fix: preserve review cost-evidence contract and prepare v1.8.4

CHANGELOG.md

@@ -4,6 +4,16 @@ All notable changes to `github-delivery` are documented here.
 
 ## [Unreleased]
 
+## [1.8.4] - 2026-11-04
+
+### Changed
+
+- Bumped the package version from `1.8.3` to `1.8.4`.
+
+### Fixed
+
+- Restored explicit baseline-versus-candidate performance review guidance using the same measurement method, representative inputs, and p50/p95 latency distribution evidence when meaningful; cold-start and unproven-measurement rules remain in place. Added a regression test for the downstream Agent Hub review-policy contract (PR #491).
+
 ## [1.8.3] - 2026-11-04
 
 ### Changed

package.json

@@ -1,6 +1,6 @@
 {
   "name": "github-delivery",
-  "version": "1.8.3",
+  "version": "1.8.4",
   "description": "Guided installer and safety tooling for GitHub Delivery workflows",
   "type": "module",
   "engines": {

references/policy/reviews.md

@@ -34,7 +34,7 @@ When the PR is not ours under `GD-GIT-004`, do not base-sync, push, or simplify
 
 For merge-ready review, **find bugs before bots** and verify the diff's contracts: wiring, operator smoke, test honesty, docs/non-goals, input/evidence semantics, hot-path scale, malformed inputs, serialization/trace budgets, recursion termination, and payload completeness. Where applicable enforce one decision/clock, filter before LIMIT, aggregate semantics matching docs, byte-true budgets, bounded memory, absent-vs-malformed distinctions, complete source aggregation, and no self-recursion. Unknown must not outrank measured; incomplete verification blocks a positive verdict.
 
-For any always-on hot path, cost is contract evidence. Compare baseline and candidate with the same method and representative inputs; prefer a latency distribution, include cold start when relevant, and mark unavailable measurement unproven.
+For any always-on hot path, cost is contract evidence. Compare baseline and candidate with the same measurement method and representative inputs. Report a latency distribution with p50 and p95 when the sample supports meaningful percentiles, include cold-start impact when relevant, and mark unavailable or insufficient measurements unproven.
 
 ### GD-REVIEW-009 — Public security output is redacted
 

tests/unit/review-cost-evidence-contract.test.mjs

@@ -0,0 +1,21 @@
+import assert from "node:assert/strict";
+import { readFileSync } from "node:fs";
+import test from "node:test";
+
+const policyUrl = new URL("../../references/policy/reviews.md", import.meta.url);
+
+test("review policy preserves comparable always-on cost measurements across skill syncs", () => {
+  const policy = readFileSync(policyUrl, "utf8");
+  const proactive = policy.split("### GD-REVIEW-008")[1]?.split("### GD-REVIEW-009")[0] ?? "";
+
+  assert.ok(proactive, "expected GD-REVIEW-008 contract");
+  assert.match(proactive, /always-on|per-edit|per-request|per-message/i);
+  assert.match(proactive, /baseline/i);
+  assert.match(proactive, /candidate|branch/i);
+  assert.match(proactive, /same measurement method/i);
+  assert.match(proactive, /representative inputs/i);
+  assert.match(proactive, /p50/i);
+  assert.match(proactive, /p95/i);
+  assert.match(proactive, /cold.start/i);
+  assert.match(proactive, /unproven/i);
+});