diff --git a/CHANGELOG.md b/CHANGELOG.md index 4d3da8e..db2aba0 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -12,476 +12,330 @@ The public changelog intentionally records policy, compatibility, and migration -### Added +### Fixed -- Add a digest-pinned activation-only third-party notice/license tree for CPython 3.13.14, Nuitka 4.1.3, Expat, HACL*, libb2, mpdecimal, mimalloc, and Hedley. -- Extend SPDX 2.3 release evidence with component packages, embedded-component relationships, and license conclusions that no longer mislabel the native runtime as wholly PolyForm-licensed. -- Add a closed co-packaged runtime setup client for read-only status, idempotent managed-state preparation, and bounded Grok device login without exposing provider recipes or caller-selected paths. +- `build-changelog.py` now sorts `changelog.d/` fragments in **reverse** + lexical order (newest filename first) instead of ascending order. The + compiled `[Unreleased]` block previously placed the oldest fragment at the + top and the newest at the bottom — backwards from the Keep a Changelog + convention this file's own header cites (most recent change on top). + `CHANGELOG.md` is regenerated from the corrected sort; only the ordering + changed, no entries were added, removed, or reworded. -### Changed +### Fixed -- Reject noncanonical package-qualified release tags, move the arm64 activation verifier to `macos-15`, and fail activation archives on missing, extra, linked, hardlinked, unsafe, or content-drifted third-party legal members. -- Keep the native child environment scrubbed while passing only a closed generic/Codex-Desktop host-context observation; the signed runtime derives and validates provider state from the OS login identity. -- Fail closed with typed `platform_unsupported` when POSIX user identity APIs are unavailable, before manifest or artifact ownership checks can raise on non-POSIX hosts. +- agent-collab 4.5.1 makes managed containment a rare structural signal rather + than an output heuristic. +- Make managed containment provider-agnostic and structural: authenticated + provider state resolves from the canonical user HOME, caller checkouts stay + read-only by default, and each request receives a private temporary workspace + for agentic tools, edits, builds, and reasoning. +- Seal `opencode/build` as output-only to the caller. OpenCode may work inside + its private workspace, but the trusted primary reviews and applies returned + material instead of granting the provider direct caller-worktree mutation. +- Reserve `containment_error` for failure to establish the boundary before + launch or positive write-escape/protected-state evidence. A successfully + blocked access attempt proves containment worked; return code, empty output, + and stderr wording cannot manufacture a containment failure. +- Keep authentication, protocol/output, timeout, provider, teardown, and + cleanup failures orthogonal. Disable in-request binary updates, require + bounded descendant teardown and positively verified temporary cleanup, and + treat routine direct-CLI fallback as a managed-path reliability defect. -### Breaking + +### Changed -- Rename the public `ai-merge-resolve` skill to `merge-resolve`, including its generated command and auto-apply policy filename. Existing installations must invoke `/agent-collab:merge-resolve` and rename `.claude/ai-merge-policy.yaml` to `.claude/merge-resolve-policy.yaml` when that opt-in file is used. +- Rebuild the darwin-arm64 provider runtime from final workspace `1.0.823` + commit `d08b6382710d6d5910d64cf011bcac873a2e1c03`, Developer-ID sign it, and + notarize it through Apple submission + `c6d29dec-5351-467d-883e-0b862734567d`. +- Replace the policy-only placeholder with a closed activation manifest that + pins the complete standalone bundle at SHA-256 + `2cea10cff2030d0238661667cf8d1b83cf9885dc6f4a03b0db4365e891b04f47`. + The rebuilt runtime includes the v4.5.1 provider-agnostic containment, + canonical-user-HOME authentication, private request workspace, bounded + execution/teardown/cleanup, OpenCode Go, output conformance, and lifecycle + continuity repairs from the final merged workspace. -### agent-collab 3.0.0 — breaking unified-package consolidation +### Tests -- **Breaking:** retire `claude-collab`, `codex-collab`, - `antigravity-collab`, `codex-tools`, and `glm-worker` immediately. Together - with the already-retired `grok-worker`, they are removed from the - marketplace, release inventory, active documentation, and generated package - surface without presets, tombstones, dependencies, or compatibility shims. - The historical `agent-collab-plugin`, `gemini-collab`, and `grok-collab` - package identities are also treated as retired exact aliases. The clean - `sumitake/agent-collab` repository is the marketplace source; a repository - name is not itself an installed legacy package. -- Add `agent-collab 3.0.0` as the only package and release. It resolves the - primary, model family, active model, host runtime, and session dynamically. - `codex-tools` → the managed Codex backend in `agent-collab`; `glm-worker` - → the managed OpenCode backend, with `opencode/glm-5.2` retained as the - current Zhipu-family model preset. -- Add a narrow signed-native-runtime manifest, standalone public coordinator, - and verifier. Exact route/action, authority, and artifact-author provenance - checks cover Gemini, Codex, OpenCode, Grok 4.5, and Composer. Grok 4.5 is - limited to sealed read-only architecture, governance, and huge-context - actions; generic advisory or worker roles cannot select it. OpenCode build - is explicitly mutation-capable workspace-write authority, distinct from - read-only plan. Response family - is derived from the artifact-author model on every call, including OpenCode - model switches; structured provider/model parsing rejects ambiguous lineage - and incidental substring matches. Applicable non-governance worker requests - may carry an exact artifact snapshot so its author family is also excluded. - Contradictory or unknown response provenance is rejected. Runtime - stdout and stderr are bounded while the process is running, with process- - group termination and reaping on output-limit or unexpected collector - failures. The release - tree contains no unsigned - placeholder artifact; all native routes are typed unavailable until the - private build/sign system supplies the notarized binary. A - policy-only release may ship with an empty artifact manifest and no runtime. - Native activation remains blocked until the Darwin-arm64 artifact advertises - the full matrix and supplies commit-bound Developer ID, hardened-runtime, and - notarization evidence. -- Split the local signed-tag tool and GitHub release workflow by canonical - package mode. Policy-only mode proves the manifest/archive contain no runtime; - activation alone invokes the strict macOS signing/notarization verifier. -- Bind the exact captured artifact independently from the instruction prompt in - sealed native JSON: base64 bytes, SHA-256, byte size, author model, and - derived author family are verified before launch. Ambiguous active-model - lineage remains unknown even when a stale asserted family is present; - governance fails closed and non-governance worker artifacts warn when author - independence is unknown. -- Add native Codex packaging with a `.codex-plugin/plugin.json` manifest and - generated `.agents/plugins/marketplace.json`, while retaining the - Claude-compatible package manifest. Release consistency requires both host - manifests to identify the same sole `agent-collab` package and version. -- Make policy-only readiness deterministic on every host: the manifest is - parsed and validated before the Darwin-arm64 activation gate, an empty - artifact set remains typed unavailable, and runtime tests explicitly - simulate the supported target rather than inheriting the CI host platform. -- Add a provider-free migration doctor, duplicate-package routing block, - dynamic known/unknown host preflight, and policy-only safe mode. Safe mode - disables every native model route. Async inbox readiness is available only - after a current host observation and the public coordinator never sends; - reinstalling a retired package is not a rollback. The doctor parses enabled - and installed-disabled Codex plugin tables from `~/.codex/config.toml`, - preserves source-host provenance, and emits removal commands for the owning - package manager. Empty primary - configuration is re-observed on every request so ZCode model switches take - effect immediately. `codex/build` and `auto/worker` are coordinator-only, - typed-unavailable contracts and never widen the signed required runtime - matrix or promote into advisory authority. Malformed rows fail as - `config_error`. Missing or hostile home-directory resolution now blocks with - a typed inventory error. Python 3.10 uses a strict exact-table compatibility - parser for Codex plugin selection, including escaped-key and multiline-string - defenses, instead of substring matching or silently skipping the registry. -- Add a clean-history public-export gate. Deleted backend sources remain in the - private history until the separately authorized rewrite and residual audit; - direct visibility changes or exports from the unsanitized clone are blocked. - The gate scans every reachable blob as bytes, recursively inspects nested - archives under cumulative depth/member/size bounds, semantically detects - statically constructed provider argv, applies only narrow harmless-fixture - masking, and rejects provider-backend archive directories, symlink, or other - unsafe tree modes. It separately inspects every ref, direct blob or tree - target, annotated-tag object/message, and release-tag form/target. -- Pin every pull-request workflow to GitHub-hosted `ubuntu-latest`; public PR - code can no longer execute on a persistent self-hosted runner, and - the mutable `RUNNER_TARGET` repository variable has been removed. -- Grant CodeQL the additional read-only `actions: read` scope required to - associate and upload pull-request analysis results; all other workflow token - permissions remain explicitly least-privilege. -- Keep CodeQL enforceable while the sanitized repository is still private: - complete analysis now retains SARIF as a bounded workflow artifact when Code - Scanning is unavailable, then switches automatically to Code Scanning upload - once the repository becomes public. -- Require releases to originate from a verified signed annotated tag whose - target commit is the checked-out commit on `origin/main`. Both the local - release tool and GitHub workflow enforce the same ancestry boundary, and - the release job force-materializes the remote annotated tag object before - history inspection so the checkout action's peeled commit ref cannot be - mistaken for an unsigned or lightweight tag. The - hardened-runtime verification parses the actual numeric code-signing flags. - Runtime and release verification also inspect the executable as a thin arm64 - Mach-O with exactly one macOS `LC_BUILD_VERSION` for minimum macOS 14.0. - The operator-owned Developer ID Team ID is pinned independently in reviewed - `signing_policy.py`; the manifest cannot select its own signer, and the - unconfigured anchor blocks activation until matching signing/notarization - credentials are provisioned. +- Verify the imported handoff byte-for-byte, re-run the Developer ID, + hardened-runtime, secure-timestamp, Apple-notarization, Mach-O, contract, + member-inventory, and whole-bundle gates, then build and reopen the canonical + activation archive. -### agent-collab 3.0.1 — clean public distribution +### Fixed -- Publish the unified policy/client package from the audited clean-history - `sumitake/agent-collab` marketplace without importing private pull-request - refs, tags, releases, workflow artifacts, or provider implementation history. -- Localize contribution governance and security reporting so contributors and - plugin users do not need access to the private build/sign system. -- Remove host-specific labels and session-owner metadata, regenerate both - marketplaces and all skills, and retain the policy-only fail-closed