sumitake · sumitake · Jul 26, 2026 · Jul 26, 2026 · Jul 26, 2026
@@ -9,7 +9,7 @@
   "plugins": [],
   "metadata": {
     "description": "Agent collaboration plugin marketplace",
-    "version": "4.5.0",
+    "version": "4.5.1",
     "repository": "https://github.com/sumitake/agent-collab"
   }
 }
@@ -10,7 +10,7 @@
     {
       "name": "agent-collab",
       "description": "Unified dynamic-host collaboration package. Centralized skills and async coordination work without legacy packages; every model-execution route requires the verified signed plugin artifact.",
-      "version": "4.5.0",
+      "version": "4.5.1",
       "author": {
         "name": "John Osumi"
       },
@@ -32,7 +32,7 @@
   ],
   "metadata": {
     "description": "Agent collaboration plugin marketplace",
-    "version": "4.5.0",
+    "version": "4.5.1",
     "repository": "https://github.com/sumitake/agent-collab"
   }
 }
@@ -78,7 +78,7 @@ trust:
   primary's identity, model, and session dynamically — no per-host forks to
   drift out of sync.
 
-This public repository distributes that one package, **agent-collab** (v4.5.0), and is
+This public repository distributes that one package, **agent-collab** (v4.5.1), and is
 the source of truth for the coordinator policy, skills, migration tooling, the
 fail-closed runtime client, contribution governance, and release-safety checks.
 The signed and notarized darwin-arm64 native runtime is committed in this
@@ -129,7 +129,22 @@ Contributors need no access to the private build/sign system. See
 
 | Package | Version | Role |
 |---|---:|---|
-| `agent-collab` | 4.5.0 | Unified skills, dynamic host policy, migration preflight, and verified native-runtime client |
+| `agent-collab` | 4.5.1 | Unified skills, dynamic host policy, migration preflight, and verified native-runtime client |
+
+## What's new - v4.5.1
+
+- **Containment is structural, provider-agnostic, and rare by design.** Managed
+  providers authenticate from the canonical user HOME while the caller
+  checkout remains read-only. Each request receives a private temporary
+  workspace in which the provider may use tools, edit, build, and reason
+  agentically; OpenCode build returns output-only material for trusted-primary
+  application. A blocked access attempt is containment success, not an
+  invocation failure. Structural containment failure is reserved for a
+  pre-launch boundary that cannot be established or positive evidence that a
+  write escaped the allowed paths or changed protected source/credentials.
+  Authentication, protocol/output, timeout, provider, teardown, and cleanup
+  failures remain orthogonal. Managed execution does not use output/stderr
+  heuristics or routine direct CLI fallbacks.
 
 ## What's new - v4.5.0
 
@@ -261,6 +276,29 @@ roots and selected-provider auth; Codex keeps a sealed per-call `CODEX_HOME`,
 SQLite, and XDG overlay. Provider-specific policy overlays may narrow
 credentials or tools without replacing process HOME. Broker frames cannot
 invoke local runtime-management actions.
+The runtime resolves the canonical user HOME from passwd for provider
+authentication while keeping the caller checkout read-only by default. Every
+request receives a private temporary workspace where the selected provider may
+clone or copy inputs, edit, build, use tools, and reason agentically. Only
+explicit provider-state paths are writable outside that workspace, in-request
+binary auto-update is disabled, execution is bounded, descendants are reaped,
+and temporary cleanup is positively verified. OpenCode build is sealed
+output-only: its private-workspace changes are returned for trusted-primary
+review and application rather than written into the caller checkout.
+Canonical HOME is not a deny-all-read confidentiality boundary: providers
+operate under explicit same-UID read trust so authenticated CLIs,
+loaders, and tools remain reliable. The structural boundary confines writes,
+execution/lifecycle, provider-state access, protected paths, and request
+cleanup; provider-specific overlays may narrow reads further.
+
+A blocked access attempt inside an established boundary is containment success
+and does not by itself fail an invocation. A structural containment failure is
+reserved for failure to establish the boundary before launch or positive
+evidence that a write escaped allowed paths or changed protected
+source/credentials. Authentication, protocol/output, timeout, provider,
+teardown, and cleanup failures stay orthogonal; `rc=0`, empty output, or stderr
+wording never manufacture a containment result. Direct CLI use is not a normal
+reliability fallback for a managed route.
 If the client disconnects, the broker propagates cancellation through every
 managed provider route, reaps provider child groups,
 and discards partial output. Disconnect-driven cancellation is never retried;
@@ -533,8 +571,9 @@ path-based attachment or raw-provider fallback.
 
