Changelog

All notable changes to @fro.bot/systematic are listed here, newest first. Entries start with the first release made through the release pull request; earlier releases are on GitHub Releases.

3.22.4 (2026-10-15)

Bug Fixes

• guard: stop the operation observer from reading a changed worktree as unchanged (#1129) (5a4ed40)
• security: patch PostCSS Nano ID denial of service (#1127) (6f23f58)

Documentation

• solutions: record the digest collapse, release gate, brokered push and action pin fixes (#1122) (1709656)
• solutions: record the operation observer false-clean fixes and the review-spiral scope cut (#1130) (f812849)

Tests

• release: accept any pinned release App token action (#1121) (cef2d11)

Miscellaneous Chores

• deps: update actions/create-github-app-token action to v3.3.0 (#1102) (30ec28b)
• deps: update fro-bot/agent to v0.122.2 (#1123) (12f3f17)
• deps: update github/codeql-action action to v4.39.0 (#1132) (b9f80cf)

3.22.3 (2026-10-14)

Bug Fixes

• guard: fingerprint operations and identities of any size (#1119) (d3b9234)
• guard: observe operations only while guarded work can use them (#1116) (3632fb2)
• release: accept GitHub-signed release commits in the scheduled gate (#1120) (3499d23)
• security: bound indexed source-map processing (#1060) (6bb89a8)
• security: patch Sharp librsvg vulnerability (#1059) (bfcc401)
• security: reject injected URI authority components (#1052) (68960f5)

Build System

• dev: update OpenCode to v1.19.0 (#1118) (f9ffc50)

Continuous Integration

• fro-bot: let trusted PR comments deliver fixes through the brokered push (#1117) (15b1ec8)
• release: drop the hourly release reconcile (#1112) (6cd8a43)

Miscellaneous Chores

• deps: update fro-bot/agent to v0.122.1 (#1114) (ccc204d)
• lint: align Biome schema with installed release (#1056) (113a0e3)

3.22.2 (2026-10-13)

Bug Fixes

• guard: only allowlisted skills activate a workflow epoch (#1107) (3fb1b4b)
• skills: name only skills the resolver can load (#1111) (f6e6cad)
• skills: resolve bundled workflow handoff targets (#1110) (a501c5a)

Tests

• guard: prove the large non-allowlisted skill load succeeded (#1109) (63f09d8)

3.22.1 (2026-10-13)

Bug Fixes

• deps: update dependency web-tree-sitter to v0.27.1 (#1085) (c95b217)
• guard: keep the workflow guard available in large repositories and record why it is not (#1101) (5480af4)

Continuous Integration

• release: open the release pull request when nothing is published (#1103) (20c2028)
• release: publish only through the gated release with npm OIDC (#1100) (15eca8f)