Prepare github-delivery 1.5.3 follow-up release

CHANGELOG.md

@@ -4,6 +4,23 @@ All notable changes to `github-delivery` are documented here.
 
 ## [Unreleased]
 
+## [1.5.3] - 2026-09-10
+
+### Changed
+
+- Bumped the package version from `1.5.2` to `1.5.3`.
+- Re-review execution is now delta-first: one compact current-head review brief establishes scope, unchanged evidence is reused instead of repeatedly re-read, specialist-owned analysis is not duplicated, and deterministic helper failures must be inspected before a corrected retry (PR #448).
+- Agent debug traces now self-identify the github-delivery version and tracing implementation, can include the owning workflow/build identity, and preserve allowlisted numeric token-usage counters without storing provider result bodies or cost payloads (PR #450).
+
+### Fixed
+
+- Authorized re-review `approve-comment` completion now runs the native-review sidecar, dismisses the viewer's superseded `CHANGES_REQUESTED` reviews, re-fetches review state, refreshes the exact-head ship gate, and rejects a verdict that claims no gate blocker while the authoritative gate is blocked or unknown. This cleanup does not submit a GitHub Approve (PR #448).
+- Comment Inspector evidence is isolated per invocation with a unique run ID and run directory. Run-bound results must carry the exact current `runId`, and previous-run result files are forbidden as classification input even for the same repository, PR, head, or scope digest (PR #449).
+
+### Security
+
+- Persisted debug-trace thread, turn, item, and parent identifiers are now pseudonymized per trace while raw tool inputs/outputs, provider result bodies, costs, and private Grok thinking remain excluded (PR #450).
+
 ## [1.5.2] - 2026-09-10
 
 ### Changed

package.json

@@ -1,6 +1,6 @@
 {
   "name": "github-delivery",
-  "version": "1.5.2",
+  "version": "1.5.3",
   "description": "Guided installer and safety tooling for GitHub Delivery workflows",
   "type": "module",
   "engines": {

tests/unit/agent-debug-trace-diagnostics.test.mjs

@@ -22,6 +22,10 @@ function traceEvents(path) {
     .map((line) => JSON.parse(line));
 }
 
+function currentPackageVersion() {
+  return JSON.parse(readFileSync(new URL("../../package.json", import.meta.url), "utf8")).version;
+}
+
 test("stream recorder starts with self-identifying trace metadata", () => {
   const stateDir = mkdtempSync(join(tmpdir(), "gd-trace-metadata-"));
   try {
@@ -37,7 +41,7 @@ test("stream recorder starts with self-identifying trace metadata", () => {
 
     const [metadata] = traceEvents(recorder.path);
     assert.equal(metadata.type, "trace_metadata");
-    assert.equal(metadata.githubDeliveryVersion, "1.5.2");
+    assert.equal(metadata.githubDeliveryVersion, currentPackageVersion());
     assert.match(metadata.traceImplementationDigest, /^sha256:[a-f0-9]{64}$/);
     assert.equal(metadata.workflow, "references/re-review-pr.md");
   } finally {

tests/unit/pr-review-quality-contracts.test.mjs

@@ -86,13 +86,23 @@ test("re-review is delta-first and avoids repeated helper-contract discovery", (
 });
 
 test("review-integrity follow-up release is complete in 1.5.2", () => {
-  const pkg = JSON.parse(read("package.json"));
   const changelog = read("CHANGELOG.md");
   const release = changelog.split("## [1.5.2] - 2026-09-10")[1]?.split("## [1.5.1]")[0] ?? "";
 
-  assert.equal(pkg.version, "1.5.2");
   assert.ok(release, "expected a dated 1.5.2 changelog section");
   for (const pr of [440, 441, 442, 443, 444, 445, 446]) {
     assert.match(release, new RegExp(`PR #${pr}\\b`));
   }
 });
+
+test("re-review trace follow-up release is complete in 1.5.3", () => {
+  const pkg = JSON.parse(read("package.json"));
+  const changelog = read("CHANGELOG.md");
+  const release = changelog.split("## [1.5.3] - 2026-09-10")[1]?.split("## [1.5.2]")[0] ?? "";
+
+  assert.equal(pkg.version, "1.5.3");
+  assert.ok(release, "expected a dated 1.5.3 changelog section");
+  for (const pr of [448, 449, 450]) {
+    assert.match(release, new RegExp(`PR #${pr}\\b`));
+  }
+});