Aspegio/nelson v2.3.0

v2.3.0 — Override-Learned Trust Calibration

on GitHub

This release introduces override-learned trust calibration — Nelson now learns how much to trust its own admiralty decisions from how often they get overridden — and lands the first tier of agent-hardening "sensors" that keep the codebase maintainable as agents work on it.

Features

• Override-learned trust calibration (#88, v1) — Nelson records admiralty decisions and the human overrides against them, then aggregates per-key calibration so future decisions are weighted by their historical override rate. Hardened for correctness: per-task_id dedupe (latest wins), required --recorded-by + session_marker_present provenance, corrupt-store .bak rotation, and index --rebuild now resets and recomputes the calibration store rather than silently accumulating stale double-counts. Key validation is enforced at the aggregation boundary, not just the CLI.
  • v2 (auto-elevation, Fisher/Wilson gating, raise-only mutation) remains tracked for a future release per #88.

Maintainability & CI

• Tier-1 agent-hardening sensors (#123) — AI-targeted Ruff thresholds, formatter, secret scanning (Gitleaks), and a documented suppress-with-reason / bump-threshold workflow so lint output is feedback an agent self-corrects against. See CLAUDE.md → "Maintainability sensors".
• CI hardening — actions and pre-commit hooks SHA-pinned, a pre-commit parity job mirroring local hooks, and per-directory parallel test jobs.
• Secret scanning fix — GITLEAKS_LICENSE is now wired into the secret-scan job env, so the gitleaks check passes on the org-owned repo.

Docs

• README polished for clarity and scannability; brownfield wording softened; the sensors workflow documented in CLAUDE.md / AGENTS.md.

Commits since v2.2.4

• 8804ebd chore: release v2.3.0
• c70c434 ci: pass GITLEAKS_LICENSE secret to gitleaks-action
• 01e5d37 docs: polish README for clarity and scannability
• 32eec71 feat: override-learned trust calibration (#88, v1)
• c8a27b3 Merge #123 — chore/harden-for-agents
• 7ade8fe ci: SHA-pin actions and pre-commit, add parity job, parallel tests
• 0a60bf7 chore: suppression hygiene + safer subprocess test pattern
• 21df007 chore: tighten lint config and triage surfaced violations
• 361a506 fix: restore LICENSE and README ownership
• 27460f9 chore: harden codebase for AI coding agents (Tier 1 sensors)