runtime - state until a separately verified signed native artifact is available. +- Restore the unreleased v4.5.0 source line to the canonical policy-only + package shape by removing the retained v4.4.2 production runtime bundle and + publishing an empty, schema-v3 runtime manifest. +- Keep the OpenCode Go policy and skill changes in v4.5.0 while making the + source tree eligible for the governed private build/sign/notarize pipeline. -### agent-collab 3.1.0 — source-available licensing and neutral guidance +### Why -- License the public repository and installed package under the unmodified - PolyForm Strict License 1.0.0. Copyright remains with John Osumi; commercial - use requires explicit written approval administered by Osumi Consulting LLC. -- Make `AGENTS.md` the sole canonical public repository guide and retain - `CLAUDE.md` only as an `@AGENTS.md` compatibility loader. -- Require contributor-rights evidence and package exact legal documents, - SHA-256 evidence, and an SPDX 2.3 SBOM in the policy-only release. +- A populated runtime is admissible to the private builder only when the + requested source is the exact commit behind a trusted signed release tag. + Carrying the older runtime into an untagged v4.5.0 commit made the source + neither a valid policy-only input nor a valid signed activation input. -### agent-collab 3.3.0 — managed Gemini governance and reliable provider state + +### Changed -- Add a distinct broker-only `gemini/governance` action with exact Gemini 3.1 - Pro/high selection, immutable artifact binding, shared-HOME/PTY containment - evidence, response hashing, and public-client proof-digest validation. -- Keep Gemini advisory and long-context separate and explicitly ineligible as - governance evidence; automatic governance now maps Gemini and Grok to their - explicit governance actions while Codex remains advisory. -- Advance the signed-runtime route contract to version 2 across policy, - manifests, schemas, archive/release verification, generated skills, and - deterministic tests. -- Document canonical passwd HOME as the managed-provider reliability policy - without relaxing family exclusion, authority separation, bounded lifecycle, - or the prohibition on raw provider fallbacks. -- Make Codex, Gemini, OpenCode, Grok, and Composer uniformly broker-only and - bind provider startup to the signed guardian's acknowledged pre-exec gate; - only local runtime management retains direct exact-artifact execution. +- **Rebuilt, re-signed, and re-notarized the darwin-arm64 provider runtime** + from the current workspace source closure. The bundle shipped in the + rolled-back v4.4.0 tag-only cut predated several runtime-behavior changes, + including the public-client digest pin; a runtime built before that pin + rejects the client this package actually ships. -### agent-collab 3.3.0 — closed standalone provider bundle +- **The signed runtime now advertises the `codex/governance` route.** This is a + capability expansion: v4.3.3 added the route to the public client's parser + allowlist and JSON schema while the shipped runtime deliberately did not + claim it, and the v4.4.1 runtime is built from a source closure where it is a + real read-only contract. -- Route managed Gemini, OpenCode, Grok, and Composer requests through an explicit, digest-bound - launchd socket broker that starts for one request and returns to zero idle - processes. Add closed install, status, rollback, and uninstall lifecycle - commands with transactional prior-version restoration and no direct fallback. -- Replace the failed onefile launch path with manifest schema 2, native contract - 3, and broker transport 2 over one closed standalone bundle. Bind its identity - to the sorted role/mode/size/digest/Mach-O facts of every member; publish only - exact immutable `0500` files; verify the kernel-reported entrypoint and the - complete lifecycle state before provider dispatch. Provider protocol 1 and - all existing route-authority boundaries remain unchanged. -- Resolve the OpenCode model per request from live OpenCode/ZCode observation, - explicit central configuration, or the fixed `opencode/glm-5.2` preset while - ignoring ambient and row-level model fallbacks. -- Reject duplicate/non-finite broker responses and state before typed parsing. -- Preserve typed `cancelled` and `input_limit` Grok/Composer failures, require - exact terminal-state validation, and document the one bounded cancellation - retry and comprehensive architecture-reviewed Composer coding-packet policy. -- Strip the Codex Desktop Seatbelt marker from broker-dispatched work so every - Grok/Composer attempt validates its own nested read-only sandbox, preserve - closed provider-child environments, and keep runtime management direct-only. -- Propagate client disconnect through managed OpenCode, Grok, and Composer - calls, reap provider child groups, discard partial output, prohibit retry of - disconnect cancellation, and fail with typed `timeout` before setup when the - managed-boundary deadline reserve is exhausted. -- Harden repository configuration with full-SHA Action pin enforcement while - retaining squash-only, signed, linear, review-thread-resolved releases. -- Align OpenCode preflight with issuance model resolution; key immutable broker - versions by both artifact and manifest digests; preserve complete rollback - state across failures and no-op reactivation; reject unverified rollback - targets; treat a never-installed root as typed uninstalled/unavailable; and - map bounded `launchctl` failures to closed lifecycle results. +- **`codex/governance` is now REQUIRED at the release gates.** All three + independent copies of the contract allowlist — + `verify_runtime_release.py`, `build_plugin_archive.py`, and + `check-public-export-safety.py` — move from a ten-route to an + eleven-route required set, keeping exact-set equality. Release gates + validate what this repository is about to publish, so requiring the route + stops a future cut from silently dropping a governance capability. The + public client deliberately keeps it OPTIONAL, because it validates whatever + is already installed, including older field artifacts that predate the + route. The two postures are intentionally opposite. -### agent-collab 3.5.0 — authenticated dispatcher canaries +### Tests -- Add exact Darwin dispatcher peer proof and a request-free, digest-bound - hello/ready handshake before any green provider request is sent. -- Add a token-gated internal `adoption_canary` coordinator operation bound to - one candidate tuple and route allowlist without exposing a user-selectable - provider path, model, auth root, or policy route. -- Keep the selector legacy-blue by default. Apply a separate local bound to the - request-free handshake so a proven pre-request green failure retains time for - independently proven blue without shortening the original request deadline; - a failure at or after request send never retries another lane. +- Enforce the contract set at the real `verify_release` call site in both + directions: omitting `codex/governance` is rejected, and an unenumerated + extra route is rejected. Pin that all three gate copies agree exactly, and + that the client keeps the opposite (optional) posture. +- Derive the contract fixtures in `test_plugin_archive.py` and + `test_release_evidence.py` from the builder's own allowlist instead of + restating ten routes inline. Both hardcoded copies had silently rotted the + moment the required set changed; deriving them makes that impossible. +- Update the route-shipping test to the new reality (route now advertised) while + still asserting it remains accepted-but-not-required. -### agent-collab 3.5.0 — provider update continuity +agent-collab 4.5.0 routes the packaged OpenCode default through +`opencode-go/glm-5.2`, recognizes +Kimi as Moonshot-family provenance, and adds an opt-in +`AGENT_COLLAB_OPENCODE_PROVIDER=opencode-go` host guard that rejects standard +metered OpenCode Zen models, malformed provider policy, namespace lookalikes, +and late policy drift before runtime launch. -- Add a strict, legacy-default blue/green broker selector so a newly installed - client can continue using the separately verified legacy broker while a - content-derived dispatcher lane is staged. -- Preserve blue on missing, invalid, unproven, refused, or timed-out green - connections before any send attempt; never retry another lane after a - connection succeeds. Each request captures one lane ordering so an in-flight - blue request completes even if the next request atomically selects green. -- Add closed stage, status, no-provider ping, canonical-lock probe, selector - commit, candidate abort, committed-control recovery, and retiring-blue drain - operations. Green uses a distinct content-derived label/socket; commitment - never bootouts blue, and recovery never changes desired provider binaries. -- Keep one canonical Gemini/Grok/OpenCode lock across blue and green for the - complete request through provider teardown. Credential-free contention and - acquisition probes let every installed client prove that namespace before - green traffic is enabled. -- Permit a bounded two-selector overlap when both entries are the unified - `agent-collab` package, allowing Codex to retain its old cache while a distinct - candidate selector is proven. Retired package names remain blocking, and old - client retirement stays behind the private fresh-session finalization gate. -- Block every packaged mutating broker/dispatcher lifecycle operation from the - Codex seatbelt before lifecycle reads or writes while retaining read-only - status and probes. +### agent-collab 4.3.5 — 2026-07-25 -### Fixed -- Notarization is now verified with the code-object-native `codesign --verify --strict --test-requirement '=notarized'` instead of `spctl --assess --type execute`, at BOTH the release CI gate (`verify_runtime_release.py`) and runtime activation in the client (`runtime_client.py`). The runtime entrypoint is a bare command-line Mach-O, not a `.app` bundle, and `spctl --type execute` only assesses `.app` bundles — it always rejects a bare executable ("the code is valid but does not seem to be an app"), a false negative that would fail every otherwise-valid activation release at the notarization step AND every client activation. The `notarized` codesign requirement binds to the CDHash and rejects unsigned, ad-hoc, and Developer-ID-signed-but-not-notarized binaries by exit code; both call-sites fail closed on tool error. The check is combined with `--check-notarization` (see the online-verification entry) so it forces the online Apple notary lookup and succeeds on a clean host — a bare Mach-O cannot have a notarization ticket stapled, so without the online lookup `=notarized` would depend on the host's local notarization trust state and fail-close on any clean host. +#### Fixed -### agent-collab 3.5.2 — launchd dispatcher peer readiness +- Accept exact legacy Gemini governance proof v1 and recovery-capable proof v2 + as disjoint public success contracts so a verified retained v1 lane remains + callable while a v2 runtime is staged. +- Select v2 validation whenever any recovery discriminator is present. Reject + partial, hybrid, coerced, contradictory, or cross-field-mismatched results + instead of falling back to the legacy contract. +- Name both exact public proof keysets explicitly and document the verified + child-runtime/private-pipe trust boundary. The proof hash is a consistency + check rather than a signature; complete v1 remains accepted only for + retained-lane rollback continuity. -- Distinguish the root-owned launchd listener credential from the - operator-owned sealed runtime process when authenticating a staged - dispatcher on macOS. -- Retry only the exact root-plus-pid-1 launchd handoff sentinel under the - existing handshake deadline, with capped exponential sleeps and immediate - failure for malformed state or socket errors. -- Re-prove the stable process start identity, exact executable, signed - artifact, socket identity, and final kernel peer PID before sending hello. +### agent-collab 4.4.2 — 2026-07-25 -### agent-collab 4.0.4 - adoption protocol boundary +### Fixed -- Preserve the sealed provider-adoption request and response on public runtime - protocol v2 while carrying them inside the private dispatcher protocol-v1 - bridge, matching the one-time authority registry and frozen dispatcher. +- Reject managed `execute` responses whose `result.text` is missing, + non-string, empty, whitespace-only, Unicode-invisible/filler-only, + replacement-glyph-only, terminal-control-only, or malformed instead of + accepting a false-positive `status=ok`. + Invalid success is a terminal `protocol_error` and cannot enter automatic + family fallback. `readiness` remains exempt, and typed containment, timeout, + teardown, and provider failures retain their classifications. -### agent-collab 4.0.3 — dispatcher lifecycle control protocol +- Ship a content-addressed execute-output conformance contract with a frozen + Unicode-16 blankness table so the public client can fail closed even when an + older signed runtime emits a defective success envelope. Include it in the + canonical release archive beside `runtime_client.py` and verify exact bytes. -- Send lifecycle ping and lock-probe control messages on the sealed dispatcher - protocol-v1 contract so a staged dispatcher can be proven before activation. -- Keep typed lifecycle failures on runtime protocol v2 and reject swapped, - malformed, or extra-field success and failure responses. +- Enforce exact CSI byte-class ordering and a closed OSC/C1 support matrix, + rejecting malformed sequences and unsupported control strings rather than + stripping printable residue into an apparent answer. -### agent-collab 4.0.2 — protocol-v1 blue lifecycle bridge +- Retain the original absolute request deadline through direct and broker + response parsing. Classification of a near-limit blank/control stream now + returns typed `timeout` if it consumes the remaining budget. -- Keep normal protocol-v2 routing fail-closed against protocol-v1 runtimes and - responses while allowing dispatcher lifecycle control to prove the exact - signed v1 blue baseline needed for make-before-break staging. -- Stage and verify protocol-v2 green without rewriting or stopping v1 blue, and - derive the selected blue protocol from its immutable manifest during mutable - control-plane recovery. +### Added -### agent-collab 4.0.1 — intent-check effort contract correction +- **`cut_release.py` runtime-currency gate (fail-closed).** An activation + release now refuses to cut when any `runtime:`-scoped merge landed after the + commit that last staged `plugins/agent-collab/runtime/` — the failure mode + that shipped a 4.2.0-era runtime in the rolled-back v4.4.0 tag-only cut. + Explicit operator override: `--allow-stale-runtime` (loud warning). Unit + tests cover pass/stale/missing/override/wiring paths. -- Fixed `intent-check` routing guidance so Gemini governance rows use their - required high effort, while rudimentary Codex advisory intent comparisons - remain low and the sealed Grok governance fallback remains high. +- visual-review + ui-to-code: direct the primary to magnify detail-bound regions + (host-native zoom/crop or a full-resolution code-execution crop) before reading + them, per the confidently-wrong sub-patch-detail failure documented in Anthropic's + crop-tool cookbook. Additive guidance only; the skills' no-image-transport honesty + boundary is unchanged. -### agent-collab 4.0.0 — Grok 4.5 model and effort unification +### Fixed +- SECURITY.md support matrix: `3.x` → `4.x` (current major per plugin.json 4.3.1; staleness audit). -- **Breaking:** advance the fixed public/native runtime protocol to v2. Older - public clients and signed runtimes now reject each other instead of silently - using the retired Composer model or an outdated request shape. -- Route Grok architecture, governance, huge-context, and compatibility codegen - through the same `xai/grok-4.5` author model. `composer/codegen` remains a - public compatibility route with output-only authority, not a separate model. -- Seal review effort from the task: architecture and governance use high, - huge-context synthesis uses medium, and callers cannot override those review - profiles. Codegen requires `simple_codegen`, `standard_codegen`, or - `complex_codegen`, with respective low, medium, and high effort floors. -- Keep all model, tool, sandbox, credential, environment, filesystem, and - application authority out of the public codegen row. The trusted primary - still owns applying output, integration review, testing, git, and release. +### Changed +- Root `README.md` opening rewritten purpose-first (operator-directed overhaul): why governed multi-agent collaboration exists (family blind spots, disclosed reward-hacking, unaccountable authority loops), what it delivers, and how governance is implemented — followed by the unchanged technical sections; stale intro version pin removed (version lives in "Current package"). Package README gains a purpose-bridge paragraph. Doc-only, no version bump. -### agent-collab 3.5.1 — fail-closed dispatcher boundary +### agent-collab 4.3.4 — 2026-07-24 -- Treat malformed or noncanonical dispatcher-client output after the - request-bearing child launches as a post-request failure, preventing a - possible second execution through blue after green acceptance. -- Preserve typed unsupported-platform behavior when POSIX `fcntl` is absent, - while failing lifecycle locking closed before filesystem I/O. +### Fixed -### Changed -- `build_plugin_archive.py` now sources the activation runtime bundle from an out-of-tree signed handoff via `--bundle-source ` instead of the git checkout — the signed runtime ships as a release asset and is never committed. The committed `runtime-manifest.json` alone decides the mode (design decision D1): an activation manifest without `--bundle-source` is a hard error (never a silent policy-only downgrade), a policy-only manifest forbids the flag, and an in-tree `runtime/` conflicts with an external source. The bundle source is treated as hostile input (symlink argument rejected before resolution; bounded non-following enumeration; member-set equality; per-member O_NOFOLLOW regular-file/uid/nlink/mode/size/sha256 checks with the strict 0o500 install mode preserved), and its payloads are re-read + re-digested through fresh descriptors at pack time. -- `verify_archive` is rearchitected to **regenerate the canonical tar from trusted inputs and byte-compare** rather than parse a possibly-hostile archive: it never hands candidate tar bytes to `tarfile`. A shared deterministic `USTAR` serializer (used by both build and verify) reproduces the canonical tar with runtime payloads zero-filled; the candidate is only bounded-inflated and then sliced at offsets the verifier computed. Every structural property — headers, exact typeflags, ordering, padding, EOF, dialect, and the absence of hidden PAX/GNU/sparse records — is bound by the byte-compare outside the runtime ranges; each runtime payload is bound to the frozen-manifest digest; the archived `runtime-manifest.json` bytes are bound to the frozen snapshot. Reading the candidate is fd-only (`O_NOFOLLOW`/`O_NONBLOCK` + `fstat`, no path-swap window) under hard compressed- and decompressed-size caps, with a canonical gzip-header check and single-stream (no trailing/concatenated data) validation. The archive is built into an exclusive temp that is verified before an atomic rename, so a failed build never leaves a publishable artifact. Hardened through a 2-round up-front adversarial design review of the hostile-archive-reading threat model (the regenerate-and-compare pivot) before implementation. +- Fixed `migration_doctor` reporting `provider_routing="BLOCKED"` for the shipped runtime. + Readiness compared the client's full acceptance set against the manifest, so the accepted + but deliberately unadvertised `codex/governance` route marked the entire runtime invalid. + Readiness is now judged against a required baseline (`REQUIRED_CONTRACTS`), with + `OPTIONAL_CONTRACTS` holding routes a signed artifact may advertise but need not ship. + +- qa-verify: instruct callers to phrase QA constraints at evidence level rather than + presence level (the inspector must produce what it checked; name likely shortcuts; + bound with an out-of-scope list), per the approve-everything verifier failure mode + documented in Anthropic's outcome-grader cookbook. Additive guidance only; the + PASS/FAIL verdict contract is unchanged. ### Added -- Regression test locking in that a host-normalized runtime bundle (directory 0o755, member files 0o500) verifies and resolves — the empirically-confirmed state produced by every supported installer (Claude Code, Codex, Antigravity/agy, and the broker's sealed copies: 2356/2356 installed member files were 0o500, none 0o700). This closes release-pipeline design item §9.7 as empirically non-reproduced: no source-mode loosening is made (it would be unnecessary and would open a direct-execution-of-owner-writable-source bypass); the loader already handles the real install correctly. -### agent-collab 4.0.5 - Gemini governance proof v2 + -- Validate Gemini governance evidence against the provider runtime `2.0.0` - proof contract `2` tuple instead of conflating it with the public bundle - manifest contract, and require governance response provenance to identify - that same compatible runtime while rejecting legacy, crossed, and - mixed-provenance version tuples. +- **Domain-expert skill pack (16 new skills).** New pure-prompt, host-neutral + expertise skills alongside the existing collaboration/governance set: + `rust-engineer`, `go-engineer`, `elixir-engineer`, `sql-engineer`, + `kubernetes-specialist`, `terraform-engineer`, `sre-engineer`, + `incident-responder`, `mlops-engineer`, `llm-architect`, + `postgres-engineer`, `data-engineer`, `eval-engineer`, + `prompt-regression-tester`, `hallucination-investigator`, and + `ai-writing-auditor`. Authored under workspace ownership, informed by the + MIT-licensed VoltAgent subagent corpora at pinned SHAs (947b44ca / + 5605c9c1) after an untrusted-input security audit; all supply-chain + patterns flagged by that audit (third-party installers, external MCP + endpoints, fictional tools) are excluded by construction. No coordinator, + provider, or delegation surface is touched. -### agent-collab 4.1.0 - Signed lane contract anchor +### agent-collab 4.3.3 — 2026-07-24 -- Bind schema-3 runtime artifacts, selector-v2 lanes, dispatcher protocol-2 - reservations, and Gemini governance proof to one authenticated runtime - contract anchor while preserving exact committed legacy normal lanes. +### Fixed -### agent-collab 4.1.1 — 2026-07-20 +- Allow verified development or future runtime manifests to advertise the + `codex/governance` route by adding it to the public client's manifest parser + allowlist and the matching JSON schema enumeration. The currently shipped + signed and notarized public runtime manifest remains unchanged at its honest + ten-route capability set, so it does not claim the unshipped route and + continues to return typed unavailable for it. -#### Fixed +### Tests -- Make `broker-status` use the same canonical selector view as request routing, - so a valid selector-v1 selected dispatcher is no longer misclassified as an - obsolete single-broker installation. -- Require the selected immutable lane, launchd job, socket, and closed liveness - exchange to pass before broker status is ready. Migration-doctor `READY` now - requires this executable proof as well as the signed runtime manifest. -- Require the one-shot launchd job to return idle and every retained fallback - lane to remain independently verifiable before status can claim executable - readiness, matching the topology that request routing will actually accept. -- Advertise a retained lane as rollback-capable, and include it as a request - fallback, only when its own launchd job is currently loaded. Retained job - availability is a point-in-time snapshot and does not deactivate a healthy - selected lane. -- Treat a selectorless legacy broker as installed but unavailable even when its - old socket responds, because current request routing cannot capture an - executable lane without the same canonical selector