 Explicit `target=gemini`, `target=codex`, and `target=opencode` requests are
 fail-closed and never silently substituted. Gemini has separate read-only
-advisory, governance, and long-context actions; Codex advisory and OpenCode plan/workspace-write authority are
-sealed separately and never promote or demote into one another. Codex build is
+advisory, governance, and long-context actions; Codex advisory, OpenCode plan,
+and OpenCode private-workspace/output-only build authority are sealed
+separately and never promote or demote into one another. Codex build is
 a resolvable mutation-capable request but returns typed unavailable until a
 hardened mutation backend exists; it never widens advisory.
 
@@ -552,8 +591,9 @@ deadline. Final UTF-8 input above the inclusive 1,048,576-byte managed ceiling
 returns `input_limit` before provider authentication or spawn.
 Grok 4.5 is reachable only through sealed `architecture`, `governance`, or
 `huge_context` actions; generic advisory, brainstorm, debate, QA, and fallback
-requests cannot select it. OpenCode build is a distinct mutation-capable
-workspace-write action and never aliases its read-only plan action.
+requests cannot select it. OpenCode build is a distinct tool-capable,
+private-workspace/output-only action and never aliases its read-only plan
+action or writes the caller checkout.
 Applicable non-governance review, fallback, and worker requests may include an
 exact immutable artifact snapshot; its author model is resolved independently
 and that family is excluded from selection alongside the active primary family. An

@@ -0,0 +1,19 @@
+### Fixed
+
+- agent-collab 4.5.1 makes managed containment a rare structural signal rather
+  than an output heuristic.
+- Make managed containment provider-agnostic and structural: authenticated
+  provider state resolves from the canonical user HOME, caller checkouts stay
+  read-only by default, and each request receives a private temporary workspace
+  for agentic tools, edits, builds, and reasoning.
+- Seal `opencode/build` as output-only to the caller. OpenCode may work inside
+  its private workspace, but the trusted primary reviews and applies returned
+  material instead of granting the provider direct caller-worktree mutation.
+- Reserve `containment_error` for failure to establish the boundary before
+  launch or positive write-escape/protected-state evidence. A successfully
+  blocked access attempt proves containment worked; return code, empty output,
+  and stderr wording cannot manufacture a containment failure.
+- Keep authentication, protocol/output, timeout, provider, teardown, and
+  cleanup failures orthogonal. Disable in-request binary updates, require
+  bounded descendant teardown and positively verified temporary cleanup, and
+  treat routine direct-CLI fallback as a managed-path reliability defect.
@@ -1,6 +1,6 @@
 {
   "name": "agent-collab",
-  "version": "4.5.0",
+  "version": "4.5.1",
   "description": "Unified dynamic-host collaboration package with centralized skills, migration preflight, and a verified plugin-relative native runtime boundary. The signed runtime artifact is intentionally absent until the private build/sign integration completes.",
   "author": {
     "name": "John Osumi"

@@ -1,6 +1,6 @@
 {
   "name": "agent-collab",
-  "version": "4.5.0",
+  "version": "4.5.1",
   "description": "Unified dynamic-host collaboration package with centralized skills, migration preflight, and a verified plugin-relative native runtime boundary. The signed runtime artifact is intentionally absent until the private build/sign integration completes.",
   "author": {
     "name": "John Osumi"

@@ -7,7 +7,7 @@ verifiable compliance evidence, and operator final-say, delivered as one
 package for every supported host. This document is the package's technical
 reference; the repository README carries the purpose and governance narrative.
 
