What's Changed

• fix(ci): repair tag-release.yml YAML so main pushes stop failing by @tmchow in #880
• chore(deps): bump github/codeql-action/upload-sarif from 4.37.0 to 4.37.1 by @dependabot[bot] in #892
• chore(deps): bump actions/checkout from 7.0.0 to 7.0.1 by @dependabot[bot] in #893
• chore(deps): bump actions/setup-go from 6.5.0 to 7.0.0 by @dependabot[bot] in #894
• chore(deps): bump zizmorcore/zizmor-action from 0.5.7 to 0.6.0 by @dependabot[bot] in #895
• chore(deps): bump actions/attest from 4.1.1 to 4.2.0 by @dependabot[bot] in #896
• fix(youtube): stop comparison-mode search timeouts under fan-out by @tmchow in #901
• chore(release): bump version to 3.18.4 by @github-actions[bot] in #902

Full Changelog: v3.18.3...v3.18.4

What's Changed

• fix(reddit): fetch window should track the requested date range by @slkbuilds in #860
• Fix Chromium cookie extraction to search all profiles, not just Default by @ellacaggfitness-lang in #725
• fix(polymarket): keep domain-sweep markets the topic filter drops by @slkbuilds in #859
• fix(render): blend thread relevance into Top Community Comments ranking by @singlaamitesh in #701
• Fix stale footer path after collision-safe save fallback by @terry-li-hm in #850
• fix(planner): reject invalid explicit plan schemas by @spiky02plateau in #841
• fix(render): keep the synthesis contract reachable when stdout is truncated (#726) by @nnhhoang in #727
• fix(pipeline): respect explicit source filters for company topics by @spiky02plateau in #842
• fix(store): guard store_findings against None engagement_score on update path by @nicolefinateri in #796
• fix(ci): make changelog-guard workflow parseable again by @tmchow in #878
• fix(youtube): log ScrapeCreators transcript rescue instead of masking it by @amitvijapur in #851
• chore(release): bump version to 3.18.3 by @github-actions[bot] in #879

New Contributors

• @slkbuilds made their first contribution in #860
• @ellacaggfitness-lang made their first contribution in #725
• @singlaamitesh made their first contribution in #701
• @nnhhoang made their first contribution in #727
• @nicolefinateri made their first contribution in #796
• @amitvijapur made their first contribution in #851

Full Changelog: v3.18.2...v3.18.3

What's Changed

• Add towncrier fragments and automated lockstep release workflow by @tmchow in #872
• fix: trustpilot domain auto-activate + sanitize evidence headings by @tmchow in #875
• chore(release): bump version to 3.18.2 by @github-actions[bot] in #877

Full Changelog: v3.18.1...v3.18.2

What's Changed

• docs(solutions): checkpointed host-judgment protocol design conventions by @mvanhorn in #858
• fix(docs): align Reddit ScrapeCreators backup copy with empty-only behavior by @tmchow in #869
• fix(competitors): stop silently dropping vs-entities beyond 4 by @tmchow in #870
• fix(bird_x): normalize retries and preserve clean empty results by @spiky02plateau in #840
• chore(deps): bump github.com/mark3labs/mcp-go from 0.55.0 to 0.56.0 in /mcp by @dependabot[bot] in #843
• chore(deps): bump actions/dependency-review-action from 4.5.0 to 5.0.0 by @dependabot[bot] in #844
• chore(deps): bump actions/attest from 4.1.0 to 4.1.1 by @dependabot[bot] in #845
• chore(deps-dev): bump pytest from 9.1.0 to 9.1.1 by @dependabot[bot] in #846
• chore(deps): bump actions/setup-go from 6.4.0 to 6.5.0 by @dependabot[bot] in #848
• chore(deps): bump github/codeql-action/upload-sarif from 4.36.2 to 4.37.0 by @dependabot[bot] in #849
• chore(deps): bump zizmorcore/zizmor-action from 0.5.6 to 0.5.7 by @dependabot[bot] in #847
• fix(youtube): avoid unnecessary transcript fallback spend by @terry-li-hm in #864
• fix(xurl): pin search to app-only auth — OAuth1-signed multi-word queries 401 by @papamo44 in #855
• fix: reject low-confidence general evidence by @terry-li-hm in #863
• chore(release): bump version to 3.18.1 by @tmchow in #871

New Contributors

• @terry-li-hm made their first contribution in #864
• @papamo44 made their first contribution in #855

Full Changelog: v3.18.0...v3.18.1

What's Changed

• feat(discover): host-judged three-leg discovery protocol by @mvanhorn in #856
• chore(release): bump version to 3.18.0 by @mvanhorn in #857

