versions changed. This is cargo-release auto-generated wording and is cosmetic, but it misleads readers of the changelog about what shipped. Fix: regenerate or hand-edit the entry to state the version bump (e.g. 'release: blueprint-client-evm 0.2.0-alpha.8').
tangletools · 2026-08-13T19:32:27Z · trace
tangletools
left a comment
tangletools
left a comment
There was a problem hiding this comment.
✅ Approved — 3 non-blocking findings — 76e514be
Full multi-shot audit completed 8/8 planned shots over 44 changed files. Global verifier still owns final merge decision. | Full multi-shot audit completed 8/8 planned shots over 44 changed files. Global verifier still owns final merge decision. | Full multi-shot audit completed 8/8 planned shots over 44 changed files. Global verifier still owns final merge decision.
Full immutable report for this review: trace
Summary comment for this run: full summary
tangletools · 2026-08-13T19:32:27Z · immutable trace
4975d94 to
e5a06e1
Compare
tangletools
left a comment
tangletools
left a comment
There was a problem hiding this comment.
🟢 Value Audit — sound
| Verdict | sound |
| Coverage | 2 of 2 lenses (value, usefulness) |
| Concerns | 0 (none) |
| Heuristic | 0.0s |
| Duplication | 0.0s |
| Interrogation | 259.6s (2 bridge agents) |
| Total | 259.6s |
💰 Value — sound
A release-plz generated release PR that publishes the two BLS aggregation fixes (#1495/#1496) by bumping the three changed crates plus their 25 transitive workspace dependents — exactly the repo's established release pattern.
- What it does: Bumps 28 workspace crates one alpha patch level (e.g. blueprint-crypto-bn254 0.2.0-alpha.9→10, blueprint-tangle-aggregation-svc and blueprint-tangle-extra 0.2.0-alpha.12→13, blueprint-sdk 0.2.0-alpha.13→14), updates the corresponding version requirements in the root Cargo.toml workspace.dependencies block, regenerates Cargo.lock, and appends changelog entries. The substantive payload is commits fa
- Goals it achieves: Gets the BLS aggregation fixes onto crates.io so downstream blueprint authors can consume them, and keeps in-workspace version requirements (path + version dual deps in Cargo.toml:127-231) consistent so the workspace still builds after publish. Release config (release-plz.toml:3) sets publish=false, so the PR itself is the version/changelog/lockfile step of a manual batch-publish flow.
- Assessment: Good on its merits. Coverage is complete and minimal:
git log 3a0d1a8..e5a06e1shows the only commits since the previous release (3a0d1a8, same shape at 92 files) are the two fix commits, and every crate they touched is bumped; everything else bumped is a required dependent. Changelogs correctly group the fixes. This matches the established pattern — 9 prior 'chore: release' commits with identic - Better / existing approach: none — this is the right approach. The change is machine-generated by the repo's own release-plz config (release-plz.toml), which exists precisely for this; no hand-rolled or duplicated release scripting to compare against.
- Model: opencode/zai-coding-plan/glm-5.2
- Bridge attempts: 5
- Bridge warning: opencode/kimi-for-coding/k2p7: opencode: opencode error
🎯 Usefulness — sound
A mechanical release-plz version bump publishing the bn254/tangle aggregation fixes (#1495, #1496) and their downstream dependents; 58 files touched, all Cargo.toml/Cargo.lock/CHANGELOG.md, no source changes.
- Integration: Fully reachable: the release machinery (.github/workflows/release-plz.yml, publish-crates.yml) consumes this commit directly. All 29 bumped manifests keep workspace.dependencies versions in lockstep with crate versions (root Cargo.toml diff shows both sides updated), and Cargo.lock is regenerated, so the workspace stays internally consistent. The pattern is identical to the prior release commit 3a
- Fit with existing patterns: Follows the repo's established release cadence exactly (release-plz workspace bump, per-crate changelogs with 'updated the following local packages' entries for transitive bumps). No competing mechanism exists.
- Real-world viability: Nothing beyond version arithmetic changed; the actual behavior shipped was reviewed in PRs #1495/#1496. The crates that genuinely changed since the last release (crypto/bn254, tangle-aggregation-svc, tangle-extra — verified via git diff 3a0d1a8..HEAD~1) are all included in the bump set, so no changed crate is left unpublished.
- Model: opencode/zai-coding-plan/glm-5.2
- Bridge attempts: 3
No concerns — sound change, no better or existing approach found. ✅
What this audit checks
It judges the change on its merits — not whether it was tasked out in an issue. Unticketed, fast-moving work is fine; the question is whether the change is good and whether a better or existing approach should be used instead.
| Pass | What it asks |
|---|---|
| Heuristic | Vague title? Whitespace-only or cruft-bearing diff? (content signals only) |
| Duplication | Do added function/class names already exist elsewhere in the repo? |
| Value Audit | What does it do? What goal does it achieve? Is it good? Better architecture or already-exists? |
| Usefulness Audit | Does it integrate and fit? Will it hold up in real use and actually get used? |
Findings are concerns, not blocks — the human reviewer decides what to do with them.
✅ No Blockers —
|
| opencode GLM 5.2 | opencode DeepSeek v4 Pro | opencode DeepSeek v4 Flash | aggregate | |
|---|---|---|---|---|
| Readiness | 95 | 92 | 92 | 92 |
| Confidence | 95 | 95 | 95 | 95 |
| Correctness | 95 | 92 | 92 | 92 |
| Security | 95 | 92 | 92 | 92 |
| Testing | 95 | 92 | 92 | 92 |
| Architecture | 95 | 92 | 92 | 92 |
Reviewer score is advisory once the run is complete and the verdict has no blockers.
Full multi-shot audit completed 8/8 planned shots over 58 changed files. Global verifier still owns final merge decision. | Full multi-shot audit completed 8/8 planned shots over 58 changed files. Global verifier still owns final merge decision. | Full multi-shot audit completed 8/8 planned shots over 58 changed files. Global verifier still owns final merge decision.
🟡 LOW Changelog lists duplicate crate names and a not-yet-bumped crate — crates/networking/extensions/agg-sig-gossip/CHANGELOG.md
The auto-generated entry reads 'updated the following local packages: blueprint-crypto, blueprint-crypto, blueprint-networking, blueprint-networking, blueprint-gossip-primitives'. Duplicates arise because release-plz emits one line per (normal + dev) dependency reference; this same pattern appears in every prior entry in this file's history, so it is cosmetic. Additionally 'blueprint-crypto' is listed as updated, but workspace root Cargo.toml:175 still pins blueprint-crypto at 0.2.0-alpha.10 while these crates moved to alpha.11; this is a pre-existing cross-crate release-ordering detail, not a build break (deps resolve by path), and falls outside this shot's files. No action required to merge.
🟡 LOW Entry lacks the referencing PR number; existing entries mix formats — crates/webhooks/CHANGELOG.md
release-plz generated this entry as a bare 'updated the following local packages: blueprint-runner' without a '#NNNN' suffix, while the alpha.13 entry (line 20) carries '#1479'. This is a cosmetic inconsistency from the release tool, not a defect. No action required; noted only for awareness.
tangletools · 2026-08-14T08:57:14Z · trace
tangletools
left a comment
tangletools
left a comment
There was a problem hiding this comment.
✅ Approved — 2 non-blocking findings — e5a06e1d
Full multi-shot audit completed 8/8 planned shots over 58 changed files. Global verifier still owns final merge decision. | Full multi-shot audit completed 8/8 planned shots over 58 changed files. Global verifier still owns final merge decision. | Full multi-shot audit completed 8/8 planned shots over 58 changed files. Global verifier still owns final merge decision.
