Changelog - Sembl

0.2.0

stable, latestPyPI

Gate a PR in one MCP call. The new gate_pr tool takes just a repo path: it picks the base ref (origin/HEAD → main → master), diffs base...HEAD (the branch's own commits only), discovers the bounds contract, and returns the PASS/WARN/BLOCK verdict plus a pr record of exactly what was gated. It refuses to run without a contract — an empty contract passes everything, which is false assurance, not a gate — and every failure comes back as a structured {error, hint}, never an exception.
IDE quickstart. One page from zero to a gated PR in Claude Code, Cursor, or VS Code: docs/ide-quickstart.md — register the server with one uvx line, declare bounds once, then tell your agent "call gate_pr and fix the findings before you stop".
Contract self-edits now flag over MCP too. verify_change passed a custom bounds file without marking it as contract, so a diff rewriting the very file judging it flagged via the CLI but not over MCP. Fixed — parity everywhere.

0.1.21

previousPyPI

A change can no longer weaken its own gate. A diff that edits bounds.json or a .sembl/ work-order file — the very contract the verdict is computed from — used to be silently excluded as "Sembl's own config". It now surfaces as a gate-contract self-edit finding and is a hard BLOCK under every policy, including advisory scope. Generating an (untracked) bounds.json right before verify stays the normal authoring flow and does not flag; in diff mode (CI / PR / sandboxed loops) any contract edit in the diff flags.
Crafted paths can't alias into scope. Path normalization now collapses .. segments and strips absolute/drive anchors, so a patch path like src/../infra/deploy.yaml is judged as what it really touches (infra/deploy.yaml — forbidden) instead of matching the editable src/ prefix.
Housekeeping: MCP registry metadata (server.json) and doc/example version pins brought back into lockstep.

0.1.20

previousPyPI

Python bytecode and tool caches no longer false-flag a change. An agent that runs or tests its own code leaves __pycache__/*.pyc (and .pytest_cache, .mypy_cache, .ruff_cache) behind. The gate was counting those as out-of-scope edits and against the churn budget, so a correct, in-scope change could BLOCK. They're machine-produced, so they're now classified like dist/, build/, and lockfiles: in-scope unless explicitly forbidden, and excluded from churn. Surfaced by a real agent run, not a hypothetical.

0.1.19

previousPyPI

Root-level files are no longer invisible to sembl bounds. The Spec Kit path extractor required a directory slash, so a greenfield spec naming index.html, snake.js, or package.json at the repo root produced empty or falsely narrow bounds. Bare root filenames are now captured (prose abbreviations like "e.g." / "i.e." are still excluded), so root-file and greenfield specs get real bounds.

0.1.18

previousPyPI

Agent Skills. Drop-in skills in skills/ (copy to .claude/skills/): sembl-verify-subagent (the main-agent-verifies-sub-agent pattern - declare what a sub-agent may touch, then gate its diff + report), sembl-setup-bounds, and sembl-gate-pr.
Full-surface MCP. The MCP server now mirrors the whole CLI: verify_change, bounds_from_spec (spec / preset / custom config), list_presets, doctor (deterministic repo diagnostics), plus beta clarify_task and generate_work_order for completeness.

0.1.17

previousPyPI

Scope made tolerant by default. Measured against 437 real human-merged pull requests, an all-or-nothing scope rule WARNed on ~94% of legitimate merges - real changes touch a file or two no declared bound named. Scope now allows a little incidental creep before it counts (default scope_tolerance: { "max_fraction": 0.25 }, a fraction so it scales with change size); set {} for zero tolerance. At good bounds completeness the false-alarm rate drops to ~0 while wholesale "wrong area" changes are still caught.
Docs & changelogs are in-scope automatically - like tests and generated files - so a fix that updates CHANGES.rst or docs/ no longer false-flags.
MCP server. pip install "sembl[mcp]" then sembl-mcp exposes the gate over MCP - tools verify_change, bounds_from_spec, list_presets. The general case for main-agent-verifies-sub-agent: hand over a diff and what was declared, get back a deterministic PASS/WARN/BLOCK - no second model in the loop.
The spec/issue path extractor now rejects version strings and user-agents (it was matching Werkzeug/2.2.2 as if it were a file) and can validate candidate paths against the real repo tree.