proof. -- Keep liveness compatible with a verified dispatcher-v1 selected lane while a - dispatcher-v2 candidate is staged, so the previous lane remains executable - until the new lane is fully proved and atomically selected. -- Preserve typed timeout, output-limit, and teardown results after a dispatcher - accepts a request instead of collapsing those local completion failures into - a misleading `protocol_error`; accepted work still never retries another lane. -- Wait for a selected dispatcher-v1 one-shot job to return idle before exposing - its response to the next caller, closing the launchd teardown window without - serializing the concurrent dispatcher-v2 scheduler. -- Bound that dispatcher-v1 idle proof by the request's existing absolute broker - deadline, including every `launchctl` collection and final polling sleep, so - teardown verification cannot silently start or overrun a fresh timeout. -- Resolve Codex Desktop's active OpenAI model from its exact current rollout - when `CODEX_ACTIVE_MODEL` is absent. The reader is fixed-root, bounded, - no-follow, same-owner, single-file, and fail-closed on ambiguous, writable, - linked, malformed, oversized, concurrently growing, or conflicting identity - evidence. +- Pin the distinction between the client's accepted contract vocabulary and + the exact routes advertised by the current signed public runtime. -#### Verification +### agent-collab 4.3.2 — 2026-07-24 -- Added RED/GREEN regressions for selector-v1 projection, legacy selected-lane - liveness, selectorless legacy false-positive rejection, one-shot idle - completion, invalid retained-lane rejection, - unloaded retained-job rollback and fallback suppression, - accepted-request timeout typing and no-fallback behavior, legacy one-shot - response teardown, deadline reuse, bounded launchctl collection, and capped - polling, failed dispatcher ping, manifest-only doctor readiness, safe Codex - rollout identity, and ambiguous, growing, or unsafe rollout rejection. +#### Fixed -### Fixed +- Enforce one end-to-end monotonic timeout across coordinator preflight, + automatic reviewer candidates, runtime verification, and provider launch. + Each fallback is resealed with only the remaining budget. +- Stop automatic fallback after a timed-out or teardown-unproven accepted + request, preventing a second provider worker from overlapping uncertain + cleanup. +- Permit automatic fallback only for a typed pre-acceptance `unavailable` + result. Authentication, quota, containment, output, protocol, provider, and + every other post-launch result are terminal, so one review request cannot + silently become a second provider invocation. +- Keep selected-dispatcher callability distinct from lifecycle quiescence so + migration doctor no longer reports a responsive lane unavailable merely + because another bounded request is active. Bound the status-only quiescence + observation to one second instead of waiting the full 30-second cold-start + allowance; lifecycle operations retain their full idle proof. -- Type an accepted-request idle-probe failure as a teardown failure, not a - protocol error: `_wait_for_job_idle` now fails closed on the expected - `OSError` / `subprocess.SubprocessError` and on a typed - `_OperatorHomeUnavailable` raised by `_launchctl`'s per-call operator-home - re-resolution (a `ValueError` subclass, so the environmental case is caught - race-free while a genuine code-bug `ValueError` and an invalid job label - still surface). -- Bound provider teardown by the caller deadline: `_terminate_and_reap` polls - to reap the SIGKILLed session-group leader within a small grace of the - caller deadline rather than two fixed five-second waits, and reports a - proven teardown only when the whole-group kill was posted AND the leader was - reaped, so a leader-only fallback is honestly typed as a teardown failure. -- Bound the request-dispatch path's retained-lane availability probe by the - request deadline: `_launch_broker` now starts the deadline before capturing - lanes and threads it through `_capture_broker_lanes` → `_job_loaded` → - `_launchctl`, so a small-`timeout_ms` request no longer blocks on - launchctl's ~20s default before dispatch (lifecycle/status callers keep the - default bound). -- Reject an incomplete Codex rollout tail instead of trusting the preceding - model context: `_codex_rollout_window` fails closed on a non-newline- - terminated final record, so a concurrently written model-changing record can - no longer yield stale governance-ready identity. +#### Safety -- Added a strict, fail-closed grammar for signed release-tag messages: exact field - set in canonical order, no duplicates or unknown fields, no trailing material, - lowercase-hex digests, ASCII-only, bare-basename asset names, and a - `vMAJOR.MINOR.PATCH` tag validator intended to run before a tag name reaches any ref or - path. Not yet wired to a release path — it is the parsing substrate the - activation cut will use (agent-collab 4.1.0). +- Notarization, signature, provenance, route authority, and selector checks are + unchanged. Install, update, rollback, commit, drain, and other lifecycle + operations still require a proven non-persistent process state. -### agent-collab 4.2.1 — 2026-07-21 +### agent-collab 4.3.1 — 2026-07-23 #### Fixed -- Align the closed coordinator schema with the collaboration-skill contract for - read-only OpenCode planning and review. `opencode/plan` now accepts the exact - optional artifact snapshot (`content` plus `author_model`) so the client can - preserve artifact bytes, provenance, and family-exclusion evidence instead of - rejecting a correctly constructed request before managed execution. +- Keep provider adoption callable after a dispatcher update commits by using + the exact verified `selected` lane when no staged `candidate` exists. +- Bind both staged and committed canary paths to the co-packaged signed and + notarized runtime identity, preserving fail-closed behavior on any selector + mismatch or transient verification failure. #### Verification -- Added a coordinator regression for an artifact-bound `opencode/plan` request; - the test fails on 4.2.0 with `request fields violate the closed coordinator - schema` and passes with the corrected review-contract set. +- Added regression coverage for staged-candidate, committed-selected, + identity-mismatch, and notarization-unavailable paths. -### agent-collab 4.2.2 — 2026-07-21 +### agent-collab 4.3.0 — 2026-07-22 -#### Fixed +#### Added -- Verify notarization online at both the release gate (`verify_runtime_release.py`) - and consumer activation (`runtime_client.py`) by adding `--check-notarization` to - the `codesign --test-requirement '=notarized'` check. A bare Mach-O cannot have a - notarization ticket stapled, so without the online lookup the requirement is - satisfied only by the notarizing host's local trust state and fail-closes on any - clean host — the CI runner (which blocked the first activation release) and every - fresh end-user install. Empirically fail-closed when the Apple notary is - unreachable, and it rejects unsigned, ad-hoc, and Developer-ID-signed-unnotarized - binaries on macOS 14 and 15. +- Added `start-inbox-monitor`, a generated portable skill with native Codex, + Claude, and Antigravity lifecycle adapters, typed startup outcomes, positive + singleton proof, and explicit no-schedule/no-sandbox-bypass boundaries. -### agent-collab 4.2.2 - first activation release +### Changed -First public activation release: the plugin now ships the signed and notarized -native runtime committed in the repository, so the documented marketplace install -(`/plugin marketplace add`) delivers a working activation build under any operator -umask, including umask 002 whose group-writable checkout the previous exact-mode -and safe-envelope checks both rejected. +- Restyle the public root `README.md` toward the reference project layout: add CI, + CodeQL, and secret-scan badges, a non-goals section, and a capability list; surface + only the latest release and link the full `CHANGELOG.md` for history; refresh the + now-shipped activation and runtime notes; and move the license section to the end. -### Added +### agent-collab 4.2.4 — 2026-07-22 -- Commit the Developer ID signed and notarized darwin-arm64 native runtime bundle - (38 members) in the repository and advertise it through a schema-version-3 - activation manifest, pinning `EXPECTED_DEVELOPER_ID_TEAM` to the Osumi Consulting - LLC team in `signing_policy.py`. The plugin remains source-available under the - PolyForm Strict License 1.0.0; commercial licensing is administered by Osumi - Consulting LLC. +#### Fixed -### Changed +- **Broker-verification notarization tri-state (issue #36 path-2).** Extend the Phase-1 + consumer-activation notarization tri-state to the broker-verification / lifecycle path in + `runtime_client.py`. A transient *online-but-notary-unreachable* outage during a broker + operation (install, status, stage/commit/abort, rollback, drain, recover, uninstall) is now + reported as a retryable `RuntimeStatus.UNAVAILABLE` instead of a mis-typed hard + `INTEGRITY_ERROR` / `PROVIDER_ERROR` / `PROTOCOL_ERROR`. Genuine integrity failures + (signature, digest, membership) keep their hard status unchanged; activation continues to + gate on `status == OK`, so re-typing changes reporting and retryability only, never whether an + unverified runtime is adopted or spawned. Implemented via a `_BrokerNotarizationUnavailable` + marker re-typed at the single `_verify_published_version` source flatten, a `retryable` field + threaded through `_BrokerMutationFailure` (rollback still runs), and earlier + `except _BrokerNotarizationUnavailable` handlers at the broker terminals. The dispatcher-bridge + probe path (non-authoritative for adoption) and dead code are out of scope. -- Treat the git checkout as a trusted source under the trust-the-checkout model: - the host already executes the plugin's Python control plane from the checkout, so - the native runtime tolerates the operator umask permission bits on the source - while keeping content integrity (per-member SHA-256, Developer ID signature, - notarization, Mach-O checks) and the exact broker-store mode unchanged. The - `AGENTS.md` runtime policy is updated to distinguish the strict private broker - store from the tolerant git source. -- Package the committed in-tree runtime in `build_plugin_archive`, binding the whole - archive to the release commit, alongside the external sealed handoff path. +### Added -### Fixed +- Coordinator/host_policy: the `("codex","governance")` first-class **synchronous** + governance-review route (operator-directed 2026-07-22), mirroring + `gemini/governance` (prompt + artifact) with a pinned reviewer model + governance + effort. Enables a proof-backed synchronous Codex governance review that anchors a + Tier-3 peer review without the async inbox. Additive route (`ROUTE_ACTIONS`, + `AUTHORITIES`, `GOVERNANCE_CONTRACTS`, `REVIEW_CONTRACTS`, `DIRECT_CONTRACTS`, + a row-validation case); existing contracts are unchanged. Companion workspace + change adds the runtime emission + the `validate_codex_governance_proof` gate. -- Runtime: the dispatcher bridge document (`runtime_client._dispatcher_bridge_document`) - now emits the canonical seven-key schema for every protocol version, instead of - over-sending the request reservation (`execution_key` / `request_size` / - `request_sha256`) for v2. The receiving bridge validator (workspace - `provider_runtime._validate_dispatcher_bridge_document`, and its tests) accepts - exactly seven keys and derives the reservation from `request` itself, so the - over-send made a fresh selector-v2 dispatcher fail its first bridge exchange with - "dispatcher bridge document is invalid". The reservation still crosses the trust - boundary on the wire hello frame (where the bridge's freshly computed values are - used); echoing it in the same-trust-domain bridge document added no integrity - value. Fixes fresh v2 dispatcher activation. +- The signed runtime bundle can now be distributed by committing it to the public + git repository, so the documented marketplace install (`/plugin marketplace add`) + delivers