Full immutable report for this review: trace
Summary comment for this run: full summary
tangletools · 2026-08-14T08:57:14Z · immutable trace
e5a06e1 to
433b4b6
Compare
tangletools
left a comment
tangletools
left a comment
There was a problem hiding this comment.
🟢 Value Audit — sound
| Verdict | sound |
| Coverage | 2 of 2 lenses (value, usefulness) |
| Concerns | 0 (none) |
| Heuristic | 0.0s |
| Duplication | 0.0s |
| Interrogation | 61.2s (2 bridge agents) |
| Total | 61.2s |
💰 Value — sound
A standard release-plz workspace release bumping 28 crates to publish three BLS/TNT-0.19 aggregation fixes landed since the last release; exactly the repo's established mechanism, correctly applied.
- What it does: Bumps versions of 28 workspace crates (Cargo.toml + Cargo.lock), regenerates each crate's CHANGELOG.md entry, and leaves source code untouched (58 files, all manifests/lock/changelog). Four crates carry real changes since the prior release (3a0d1a8, PR #1478): blueprint-crypto-bn254, blueprint-tangle-aggregation-svc, blueprint-tangle-extra, and blueprint-client-tangle, covering commits 8ea15d2 (al
- Goals it achieves: Gets the aggregation fixes from #1495/#1496/#1497 into published, resolvable crate versions. Because the workspace pins path deps with explicit version strings (root Cargo.toml), any bump of a leaf crate forces bumps of all dependents — the release makes the whole workspace internally consistent so
cargo publish(batched manually per release-plz.tomlpublish = false) and downstream consumers r - Assessment: Good. This is the repo's configured release mechanism end to end: release-plz.toml drives it, .github/workflows/release-plz.yml gates it, and the identical pattern ran at 3a0d1a8 'chore: release (#1478)'. The change set is exactly what a release commit should be — manifests, lockfile, changelogs, zero source diffs — and every bumped crate maps to either a real fix or a transitive path-dep requirem
- Better / existing approach: none — this is the right approach. Checked: release-plz.toml and .github/workflows/release-plz.yml define this exact flow (workspace release, batched manual publish, changelog commit parsers); prior release PR #1478 (3a0d1a8) followed the same shape; no alternative release tooling exists in the repo (dist-workspace.toml covers only the cargo-tangle binary artifacts, complementary not duplicative).
- Model: opencode/zai-coding-plan/glm-5.2
- Bridge attempts: 2
- Bridge warning: opencode/kimi-for-coding/k2p7: opencode: opencode error
🎯 Usefulness — sound
Routine release-please version bump that publishes three real aggregation fixes (#1495/#1496/#1497) to crates.io, with all 28 crate versions, workspace dependency declarations, Cargo.lock, and changelogs updated in verified lockstep.
- Integration: This PR is the repo's established release vehicle (webb-spider[bot] release automation; prior entries e.g. 2026-08-02 alphas follow the identical structure). The bumped crates are exactly those touched by the three functional commits since last release (crates/crypto/bn254, crates/tangle-aggregation-svc, crates/tangle-extra, crates/clients/tangle — confirmed via
git show <fix> --stat) plus their - Fit with existing patterns: Fits exactly: pre-release alpha.N → alpha.N+1 bumps for non-breaking 0.x changes match the repo's release cadence, and the CHANGELOG.md entries correctly attribute the fixes to the crates that contain them (crates/crypto/bn254/CHANGELOG.md and crates/tangle-aggregation-svc/CHANGELOG.md list #1495+#1496; crates/tangle-extra/CHANGELOG.md lists all three; crates/clients/tangle/CHANGELOG.md lists #149
- Real-world viability: Mechanical metadata change; no runtime surface altered. Cargo.lock entries for every bumped package were regenerated consistently (all 56 lock changes are version-string-only). Version-requirement resolution is internally consistent, so workspace builds and publishes resolve cleanly. Alpha semver handling is correct for this stage.
- Model: opencode/zai-coding-plan/glm-5.2
- Bridge attempts: 1
No concerns — sound change, no better or existing approach found. ✅
What this audit checks
It judges the change on its merits — not whether it was tasked out in an issue. Unticketed, fast-moving work is fine; the question is whether the change is good and whether a better or existing approach should be used instead.
| Pass | What it asks |
|---|---|
| Heuristic | Vague title? Whitespace-only or cruft-bearing diff? (content signals only) |
| Duplication | Do added function/class names already exist elsewhere in the repo? |
| Value Audit | What does it do? What goal does it achieve? Is it good? Better architecture or already-exists? |
| Usefulness Audit | Does it integrate and fit? Will it hold up in real use and actually get used? |
Findings are concerns, not blocks — the human reviewer decides what to do with them.
✅ No Blockers —
|
| opencode GLM 5.2 | opencode DeepSeek v4 Pro | opencode DeepSeek v4 Flash | aggregate | |
|---|---|---|---|---|
| Readiness | 95 | 92 | 95 | 92 |
| Confidence | 95 | 95 | 95 | 95 |
| Correctness | 95 | 92 | 95 | 92 |
| Security | 95 | 92 | 95 | 92 |
| Testing | 95 | 92 | 95 | 92 |
| Architecture | 95 | 92 | 95 | 92 |
Reviewer score is advisory once the run is complete and the verdict has no blockers.
Full multi-shot audit completed 8/8 planned shots over 58 changed files. Global verifier still owns final merge decision. | Full multi-shot audit completed 8/8 planned shots over 58 changed files. Global verifier still owns final merge decision. | Full multi-shot audit completed 8/8 planned shots over 58 changed files. Global verifier still owns final merge decision.
🟡 LOW Duplicate package names in release-plz changelog entries — crates/networking/extensions/agg-sig-gossip/CHANGELOG.md
The 'updated the following local packages' line lists 'blueprint-crypto, blueprint-crypto, blueprint-networking, blueprint-networking, blueprint-gossip-primitives' with duplicate entries. Same pattern in round-based (line 14) and prior releases (alpha.10, alpha.7). This is tool-generated noise, not a functional defect. Fix only if de-duping the release-plz changelog is desired; no impact on build or release correctness.
tangletools · 2026-08-14T10:11:32Z · trace
tangletools
left a comment
tangletools
left a comment
There was a problem hiding this comment.
✅ Approved — 1 non-blocking finding — 433b4b67
Full multi-shot audit completed 8/8 planned shots over 58 changed files. Global verifier still owns final merge decision. | Full multi-shot audit completed 8/8 planned shots over 58 changed files. Global verifier still owns final merge decision. | Full multi-shot audit completed 8/8 planned shots over 58 changed files. Global verifier still owns final merge decision.
Full immutable report for this review: trace
Summary comment for this run: full summary
tangletools · 2026-08-14T10:11:32Z · immutable trace
e8c7e0f to
0c45391
Compare
tangletools
left a comment
tangletools
left a comment
There was a problem hiding this comment.
🟢 Value Audit — sound
| Verdict | sound |
| Coverage | 2 of 2 lenses (value, usefulness) |
| Concerns | 0 (none) |
| Heuristic | 0.0s |
| Duplication | 0.0s |
| Interrogation | 79.3s (2 bridge agents) |
| Total | 79.3s |
💰 Value — sound
A routine, machine-generated release-plz version bump that correctly propagates the five aggregation/BLS fixes merged since the last release; clean, consistent, and exactly the repo's established release mechanism.