-Current: **4.5.0**
+Current: **4.5.1**
 
 It resolves `primary_id`, `primary_family`, `active_model`, `host_runtime`, and
 `session_identifier` from the current host or explicit configuration. ZCode
@@ -65,7 +65,7 @@ one macOS `LC_BUILD_VERSION` with minimum macOS 14.0 instead of trusting those
 manifest labels. The broker transport and provider protocol are both version 2.
 The package
 carries both `.claude-plugin/plugin.json` and `.codex-plugin/plugin.json`; both
-identify this same 4.5.0 package.
+identify this same 4.5.1 package.
 
 Codex, Gemini, OpenCode, Grok, and Composer are broker-only contracts. Their sealed requests cross a
 mode-`0600`, digest-bound per-user launchd Unix socket; launchd starts the exact
@@ -125,6 +125,29 @@ private XDG roots and selected-provider auth; Codex keeps a sealed per-call
 `CODEX_HOME`, SQLite, and XDG overlay. A provider-specific policy overlay may
 narrow credentials or tools without replacing process HOME. Broker transport cannot invoke local `status`,
 `prepare`, or `grok_login` management authority.
+The runtime resolves that canonical user HOME from passwd for provider
+authentication while keeping the caller checkout read-only by default. Every
+request receives a private temporary workspace where the provider may clone or
+copy inputs, edit, build, use tools, and reason agentically. Only explicit
+provider-state paths are writable outside that workspace, in-request binary
+auto-update is disabled, execution is bounded, descendants are reaped, and
+temporary cleanup is positively verified. OpenCode build is sealed output-only:
+its private-workspace changes are returned for trusted-primary review and
+application rather than written into the caller checkout.
+Canonical HOME is not a deny-all-read confidentiality boundary: providers
+operate under explicit same-UID read trust so authenticated CLIs,
+loaders, and tools remain reliable. The structural boundary confines writes,
+execution/lifecycle, provider-state access, protected paths, and request
+cleanup; provider-specific overlays may narrow reads further.
+
+A blocked access attempt inside an established boundary is containment success,
+not an invocation failure. Structural containment failure is reserved for a
+boundary that cannot be established before launch or positive evidence that a
+write escaped allowed paths or changed protected source/credentials.
+Authentication, protocol/output, timeout, provider, teardown, and cleanup
+failures remain orthogonal; `rc=0`, empty output, or stderr wording never
+manufacture a containment result. Direct CLI use is not a normal reliability
+fallback for a managed route.
 Client disconnect propagates cancellation through every managed provider
 route, reaps provider child groups, and discards partial
 output. Disconnect cancellation is never retried; a deadline below the managed
@@ -226,7 +249,7 @@ mutation-capable authority never promote or demote into one another.
 | `target=codex` second opinion, high-stakes advice, or tiebreaker | Read-only | Codex advisory |
 | `target=codex` bounded implementation | Mutation-capable worker | Typed unavailable pending hardened mutation backend; no advisory fallback |
 | `target=opencode` analysis or implementation plan | Read-only | OpenCode plan |
-| `target=opencode` implementation | Mutation-capable worker | OpenCode build with exact workspace-write authority |
+| `target=opencode` implementation | Output-only worker | OpenCode build with tools in a private temporary workspace; trusted primary applies the returned material |
 | `target=grok` architecture consultation | Read-only | Grok 4.5 `architecture` action |
 | `target=grok` governance review | Read-only | Grok 4.5 `governance` action |
 | `target=grok` large-corpus extraction | Read-only | Grok 4.5 huge-context ingestion |
@@ -442,7 +465,7 @@ Exact row contracts are:
 | `gemini/long_context` | Gemini advisory fields plus `"documents":[{"label":"...","content":"..."}]` |
 | `codex/advisory` | `{"model":"openai/...","effort":"low|medium|high|xhigh","mode":"prompt-only"}` or `mode=repo-review` plus absolute `cwd` |
 | `opencode/plan` | Absolute `cwd`; optional explicitly observed `model` and `variant` |
-| `opencode/build` | Absolute `cwd`; optional explicitly observed `model` and `variant`; mutation-capable workspace authority |
+| `opencode/build` | Absolute read-only caller `cwd`; optional explicitly observed `model` and `variant`; private temporary workspace with output-only caller authority |
 | `grok/architecture` | `{"mode":"prompt-only"}` or `mode=repo-review` plus absolute `cwd` |
 | `grok/governance` | Same exact row as architecture; requires `governance=true` and an artifact snapshot |
 | `grok/huge_context` | `{"documents":[{"label":"...","content":"..."}]}` |

