# EvalGate changelog

Product and SDK releases. The application, TypeScript SDK, Python SDK, and
OpenAPI specification can have different release identities; each entry states
the surfaces verified for that release.

## 3.7.9 — August 26, 2026

**Available:** EvalGate application and `@evalgate/sdk` for TypeScript.
**Separate release:** Python 3.7.9 is source capability until its PyPI
publication is verified. The published OpenAPI specification remains 3.7.8.

EvalGate now connects repository setup, production evidence, evaluation
coverage, release gates, and reviewed improvements into one
repository-to-release workflow.

### Repository-first setup

- Choose the authorized GitHub installation, repository, branch, root, harness,
  and commit rather than relying on an inferred default.
- Follow a durable activation run through queued, running, completed, partial,
  or failed states, with report links and safe recovery.
- Let multiple organization members work from the same repository attachment.

### Agent-native workflows

- Use `evalgate connect --client` to install native Codex, Claude Code, or Cursor
  instructions, or a portable Agent Skill.
- Discover authenticated product and documentation tools through MCP, A2A,
  WebMCP, and the machine-readable API catalog.
- Obtain a scoped API key through human-approved OAuth device authorization;
  agents do not automate GitHub or Google social login.

### Evidence, coverage, and release decisions

- Feed repository intelligence, grounded quality profiles, synthetic candidates,
  runtime observations, and traces into one governed improvement loop.
- Review AIDEFEND-aligned controls and red-team findings beside regression
  evidence.
- Preserve execution state, candidate mutations, approval evidence, and rollback
  plans rather than applying recommendations automatically.
- Capture application-health and coding-agent harness evidence from the
  TypeScript CLI.

### Production and data boundaries

- Customer content is excluded from generalized product improvement.
- Operational identifiers are pseudonymous, while external error reporting and
  log drains use fail-closed payloads.
- Vercel packaging uses the regular 8 GB build contract, bounded page generation,
  lazy MCP route construction, and explicit runtime dependency materialization.

Start at [repository setup](https://www.evalgate.com/setup), read the
[quickstart](https://www.evalgate.com/docs/quickstart), or install
[`@evalgate/sdk`](https://www.npmjs.com/package/@evalgate/sdk).

## 3.7.8 — August 15, 2026

- Completed the published API contract with five missing operations and 49
  refreshed path schemas.
- Prevented local, rule-only, and invalid judge providers from borrowing OpenAI
  credentials or endpoint identity in run provenance.
- Hardened large proof-runner lanes and table-driven runtime invariant discovery.

## 3.7.7 — August 14, 2026

- Added understand-first TypeScript and Python authoring that applies confirmed
  product context only after review.
- Added examples-first quality profiles that produce deterministic, quarantined
  drafts without model calls, network access, Git mutation, or auto-promotion.
- Prevented ungrounded profile vocabulary from becoming fabricated Cartesian
  test cases.

## 3.6.0 — July 4, 2026

- Expanded Redis, MCP, anonymous, and fallback rate-limit runway so safeguards
  act as runaway-traffic protection rather than interrupting normal use.
- Added release guards for npm agent-evidence commands and aligned Python
  production-loop scaffolding with local verify, run, and gate behavior.

For earlier releases, use the [interactive changelog](https://www.evalgate.com/changelog)
or the [npm version history](https://www.npmjs.com/package/@evalgate/sdk?activeTab=versions).