Release v2.22.1

Highlights

This hotfix release ships the post-v2.22.0 finding workflow and security harness updates without waiting for the normal release cadence. You can now inspect saved findings from the CLI, run a repo-native redteam pack locally, and rely on the prevention loop and validation gates to stay aligned with the shipped skill and runtime bundle.

What's New

ao findings commands — Browse and manage saved findings from the terminal instead of treating the registry as an internal file format.
Repo-native redteam harness — security-suite now includes a bundled redteam pack and prompt runner for repository-local security exercises.
Stronger prevention loop validation — The finding compiler, task-validation constraints, and end-to-end prevention-ratchet coverage are now validated together.
Runtime contract parity fix — Core multi-agent skills again reference the shared Claude feature contract while keeping local mirrored copies for runtime-local reads.

All Changes

Added

CLI commands for listing and managing findings.
A packaged redteam harness for repository-local security exercises.

Changed

End-to-end prevention-ratchet validation and docs so saved findings feed back into earlier planning and validation more reliably.
Skill reference packs and generated Codex artifacts stay aligned with the shared runtime contract.

Fixed

Finding metadata now appears consistently in inject output and JSON flows.
Release-gate coverage and hook-fixture drift that accumulated after the post-v2.22.0 merges.

Full changelog

1.7 KiB Raw Blame History