- What it does: Bumps 28 workspace crates one alpha step (e.g. blueprint-tangle-extra 0.2.0-alpha.12 -> 0.2.0-alpha.13, cargo-tangle 0.5.0-alpha.14 -> 0.5.0-alpha.15), updates their CHANGELOG.md entries, syncs the workspace Cargo.toml dependency versions, and regenerates Cargo.lock. Only four crates had source changes since the last release (3a0d1a8): crypto/bn254, clients/tangle, tangle-aggregation-svc, tangle-e
- Goals it achieves: Publishes the aggregation hardening series (#1495, #1496, #1497, #1499, #1500, #1501 — degenerate-context rejection, TNT 0.19 BLS alignment, fail-closed policy errors, quorum rounding, submission-failure propagation, state persistence across restarts) to crates.io consumers, keeping path-dep versions in sync so published crates resolve against each other.
- Assessment: Good. I verified via
git diff 3a0d1a8..0c45391~1 --name-onlythat the only source changes since the prior release are in the four crates carrying real 'Fixed' changelog entries; the changelog entries match the actual merge commits one-to-one. All 58 touched files are Cargo.toml/CHANGELOG.md/Cargo.lock — no code drift smuggled in. Version propagation follows the dependency closure correctly (e.g. - Better / existing approach: none — this is the right approach. I checked release-plz.toml (publish = false with manual batched publishing via .github/workflows/publish-crates.yml is a deliberate choice to avoid crates.io rate limits) and .github/workflows/release-plz.yml; the repo has no competing release mechanism to reuse.
- Model: opencode/zai-coding-plan/glm-5.2
- Bridge attempts: 2
- Bridge warning: opencode/kimi-for-coding/k2p7: opencode: opencode error
🎯 Usefulness — sound
A routine, internally consistent release-plz workspace bump that ships 6 real aggregation/BLS fixes (from #1495-#1501) to crates.io consumers; zero code surface changed.
- Integration: Fully wired. All 28 bumped crates are existing workspace members consumed internally via path deps (verified: root Cargo.toml workspace.dependencies versions match every crate's Cargo.toml and Cargo.lock across all 61 members, script-checked with zero mismatches). External reach is crates.io via the publish workflow (release-plz.yml, publish-crates.yml); blueprint-sdk 0.2.0-alpha.14 is the umbrell
- Fit with existing patterns: This is the established pattern, not a competing one: identical 'chore: release' PRs at #1464, #1470, #1478 precede this one, generated by the same release-plz automation. Version-bump-only diffs across Cargo.toml/Cargo.lock/CHANGELOG.md is exactly the grain of this repo. Crates whose changelog says only 'updated the following local packages' (e.g. blueprint-auth, blueprint-chain-setup) are releas
- Real-world viability: Trivially robust: every changed line is a semver alpha bump, a changelog entry, or a lockfile version; grep confirmed no other manifest lines and no source files touched. Alpha-prerelease bumps (0.2.0-alpha.N) keep the pre-release ordering consistent, and lockfile sync was verified against every member crate, so builds resolve identically for workspace users. The fixes being shipped (quorum roundi
- Model: opencode/zai-coding-plan/glm-5.2
- Bridge attempts: 1
No concerns — sound change, no better or existing approach found. ✅
What this audit checks
It judges the change on its merits — not whether it was tasked out in an issue. Unticketed, fast-moving work is fine; the question is whether the change is good and whether a better or existing approach should be used instead.
| Pass | What it asks |
|---|---|
| Heuristic | Vague title? Whitespace-only or cruft-bearing diff? (content signals only) |
| Duplication | Do added function/class names already exist elsewhere in the repo? |
| Value Audit | What does it do? What goal does it achieve? Is it good? Better architecture or already-exists? |
| Usefulness Audit | Does it integrate and fit? Will it hold up in real use and actually get used? |
Findings are concerns, not blocks — the human reviewer decides what to do with them.
✅ No Blockers —
|
| opencode GLM 5.2 | opencode DeepSeek v4 Pro | opencode DeepSeek v4 Flash | aggregate | |
|---|---|---|---|---|
| Readiness | 95 | 92 | 92 | 92 |
| Confidence | 95 | 95 | 95 | 95 |
| Correctness | 95 | 92 | 92 | 92 |
| Security | 95 | 92 | 92 | 92 |
| Testing | 95 | 92 | 92 | 92 |
| Architecture | 95 | 92 | 92 | 92 |
Reviewer score is advisory once the run is complete and the verdict has no blockers.
Full multi-shot audit completed 8/8 planned shots over 58 changed files. Global verifier still owns final merge decision. | Full multi-shot audit completed 8/8 planned shots over 58 changed files. Global verifier still owns final merge decision. | Full multi-shot audit completed 8/8 planned shots over 58 changed files. Global verifier still owns final merge decision.
🟡 LOW Compare URL points at a tag that does not exist yet — crates/auth/CHANGELOG.md
The new entry's compare URL references blueprint-auth-v0.2.0-alpha.12, but no such tag exists in the local repo (only alpha.1-alpha.11 do). This is expected for release-prep commits (tags are created at publish), and every prior entry references an existing tag, so this resolves automatically. Flagging only to note that the link 404s until the release tag is pushed.
🟡 LOW Duplicate dependency names in auto-generated changelog — crates/networking/extensions/agg-sig-gossip/CHANGELOG.md
Entry lists 'blueprint-crypto, blueprint-crypto, blueprint-networking, blueprint-networking' (same for round-based/CHANGELOG.md line 14). Cosmetic release-plz artifact, pre-existing in the alpha.10 entries; not introduced by this PR and no functional impact. No action required.
tangletools · 2026-08-14T10:58:31Z · trace
tangletools
left a comment
tangletools
left a comment
There was a problem hiding this comment.
✅ Approved — 2 non-blocking findings — 0c453917
Full multi-shot audit completed 8/8 planned shots over 58 changed files. Global verifier still owns final merge decision. | Full multi-shot audit completed 8/8 planned shots over 58 changed files. Global verifier still owns final merge decision. | Full multi-shot audit completed 8/8 planned shots over 58 changed files. Global verifier still owns final merge decision.
Full immutable report for this review: trace
Summary comment for this run: full summary
tangletools · 2026-08-14T10:58:31Z · immutable trace
0c45391 to
f0de369
Compare
tangletools
left a comment
tangletools
left a comment
There was a problem hiding this comment.
🟢 Value Audit — sound
| Verdict | sound |
| Coverage | 1 of 2 lenses (usefulness) |
| Concerns | 0 (none) |
| Heuristic | 0.2s |
| Duplication | 0.0s |
| Interrogation | 210.0s (2 bridge agents) |
| Total | 210.2s |
⚠️ Partial audit — the verdict covers only usefulness. value: cli-bridge admission rejected (queue saturated). Treat the missing lens as unexamined, not as clear.
💰 Value — error
value agent never ran: the CLI bridge refused admission (no model was started).
- Model: opencode/deepseek/deepseek-v4-pro
- Bridge attempts: 4
- Bridge error: opencode/kimi-for-coding/k2p7: Bridge returned 503: bridge at capacity (queue_timeout, lane=reserved): active=20/20 queued=5/48 — no model was started
🎯 Usefulness — sound
A clean release-plz version bump of 27 crates that correctly packages the TNT-0.19 aggregation fixes (#1495-#1502) for publication, fully consistent across crate manifests, workspace deps, and lockfile.
- Integration: Fully wired: the commit updates each crate's Cargo.toml version, the root workspace dependency declarations, and Cargo.lock in lockstep — a programmatic check of all 52 path-dep version references against their crate manifests found 0 mismatches (root Cargo.toml:124-200, e.g. blueprint-sdk 0.2.0-alpha.14 at Cargo.toml:126). Callers are downstream blueprint consumers pulling blueprint-sdk and frien
- Fit with existing patterns: This is the established release mechanism, not a competing one: author is webb-spider[bot] (release-plz), format is keep-a-changelog, and it exactly repeats the prior release commit 3a0d1a8 'chore: release (#1478)'. No new surface is introduced that could conflict with existing patterns.