0.1.16

previousPyPI

Declarative bounds adapters. sembl bounds --from kiro|tessl|agents-md|cursor-rules turns those tools' planning artifacts into a bounds file - no per-tool code. Built-in presets are just config; point --config adapter.json at your own for anything else (which files to read, how to pull paths, what's forbidden). New planning tools become a config entry, so the long tail stays free to support.
The Spec Kit adapter generalizes: --from spec-kit --source <glob> works against any path-naming doc.

0.1.15

previousPyPI

pre-commit hook. Add the sembl-verify hook to .pre-commit-config.yaml and every commit is gated locally against your bounds.
Agent-harness recipes. Run verify the moment the agent stops editing - Claude Code (Stop hook), Aider (--test-cmd), OpenCode (post-edit hook), or any harness that can run a shell command. Copy-paste configs in examples/ and docs/integrations.md.
Zero-arg verify. verify now auto-discovers a bounds.json (then .sembl/bounds.json) at the repo root, and ignores its own config file - so hooks and CI run without flags.

0.1.14

previousPyPI

Lockfiles and generated files no longer cause false noise. verify now recognizes lockfiles (package-lock.json, poetry.lock, go.sum, …), vendored/build output, and codegen: they count as in-scope rather than out-of-scope, and they're excluded from the churn budget - so a dependency bump's giant lockfile diff doesn't trip the gate. A forbidden-area rule still wins over this.
Sturdier diff parsing. --diff now handles renames and deletions correctly (paths read from the diff header, post-image /dev/null falls back to the pre-image).
Broader executor-report coverage. Fabricated-file and unevidenced-test checks now recognize many more report shapes - snake and camelCase keys (changedFiles, testsPassed, …), a changes field as a list or a filename-keyed dict - so the checks fire on whatever your agent or harness emits.

0.1.13

previousPyPI

Advisory scope is now the default. An out-of-scope edit is a WARN, not a BLOCK - only forbidden-area edits and fabricated claims block by default. Loose or auto-generated bounds were false-blocking legitimate related changes (config, manifests); a gate that cries wolf gets switched off. Pass --strict for a hard scope gate that also fails on any WARN.
Verify a PR or patch directly. sembl verify --diff pr.patch (or --diff - for stdin) scores a unified diff with no working-tree checkout - the piece CI needs.
GitHub Action. uses: speedvibecode/sembl@v0.1.13 runs verify on every pull request's diff and fails the check on a hard breach. Drop-in workflow in examples/.

0.1.12

previousPyPI

Sembl is now an accountability gate, first. sembl verify is the product: it checks an agent's real diff against declared bounds and returns PASS / WARN / BLOCK - deterministic, executor-neutral, no model in the loop, free to run in CI. We tested whether a rich up-front contract makes agents produce better code and our own results didn't support it, so we stopped claiming it. The honest claim is narrow and true: a repeatable check that a change stayed in bounds and didn't fake its results.
New: sembl bounds --spec-kit. Point it at a GitHub Spec Kit tasks.md (which already names exact file paths per task) and it emits the bounds file verify reads. Use Spec Kit, Tessl, or Kiro to plan what to build; use Sembl to verify the agent stayed inside it.
Generation is now beta and optional. sembl generate / clarify and the graph context still work and can draft a bounds file, but they're off the critical path - if you already plan with a spec tool, use that and feed the result to verify.
Bring-your-own bounds: verify --wo-file reads any JSON with four fields (editable paths, forbidden areas, churn budget). Docs: the bounds contract page.

0.1.11

previousPyPI

Change control, end to end. The new sembl verify command turns a diff into a PASS / WARN / BLOCK verdict against the Work Order: it BLOCKs out-of-scope and forbidden-area edits and fabricated success claims, and WARNs on broad churn or validation that was claimed but not evidenced. Deterministic only - no maintainability guesswork. --json for tooling, --strict to gate CI.
New intent stage: sembl clarify. Before packaging, it scores how underspecified a task is, asks typed missing-info questions, and separates safe assumptions from unsafe ones. Blocked questions become stop conditions; unsafe assumptions become approval triggers - so "ask before assuming" reaches the executor.
Size budgets on Work Orders. A new churn_budget (max files / lines) lets verify flag a diff that sprawls beyond the intended change.
More executors reachable: TokenRouter (OpenAI-compatible, near-frontier models) and a local Claude CLI provider. Every Work Order now records what it cost to produce (tokens + wall time).
Graph staleness guard: generation now notices when the code graph is older than the repo and says so, instead of silently using stale structure.