a working activation build under any operator umask — including umask + 002, whose group-writable checkout the previous exact-`0o500` and safe-envelope + checks both rejected. The plugin checkout is now treated as a trusted **source** + under the trust-the-checkout model: the host already executes the plugin's Python + control plane from the same tree, so a peer who can write the checkout already + owns the verifier, and the source permission-mode rejection (which blocked normal + clones) is dropped in favor of a floor that requires owner read+execute and no + special bits while tolerating group/other bits. Content integrity is unchanged — + per-member SHA-256, Developer-ID signature, notarization, and Mach-O checks are + untouched — and the privately-extracted **broker store** keeps its exact `0o500` + check. `build_plugin_archive` now packages the committed in-tree runtime (with + optional git-`HEAD` `100755`/`100644` provenance binding it to the release tag) + in addition to the external sealed `--bundle-source` handoff. (agent-collab 4.1.1) ### agent-collab 4.2.3 — 2026-07-21 @@ -515,320 +369,476 @@ and safe-envelope checks both rejected. remains a separately-scoped Tier-3 effort gated on a feasibility spike (a bare Mach-O cannot be stapled, so it is not turnkey). -- The signed runtime bundle can now be distributed by committing it to the public - git repository, so the documented marketplace install (`/plugin marketplace add`) - delivers a working activation build under any operator umask — including umask - 002, whose group-writable checkout the previous exact-`0o500` and safe-envelope - checks both rejected. The plugin checkout is now treated as a trusted **source** - under the trust-the-checkout model: the host already executes the plugin's Python - control plane from the same tree, so a peer who can write the checkout already - owns the verifier, and the source permission-mode rejection (which blocked normal - clones) is dropped in favor of a floor that requires owner read+execute and no - special bits while tolerating group/other bits. Content integrity is unchanged — - per-member SHA-256, Developer-ID signature, notarization, and Mach-O checks are - untouched — and the privately-extracted **broker store** keeps its exact `0o500` - check. `build_plugin_archive` now packages the committed in-tree runtime (with - optional git-`HEAD` `100755`/`100644` provenance binding it to the release tag) - in addition to the external sealed `--bundle-source` handoff. (agent-collab 4.1.1) +### Fixed -### Added +- Runtime: the dispatcher bridge document (`runtime_client._dispatcher_bridge_document`) + now emits the canonical seven-key schema for every protocol version, instead of + over-sending the request reservation (`execution_key` / `request_size` / + `request_sha256`) for v2. The receiving bridge validator (workspace + `provider_runtime._validate_dispatcher_bridge_document`, and its tests) accepts + exactly seven keys and derives the reservation from `request` itself, so the + over-send made a fresh selector-v2 dispatcher fail its first bridge exchange with + "dispatcher bridge document is invalid". The reservation still crosses the trust + boundary on the wire hello frame (where the bridge's freshly computed values are + used); echoing it in the same-trust-domain bridge document added no integrity + value. Fixes fresh v2 dispatcher activation. -- Coordinator/host_policy: the `("codex","governance")` first-class **synchronous** - governance-review route (operator-directed 2026-07-22), mirroring - `gemini/governance` (prompt + artifact) with a pinned reviewer model + governance - effort. Enables a proof-backed synchronous Codex governance review that anchors a - Tier-3 peer review without the async inbox. Additive route (`ROUTE_ACTIONS`, - `AUTHORITIES`, `GOVERNANCE_CONTRACTS`, `REVIEW_CONTRACTS`, `DIRECT_CONTRACTS`, - a row-validation case); existing contracts are unchanged. Companion workspace - change adds the runtime emission + the `validate_codex_governance_proof` gate. +### agent-collab 4.2.2 - first activation release -### agent-collab 4.2.4 — 2026-07-22 +First public activation release: the plugin now ships the signed and notarized +native runtime committed in the repository, so the documented marketplace install +(`/plugin marketplace add`) delivers a working activation build under any operator +umask, including umask 002 whose group-writable checkout the previous exact-mode +and safe-envelope checks both rejected. -#### Fixed +### Added -- **Broker-verification notarization tri-state (issue #36 path-2).** Extend the Phase-1 - consumer-activation notarization tri-state to the broker-verification / lifecycle path in - `runtime_client.py`. A transient *online-but-notary-unreachable* outage during a broker - operation (install, status, stage/commit/abort, rollback, drain, recover, uninstall) is now - reported as a retryable `RuntimeStatus.UNAVAILABLE` instead of a mis-typed hard - `INTEGRITY_ERROR` / `PROVIDER_ERROR` / `PROTOCOL_ERROR`. Genuine integrity failures - (signature, digest, membership) keep their hard status unchanged; activation continues to - gate on `status == OK`, so re-typing changes reporting and retryability only, never whether an - unverified runtime is adopted or spawned. Implemented via a `_BrokerNotarizationUnavailable` - marker re-typed at the single `_verify_published_version` source flatten, a `retryable` field - threaded through `_BrokerMutationFailure` (rollback still runs), and earlier - `except _BrokerNotarizationUnavailable` handlers at the broker terminals. The dispatcher-bridge - probe path (non-authoritative for adoption) and dead code are out of scope. +- Commit the Developer ID signed and notarized darwin-arm64 native runtime bundle + (38 members) in the repository and advertise it through a schema-version-3 + activation manifest, pinning `EXPECTED_DEVELOPER_ID_TEAM` to the Osumi Consulting + LLC team in `signing_policy.py`. The plugin remains source-available under the + PolyForm Strict License 1.0.0; commercial licensing is administered by Osumi + Consulting LLC. ### Changed -- Restyle the public root `README.md` toward the reference project layout: add CI, - CodeQL, and secret-scan badges, a non-goals section, and a capability list; surface - only the latest release and link the full `CHANGELOG.md` for history; refresh the - now-shipped activation and runtime notes; and move the license section to the end. +- Treat the git checkout as a trusted source under the trust-the-checkout model: + the host already executes the plugin's Python control plane from the checkout, so + the native runtime tolerates the operator umask permission bits on the source + while keeping content integrity (per-member SHA-256, Developer ID signature, + notarization, Mach-O checks) and the exact broker-store mode unchanged. The + `AGENTS.md` runtime policy is updated to distinguish the strict private broker + store from the tolerant git source. +- Package the committed in-tree runtime in `build_plugin_archive`, binding the whole + archive to the release commit, alongside the external sealed handoff path. -### agent-collab 4.3.0 — 2026-07-22 +### agent-collab 4.2.2 — 2026-07-21 -#### Added +#### Fixed -- Added `start-inbox-monitor`, a generated portable skill with native Codex, - Claude, and Antigravity lifecycle adapters, typed startup outcomes, positive - singleton proof, and explicit no-schedule/no-sandbox-bypass boundaries. +- Verify notarization online at both the release gate (`verify_runtime_release.py`) + and consumer activation (`runtime_client.py`) by adding `--check-notarization` to + the `codesign --test-requirement '=notarized'` check. A bare Mach-O cannot have a + notarization ticket stapled, so without the online lookup the requirement is + satisfied only by the notarizing host's local trust state and fail-closes on any + clean host — the CI runner (which blocked the first activation release) and every + fresh end-user install. Empirically fail-closed when the Apple notary is + unreachable, and it rejects unsigned, ad-hoc, and Developer-ID-signed-unnotarized + binaries on macOS 14 and 15. -### agent-collab 4.3.1 — 2026-07-23 +### agent-collab 4.2.1 — 2026-07-21 #### Fixed -- Keep provider adoption callable after a dispatcher update commits by using - the exact verified `selected` lane when no staged `candidate` exists. -- Bind both staged and committed canary paths to the co-packaged signed and - notarized runtime identity, preserving fail-closed behavior on any selector - mismatch or transient verification failure. +- Align the closed coordinator schema with the collaboration-skill contract for + read-only OpenCode planning and review. `opencode/plan` now accepts the exact + optional artifact snapshot (`content` plus `author_model`) so the client can + preserve artifact bytes, provenance, and family-exclusion evidence instead of + rejecting a correctly constructed request before managed execution. #### Verification -- Added regression coverage for staged-candidate, committed-selected, - identity-mismatch, and notarization-unavailable paths. - -### agent-collab 4.3.2 — 2026-07-24 - -#### Fixed +- Added a coordinator regression for an artifact-bound `opencode/plan` request; + the test fails on 4.2.0 with `request fields violate the closed coordinator + schema` and passes with the corrected review-contract set. -- Enforce one end-to-end monotonic timeout across coordinator preflight, - automatic reviewer candidates, runtime verification, and provider launch. - Each fallback is resealed with only the remaining budget. -- Stop automatic fallback after a timed-out or teardown-unproven accepted - request, preventing a second provider worker from overlapping uncertain - cleanup. -- Permit automatic fallback only for a typed pre-acceptance `unavailable` - result. Authentication, quota, containment, output, protocol, provider, and - every other post-launch result are terminal, so one review request cannot - silently become a second provider invocation. -- Keep selected-dispatcher callability distinct from lifecycle quiescence so - migration doctor no longer reports a responsive lane unavailable merely - because another bounded request is active. Bound the status-only quiescence - observation to one second instead of waiting the full 30-second cold-start - allowance; lifecycle operations retain their full idle proof. - -#### Safety - -- Notarization, signature, provenance, route authority, and selector checks are - unchanged. Install, update, rollback, commit, drain, and other lifecycle - operations still require a proven non-persistent process state. - -### agent-collab 4.3.3 — 2026-07-24 +- Added a strict, fail-closed grammar for signed release-tag messages: exact field + set in canonical order, no duplicates or unknown fields, no trailing material, + lowercase-hex digests, ASCII-only, bare-basename asset names, and a + `vMAJOR.MINOR.PATCH` tag validator intended to run before a tag name reaches any ref or + path. Not yet wired to a release path — it is the parsing substrate the + activation cut will use (agent-collab 4.1.0). ### Fixed -- Allow verified development or future runtime manifests to advertise the - `codex/governance` route by adding it to the public client's manifest parser - allowlist and the matching JSON schema enumeration. The currently shipped - signed and notarized public runtime manifest remains unchanged at its honest - ten-route capability set, so it does not claim the unshipped route and - continues to return typed unavailable for it. +- Type an accepted-request idle-probe failure as a teardown failure, not a + protocol error: `_wait_for_job_idle` now fails closed on the expected + `OSError` / `subprocess.SubprocessError` and on a typed + `_OperatorHomeUnavailable` raised by `_launchctl`'s per-call operator-home + re-resolution (a `ValueError` subclass, so the environmental case is caught + race-free while a genuine code-bug `ValueError` and an invalid job label + still surface). +- Bound provider teardown by the caller deadline: `_terminate_and_reap` polls + to reap the SIGKILLed session-group leader within a small grace of the + caller deadline rather than two