- Real-world viability: Zero runtime surface changes — only manifests, changelogs, and lockfile. The only realistic failure mode for such a commit is internal version inconsistency, which was checked and is absent: every Cargo.lock delta (54 lines) is a blueprint crate version; no third-party dependency changed. Publishing behavior is additionally covered by the repo's release CI (dry-run handling fixed in 4f16183).
- Model: opencode/zai-coding-plan/glm-5.2
- Bridge attempts: 2
No concerns from the lens that ran (usefulness). The missing lens examined nothing, so this is not a full clean bill of health.
What this audit checks
It judges the change on its merits — not whether it was tasked out in an issue. Unticketed, fast-moving work is fine; the question is whether the change is good and whether a better or existing approach should be used instead.
| Pass | What it asks |
|---|---|
| Heuristic | Vague title? Whitespace-only or cruft-bearing diff? (content signals only) |
| Duplication | Do added function/class names already exist elsewhere in the repo? |
| Value Audit | What does it do? What goal does it achieve? Is it good? Better architecture or already-exists? |
| Usefulness Audit | Does it integrate and fit? Will it hold up in real use and actually get used? |
Findings are concerns, not blocks — the human reviewer decides what to do with them.
✅ No Blockers —
|
tangletools
left a comment
tangletools
left a comment
There was a problem hiding this comment.
✅ Approved — 1 non-blocking finding — f0de369b
Full multi-shot audit completed 8/8 planned shots over 54 changed files. Global verifier still owns final merge decision.
Full immutable report for this review: trace
Summary comment for this run: full summary
tangletools · 2026-08-14T11:49:17Z · immutable trace
f0de369 to
d7fabed
Compare
tangletools
left a comment
tangletools
left a comment
There was a problem hiding this comment.
🟢 Value Audit — sound
| Verdict | sound |
| Coverage | 1 of 2 lenses (usefulness) |
| Concerns | 0 (none) |
| Heuristic | 0.0s |
| Duplication | 0.0s |
| Interrogation | 210.0s (2 bridge agents) |
| Total | 210.0s |
⚠️ Partial audit — the verdict covers only usefulness. value: cli-bridge admission rejected (queue saturated). Treat the missing lens as unexamined, not as clear.
💰 Value — error
value agent never ran: the CLI bridge refused admission (no model was started).
- Model: opencode/deepseek/deepseek-v4-pro
- Bridge attempts: 4
- Bridge error: opencode/kimi-for-coding/k2p7: Bridge returned 503: bridge at capacity (queue_timeout, lane=reserved): active=20/20 queued=1/48 — no model was started
🎯 Usefulness — sound
A mechanically consistent workspace release bump that publishes the real aggregation/BLS fixes merged since the last release (#1495-#1503) through the standard release-automation path.
- Integration: Fully wired. Verified with a toml parse of all 29 crate manifests + root Cargo.toml: 0 mismatches between workspace.dependencies declarations and actual crate versions, and 0 stale internal path-dep version reqs across crates/, cli/, and examples/ (pre-release alphas are mutually incompatible, so the ~24 transitive bumps are required, not decorative). Cargo.lock is regenerated in the same commit.
- Fit with existing patterns: Follows the repo's established release pattern exactly: same 'chore: release' commit shape as the prior release (3a0d1a8, #1478), same per-crate CHANGELOG format, same cascade bumping semantics driven by the release-plz/cargo-workflows CI the repo actively maintains (#1485, #1488). No competing release mechanism.
- Real-world viability: The release commit itself carries no logic — only versions, lock entries, and generated changelogs — so there is no happy-path vs error-path surface here. Consistency checks (workspace deps vs crate versions, internal dep reqs vs actual versions, Cargo.lock vs manifests) all pass, which is what determines whether the published set resolves cleanly for downstream users.
- Model: opencode/zai-coding-plan/glm-5.2
- Bridge attempts: 1
No concerns from the lens that ran (usefulness). The missing lens examined nothing, so this is not a full clean bill of health.
What this audit checks
It judges the change on its merits — not whether it was tasked out in an issue. Unticketed, fast-moving work is fine; the question is whether the change is good and whether a better or existing approach should be used instead.
| Pass | What it asks |
|---|---|
| Heuristic | Vague title? Whitespace-only or cruft-bearing diff? (content signals only) |
| Duplication | Do added function/class names already exist elsewhere in the repo? |
| Value Audit | What does it do? What goal does it achieve? Is it good? Better architecture or already-exists? |
| Usefulness Audit | Does it integrate and fit? Will it hold up in real use and actually get used? |
Findings are concerns, not blocks — the human reviewer decides what to do with them.
✅ No Blockers —
|
| opencode GLM 5.2 | opencode DeepSeek v4 Pro | aggregate | |
|---|---|---|---|
| Readiness | 92 | 92 | 92 |
| Confidence | 95 | 95 | 95 |
| Correctness | 92 | 92 | 92 |
| Security | 92 | 92 | 92 |
| Testing | 92 | 92 | 92 |
| Architecture | 92 | 92 | 92 |
Reviewer score is advisory once the run is complete and the verdict has no blockers.
Full multi-shot audit completed 8/8 planned shots over 54 changed files. Global verifier still owns final merge decision. | Full multi-shot audit completed 8/8 planned shots over 54 changed files. Global verifier still owns final merge decision.
🟡 LOW Duplicate package names in auto-generated changelog entry — crates/networking/extensions/agg-sig-gossip/CHANGELOG.md
'blueprint-crypto, blueprint-crypto' repeats; same for blueprint-networking. Purely cosmetic, matches prior entries in the same file, and has no functional impact. Optional cleanup only.
🟡 LOW Duplicated package names in changelog dependency lists — crates/networking/extensions/round-based/CHANGELOG.md
Entry lists 'blueprint-crypto, blueprint-crypto, blueprint-networking, blueprint-networking' twice each. This is a release-plz quirk (same dep pulled with different feature sets) and the identical pattern exists in the alpha.10 entry, so it is pre-existing and cosmetic. Same pattern in agg-sig-gossip/CHANGELOG.md line 14. No action required; would only be fixed by a release-plz config/upgrade change, not this PR.
tangletools · 2026-08-14T13:27:58Z · trace
tangletools
left a comment
tangletools
left a comment
There was a problem hiding this comment.
✅ Approved — 2 non-blocking findings — d7fabede
Full multi-shot audit completed 8/8 planned shots over 54 changed files. Global verifier still owns final merge decision. | Full multi-shot audit completed 8/8 planned shots over 54 changed files. Global verifier still owns final merge decision.
Full immutable report for this review: trace
Summary comment for this run: full summary
tangletools · 2026-08-14T13:27:58Z · immutable trace
d7fabed to
03b6be8
Compare
03b6be8 to
9cc02ad
Compare
tangletools
left a comment
tangletools
left a comment
There was a problem hiding this comment.
🟢 Value Audit — sound
| Verdict | sound |
| Coverage | 2 of 2 lenses (value, usefulness) |
| Concerns | 1 (1 weak-concern) |
| Heuristic | 0.0s |
| Duplication | 0.0s |
| Interrogation | 139.3s (2 bridge agents) |
| Total | 139.3s |
💰 Value — sound
Automated release-plz release bumping 28 workspace crates one alpha step with correct changelogs and lockfile — exactly the repo's established release mechanism; only nit is stale chain-setup lines in the PR body.