@@ -89,7 +89,7 @@
     ("codex", "advisory"): "read_only",
     ("codex", "governance"): "read_only",
     ("opencode", "plan"): "read_only",
-    ("opencode", "build"): "workspace_write",
+    ("opencode", "build"): "output_only",
     ("grok", "architecture"): "read_only",
     ("grok", "governance"): "read_only",
     ("grok", "huge_context"): "read_only",

@@ -1,6 +1,6 @@
 ---
 name: agent-readiness
-version: 4.5.0
+version: 4.5.1
 description: Evaluate whether an agent, model, CLI, plugin, or role is ready for a proposed responsibility. Use when the user says "agent readiness," "is this agent ready," "can Codex be primary," "can Grok handle this role," "promote this agent," "evaluate this worker," "review model readiness," or "/agent-collab:agent-readiness." Also offer this proactively before assigning a new primary, reviewer, worker, delegate, headless, release, or merge-related role to Claude, Codex, Antigravity/Gemini, Grok, or a future agent.
 ---
 

@@ -1,6 +1,6 @@
 ---
 name: agent-runtime-status
-version: 4.5.0
+version: 4.5.1
 defaults:
   tier: Fast
   effort: low

@@ -1,6 +1,6 @@
 ---
 name: ai-writing-auditor
-version: 4.5.0
+version: 4.5.1
 description: Audits prose for the tells of machine-generated writing and rewrites it to read as if a careful human wrote it, without softening the actual content. Use when the user says "de-AI this text", "audit this writing for AI patterns", "make this read human", or "/agent-collab:ai-writing-auditor." Also offer this proactively when a piece of customer-facing or published prose is dense with the stock phrasing and mechanical structure typical of unedited model output.
 ---
 

@@ -1,6 +1,6 @@
 ---
 name: architect
-version: 4.5.0
+version: 4.5.1
 description: Request read-only architecture consultation for codebase analysis, system design, implementation planning, decomposition, or long-horizon coding strategy. Use when the user says "ask the architect," "have Grok design this," "architecture consultation," "plan this implementation," "decompose this build," "analyze the system design," or "/agent-collab:architect." Also offer this proactively before a substantial multi-system or long-horizon implementation where an independent architecture pass can reduce rework. This role never edits files, runs shell commands or tests, mutates a worktree, opens PRs, merges, or deploys.
 ---
 

@@ -1,6 +1,6 @@
 ---
 name: autonomy-readiness
-version: 4.5.0
+version: 4.5.1
 description: Evaluate whether an autonomous, always-on, scheduled, headless, or self-evolving workflow is ready to run safely. Use when the user says "autonomy readiness," "activation gate review," "is this workflow ready to run autonomously," "go/no-go autonomy," "always-on readiness," "headless operation review," or "/agent-collab:autonomy-readiness." Also offer this proactively before enabling background agents, recurring automations, auto-merge/self-evolution, external actions, unattended host runs, or any workflow that can continue without a human watching.
 ---
 

@@ -1,6 +1,6 @@
 ---
 name: brainstorm
-version: 4.5.0
+version: 4.5.1
 defaults:
   tier: Fast
   effort: low