fixed five-second waits, and reports a + proven teardown only when the whole-group kill was posted AND the leader was + reaped, so a leader-only fallback is honestly typed as a teardown failure. +- Bound the request-dispatch path's retained-lane availability probe by the + request deadline: `_launch_broker` now starts the deadline before capturing + lanes and threads it through `_capture_broker_lanes` → `_job_loaded` → + `_launchctl`, so a small-`timeout_ms` request no longer blocks on + launchctl's ~20s default before dispatch (lifecycle/status callers keep the + default bound). +- Reject an incomplete Codex rollout tail instead of trusting the preceding + model context: `_codex_rollout_window` fails closed on a non-newline- + terminated final record, so a concurrently written model-changing record can + no longer yield stale governance-ready identity. -### Tests +### agent-collab 4.1.1 — 2026-07-20 -- Pin the distinction between the client's accepted contract vocabulary and - the exact routes advertised by the current signed public runtime. +#### Fixed -### Added +- Make `broker-status` use the same canonical selector view as request routing, + so a valid selector-v1 selected dispatcher is no longer misclassified as an + obsolete single-broker installation. +- Require the selected immutable lane, launchd job, socket, and closed liveness + exchange to pass before broker status is ready. Migration-doctor `READY` now + requires this executable proof as well as the signed runtime manifest. +- Require the one-shot launchd job to return idle and every retained fallback + lane to remain independently verifiable before status can claim executable + readiness, matching the topology that request routing will actually accept. +- Advertise a retained lane as rollback-capable, and include it as a request + fallback, only when its own launchd job is currently loaded. Retained job + availability is a point-in-time snapshot and does not deactivate a healthy + selected lane. +- Treat a selectorless legacy broker as installed but unavailable even when its + old socket responds, because current request routing cannot capture an + executable lane without the same canonical selector proof. +- Keep liveness compatible with a verified dispatcher-v1 selected lane while a + dispatcher-v2 candidate is staged, so the previous lane remains executable + until the new lane is fully proved and atomically selected. +- Preserve typed timeout, output-limit, and teardown results after a dispatcher + accepts a request instead of collapsing those local completion failures into + a misleading `protocol_error`; accepted work still never retries another lane. +- Wait for a selected dispatcher-v1 one-shot job to return idle before exposing + its response to the next caller, closing the launchd teardown window without + serializing the concurrent dispatcher-v2 scheduler. +- Bound that dispatcher-v1 idle proof by the request's existing absolute broker + deadline, including every `launchctl` collection and final polling sleep, so + teardown verification cannot silently start or overrun a fresh timeout. +- Resolve Codex Desktop's active OpenAI model from its exact current rollout + when `CODEX_ACTIVE_MODEL` is absent. The reader is fixed-root, bounded, + no-follow, same-owner, single-file, and fail-closed on ambiguous, writable, + linked, malformed, oversized, concurrently growing, or conflicting identity + evidence. - +#### Verification -- **Domain-expert skill pack (16 new skills).** New pure-prompt, host-neutral - expertise skills alongside the existing collaboration/governance set: - `rust-engineer`, `go-engineer`, `elixir-engineer`, `sql-engineer`, - `kubernetes-specialist`, `terraform-engineer`, `sre-engineer`, - `incident-responder`, `mlops-engineer`, `llm-architect`, - `postgres-engineer`, `data-engineer`, `eval-engineer`, - `prompt-regression-tester`, `hallucination-investigator`, and - `ai-writing-auditor`. Authored under workspace ownership, informed by the - MIT-licensed VoltAgent subagent corpora at pinned SHAs (947b44ca / - 5605c9c1) after an untrusted-input security audit; all supply-chain - patterns flagged by that audit (third-party installers, external MCP - endpoints, fictional tools) are excluded by construction. No coordinator, - provider, or delegation surface is touched. +- Added RED/GREEN regressions for selector-v1 projection, legacy selected-lane + liveness, selectorless legacy false-positive rejection, one-shot idle + completion, invalid retained-lane rejection, + unloaded retained-job rollback and fallback suppression, + accepted-request timeout typing and no-fallback behavior, legacy one-shot + response teardown, deadline reuse, bounded launchctl collection, and capped + polling, failed dispatcher ping, manifest-only doctor readiness, safe Codex + rollout identity, and ambiguous, growing, or unsafe rollout rejection. -- qa-verify: instruct callers to phrase QA constraints at evidence level rather than - presence level (the inspector must produce what it checked; name likely shortcuts; - bound with an out-of-scope list), per the approve-everything verifier failure mode - documented in Anthropic's outcome-grader cookbook. Additive guidance only; the - PASS/FAIL verdict contract is unchanged. +### agent-collab 4.1.0 - Signed lane contract anchor -### agent-collab 4.3.4 — 2026-07-24 +- Bind schema-3 runtime artifacts, selector-v2 lanes, dispatcher protocol-2 + reservations, and Gemini governance proof to one authenticated runtime + contract anchor while preserving exact committed legacy normal lanes. -### Fixed +### agent-collab 4.0.5 - Gemini governance proof v2 -- Fixed `migration_doctor` reporting `provider_routing="BLOCKED"` for the shipped runtime. - Readiness compared the client's full acceptance set against the manifest, so the accepted - but deliberately unadvertised `codex/governance` route marked the entire runtime invalid. - Readiness is now judged against a required baseline (`REQUIRED_CONTRACTS`), with - `OPTIONAL_CONTRACTS` holding routes a signed artifact may advertise but need not ship. +- Validate Gemini governance evidence against the provider runtime `2.0.0` + proof contract `2` tuple instead of conflating it with the public bundle + manifest contract, and require governance response provenance to identify + that same compatible runtime while rejecting legacy, crossed, and + mixed-provenance version tuples. + +### Added +- Regression test locking in that a host-normalized runtime bundle (directory 0o755, member files 0o500) verifies and resolves — the empirically-confirmed state produced by every supported installer (Claude Code, Codex, Antigravity/agy, and the broker's sealed copies: 2356/2356 installed member files were 0o500, none 0o700). This closes release-pipeline design item §9.7 as empirically non-reproduced: no source-mode loosening is made (it would be unnecessary and would open a direct-execution-of-owner-writable-source bypass); the loader already handles the real install correctly. ### Changed -- Root `README.md` opening rewritten purpose-first (operator-directed overhaul): why governed multi-agent collaboration exists (family blind spots, disclosed reward-hacking, unaccountable authority loops), what it delivers, and how governance is implemented — followed by the unchanged technical sections; stale intro version pin removed (version lives in "Current package"). Package README gains a purpose-bridge paragraph. Doc-only, no version bump. +- `build_plugin_archive.py` now sources the activation runtime bundle from an out-of-tree signed handoff via `--bundle-source ` instead of the git checkout — the signed runtime ships as a release asset and is never committed. The committed `runtime-manifest.json` alone decides the mode (design decision D1): an activation manifest without `--bundle-source` is a hard error (never a silent policy-only downgrade), a policy-only manifest forbids the flag, and an in-tree `runtime/` conflicts with an external source. The bundle source is treated as hostile input (symlink argument rejected before resolution; bounded non-following enumeration; member-set equality; per-member O_NOFOLLOW regular-file/uid/nlink/mode/size/sha256 checks with the strict 0o500 install mode preserved), and its payloads are re-read + re-digested through fresh descriptors at pack time. +- `verify_archive` is rearchitected to **regenerate the canonical tar from trusted inputs and byte-compare** rather than parse a possibly-hostile archive: it never hands candidate tar bytes to `tarfile`. A shared deterministic `USTAR` serializer (used by both build and verify) reproduces the canonical tar with runtime payloads zero-filled; the candidate is only bounded-inflated and then sliced at offsets the verifier computed. Every structural property — headers, exact typeflags, ordering, padding, EOF, dialect, and the absence of hidden PAX/GNU/sparse records — is bound by the byte-compare outside the runtime ranges; each runtime payload is bound to the frozen-manifest digest; the archived `runtime-manifest.json` bytes are bound to the frozen snapshot. Reading the candidate is fd-only (`O_NOFOLLOW`/`O_NONBLOCK` + `fstat`, no path-swap window) under hard compressed- and decompressed-size caps, with a canonical gzip-header check and single-stream (no trailing/concatenated data) validation. The archive is built into an exclusive temp that is verified before an atomic rename, so a failed build never leaves a publishable artifact. Hardened through a 2-round up-front adversarial design review of the hostile-archive-reading threat model (the regenerate-and-compare pivot) before implementation. -### Fixed -- SECURITY.md support matrix: `3.x` → `4.x` (current major per plugin.json 4.3.1; staleness audit). +### agent-collab 3.5.1 — fail-closed dispatcher boundary -- visual-review + ui-to-code: direct the primary to magnify detail-bound regions - (host-native zoom/crop or a full-resolution code-execution crop) before reading - them, per the confidently-wrong sub-patch-detail failure documented in Anthropic's - crop-tool cookbook. Additive guidance only; the skills' no-image-transport honesty - boundary is unchanged. +- Treat malformed or noncanonical dispatcher-client output after the + request-bearing child launches as a post-request failure, preventing a + possible second execution through blue after green acceptance. +- Preserve typed unsupported-platform behavior when POSIX `fcntl` is absent, + while failing lifecycle locking closed before filesystem I/O. -### Added +### agent-collab 4.0.0 — Grok 4.5 model and effort unification -- **`cut_release.py` runtime-currency gate (fail-closed).