# Changelog

## 2026-08-28

- Distill now receives which reviewers reported coverage they did not
  complete, and prints the area each one left unread.
- A reviewer that spawns a sub-agent now has to wait for it, is barred from
  passing `name:`, and has to name any dispatched scan that did not return
  along with the area it left unread.

## 2026-08-27

- The focus-area question now carries a `No focus area` option, so declining a
  focus is a listed answer rather than an off-menu one.

## 2026-08-16

- Added two lenses, taking the skill from 14 reviewers to 16.
  `credential-scope` covers how far one of your own credentials reaches —
  wildcard scopes, prod keys in non-prod, personal tokens as service identities.
  `egress-payload` covers data the code sends to a third party on purpose:
  error-tracker bodies, analytics traits, model prompts, webhook dumps. Both
  came with boundaries against `token-lifecycle`, `authz`, `secrets-at-runtime`
  and `error-disclosure`, grep patterns in the scan, and a skip rule for repos
  with no IAM policy or no outbound client.
- Added the "Record the Run" step: the report goes to `skill-reviews/runs/` and
  a row goes to `skill-reviews/INDEX.md` in the reviewed repository.

## 2026-08-15

- Raised the report cap from 25 action points to 35, and added a `Below the cap`
  section — one line per theme with a count and one example path, omitted when
  nothing was dropped.

## 2026-08-10

- Replaced `1+Parallel` with `Rolling 5`, then with `1+Rolling 5`: the window
  refills on each completion notification rather than running waves, and never
  holds a sixth agent, since a 429 mid-run wastes the work of every agent that
  already finished.
- Made the first agent run alone in the foreground. A cache entry is readable
  only once the request writing it starts streaming, so a simultaneous burst
  misses it and every agent pays the 1.25× write. Agents now inherit the default
  model *and* the default agent type.
- Replaced the caching numbers with a 5-agent measurement: first agent read 0
  and wrote 16,713 tokens, each later agent read 5,994 and wrote ~10.9K.
- Split the background contract out: foreground findings arrive in the tool
  result, background findings in the completion notification. Never call
  `TaskOutput` on a subagent, and never read its `.output` symlink.

## 2026-08-09

- Stopped defaulting to Full mode and Sequential when the user names neither:
  the skill asks and waits unless the invocation already named one.

## 2026-08-04

- Rewrote the description into a triggerable one — what it does, when to reach
  for it, how it differs from `/security-review`, and what belongs to `dba` and
  `fuzz-my-stuff-up` — and replaced the inert `args`/`user-invocable`
  frontmatter with `argument-hint` and `disable-model-invocation: true`.
- Retracted the "~90% cheaper input after the first agent" claim. Agents share
  no prompt cache with each other: the Agent tool takes one prompt string, so
  the shared snapshot and the per-agent assignment land inside the same cached
  unit and can never match across agents. Launch order does not change cost;
  snapshot size does. The `---` divider is a section divider, not a cache
  boundary.
- Added the errata contract for a brief that turns out to be wrong mid-run. The
  resolved template freezes at the first launch; corrections go into an errata
  list appended to every later agent, and distill drops earlier findings that
  rested on the corrected claim, counting them as `stale-brief`.
- Corrected the snapshot TTL note: a staleness backstop, not a prompt-cache
  window, and per-skill rather than shared across meta-skills.

## 2026-08-03

- Added the spawn contract: never pass `name:` — a named agent becomes a mailbox
  teammate whose findings never come back and whose `run_in_background: false`
  is ignored. The distill output now goes into the reply verbatim, since only
  the reply is rendered to the user.
- Added the skill with 14 lenses: `authn`, `authz`, `crypto-misuse`,
  `dep-supply-chain`, `error-disclosure`, `file-perms`, `input-trust`,
  `network-exposure`, `secrets-at-runtime`, `secrets-in-git`, `subprocess-shell`,
  `symlink-path-safety`, `timing-side-channels`, `token-lifecycle`, plus
  `agent.md`, `distill.md` and `scan-steps.md`.