- What it does: Cutting a workspace release: bumps 28 crates (e.g. blueprint-sdk 0.2.0-alpha.13→.14, cargo-tangle 0.5.0-alpha.14→.15) in each crate's Cargo.toml, the root Cargo.toml workspace.dependencies, and Cargo.lock, and prepends generated CHANGELOG.md entries per crate. It is the release-plz output for the 9 fix commits since the blueprint-sdk-v0.2.0-alpha.13 tag (TNT 0.19 BLS aggregation alignment, fail-cl
- Goals it achieves: Make the two weeks of aggregation/BLS fixes consumable by downstream blueprint repos as published alpha crates. Matches the repo's cadence of batch releases (#1456, #1458, #1464, #1470, #1478 all follow this exact 'chore: release' pattern, driven by release-plz.toml with publish=false and manual batch publish per .github/workflows/publish-crates.yml).
- Assessment: Good on its merits and fully in the grain. Verified: (a) every crate with source changes since the last tag got a bump — crates/clients/tangle, tangle-extra, tangle-aggregation-svc, crypto/bn254 plus dependent crates; (b) changelog entries match the real commits with correct PR numbers (e.g. crates/tangle-extra/CHANGELOG.md lists #1503, #1501, #1499, #1497, #1496, #1495); (c) crates/chain-setup/an
- Better / existing approach: none — this is the right approach. Searched for alternatives (release-plz.toml, .github/workflows/release-plz.yml, publish-crates.yml): release-plz with manual batch publish is the established mechanism and hand-cutting versions would be strictly worse.
- Model: opencode/zai-coding-plan/glm-5.2
- Bridge attempts: 2
- Bridge warning: opencode/kimi-for-coding/k2p7: opencode: opencode error
🎯 Usefulness — sound
A clean, fully-consistent workspace release that publishes the 8 aggregation/BLS/TNT-0.19 fixes merged since the last release; versions, lockfile, and changelogs all check out with zero mismatches.
- Integration: Release commit 9cc02ad sits directly on top of the 8 fix commits it ships (#1495, #1496, #1497, #1499, #1500, #1501, #1503, #1505 — all confirmed in git log between prior release 3a0d1a8 and HEAD). Immediate consumers: downstream blueprint authors pulling blueprint-sdk 0.2.0-alpha.14 / cargo-tangle 0.5.0-alpha.15 from crates.io, plus the repo's own examples and CI which consume the workspace path
- Fit with existing patterns: Perfectly in-grain: this IS the established pattern (release-plz/cargo-release style workspace bump, identical to 3a0d1a8 two weeks earlier). Verified programmatically that all 54 changed files are only Cargo.toml/Cargo.lock/CHANGELOG.md — no source changes smuggled in. All 245 workspace dependency entries match each crate's own version and the Cargo.lock version, with no mismatches. Unchanged cra
- Real-world viability: The heavy lifting was done in the merged fix PRs; this PR is pure metadata, so its real-world risk is inconsistency, which I checked exhaustively: workspace.dependencies vs member Cargo.toml vs Cargo.lock — all consistent across 245 entries. Changelog entries reference real merged PR numbers with matching titles (e.g., crates/clients/tangle/CHANGELOG.md cites #1505 and #1497, both in git log). Not
- Model: opencode/zai-coding-plan/glm-5.2
- Bridge attempts: 1
💰 Value Audit
🟡 PR body lists chain-setup bumps that are not in this diff [maintenance] ``
The PR body claims blueprint-chain-setup and blueprint-chain-setup-anvil 0.2.0-alpha.12→.13, but neither manifest changes in this commit; those shipped in the 2026-08-02 release (#1478, see crates/chain-setup/CHANGELOG.md:10). Stale generated body text only — the diff is correct — but anyone expecting chain-setup artifacts from this release should know they already shipped.
What this audit checks
It judges the change on its merits — not whether it was tasked out in an issue. Unticketed, fast-moving work is fine; the question is whether the change is good and whether a better or existing approach should be used instead.
| Pass | What it asks |
|---|---|
| Heuristic | Vague title? Whitespace-only or cruft-bearing diff? (content signals only) |
| Duplication | Do added function/class names already exist elsewhere in the repo? |
| Value Audit | What does it do? What goal does it achieve? Is it good? Better architecture or already-exists? |
| Usefulness Audit | Does it integrate and fit? Will it hold up in real use and actually get used? |
Findings are concerns, not blocks — the human reviewer decides what to do with them.
✅ No Blockers —
|
| opencode GLM 5.2 | opencode DeepSeek v4 Pro | opencode DeepSeek v4 Flash | aggregate | |
|---|---|---|---|---|
| Readiness | 89 | 92 | 95 | 89 |
| Confidence | 95 | 95 | 95 | 95 |
| Correctness | 89 | 92 | 95 | 89 |
| Security | 89 | 92 | 95 | 89 |
| Testing | 89 | 92 | 95 | 89 |
| Architecture | 89 | 92 | 95 | 89 |
Reviewer score is advisory once the run is complete and the verdict has no blockers.
Full multi-shot audit completed 8/8 planned shots over 54 changed files. Global verifier still owns final merge decision. | Full multi-shot audit completed 8/8 planned shots over 54 changed files. Global verifier still owns final merge decision. | Full multi-shot audit completed 8/8 planned shots over 54 changed files. Global verifier still owns final merge decision.
🟡 LOW Duplicate package names in auto-generated changelog release notes — crates/networking/extensions/agg-sig-gossip/CHANGELOG.md
Release note reads 'updated the following local packages: blueprint-crypto, blueprint-crypto, blueprint-networking, blueprint-networking, blueprint-gossip-primitives'. Same duplication appears in round-based/CHANGELOG.md ('blueprint-crypto, blueprint-crypto, blueprint-networking, blueprint-networking'). Cause: release-plz emits one line per dependency edge (normal + dev-dependency), producing repeated names. Cosmetic only — no version or linkage error. Fix: dedupe in release config or accept as-is.
🟡 LOW Duplicate package names in generated changelog entries — crates/networking/extensions/agg-sig-gossip/CHANGELOG.md
Entry reads 'updated the following local packages: blueprint-crypto, blueprint-crypto, blueprint-networking, blueprint-networking, blueprint-gossip-primitives'. Duplicate names are a known artifact of release tooling listing the same crate via multiple manifest paths (same pattern appears in round-based/CHANGELOG.md line 14). Cosmetic only; no action required unless the team wants to dedupe in the release tool config.
🟡 LOW New external dependencies in this release are not noted in the changelog — crates/tangle-extra/CHANGELOG.md
Between alpha.12 (3a0d1a8) and alpha.13 the crate gained new optional deps ark-bn254, ark-ff, ark-serialize, and alloy-provider, plus an expanded
aggregationfeature list (git diff 3a0d1a8..9cc02ad -- crates/tangle-extra/Cargo.toml). The changelog section lists only the six fixes. Keep-a-Changelog convention would surface dependency/feature-surface changes under Added/Changed. This is standard release-please behavior (it only auto-lists workspace-local package bumps under 'Other', as alpha.7-alpha.12 did), so impact is cosmetic discoverability for SDK consumers. Fix is optional: add a one-line '### Other' note listing the new aggregation-feature deps.
tangletools · 2026-08-15T12:50:01Z · trace
tangletools
left a comment
tangletools
left a comment
There was a problem hiding this comment.
✅ Approved — 3 non-blocking findings — 9cc02ad5
Full multi-shot audit completed 8/8 planned shots over 54 changed files. Global verifier still owns final merge decision. | Full multi-shot audit completed 8/8 planned shots over 54 changed files. Global verifier still owns final merge decision. | Full multi-shot audit completed 8/8 planned shots over 54 changed files. Global verifier still owns final merge decision.