0.1.10

previousPyPI

Edit scope is now ranked by task relevance, not graph centrality. Controlled A/B demos on four real repos (httpie, katana, the FastAPI full-stack template, chatbot-ui) showed entry points and config files crowding the true fix file out of editable_paths. Files containing the task's quoted error text now rank first, content matches outrank path-name matches, and launchers/packaging/config carry a penalty.
Work Order contracts are now self-consistent by construction. Deterministic reconciliation before writing: no path can be both editable and forbidden, patch expectations cannot name non-editable files, and demanding test additions guarantees an editable test path.
Permission to stop is now part of every scoped Work Order (Lock 7): "if the correct fix requires editing a file outside editable_paths, stop and report which file and why." Strong executors already did this; now it is the contract.
New sembl validate command: checks the actual git diff against the Work Order scope and cross-checks executor reports for fabricated claims - never trust an agent's self-report.
Go and JS test files (_test.go, .test.js) are now recognized as test paths.

0.1.9

previousPyPI

Repo probing now auto-builds the code-review-graph database when it exists but is empty. CRG 2.3.5 reports success even with zero nodes, so unbuilt repos silently skipped graph context; the probe now detects an empty graph, builds it, and re-checks - so structural context reaches Work Orders on first run.

0.1.8

previousPyPI

Graph-grounded edit scope now ranks graph-surfaced files ahead of non-graph LLM/direct candidates, so graph-on runs can actually change editable_paths instead of being crowded out by keyword hits.
Grounding now filters generated and local scratch paths, including repo-ignored caches and benchmark fixtures, and removes invalid path-bearing patch expectations before writing the executor prompt.
Missing provider-key errors now name the selected provider and exact env var; doctor --json also reports OpenRouter key status.

0.1.7

previousPyPI

Editable-scope grounding now reads file paths from graph context in any repo layout (previously only matched a JS/web prefix list, so graph file signal never reached Python repos).
The model's own editable picks and graph-surfaced files are trusted into the edit scope even when a path lacks task keywords, so a real target file is no longer dropped by a weak keyword heuristic.

0.1.6

previousPyPI

sembl doctor now reports the installed Graphify and code-review-graph versions, so a Work Order's graph context is traceable to an exact tool stack.
--version is now single-sourced; releases are CI-guarded so the package version can never drift across files.

0.1.5

previousPyPI

Ollama provider (--provider ollama): run Work Order generation against a local model - no API key, no rate limits, fully offline. Defaults to qwen2.5-coder:7b; override host with OLLAMA_HOST.

0.1.4

previousPyPI

OpenRouter provider (--provider openrouter): OpenAI-compatible access to OpenRouter's full model catalog with one key.
Work Order JSON generation now allows up to 8192 output tokens across all providers, so larger Work Orders no longer truncate into invalid JSON.
Localization benchmarking started. Work Order scope accuracy is now measured against real merged PRs; this research runs in the background and will be published once results mature.

0.1.3

previousPyPI

Hardening for the graph subsystem from a full review pass.
Install hints render correctly in doctor and --refresh-graph (no more dropped [graph-pipeline]).
Graph context counts as available only when the tool is installed and its graph is built - a leftover artifact alone no longer counts.
python -m sembl.cli now works.

0.1.2

previousPyPI

sembl doctor: see what graph tools and graphs are present, which provider key is set, and the exact command to fix each gap.
--graph-mode auto / required / off: control graph context explicitly. required stops before any LLM call if graph context is unavailable, so you never waste tokens.
--refresh-graph rebuilds Graphify and code-review-graph before generating.
Generated file paths are grounded against the real repo, and validation commands pointing at missing files are dropped.
An LLM pass turns the structural graph into a plain-language impact analysis (graph-impact.md).
The site now has beginner docs, troubleshooting, architecture notes, and the animated terminal demo.

0.1.1

previousPyPI

Multiple providers: OpenAI, Anthropic, Gemini, and NVIDIA NIM.
Generated artifacts for human reading, agent execution, validation, and machine-readable output.
Repo probing for language, framework, branch, dirty state, and project rules.

plannedroadmap

A tighter sembl bounds adapter: read forbidden areas and size hints from a Spec Kit plan, not just file paths.
A signed, human-readable accountability record attached to each verdict.

What changed in Sembl

0.2.0

0.1.21

0.1.20

0.1.19

0.1.18

0.1.17

0.1.16

0.1.15

0.1.14

0.1.13

0.1.12

0.1.11

0.1.10

0.1.9

0.1.8

0.1.7

0.1.6

0.1.5

0.1.4

0.1.3

0.1.2

0.1.1

Next