chore(seidroid-review): take driver v0.17.0

[bdchatham]

Two literals moved together, as the floor's own comment requires: driver-version's default and MIN_DRIVER_VERSION, both v0.15.0 → v0.17.0. A caller may run ahead of the default, never behind it.

Why now

v0.17.0 publishes supersedes per finding — the prior threads that finding replaces. The resolve step reads it to close each superseded thread only once that finding's own replacement reached the code.

On v0.15.0 or v0.16.0 the field is absent, so the step reports superseded_linked=false and falls back to its per-review gate: a review superseding threads A, B and C closes all three on the strength of one unrelated finding placing. The per-thread gate shipped in #102 is inert until this lands.

The floor also crosses v0.16.0, which bounds the prior-thread history by bytes rather than by a count of twenty threads and three replies — the same budget that carries 645 one-line findings where the count carried 20.

Also updated

The MIN_DRIVER_VERSION comment's version ladder, which contrasts what each release concludes or carries. It now runs to v0.17.0. The two remaining v0.15.0 mentions are both in that ladder, as contrasts, and stay true.

Both go install examples in the prose now name v0.17.0.

What this refuses

Any caller pinning below v0.17.0 fails at install with a named message rather than mid-review. Both callers pin uses: by sha and still run an older workflow, so nothing breaks today — but each cutover must drop its driver-version line in the same commit that bumps its uses: sha. Recorded on PLT-1165, PLT-1170 and PLT-1174.

Verification

go install …@v0.17.0, cold GOMODCACHE   resolves, mod version v0.17.0
  (go: downloading … proves the cache was empty)
Supersedes in the tag                   findings.go:59, both tag forms
actionlint base   4 SC2102
actionlint head   4 SC2102              identical
yaml.safe_load                          parses

run.sh          271 passed, 0 failed
run-guard.sh    241 passed, 0 failed
reactions.sh     77 passed, 0 failed
conditions.py    77 passed, 0 failed

Not verified: nothing ran on a GitHub runner. The install step's floor comparison was exercised against real go installs when it shipped; this change moves its constant and does not touch its logic.

[cursor]

PR Summary

Low Risk
Constant-only bump in CI wiring; install floor logic is unchanged, but reviews now depend on v0.17.0 behavior for thread resolution.

Overview
Bumps the sei-agent-driver pin for the reusable seidroid-review workflow from v0.15.0 to v0.17.0 in both places that must move together: the driver-version input default and MIN_DRIVER_VERSION on the install step. Callers that omit driver-version now get v0.17.0; anything below that fails at install before a review runs.

Documentation in the workflow is updated to match: go install examples use v0.17.0, and the version ladder comment now covers v0.16.0 (prior-thread history bounded by bytes) and v0.17.0 (per-finding supersedes, which the placement/resolve steps use to close superseded threads only when that finding’s replacement actually landed on the code).

^{Reviewed by Cursor Bugbot for commit 8eb907b. Bugbot is set up for automated code reviews on this repo. Configure here.}

[github-actions]

A clean, well-scoped bump of both the driver-version default and MIN_DRIVER_VERSION from v0.15.0 to v0.17.0, moved together as the file's own comment requires, with the prose and the version ladder updated to match. Only finding is a stray line break left by an incomplete comment rewrap.

Findings: 0 blocking | 2 non-blocking | 1 posted inline

Blockers

• None at the file/PR level.

Non-blocking

• The floor and the driver-version default move together as the comment at .github/workflows/seidroid-review.yml:1347 requires, and all four prose mentions of the installable version (lines 106 twice, 1369) are consistent at v0.17.0. The two remaining v0.15.0 mentions are contrastive entries in the version ladder and stay correct. No in-repo caller passes driver-version, and no test asserts a version string, so nothing here breaks. Consumers in other repos that pin driver-version: v0.15.0 will hard-fail at install once they bump their uses: sha — the PR body already records this on PLT-1165/1170/1174, which is the right place for it since this repo cannot enforce it.
• 1 suggestion(s)/nit(s) flagged inline on specific lines.

[github-actions]

[nit] Incomplete rewrap: # on one of is left as a three-word line dangling between two full-width ones, and line 1343 ends mid-clause (A merge gate keyed). Reflowing 1343-1345 into two full lines would keep this block reading as prose, which matters more than usual in a file where these comments are the documentation.

[bdchatham]

Fixed in 8eb907b. The rewrap was mine and it was sloppy: # on one of dangling between two full-width lines, with the line above ending mid-clause at A merge gate keyed.

Reflowed to two lines. Widths across the block now run 84-90 with the closing # rest. — no dangling fragment, and the sentence reads through.

You are right that it matters more here than usual. These comments are this file's documentation, and a reader who hits a three-word line assumes something was cut.

Four harnesses re-run on the reflow: 271, 241, 77, 77, all zero failed. actionlint unchanged at 4× SC2102.

[github-actions]

A version-only bump of the review driver from v0.15.0 to v0.17.0, moving the driver-version default and MIN_DRIVER_VERSION together as the floor's own comment requires, with the version ladder and both go install prose examples updated to match. No in-repo caller pins driver-version, the floor comparison handles the new value correctly, and the supersedes consumer this bump activates is already present and degrades safely — nothing to flag.

Findings: 0 blocking | 0 non-blocking | 0 posted inline

Blockers

• None at the file/PR level.

Non-blocking

• None at the file/PR level.