Full immutable report for this review: trace
Summary comment for this run: full summary
tangletools · 2026-08-15T12:50:01Z · immutable trace
351fd75 to
6f89f6a
Compare
tangletools
left a comment
tangletools
left a comment
There was a problem hiding this comment.
🟢 Value Audit — sound
| Verdict | sound |
| Coverage | 2 of 2 lenses (value, usefulness) |
| Concerns | 1 (1 weak-concern) |
| Heuristic | 0.0s |
| Duplication | 0.0s |
| Interrogation | 40.2s (2 bridge agents) |
| Total | 40.2s |
💰 Value — sound
Standard automated release-plz version bump across 27 crates, capturing the two weeks of aggregation/TNT-0.19 fixes since the last release; exactly the established process for this repo — ship.
- What it does: Bumps versions of 27 workspace crates (one alpha step each, e.g. blueprint-sdk 0.2.0-alpha.13 -> 0.2.0-alpha.14, cargo-tangle 0.5.0-alpha.14 -> 0.5.0-alpha.15), updates the matching workspace.dependencies entries in the root Cargo.toml, regenerates Cargo.lock, and writes CHANGELOG.md entries per crate. It publishes no code changes of its own — it packages the existing fix commits (#1495-#1509: BLS
- Goals it achieves: Cut a consumable release so downstream blueprint developers and the batch publish workflow (.github/workflows/publish-crates.yml, which runs manually per release-plz.toml:3 'publish = false') can pick up the aggregation correctness fixes. Nothing in the system changes behaviorally; the goal is purely to move merged fixes from main into versioned, publishable artifacts.
- Assessment: Good and in-grain. Evidence: this is the repo's existing release automation — release-plz.toml and .github/workflows/release-plz.yml drive it, and git log shows identical bot-authored 'chore: release' commits (#1478, #1470, #1464, #1458, #1456) at regular cadence, all by webb-spider[bot]. The diff is purely mechanical and internally consistent: every crate Cargo.toml bump has a matching workspace.
- Better / existing approach: none — this is the right approach. The codebase already owns this exact capability: release-plz.toml (config) plus .github/workflows/release-plz.yml (execution) plus publish-crates.yml (manual batch publish). This PR is that machinery's output, not a reinvention. Searched for alternative release tooling (cargo-release config, dist-workspace release paths, manual release scripts) — dist-workspace.t
- Model: opencode/zai-coding-plan/glm-5.2
- Bridge attempts: 2
- Bridge warning: opencode/kimi-for-coding/k2p7: opencode: opencode error event without a message: {"type":"error","timestamp":1787689947578,"sessionID":"ses_fc5602fbeffexCtI8np8K7u18Y","error":{"name":"UnknownError","data":{"message":"Unexpected server error. Check server logs for details.","ref":"err_a08f8d7e"}}}
🎯 Usefulness — sound
Routine release-plz version-bump PR cutting 28 crates; all version references are internally consistent and the release publishes the real aggregation-fix series (#1495-#1505) that downstream users can only get via crates.io.
- Integration: The release IS the integration mechanism: git log shows 10+ unreleased substantive fixes (fix(tangle): buffer aggregated result gas #1505, fail closed on aggregation policy errors #1497, persist task state across restarts #1500, align BLS aggregation with TNT 0.19 #1495, release waiting operators #1503) that are currently unpublished; this PR makes them reachable to downstream blueprint consumers.
- Fit with existing patterns: Follows the repo's established release pattern exactly: per-crate CHANGELOG.md with compare-links, workspace-dependency co-bumping, Cargo.lock regeneration — same shape as prior release commits in git history. No competing mechanism exists.
- Real-world viability: Pure metadata change (54 files, all Cargo.toml/CHANGELOG.md/Cargo.lock); no runtime code touched, so no concurrency/edge-case surface. Changelog entries reference PRs that exist in git log, so the published notes match reality.
- Model: opencode/zai-coding-plan/glm-5.2
- Bridge attempts: 1
💰 Value Audit
🟡 PR body lists blueprint-chain-setup/-anvil bumps absent from the diff [maintenance] ``
The PR body claims blueprint-chain-setup and blueprint-chain-setup-anvil go 0.2.0-alpha.12 -> 0.2.0-alpha.13, but crates/chain-setup/Cargo.toml already reads 0.2.0-alpha.13 and its last change was the prior release PR #1478; this release's diff stat contains no chain-setup files. The shipped files are correct; only the bot-generated release body is off. No action needed beyond awareness when reading the release notes.
What this audit checks
It judges the change on its merits — not whether it was tasked out in an issue. Unticketed, fast-moving work is fine; the question is whether the change is good and whether a better or existing approach should be used instead.
| Pass | What it asks |
|---|---|
| Heuristic | Vague title? Whitespace-only or cruft-bearing diff? (content signals only) |
| Duplication | Do added function/class names already exist elsewhere in the repo? |
| Value Audit | What does it do? What goal does it achieve? Is it good? Better architecture or already-exists? |
| Usefulness Audit | Does it integrate and fit? Will it hold up in real use and actually get used? |
Findings are concerns, not blocks — the human reviewer decides what to do with them.
✅ No Blockers —
|
| opencode GLM 5.2 | opencode DeepSeek v4 Pro | opencode DeepSeek v4 Flash | aggregate | |
|---|---|---|---|---|
| Readiness | 89 | 92 | 95 | 89 |
| Confidence | 95 | 95 | 95 | 95 |
| Correctness | 89 | 92 | 95 | 89 |
| Security | 89 | 92 | 95 | 89 |
| Testing | 89 | 92 | 95 | 89 |
| Architecture | 89 | 92 | 95 | 89 |
Reviewer score is advisory once the run is complete and the verdict has no blockers.
Full multi-shot audit completed 8/8 planned shots over 54 changed files. Global verifier still owns final merge decision. | Full multi-shot audit completed 8/8 planned shots over 54 changed files. Global verifier still owns final merge decision. | Full multi-shot audit completed 8/8 planned shots over 54 changed files. Global verifier still owns final merge decision.
🟡 LOW blueprint-chain-setup test-fixture refresh stays unreleased (no version bump) — Cargo.toml
Commit aa9ef4f ('fix(testing): refresh TNT fixture after G2 fix #1502') landed after tag blueprint-chain-setup-v0.2.0-alpha.13 and touched crates/chain-setup/anvil/snapshots/ (localtestnet-broadcast.json, localtestnet-state.json, AGENTS.md), but this release leaves blueprint-chain-setup at 0.2.0-alpha.13 and publishes no chain-setup CHANGELOG entry. No src/ code changed, so there is no functional regression; the refreshed fixtures will simply not reach consumers until the next chain-setup release. If the fixture refresh is meant to accompany the tnt-core G2 fix shipped in this release (testing-utils and client-tangle were bumped), consider a manual chain-setup bump; otherwise accept as intentional. Fix: run cargo-release for crates/chain-setup or add an exclude for anvil/snapshots in its C
🟡 LOW Changelog lists duplicate local-package names — crates/networking/extensions/agg-sig-gossip/CHANGELOG.md
The alpha.11 entry lists 'blueprint-crypto, blueprint-crypto, blueprint-networking, blueprint-networking, blueprint-gossip-primitives' — each of blueprint-crypto and blueprint-networking appears twice. This is generated by the release tooling and is identical in style to the prior alpha.10 entry (same duplication), so it is cosmetic and not introduced uniquely by this PR. No action required; flagging only for completeness. round-based/CHANGELOG.md line 14 has the same duplication.