Full Changelog: v3.17.0...v3.18.0

What's Changed

• feat(discover): judged topic names, junk gate, angles, topic queue by @mvanhorn in #852
• docs(solutions): compound discovery content pipeline learnings by @mvanhorn in #853
• chore(release): bump version to 3.17.0 by @mvanhorn in #854

Full Changelog: v3.16.0...v3.17.0

What's Changed

• fix: isolate ScrapeCreators transcript HTTP errors from pipeline failure tracking (#829) by @23241a6749 in #830
• fix(bird_x): trust valid JSON stdout from Bird CLI even on non-zero exit (handle search) by @23241a6749 in #813
• fix(env): register DEGRADED_TRANSCRIPT_THRESHOLD so .env value is picked up by @23241a6749 in #807
• feat(env): register GITHUB_TOKEN for .env and keychain end-to-end support by @23241a6749 in #793
• fix: register LAST30DAYS_DEBUG in env keys, lazy resolution, fix xai_x crash by @23241a6749 in #770
• fix: guard all .get(key, 0) patterns that can return None (7 files, 17 occurrences) by @23241a6749 in #822
• fix: accept bare integer seconds in LAST30DAYS_MCP_TIMEOUT (#756) by @23241a6749 in #765
• feat(youtube): fetch comments free via yt-dlp, drop the ScrapeCreators requirement by @micmicalpha in #827
• fix(save): truncate long-topic slugs to stay under filename limits by @tkwilosz3 in #786
• fix(pipeline): forward pinned parameters in thin-source retry logic by @bastitva0-blip in #795
• Keep Chromium cookie temp copies private by @rp0927 in #764
• feat(pipeline): overridable result caps so high-volume sources aren't truncated (#716) by @jmilinovich in #717
• feat: make the OpenRouter base URL overridable (OPENROUTER_BASE_URL) by @oager in #703
• Honor plan's explicit sources at quick depth by @Bexr66 in #664
• chore(deps): bump trufflesecurity/trufflehog from 3.95.6 to 3.95.8 by @dependabot[bot] in #814
• fix: keyless web search on DuckDuckGo-blocked IPs + reddit enrichment failure isolation by @Mekiwi (cherry-picked from #825 as 2626d0f)

New Contributors

• @micmicalpha made their first contribution in #827

• @tkwilosz3 made their first contribution in #786

• @rp0927 made their first contribution in #764

• @jmilinovich made their first contribution in #717

• @oager made their first contribution in #703

• @Bexr66 made their first contribution in #664

• @Mekiwi made their first contribution in #825

Full Changelog: v3.15.0...v3.16.0

doctor: four-state audit, post-mortem, live probe

doctor is reworked from a flat config prediction into a genuine audit, plus the modes to diagnose real runs.

Added

• Four-state audit — every source is grouped into WORKING (verified this run/last run or keyless-always-on), TURNED ON - UNVERIFIED (configured/opted-in, no run evidence), NOT WORKING (configured but failing, or the last run errored), or COULD BE ON (available, not yet configured). One labeled line per source — nothing is buried in a cluster anymore.
• doctor --postmortem — reads the last run's last-report.json and reports what actually broke per source (Failed / Partial / Succeeded / Skipped, with details and fix hints).
• doctor --probe — a bounded live test that verifies WORKING instead of guessing; also auto-fires on a plain doctor when there's no fresh run. Per-source deadline (LAST30DAYS_DOCTOR_PROBE_TIMEOUT, default 10s) so a slow source can't hang it. Scoped to free HTTP + keyless CLI sources; credit-gated sources are never probed and stay UNVERIFIED.
• CLI health — sources needing a downloaded binary carry a [CLI: name ✓] marker and a dedicated CLI-health block. techmeme, arXiv, and trustpilot are now audited (they run in research but were previously invisible on the health surface).
• Backup + comment sub-lanes — Reddit SC backfill, YouTube SC transcript/search backstop (with a yt-dlp-rate-limit note), X cookie-vs-XAI_API_KEY dual path, and youtube/tiktok/instagram comment lanes render as indented sub-lines.
• doctor --json gains audit_state, cli, backups, comments, run_outcome, and a top-level mode — all additive.

Fixed

• Threads no longer reports Ready when it won't run: SC-gated opt-in sources honor INCLUDE_SOURCES, so Threads shows COULD BE ON until opted in. TikTok/Instagram stay on-by-default.

Full PR: #826

What's Changed

• feat(discover): rebuild --discover as nominate -> enrich -> floor; add global trending by @mvanhorn in #816

Full Changelog: v3.13.1...v3.14.0

What's Changed

• fix(doctor): honest source classification + drop zero-item footer lines by @mvanhorn in #815

Full Changelog: v3.13.0...v3.13.1