What's new.

The builtin content policy judges prose by function instead of fixed vocabulary, and reviews can resolve their own uncertainty findings against repository files.

• ChangedFinding bodies over six hundred bytes are rewritten to state the defect, evidence, and fix in at most three sentences; reviews.conciseFindings: false opts out.
• ChangedBuiltin content-policy rules for stale text and house style state functional tests with illustrative examples, so the policy stays accurate as model vocabularies shift, and repo-appended rules can scope themselves to specific paths.
• AddedA bounded post-scoring pass fetches the repository files an uncertainty finding names and resolves it with byte-verbatim evidence instead of asking the developer to inspect them; reviews.uncertaintyResolution: false opts out.

Self-service trials and bounded hosted reviews use release-scoped activation checks and durable retry accounting.

• AddedNew installations receive a 30-day private-repository trial without a payment card.
• ChangedHosted activation checks the pinned model and provider route, token usage, and provider cost accounting.
• FixedFailed hosted reviews reconcile reserved provider spend after model execution begins.
• FixedHosted runs report an operational failure unless GitHub receives their terminal review checks.
• FixedBounded reviews recover incomplete model output and validate every selected source batch before returning results.
• FixedPrior findings remain active until a current review rechecks their evidence across bounded batches and renamed files.
• FixedReasoning-heavy synthesis retries once with a larger bounded output budget and stops when that retry is exhausted.
• SecurityHosted large-review retries bind provider calls and billing to an authenticated durable plan and immutable retry identity.

Review delivery has time and output bounds, hosted reviews handle large changes in bounded batches, and GitHub reviews fetch every changed-file page.

• ChangedHosted reviews process large changes in bounded batches; local reviews can opt in with postil review --bounded.
• FixedGitHub reviews fetch every changed-file page and recover when a model spends its response on reasoning without returning review content.
• FixedProvider recovery and review publication have explicit limits, so a completed review cannot turn into an unbounded retry or oversized comment.

Bring-your-own-key setups can call Anthropic-compatible APIs directly.

• AddedNative Anthropic request and authentication support alongside the OpenAI-compatible API format.

Scoring, model fallback, and blocking rules became configurable and time-bounded.

• AddedAn independent scorer records its assessment separately from the review model, and gate policy can block selected finding kinds.
• ChangedModel cascades live in configuration and report progress while a review is running.
• FixedTimeouts retry before advancing the cascade; gate replay, GitHub links, and review-comment formatting stay consistent.

Content-policy checks, accurate run states, and reliable re-runs became defaults.

• ChangedContent-policy review is enabled by default, with plain gate output and truthful queued, running, completed, and failed states.
• FixedRe-runs can resolve carried findings, annotations use the changed side of the diff, and transient forge failures retain the completed review.
• ChangedParallel source fetches and bounded model output reduce review latency without shortening the review prompt.

Multi-forge replies, benchmark coverage, content-policy checks, and security hardening extend the first CLI releases.

• AddedInteractive replies work across GitHub, GitLab, Bitbucket, and Azure DevOps, with end-to-end coverage for each forge.
• AddedThe benchmark harness runs in CI and supports bounded live-model comparisons with detection, severity, concurrency, and retry measurements.
• SecurityCargo audit runs in CI, known dependency advisories are closed, model output is stripped of terminal control sequences, and diff plus check-run output is capped.
• FixedAmbiguous incremental baselines fail closed, disabled review stays disabled, and PR-description findings must cite the relevant text.

First tagged release of the CLI and the gate contract. Signed multi-arch binaries are published on GitHub releases; you can also install via the one-line script, build from source, or pin the GitHub Action to a commit SHA.

• Addedpostil review with --staged, --base, and --diff-file inputs, plus JSON envelope output via --output-json and SARIF 2.1.0 output via --sarif.
• AddedTwo named check-runs on every non-draft PR in enabled repositories: postil/gate (blocking) and postil/review (advisory), with documented branch-protection setup.
• AddedForge support beyond GitHub via --forge gitlab, bitbucket, and azure, each covering its self-managed/server variant through a base-URL environment variable (GITLAB_API_URL and friends). Bitbucket and Azure DevOps are best effort: shipped, tested, and refined as platform-specific edge cases surface.
• AddedIncremental re-review (--since-sha + --baseline) with resolved/carried finding reconciliation.
• Addedpostil respond: the interactive @postil bot engine for PR and issue mentions. The CLI command covers GitHub, GitLab, Bitbucket, and Azure DevOps via --forge; the hosted GitHub App is GitHub only. Review-and-answer only, never opens PRs.
• Addedpostil doctor preflight, postil plan dry-run against stored envelopes, and postil hook install for a pre-push review hook.
• AddedRepo guardrails: rules in .postil/guardrails.md are injected into the prompt; violations surface as guardrail findings that quote the rule.
• AddedOne-line install script with SHA-256 checksum verification and Sigstore keyless signature verification when cosign is present; build from source with cargo install --git.
• SecurityLeast-privilege GitHub App (no contents:write), fail-closed gate on operational errors (repos can opt into gate.onError: advisory), AES-256-GCM sealing for bring-your-own inference keys, Sigstore keyless signing of release artifacts in CI.