🟡 LOW Duplicate package names in changelog 'updated local packages' lines — crates/networking/extensions/agg-sig-gossip/CHANGELOG.md
Line reads 'updated the following local packages: blueprint-crypto, blueprint-crypto, blueprint-networking, blueprint-networking, blueprint-gossip-primitives'. The duplicates are a release-plz artifact: blueprint-crypto and blueprint-networking each appear in both [dependencies] and [dev-dependencies] of agg-sig-gossip/Cargo.toml:13,15,50,51,52 (same pattern in round-based/Cargo.toml:18,19,54,55). Purely cosmetic, matches the established pattern of prior releases in the same files, and carries no correctness risk. No action required; if desired, a release-plz config change (outside this PR) could deduplicate.
tangletools · 2026-08-25T20:37:51Z · trace
tangletools
left a comment
tangletools
left a comment
There was a problem hiding this comment.
✅ Approved — 3 non-blocking findings — 6f89f6af
Full multi-shot audit completed 8/8 planned shots over 54 changed files. Global verifier still owns final merge decision. | Full multi-shot audit completed 8/8 planned shots over 54 changed files. Global verifier still owns final merge decision. | Full multi-shot audit completed 8/8 planned shots over 54 changed files. Global verifier still owns final merge decision.
Full immutable report for this review: trace
Summary comment for this run: full summary
tangletools · 2026-08-25T20:37:51Z · immutable trace
6f89f6a to
96c7b96
Compare
tangletools
left a comment
tangletools
left a comment
There was a problem hiding this comment.
🟢 Value Audit — sound
| Verdict | sound |
| Coverage | 2 of 2 lenses (value, usefulness) |
| Concerns | 0 (none) |
| Heuristic | 0.0s |
| Duplication | 0.0s |
| Interrogation | 203.9s (2 bridge agents) |
| Total | 203.9s |
💰 Value — sound
A fully automated release-plz release PR that bumps 30 workspace crates one alpha patch and updates their CHANGELOGs; mechanical and correct — ship.
- What it does: Bumps the version of 30 crates in the workspace (Cargo.toml manifests + workspace.dependencies in the root Cargo.toml + Cargo.lock) and prepends a dated release entry to each crate's CHANGELOG.md. There are zero non-manifest changes:
git diff HEAD~1 --name-onlyfiltered to non-Cargo.toml/Cargo.lock/CHANGELOG.md files is empty. The diff reflects no source, doc, or example edits — only version lin - Goals it achieves: Publishes the accumulated fixes that landed since the previous release (Aug 2). Reading from the changelog content the release carries real behavior deltas:
fix(deps): update libp2p for hickory security fixes (#1511)into blueprint-networking,buffer aggregated result gas (#1505),reject degenerate aggregation contexts (#1496),align BLS aggregation with TNT 0.19 (#1495), and `fail closed - Assessment: Good and coherent. It is generated by release-plz, which is the repo's own release tooling — confirmed by
release-plz.toml(withpublish = false, batch-publish model) and.github/workflows/release-plz.yml. The version bumps are internally consistent: every workspace.dependencies entry in Cargo.toml and every entry in Cargo.lock is advanced in lockstep by exactly one alpha patch, so downstrea - Better / existing approach: none — this is the right approach. The repo already uses release-plz as its release mechanism (release-plz.toml + the release-plz.yml workflow), and this PR is that tool's output; no manual or alternative mechanism exists to reuse. I checked the changelog/version diff for hand-rolled inconsistencies and found none.
- Model: opencode/deepseek/deepseek-v4-pro
- Bridge attempts: 3
- Bridge warning: opencode/kimi-for-coding/k2p7: opencode: opencode error event without a message: {"type":"error","timestamp":1788337030259,"sessionID":"ses_f9ece7f8cffeASAS3jlPVsH0LH","error":{"name":"UnknownError","data":{"message":"Unexpected server error. Check server logs for details.","ref":"err_f18ee02e"}}}; opencode/zai-coding-plan/glm-5.2: opencode: opencode error event without a message: {"type":"error",
🎯 Usefulness — sound
A consistent mechanical version-bump release across 29 crates; manifests, workspace deps, and Cargo.lock all align and the workspace resolves cleanly.
- Integration: Version bumps are consistent across root Cargo.toml workspace deps (Cargo.toml:124-229), each crate's own Cargo.toml version field, and Cargo.lock; cargo metadata --no-deps resolves the workspace with no stale internal version references. Internal cross-crate deps use workspace inheritance so nothing is left pointing at an old pinned version. This is a release gate, not a capability — the 'caller'
- Fit with existing patterns: Matches the established release-plz convention already in use (compare-link CHANGELOG entries, '### Other' sections, per-crate changelog files, prior releases at 2026-08-02 follow the identical shape). It does not introduce any new pattern or compete with an existing one.
- Real-world viability: No runtime behavior changes — this is a pure metadata/version bump, so there are no concurrency, error-path, or edge-input surfaces to break. The only realistic failure mode (a version mismatch breaking resolution/publish) was checked and is clean.
- Model: opencode/deepseek/deepseek-v4-pro
- Bridge attempts: 3
- Bridge warning: opencode/zai-coding-plan/glm-5.2: opencode: opencode error event without a message: {"type":"error","timestamp":1788337122521,"sessionID":"ses_f9ece37bcffeAzjKDoo65JQRuc","error":{"name":"APIError","data":{"message":"Usage limit reached for 5 hour. Your limit will reset at 2026-09-02 17:05:43","statusCode":429,"isRetryable":true,"responseHeaders":{"alt-svc":"h3=":443"; ma=3600","connection":"kee
No concerns — sound change, no better or existing approach found. ✅
What this audit checks
It judges the change on its merits — not whether it was tasked out in an issue. Unticketed, fast-moving work is fine; the question is whether the change is good and whether a better or existing approach should be used instead.
| Pass | What it asks |
|---|---|
| Heuristic | Vague title? Whitespace-only or cruft-bearing diff? (content signals only) |
| Duplication | Do added function/class names already exist elsewhere in the repo? |
| Value Audit | What does it do? What goal does it achieve? Is it good? Better architecture or already-exists? |
| Usefulness Audit | Does it integrate and fit? Will it hold up in real use and actually get used? |
Findings are concerns, not blocks — the human reviewer decides what to do with them.
✅ No Blockers —
|
| opencode DeepSeek v4 Pro | opencode DeepSeek v4 Flash | aggregate | |
|---|---|---|---|
| Readiness | 92 | 89 | 89 |
| Confidence | 95 | 95 | 95 |
| Correctness | 92 | 89 | 89 |
| Security | 92 | 89 | 89 |
| Testing | 92 | 89 | 89 |
| Architecture | 92 | 89 | 89 |
Reviewer score is advisory once the run is complete and the verdict has no blockers.
Full multi-shot audit completed 8/8 planned shots over 56 changed files. Global verifier still owns final merge decision. | Full multi-shot audit completed 8/8 planned shots over 56 changed files. Global verifier still owns final merge decision.
🟡 LOW Lock validated statically, not by resolver — Cargo.lock
cargo metadata --locked could not be run (no cargo binary in review environment). Every bumped lock version was instead cross-checked by hand against each crate's Cargo.toml at head (51 packages, 0 mismatches). Given the lock entries are path/workspace members with no checksum lines and the sibling changes are exactly the Cargo.toml bumps this lock was generated from, residual risk is negligible - but a resolver run in CI (--locked) remains the authoritative check.
🟡 LOW alpha.12 tag not present at HEAD — crates/auth/CHANGELOG.md
The new 0.2.0-alpha.12 compare link resolves against tag blueprint-auth-v0.2.0-alpha.12, which does not exist in the local tag list at this commit. Expected for a release commit (tag is typically created after 'chore: release' lands), but if the tag is never cut the compare link and release note point at a nonexistent ref. Confirm the release process creates blueprint-auth-v0.2.0-alpha.12 before/at merge.
