chore(deps): pin gentle-ai v2.2.3 runtime

[Alan-TheGentleman]

Closes #259

Related: #256

Type

• Bug fix
• New feature
• Documentation only
• Code refactoring
• Maintenance/tooling
• Breaking change

Summary

• Pins the package-local Gentle AI runtime to stable v2.2.3 at release commit 919ea3daf2afd8287bb42d86f8d979a9741b4b9e.
• Updates independently verified Darwin/Linux archive and executable digests while preserving the Windows Go SumDB source-build trust model.
• Mirrors the exact changed v2 consent fixture and review-integration documentation, adds the grounded v2.2.3 capability row, and keeps generated runtime/package checks in sync.

Parity audit

The #256 behavioral audit already covered every provider change through 0126077c; the stable release adds only two Windows review-CI portability/stability commits. PRs #257 and #258 cover the completed large-repository and frozen-scope work. Provider-owned path admission, nested-cwd status, directory-evidence rejection, targeted validation, and candidate inspection remain native. The remaining candidate-decline, SDD-attempt, recovery, provider-defect, issue/privacy, and skill-fingerprint tracks remain under #256, which this PR does not close.

Changes

Area	Change
Installer and resolver	Pin v2.2.3 URLs, version/tag, four archive hashes, four executable hashes, Windows module checksum, and exact version guard.
Native contract	Add the released v2.2.3 capability row and regenerate runtime mirrors.
Released artifacts	Mirror the changed v2 consent fixture and docs/review-integration.md bytes with new package hashes.
Tests and docs	Update installer/integrity/package assertions, README, runtime harness, and active review-transaction spec.

Test plan

• Minisign verification of checksums.txt.minisig with the repository trust anchor.
• sha256sum -c checksums.txt for all four release archives.
• Independently extracted and hashed all four release executables.
• go mod download -json github.com/gentleman-programming/gentle-ai/v2@v2.2.3 with GOSUMDB=sum.golang.org.
• Package-local install, version, executable hash, integrity manifest, and v2 capability probe.
• Focused installer/integrity/capability/package suite: 86 passed.
• Real released-binary runtime parity: 3 passed under an isolated home.
• Full pnpm test: 998 passed, 1 expected Windows-only skip; runtime harness passed.
• node scripts/verify-package-files.mjs: 129 resources, 64 exact v2.2.3 artifacts.
• pnpm run check:transaction-runner.
• pnpm run test:packed-runner: Gentle AI 2.2.3, 13 states.
• git diff --check.

Global RDD mode was not changed; binary-dependent tests used an isolated home.

Contributor checklist

• Linked approved issue chore(deps): pin Gentle AI v2.2.3 runtime #259.
• Added exactly one type:* label.
• Tests and docs are included with the pin.
• Conventional commit format.
• No Co-Authored-By trailers.

[coderabbitai]

Warning

Review limit reached

@Alan-TheGentleman, you've reached your PR review limit, so we couldn't start this review.

Next review available in: 27 minutes

Enable usage-based reviews in Billing to review now. Otherwise, wait until the next included review is available.
You're only billed for reviews past your plan's rate limits ($0.25/file).

How can I continue?

After more reviews become available, a review can be triggered using the @coderabbitai review command as a PR comment. Alternatively, push new commits to this PR.

To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews.

How do review limits work?

CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability.

For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window.

Please refer docs for additional details.

Review details

⚙️ Run configuration

Configuration used: Repository UI

Review profile: ASSERTIVE

Plan: Pro Plus

Run ID: e3b23770-bb1b-4608-a4b9-1c6033af1462

📥 Commits

Reviewing files that changed from the base of the PR and between 3d4a362 and d89be17.

📒 Files selected for processing (15)

• README.md
• contracts/review-integration/v2/fixtures/consent.fixture.json
• docs/review-integration.md
• lib/gentle-ai-binary.ts
• lib/native-review-cli.ts
• openspec/specs/review-transaction/spec.md
• runtime/gentle-ai-binary.mjs
• runtime/native-review-cli.mjs
• scripts/gentle-ai-installer.mjs
• scripts/verify-package-files.mjs
• tests/gentle-ai-binary.test.ts
• tests/gentle-ai-installer.test.ts
• tests/native-review-capability-contract.test.ts
• tests/package-manifest.test.ts
• tests/runtime-harness.mjs

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}