@@ -1,6 +1,6 @@
 ---
 name: chain-configurator
-version: 4.5.0
+version: 4.5.1
 defaults:
   tier: Standard
   effort: medium

@@ -1,6 +1,6 @@
 ---
 name: chain
-version: 4.5.0
+version: 4.5.1
 defaults:
   tier: Standard
   effort: medium

@@ -1,6 +1,6 @@
 ---
 name: code-review
-version: 4.5.0
+version: 4.5.1
 defaults:
   tier: Advanced
   effort: high

@@ -1,6 +1,6 @@
 ---
 name: compose-skills
-version: 4.5.0
+version: 4.5.1
 description: Select a bounded, token-aware combination of collaboration skills or task lenses before execution. Use when the user says "compose skills," "which skills should I use," "use skill composition," "select a recipe," "combine these skills," or "/agent-collab:compose-skills." Also offer this proactively when a task plausibly needs multiple lenses, reviewers, or agents and would benefit from progressive disclosure, explicit fan-out limits, and a smallest-useful-skill plan before routing or loading full skill bodies.
 ---
 

@@ -1,6 +1,6 @@
 ---
 name: data-engineer
-version: 4.5.0
+version: 4.5.1
 description: Builds and hardens the pipelines and warehouse structures that move data from source systems to the people and systems that consume it. Use when the user says "build the ETL pipeline", "design the dbt models", "orchestrate this pipeline", or "design the warehouse schema", or "/agent-collab:data-engineer." Also offer this proactively when a pipeline lacks idempotency, has no data-quality checks, or moves data through undocumented schema contracts.
 ---
 

@@ -1,6 +1,6 @@
 ---
 name: debate
-version: 4.5.0
+version: 4.5.1
 defaults:
   tier: Advanced
   effort: high

@@ -1,6 +1,6 @@
 ---
 name: delegate
-version: 4.5.0
+version: 4.5.1
 defaults:
   tier: Fast
   effort: low

@@ -1,6 +1,6 @@
 ---
 name: dev-delegate
-version: 4.5.0
+version: 4.5.1
 defaults:
   tier: Standard
   effort: medium
@@ -26,8 +26,9 @@ and preserves artifact provenance. Never discover a provider executable.
 ## Supported model routes
 
 - OpenCode `plan`: read-only plan in one contained cwd.
-- OpenCode `build`: mutation-capable workspace-write execution within one
-  contained cwd; no `.git`, commit, push, PR, merge, or deploy authority.
+- OpenCode `build`: tool-capable execution in one private temporary workspace,
+  returning output-only material; the caller checkout stays read-only and the
+  route has no `.git`, commit, push, PR, merge, or deploy authority.
 - Grok 4.5 through the `composer/codegen` compatibility route: output-only
   patch/code JSON; no workspace tools. Seal simple work as low effort, standard
   fixes/features as medium, and complex multi-file or architecture work as high.

@@ -1,6 +1,6 @@
 ---
 name: elixir-engineer
-version: 4.5.0
+version: 4.5.1
 description: Senior Elixir and OTP engineer for fault-tolerant, concurrent, and Phoenix-based systems. Use when the user says "review this supervision tree", "why did this GenServer crash", "help me design this OTP process architecture", or "/agent-collab:elixir-engineer." Also offer this proactively when a change adds a new process, alters a restart strategy, or touches a Phoenix channel or LiveView boundary.
 ---
 

@@ -1,6 +1,6 @@
 ---
 name: eval-engineer
-version: 4.5.0
+version: 4.5.1
 description: Designs evaluation suites and scoring methods that measure whether an AI-backed workflow is actually good enough to ship. Use when the user says "design evals for this", "build an eval suite", "how should we measure this workflow", or "/agent-collab:eval-engineer." Also offer this proactively when a project ships a prompt, retrieval pipeline, or agent workflow with no structured way to tell whether a change made it better or worse.
 ---