🟡 LOW Changelog entry 'update Cargo.toml dependencies' is inaccurate for these crates — crates/networking/extensions/agg-sig-gossip/CHANGELOG.md
The new changelog entry states 'update Cargo.toml dependencies', but for these three crates the Cargo.toml diff changes only the
versionfield (0.2.0-alpha.10 -> 0.2.0-alpha.11); no[dependencies]line changed. The message is generic release-tooling boilerplate applied uniformly across the PR and is harmless, but it is misleading for readers of these specific changelogs. No action required to merge; optionally regenerate or annotate the entry to reflect a version-only bump. Same condition applies to gossip-primitives and round-based CHANGELOG.md (line 14 in each).
tangletools · 2026-09-02T08:39:19Z · trace
tangletools
left a comment
tangletools
left a comment
There was a problem hiding this comment.
✅ Approved — 3 non-blocking findings — 96c7b96a
Full multi-shot audit completed 8/8 planned shots over 56 changed files. Global verifier still owns final merge decision. | Full multi-shot audit completed 8/8 planned shots over 56 changed files. Global verifier still owns final merge decision.
Full immutable report for this review: trace
Summary comment for this run: full summary
tangletools · 2026-09-02T08:39:19Z · immutable trace
96c7b96 to
2f34d8e
Compare
2f34d8e to
8d75cf0
Compare
1 participant
🤖 New release
blueprint-core: 0.2.0-alpha.5 -> 0.2.0-alpha.6blueprint-std: 0.2.0-alpha.6 -> 0.2.0-alpha.7blueprint-crypto-core: 0.2.0-alpha.6 -> 0.2.0-alpha.7blueprint-crypto-bls: 0.2.0-alpha.9 -> 0.2.0-alpha.10blueprint-crypto-bn254: 0.2.0-alpha.9 -> 0.2.0-alpha.10blueprint-crypto-ed25519: 0.2.0-alpha.6 -> 0.2.0-alpha.7blueprint-crypto-hashing: 0.2.0-alpha.7 -> 0.2.0-alpha.8blueprint-crypto-k256: 0.2.0-alpha.6 -> 0.2.0-alpha.7blueprint-crypto-sr25519: 0.2.0-alpha.6 -> 0.2.0-alpha.7blueprint-crypto: 0.2.0-alpha.9 -> 0.2.0-alpha.10blueprint-auth: 0.2.0-alpha.11 -> 0.2.0-alpha.12blueprint-client-core: 0.2.0-alpha.6 -> 0.2.0-alpha.7blueprint-metrics-rpc-calls: 0.2.0-alpha.5 -> 0.2.0-alpha.6blueprint-client-evm: 0.2.0-alpha.7 -> 0.2.0-alpha.8blueprint-keystore: 0.2.0-alpha.10 -> 0.2.0-alpha.11blueprint-client-tangle: 0.2.0-alpha.12 -> 0.2.0-alpha.13blueprint-clients: 0.2.0-alpha.13 -> 0.2.0-alpha.14blueprint-manager-bridge: 0.2.0-alpha.12 -> 0.2.0-alpha.13blueprint-networking: 0.2.0-alpha.10 -> 0.2.0-alpha.11blueprint-gossip-primitives: 0.2.0-alpha.10 -> 0.2.0-alpha.11blueprint-networking-agg-sig-gossip-extension: 0.2.0-alpha.10 -> 0.2.0-alpha.11blueprint-tangle-aggregation-svc: 0.2.0-alpha.12 -> 0.2.0-alpha.13blueprint-tangle-extra: 0.2.0-alpha.12 -> 0.2.0-alpha.13blueprint-pricing-engine: 0.3.0-alpha.11 -> 0.3.0-alpha.12blueprint-tee: 0.2.0-alpha.9 -> 0.2.0-alpha.10blueprint-remote-providers: 0.2.0-alpha.12 -> 0.2.0-alpha.13blueprint-qos: 0.2.0-alpha.13 -> 0.2.0-alpha.14blueprint-router: 0.2.0-alpha.5 -> 0.2.0-alpha.6blueprint-evm-extra: 0.2.0-alpha.7 -> 0.2.0-alpha.8blueprint-faas: 0.2.0-alpha.7 -> 0.2.0-alpha.8blueprint-runner: 0.2.0-alpha.12 -> 0.2.0-alpha.13blueprint-core-testing-utils: 0.2.0-alpha.12 -> 0.2.0-alpha.13blueprint-chain-setup-anvil: 0.2.0-alpha.12 -> 0.2.0-alpha.13blueprint-chain-setup: 0.2.0-alpha.12 -> 0.2.0-alpha.13blueprint-contexts: 0.2.0-alpha.12 -> 0.2.0-alpha.13blueprint-profiling: 0.2.0-alpha.5 -> 0.2.0-alpha.6blueprint-anvil-testing-utils: 0.2.0-alpha.12 -> 0.2.0-alpha.13blueprint-testing-utils: 0.2.0-alpha.12 -> 0.2.0-alpha.13blueprint-manager: 0.4.0-alpha.12 -> 0.4.0-alpha.13cargo-tangle: 0.5.0-alpha.14 -> 0.5.0-alpha.15blueprint-build-utils: 0.2.0-alpha.6 -> 0.2.0-alpha.7blueprint-context-derive: 0.2.0-alpha.5 -> 0.2.0-alpha.6blueprint-macros: 0.2.0-alpha.4 -> 0.2.0-alpha.5blueprint-networking-round-based-extension: 0.2.0-alpha.10 -> 0.2.0-alpha.11blueprint-producers-extra: 0.2.0-alpha.5 -> 0.2.0-alpha.6blueprint-store-local-database: 0.2.0-alpha.6 -> 0.2.0-alpha.7blueprint-stores: 0.2.0-alpha.6 -> 0.2.0-alpha.7blueprint-webhooks: 0.2.0-alpha.12 -> 0.2.0-alpha.13blueprint-x402: 0.2.0-alpha.12 -> 0.2.0-alpha.13blueprint-sdk: 0.2.0-alpha.12 -> 0.2.0-alpha.13blueprint-benchmarking: 0.2.0-alpha.6 -> 0.2.0-alpha.7blueprint-metrics: 0.2.0-alpha.5 -> 0.2.0-alpha.6Changelog
blueprint-coreblueprint-stdblueprint-crypto-coreblueprint-crypto-blsblueprint-crypto-bn254blueprint-crypto-ed25519blueprint-crypto-hashingblueprint-crypto-k256blueprint-crypto-sr25519blueprint-cryptoblueprint-authblueprint-client-coreblueprint-metrics-rpc-callsblueprint-client-evmblueprint-keystoreblueprint-client-tangleblueprint-clientsblueprint-manager-bridgeblueprint-networkingblueprint-gossip-primitivesblueprint-networking-agg-sig-gossip-extensionblueprint-tangle-aggregation-svcblueprint-tangle-extrablueprint-pricing-engineblueprint-teeblueprint-remote-providersblueprint-qosblueprint-routerblueprint-evm-extrablueprint-faasblueprint-runnerblueprint-core-testing-utilsblueprint-chain-setup-anvilblueprint-chain-setupblueprint-contextsblueprint-profilingblueprint-anvil-testing-utilsblueprint-testing-utilsblueprint-managercargo-tangleblueprint-build-utilsblueprint-context-deriveblueprint-macrosblueprint-networking-round-based-extensionblueprint-producers-extrablueprint-store-local-databaseblueprint-storesblueprint-webhooksblueprint-x402blueprint-sdkblueprint-benchmarkingblueprint-metricsThis PR was generated with release-plz.