** An activation - release now refuses to cut when any `runtime:`-scoped merge landed after the - commit that last staged `plugins/agent-collab/runtime/` — the failure mode - that shipped a 4.2.0-era runtime in the rolled-back v4.4.0 tag-only cut. - Explicit operator override: `--allow-stale-runtime` (loud warning). Unit - tests cover pass/stale/missing/override/wiring paths. +- **Breaking:** advance the fixed public/native runtime protocol to v2. Older + public clients and signed runtimes now reject each other instead of silently + using the retired Composer model or an outdated request shape. +- Route Grok architecture, governance, huge-context, and compatibility codegen + through the same `xai/grok-4.5` author model. `composer/codegen` remains a + public compatibility route with output-only authority, not a separate model. +- Seal review effort from the task: architecture and governance use high, + huge-context synthesis uses medium, and callers cannot override those review + profiles. Codegen requires `simple_codegen`, `standard_codegen`, or + `complex_codegen`, with respective low, medium, and high effort floors. +- Keep all model, tool, sandbox, credential, environment, filesystem, and + application authority out of the public codegen row. The trusted primary + still owns applying output, integration review, testing, git, and release. -### agent-collab 4.4.2 — 2026-07-25 +### agent-collab 4.0.1 — intent-check effort contract correction -### Fixed +- Fixed `intent-check` routing guidance so Gemini governance rows use their + required high effort, while rudimentary Codex advisory intent comparisons + remain low and the sealed Grok governance fallback remains high. -- Reject managed `execute` responses whose `result.text` is missing, - non-string, empty, whitespace-only, Unicode-invisible/filler-only, - replacement-glyph-only, terminal-control-only, or malformed instead of - accepting a false-positive `status=ok`. - Invalid success is a terminal `protocol_error` and cannot enter automatic - family fallback. `readiness` remains exempt, and typed containment, timeout, - teardown, and provider failures retain their classifications. +### agent-collab 4.0.2 — protocol-v1 blue lifecycle bridge -- Ship a content-addressed execute-output conformance contract with a frozen - Unicode-16 blankness table so the public client can fail closed even when an - older signed runtime emits a defective success envelope. Include it in the - canonical release archive beside `runtime_client.py` and verify exact bytes. +- Keep normal protocol-v2 routing fail-closed against protocol-v1 runtimes and + responses while allowing dispatcher lifecycle control to prove the exact + signed v1 blue baseline needed for make-before-break staging. +- Stage and verify protocol-v2 green without rewriting or stopping v1 blue, and + derive the selected blue protocol from its immutable manifest during mutable + control-plane recovery. -- Enforce exact CSI byte-class ordering and a closed OSC/C1 support matrix, - rejecting malformed sequences and unsupported control strings rather than - stripping printable residue into an apparent answer. +### agent-collab 4.0.3 — dispatcher lifecycle control protocol -- Retain the original absolute request deadline through direct and broker - response parsing. Classification of a near-limit blank/control stream now - returns typed `timeout` if it consumes the remaining budget. +- Send lifecycle ping and lock-probe control messages on the sealed dispatcher + protocol-v1 contract so a staged dispatcher can be proven before activation. +- Keep typed lifecycle failures on runtime protocol v2 and reject swapped, + malformed, or extra-field success and failure responses. -### agent-collab 4.3.5 — 2026-07-25 +### agent-collab 4.0.4 - adoption protocol boundary -#### Fixed +- Preserve the sealed provider-adoption request and response on public runtime + protocol v2 while carrying them inside the private dispatcher protocol-v1 + bridge, matching the one-time authority registry and frozen dispatcher. -- Accept exact legacy Gemini governance proof v1 and recovery-capable proof v2 - as disjoint public success contracts so a verified retained v1 lane remains - callable while a v2 runtime is staged. -- Select v2 validation whenever any recovery discriminator is present. Reject - partial, hybrid, coerced, contradictory, or cross-field-mismatched results - instead of falling back to the legacy contract. -- Name both exact public proof keysets explicitly and document the verified - child-runtime/private-pipe trust boundary. The proof hash is a consistency - check rather than a signature; complete v1 remains accepted only for - retained-lane rollback continuity. +### agent-collab 3.5.2 — launchd dispatcher peer readiness -agent-collab 4.5.0 routes the packaged OpenCode default through -`opencode-go/glm-5.2`, recognizes -Kimi as Moonshot-family provenance, and adds an opt-in -`AGENT_COLLAB_OPENCODE_PROVIDER=opencode-go` host guard that rejects standard -metered OpenCode Zen models, malformed provider policy, namespace lookalikes, -and late policy drift before runtime launch. +- Distinguish the root-owned launchd listener credential from the + operator-owned sealed runtime process when authenticating a staged + dispatcher on macOS. +- Retry only the exact root-plus-pid-1 launchd handoff sentinel under the + existing handshake deadline, with capped exponential sleeps and immediate + failure for malformed state or socket errors. +- Re-prove the stable process start identity, exact executable, signed + artifact, socket identity, and final kernel peer PID before sending hello. - -### Changed +### Fixed +- Notarization is now verified with the code-object-native `codesign --verify --strict --test-requirement '=notarized'` instead of `spctl --assess --type execute`, at BOTH the release CI gate (`verify_runtime_release.py`) and runtime activation in the client (`runtime_client.py`). The runtime entrypoint is a bare command-line Mach-O, not a `.app` bundle, and `spctl --type execute` only assesses `.app` bundles — it always rejects a bare executable ("the code is valid but does not seem to be an app"), a false negative that would fail every otherwise-valid activation release at the notarization step AND every client activation. The `notarized` codesign requirement binds to the CDHash and rejects unsigned, ad-hoc, and Developer-ID-signed-but-not-notarized binaries by exit code; both call-sites fail closed on tool error. The check is combined with `--check-notarization` (see the online-verification entry) so it forces the online Apple notary lookup and succeeds on a clean host — a bare Mach-O cannot have a notarization ticket stapled, so without the online lookup `=notarized` would depend on the host's local notarization trust state and fail-close on any clean host. -- **Rebuilt, re-signed, and re-notarized the darwin-arm64 provider runtime** - from the current workspace source closure. The bundle shipped in the - rolled-back v4.4.0 tag-only cut predated several runtime-behavior changes, - including the public-client digest pin; a runtime built before that pin - rejects the client this package actually ships. +### agent-collab 3.5.0 — provider update continuity -- **The signed runtime now advertises the `codex/governance` route.** This is a - capability expansion: v4.3.3 added the route to the public client's parser - allowlist and JSON schema while the shipped runtime deliberately did not - claim it, and the v4.4.1 runtime is built from a source closure where it is a - real read-only contract. +- Add a strict, legacy-default blue/green broker selector so a newly installed + client can continue using the separately verified legacy broker while a + content-derived dispatcher lane is staged. +- Preserve blue on missing, invalid, unproven, refused, or timed-out green + connections before any send attempt; never retry another lane after a + connection succeeds. Each request captures one lane ordering so an in-flight + blue request completes even if the next request atomically selects green. +- Add closed stage, status, no-provider ping, canonical-lock probe, selector + commit, candidate abort, committed-control recovery, and retiring-blue drain + operations. Green uses a distinct content-derived label/socket; commitment + never bootouts blue, and recovery never changes desired provider binaries. +- Keep one canonical Gemini/Grok/OpenCode lock across blue and green for the + complete request through provider teardown. Credential-free contention and + acquisition probes let every installed client prove that namespace before + green traffic is enabled. +- Permit a bounded two-selector overlap when both entries are the unified + `agent-collab` package, allowing Codex to retain its old cache while a distinct + candidate selector is proven. Retired package names remain blocking, and old + client retirement stays behind the private fresh-session finalization gate. +- Block every packaged mutating broker/dispatcher lifecycle operation from the + Codex seatbelt before lifecycle reads or writes while retaining read-only + status and probes. -- **`codex/governance` is now REQUIRED at the release gates.** All three - independent copies of the contract allowlist — - `verify_runtime_release.py`, `build_plugin_archive.py`, and - `check-public-export-safety.py` — move from a ten-route to an - eleven-route required set, keeping exact-set equality. Release gates - validate what this repository is about to publish, so requiring the route - stops a future cut from silently dropping a governance capability. The - public client deliberately keeps it OPTIONAL, because it validates whatever - is already installed, including older field artifacts that predate the - route. The two postures are intentionally opposite. +### agent-collab 3.5.0 — authenticated dispatcher canaries -### Tests +- Add exact Darwin dispatcher peer proof and a request-free, digest-bound + hello/ready handshake before any green provider request is sent. +- Add a token-gated internal `adoption_canary` coordinator operation bound to + one candidate tuple and route allowlist without exposing a user-selectable + provider path, model, auth root, or policy route. +- Keep the selector legacy-blue by default. Apply a separate local bound to the + request-free handshake so a proven pre-request green failure retains time for + independently proven blue without shortening the original request deadline; + a failure at or after request send never retries another lane. -- Enforce the contract set at the real `verify_release` call site in both - directions: omitting `codex/governance` is rejected, and an unenumerated - extra route is rejected. Pin that all three gate copies agree exactly, and - that the client keeps the opposite (optional) posture. -- Derive the contract fixtures in `test_plugin_archive.py` and - `test_release_evidence.py` from the builder's own allowlist instead of - restating ten routes inline. Both hardcoded copies had silently rotted the - moment the required set changed; deriving them makes that impossible. -- Update the route-shipping test to the new reality (route now advertised) while - still asserting it remains accepted-but-not-required. +### agent-collab 3.3.0 — closed standalone provider bundle -### Fixed +- Route managed Gemini, OpenCode, Grok, and Composer requests through an explicit, digest-bound + launchd socket broker that starts for one request and returns to zero idle + processes. Add closed install, status, rollback, and uninstall lifecycle + commands with transactional prior-version restoration and no direct fallback. +- Replace the failed onefile launch path with manifest schema 2, native contract + 3, and broker transport 2 over one closed standalone bundle. Bind its identity + to the sorted role/mode/size/digest/Mach-O facts of every member; publish only + exact immutable `0500` files; verify the kernel-reported entrypoint and the + complete lifecycle state before provider dispatch. Provider protocol 1 and + all existing route-authority boundaries remain unchanged. +- Resolve the OpenCode model per request from live OpenCode/ZCode observation, + explicit central configuration, or the fixed `opencode/glm-5.2` preset while + ignoring ambient and row-level model fallbacks. +- Reject duplicate/non-finite broker responses and state before typed parsing. +- Preserve typed `cancelled` and `input_limit` Grok/Composer failures, require + exact terminal-state validation, and document the one bounded cancellation + retry and comprehensive architecture-reviewed Composer coding-packet policy. +- Strip the Codex Desktop Seatbelt marker from broker-dispatched work so every + Grok/Composer attempt validates its own nested read-only sandbox, preserve + closed provider-child environments, and keep runtime management direct-only. +- Propagate client disconnect through managed OpenCode, Grok, and Composer + calls, reap provider child groups, discard partial output, prohibit retry of + disconnect cancellation, and fail with typed `timeout` before setup when the + managed-boundary deadline reserve is exhausted. +- Harden repository configuration with full-SHA Action pin enforcement while + retaining squash-only, signed, linear, review-thread-resolved releases. +- Align OpenCode preflight with issuance model resolution; key immutable broker + versions by both artifact and manifest digests; preserve complete rollback + state across failures and no-op reactivation; reject unverified rollback + targets; treat a never-installed root as typed uninstalled/unavailable; and + map bounded `launchctl` failures to closed lifecycle results. -- Restore the unreleased v4.5.0 source line to the canonical policy-only - package shape by removing the