release: promote Opcore 0.2.2 nested-workspace fix

.github/workflows/ci.yml

@@ -59,11 +59,27 @@ jobs:
         with:
           python-version: "3.12"
 
+      - name: Provision pinned Ruff proof artifact
+        run: |
+          python -m pip install --disable-pip-version-check ruff==0.6.9
+          test "$(ruff --version)" = "ruff 0.6.9"
+
       - name: Setup Rust
         uses: dtolnay/rust-toolchain@stable
         with:
           targets: x86_64-unknown-linux-musl
 
+      - name: Provision pinned cargo-udeps proof artifact
+        run: |
+          rustup toolchain install nightly-2026-07-27 --profile minimal
+          cargo +nightly-2026-07-27 install cargo-udeps --version 0.1.61 --locked
+          test "$(cargo +nightly-2026-07-27 udeps --version)" = "cargo-udeps 0.1.61"
+
+      - name: Provision pinned Rust function-metrics proof artifact
+        run: |
+          cargo install rust-code-analysis-cli --version 0.0.25 --locked
+          test "$(rust-code-analysis-cli --version)" = "rust-code-analysis-cli 0.0.25"
+
       - name: Setup Linux musl toolchain
         run: sudo apt-get update && sudo apt-get install -y musl-tools
 
@@ -78,6 +94,8 @@ jobs:
 
       - name: Check
         run: npm run ci
+        env:
+          OPCORE_RUST_NIGHTLY_TOOLCHAIN: nightly-2026-07-27
 
       - name: Prove authoritative mypy after-state execution
         run: npm run python:mypy-authority-proof

.github/workflows/release.yml

@@ -26,7 +26,7 @@ jobs:
       (github.event_name == 'workflow_run' && github.event.workflow_run.conclusion == 'success')
     runs-on: ubuntu-latest
     env:
-      RELEASE_VERSION: "0.2.1"
+      RELEASE_VERSION: "0.2.2"
       NPM_TAG: latest
     steps:
       - name: Checkout
@@ -97,7 +97,7 @@ jobs:
         if: github.event_name == 'workflow_run'
         run: npm run release:publish -- --version "$RELEASE_VERSION" --tag "$NPM_TAG"
         env:
-          OPCORE_CONFIRM_PUBLISH: "0.2.1"
+          OPCORE_CONFIRM_PUBLISH: "0.2.2"
           OPCORE_REQUIRE_ALL_NATIVE_PACKAGES: "1"
           NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
 

.gitignore

@@ -2,18 +2,15 @@ node_modules/
 dist/
 *.tsbuildinfo
 target/
-.ace/
 .agents/
 .claude/
 .codex/
 .gemini/
 .opencode/
-.code-review-graph/
-.rox-cache/
-.robustness-engine-cache/
 .zeroshot/*
 !.zeroshot/settings.json
-.opcore/
+.opcore/*
+!.opcore/config
 .asp/
 coverage/
 *.tgz

.opcore/config

@@ -0,0 +1,85 @@
+{
+  "validation": {
+    "adapters": [
+      "typescript",
+      "rust",
+      "python",
+      "docs",
+      "clone"
+    ],
+    "pathPolicy": {
+      "exclude": [
+        "packages/fixtures/",
+        "tests/fixtures/",
+        "packages/opcore-graph-core-darwin-arm64/",
+        "packages/opcore-graph-core-darwin-x64/",
+        "packages/opcore-graph-core-linux-x64/"
+      ]
+    },
+    "checks": {
+      "packs": [],
+      "disabled": [],
+      "defaults": [
+        "typescript.syntax",
+        "typescript.types",
+        "typescript.lint",
+        "typescript.import-graph",
+        "typescript.dead-code",
+        "typescript.function-metrics",
+        "typescript.relevant-tests",
+        "typescript.file-length",
+        "rust.source-hygiene",
+        "rust.fmt",
+        "rust.cargo-check",
+        "rust.clippy",
+        "rust.rustdoc",
+        "rust.import-graph",
+        "rust.dead-code",
+        "rust.graph-signals",
+        "rust.unused-deps",
+        "rust.file-length",
+        "rust.function-metrics",
+        "python.syntax",
+        "python.source-hygiene",
+        "python.ruff-lint",
+        "python.ruff-format",
+        "python.types",
+        "python.import-graph",
+        "python.dead-code",
+        "python.relevant-tests",
+        "python.pytest",
+        "docs.existence",
+        "docs.staleness",
+        "docs.freshness",
+        "docs.length",
+        "docs.dry",
+        "docs.content-quality",
+        "docs.code-blocks",
+        "docs.rules-why",
+        "docs.hub-coverage",
+        "docs.subtree-coverage",
+        "clone.duplication"
+      ],
+      "typescript": {
+        "fileLength": {
+          "maxFileLines": 300
+        },
+        "functionMetrics": {
+          "maxFunctionLines": 80,
+          "maxComplexity": 10,
+          "maxParams": 4
+        }
+      },
+      "rust": {
+        "fileLength": {
+          "maxFileLines": 500
+        },
+        "functionMetrics": {
+          "maxFunctionLines": 80,
+          "maxComplexity": 10,
+          "maxParams": 4
+        }
+      }
+    }
+  }
+}

.zeroshot/settings.json

@@ -5,7 +5,7 @@
   "worktree": {
     "baseRef": "origin/dev",
     "setup": [
-      "npm run setup"
+      "npm ci"
     ]
   },
   "ship": {

CHANGELOG.md

@@ -1,5 +1,35 @@
 # Changelog
 
+## 0.2.2
+
+Fixes validation for workspaces rooted below the Git worktree root.
+
+- Resolves the Git prefix so object reads and diff listings use worktree-root-relative paths while the workspace keeps its own relative view.
+- Scopes changed, staged, tree, tracked, and untracked listings to the selected workspace, so sibling packages no longer leak into a nested run.
+- Nested runs previously ended in `infrastructure_failure` with no checks executed; they now run the full changed-file gate.
+- Reported and fixed by Sigurd Høystad (@saasom) in #298.
+
+## 0.2.1
+
+macOS stability hotfix for Rust validation.
+
+- Materializes one Rust workspace per validation file-view state and materialization environment instead of a fresh recursive copy per check.
+- Shares that staged, tree, or hypothetical after-state across the selected Rust checks, and retains separate snapshots when Git or tool environments differ.
+- Disposes run-scoped workspaces on normal, fail-fast, streaming, and failed exits.
+- Removes the create/delete event storm that drove `fseventsd` memory growth on large repositories and concurrent agent runs.
+
+## 0.2.0
+
+Lighter default robustness loop on large repositories, plus validation correctness work.
+
+- Bounds product scan validation output to summaries, counts, failed check IDs, and diagnostic samples.
+- Makes validation file views lazy so path-specific checks skip enumerating every visible file.
+- Sends committed clone-analysis inputs as path references, reserving content-bearing overlays for changed or hypothetical files.
+- Replaces Python grammar heuristics with exact-interpreter `compile()` validation over `.py`/`.pyi` after-state content, including structured ranges and interpreter provenance.
+- Adds native validation-policy parity and tightens the package guardrails around it.
+
+The broader large-monorepo memory program stays open: graph build/query working sets, inspect/edit language-service isolation, bounded history and sidecar payloads, and the regression harness are tracked separately.
+
 ## 0.1.0
 
 Initial public release.