# CommitBrief v1.10.0

> A declarative merge gate — `commitbrief guard` — caps how many findings of each severity a change may carry via an opt-in `.commitbrief/policy.yml`. Richer than the single `--fail-on` threshold and aimed at gating high-volume, often AI-authored, pull requests. Run-mode reviews the diff; `--from-json` evaluates a review you already produced without a provider call.

Released June 20, 2026

Canonical URL: https://commitbrief.com/changelog/v1.10.0/

---

## Added

- **Policy gate: `commitbrief guard` (ADR-0029).** A declarative merge gate that
  caps how many findings of each severity a change may carry, via an opt-in
  `.commitbrief/policy.yml` — `thresholds:` per severity plus an optional
  overall `total:`. It is richer than the single `--fail-on=<severity>`
  threshold (a per-severity *budget*, not one cutoff) and is aimed at gating
  high-volume — often AI-authored — pull requests.

  ```yaml
  # .commitbrief/policy.yml
  version: 1
  thresholds:        # max findings allowed per severity (omit / ~ = unlimited)
    critical: 0
    high: 0
    medium: 5
  total: 20          # optional overall cap
  ```

- Two modes. **Run-mode** reviews the diff (reusing the standard pipeline) and
  then evaluates it; **consume-mode** (`--from-json <file|->`) evaluates a prior
  schema-v1 review with **no provider call**, so an agent's MCP self-review can
  be gated cheaply. It judges the set that survives baseline + suppression
  (signal control) — exactly what `--json` shows.
- It exits **0 on pass, non-zero when blocked**; a missing or malformed policy,
  or an unparseable review, also blocks — a merge gate must not pass when it
  cannot prove the change is within policy. `--json` emits a machine-readable
  verdict (`{passed, counts, total, violations}`). `guard` complements
  `--fail-on` — use either or both. Rule-id-scoped allow/deny lists are deferred
  (findings carry no stable rule id yet).