retained v4.4.2 production runtime bundle and - publishing an empty, schema-v3 runtime manifest. -- Keep the OpenCode Go policy and skill changes in v4.5.0 while making the - source tree eligible for the governed private build/sign/notarize pipeline. +### agent-collab 3.3.0 — managed Gemini governance and reliable provider state -### Why +- Add a distinct broker-only `gemini/governance` action with exact Gemini 3.1 + Pro/high selection, immutable artifact binding, shared-HOME/PTY containment + evidence, response hashing, and public-client proof-digest validation. +- Keep Gemini advisory and long-context separate and explicitly ineligible as + governance evidence; automatic governance now maps Gemini and Grok to their + explicit governance actions while Codex remains advisory. +- Advance the signed-runtime route contract to version 2 across policy, + manifests, schemas, archive/release verification, generated skills, and + deterministic tests. +- Document canonical passwd HOME as the managed-provider reliability policy + without relaxing family exclusion, authority separation, bounded lifecycle, + or the prohibition on raw provider fallbacks. +- Make Codex, Gemini, OpenCode, Grok, and Composer uniformly broker-only and + bind provider startup to the signed guardian's acknowledged pre-exec gate; + only local runtime management retains direct exact-artifact execution. -- A populated runtime is admissible to the private builder only when the - requested source is the exact commit behind a trusted signed release tag. - Carrying the older runtime into an untagged v4.5.0 commit made the source - neither a valid policy-only input nor a valid signed activation input. +### agent-collab 3.1.0 — source-available licensing and neutral guidance - -### Changed +- License the public repository and installed package under the unmodified + PolyForm Strict License 1.0.0. Copyright remains with John Osumi; commercial + use requires explicit written approval administered by Osumi Consulting LLC. +- Make `AGENTS.md` the sole canonical public repository guide and retain + `CLAUDE.md` only as an `@AGENTS.md` compatibility loader. +- Require contributor-rights evidence and package exact legal documents, + SHA-256 evidence, and an SPDX 2.3 SBOM in the policy-only release. -- Rebuild the darwin-arm64 provider runtime from final workspace `1.0.823` - commit `d08b6382710d6d5910d64cf011bcac873a2e1c03`, Developer-ID sign it, and - notarize it through Apple submission - `c6d29dec-5351-467d-883e-0b862734567d`. -- Replace the policy-only placeholder with a closed activation manifest that - pins the complete standalone bundle at SHA-256 - `2cea10cff2030d0238661667cf8d1b83cf9885dc6f4a03b0db4365e891b04f47`. - The rebuilt runtime includes the v4.5.1 provider-agnostic containment, - canonical-user-HOME authentication, private request workspace, bounded - execution/teardown/cleanup, OpenCode Go, output conformance, and lifecycle - continuity repairs from the final merged workspace. +### agent-collab 3.0.1 — clean public distribution -### Tests +- Publish the unified policy/client package from the audited clean-history + `sumitake/agent-collab` marketplace without importing private pull-request + refs, tags, releases, workflow artifacts, or provider implementation history. +- Localize contribution governance and security reporting so contributors and + plugin users do not need access to the private build/sign system. +- Remove host-specific labels and session-owner metadata, regenerate both + marketplaces and all skills, and retain the policy-only fail-closed runtime + state until a separately verified signed native artifact is available. -- Verify the imported handoff byte-for-byte, re-run the Developer ID, - hardened-runtime, secure-timestamp, Apple-notarization, Mach-O, contract, - member-inventory, and whole-bundle gates, then build and reopen the canonical - activation archive. +### agent-collab 3.0.0 — breaking unified-package consolidation -### Fixed +- **Breaking:** retire `claude-collab`, `codex-collab`, + `antigravity-collab`, `codex-tools`, and `glm-worker` immediately. Together + with the already-retired `grok-worker`, they are removed from the + marketplace, release inventory, active documentation, and generated package + surface without presets, tombstones, dependencies, or compatibility shims. + The historical `agent-collab-plugin`, `gemini-collab`, and `grok-collab` + package identities are also treated as retired exact aliases. The clean + `sumitake/agent-collab` repository is the marketplace source; a repository + name is not itself an installed legacy package. +- Add `agent-collab 3.0.0` as the only package and release. It resolves the + primary, model family, active model, host runtime, and session dynamically. + `codex-tools` → the managed Codex backend in `agent-collab`; `glm-worker` + → the managed OpenCode backend, with `opencode/glm-5.2` retained as the + current Zhipu-family model preset. +- Add a narrow signed-native-runtime manifest, standalone public coordinator, + and verifier. Exact route/action, authority, and artifact-author provenance + checks cover Gemini, Codex, OpenCode, Grok 4.5, and Composer. Grok 4.5 is + limited to sealed read-only architecture, governance, and huge-context + actions; generic advisory or worker roles cannot select it. OpenCode build + is explicitly mutation-capable workspace-write authority, distinct from + read-only plan. Response family + is derived from the artifact-author model on every call, including OpenCode + model switches; structured provider/model parsing rejects ambiguous lineage + and incidental substring matches. Applicable non-governance worker requests + may carry an exact artifact snapshot so its author family is also excluded. + Contradictory or unknown response provenance is rejected. Runtime + stdout and stderr are bounded while the process is running, with process- + group termination and reaping on output-limit or unexpected collector + failures. The release + tree contains no unsigned + placeholder artifact; all native routes are typed unavailable until the + private build/sign system supplies the notarized binary. A + policy-only release may ship with an empty artifact manifest and no runtime. + Native activation remains blocked until the Darwin-arm64 artifact advertises + the full matrix and supplies commit-bound Developer ID, hardened-runtime, and + notarization evidence. +- Split the local signed-tag tool and GitHub release workflow by canonical + package mode. Policy-only mode proves the manifest/archive contain no runtime; + activation alone invokes the strict macOS signing/notarization verifier. +- Bind the exact captured artifact independently from the instruction prompt in + sealed native JSON: base64 bytes, SHA-256, byte size, author model, and + derived author family are verified before launch. Ambiguous active-model + lineage remains unknown even when a stale asserted family is present; + governance fails closed and non-governance worker artifacts warn when author + independence is unknown. +- Add native Codex packaging with a `.codex-plugin/plugin.json` manifest and + generated `.agents/plugins/marketplace.json`, while retaining the + Claude-compatible package manifest. Release consistency requires both host + manifests to identify the same sole `agent-collab` package and version. +- Make policy-only readiness deterministic on every host: the manifest is + parsed and validated before the Darwin-arm64 activation gate, an empty + artifact set remains typed unavailable, and runtime tests explicitly + simulate the supported target rather than inheriting the CI host platform. +- Add a provider-free migration doctor, duplicate-package routing block, + dynamic known/unknown host preflight, and policy-only safe mode. Safe mode + disables every native model route. Async inbox readiness is available only + after a current host observation and the public coordinator never sends; + reinstalling a retired package is not a rollback. The doctor parses enabled + and installed-disabled Codex plugin tables from `~/.codex/config.toml`, + preserves source-host provenance, and emits removal commands for the owning + package manager. Empty primary + configuration is re-observed on every request so ZCode model switches take + effect immediately. `codex/build` and `auto/worker` are coordinator-only, + typed-unavailable contracts and never widen the signed required runtime + matrix or promote into advisory authority. Malformed rows fail as + `config_error`. Missing or hostile home-directory resolution now blocks with + a typed inventory error. Python 3.10 uses a strict exact-table compatibility + parser for Codex plugin selection, including escaped-key and multiline-string + defenses, instead of substring matching or silently skipping the registry. +- Add a clean-history public-export gate. Deleted backend sources remain in the + private history until the separately authorized rewrite and residual audit; + direct visibility changes or exports from the unsanitized clone are blocked. + The gate scans every reachable blob as bytes, recursively inspects nested + archives under cumulative depth/member/size bounds, semantically detects + statically constructed provider argv, applies only narrow harmless-fixture + masking, and rejects provider-backend archive directories, symlink, or other + unsafe tree modes. It separately inspects every ref, direct blob or tree + target, annotated-tag object/message, and release-tag form/target. +- Pin every pull-request workflow to GitHub-hosted `ubuntu-latest`; public PR + code can no longer execute on a persistent self-hosted runner, and + the mutable `RUNNER_TARGET` repository variable has been removed. +- Grant CodeQL the additional read-only `actions: read` scope required to + associate and upload pull-request analysis results; all other workflow token + permissions remain explicitly least-privilege. +- Keep CodeQL enforceable while the sanitized repository is still private: + complete analysis now retains SARIF as a bounded workflow artifact when Code + Scanning is unavailable, then switches automatically to Code Scanning upload + once the repository becomes public. +- Require releases to originate from a verified signed annotated tag whose + target commit is the checked-out commit on `origin/main`. Both the local + release tool and GitHub workflow enforce the same ancestry boundary, and + the release job force-materializes the remote annotated tag object before + history inspection so the checkout action's peeled commit ref cannot be + mistaken for an unsigned or lightweight tag. The + hardened-runtime verification parses the actual numeric code-signing flags. + Runtime and release verification also inspect the executable as a thin arm64 + Mach-O with exactly one macOS `LC_BUILD_VERSION` for minimum macOS 14.0. + The operator-owned Developer ID Team ID is pinned independently in reviewed + `signing_policy.py`; the manifest cannot select its own signer, and the + unconfigured anchor blocks activation until matching signing/notarization + credentials are provisioned. -- agent-collab 4.5.1 makes managed containment a rare structural signal rather - than an output heuristic. -- Make managed containment provider-agnostic and structural: authenticated - provider state resolves from the canonical user HOME, caller checkouts stay - read-only by default, and each request receives a private temporary workspace - for agentic tools, edits, builds, and reasoning. -- Seal `opencode/build` as output-only to the caller. OpenCode may work inside - its private workspace, but the trusted primary reviews and applies returned - material instead of granting the provider direct caller-worktree mutation. -- Reserve `containment_error` for failure to establish the boundary before - launch or positive write-escape/protected-state evidence. A successfully - blocked access attempt proves containment worked; return code, empty output, - and stderr wording cannot manufacture a containment failure. -- Keep authentication, protocol/output, timeout, provider, teardown, and - cleanup failures orthogonal. Disable in-request binary updates, require - bounded descendant teardown and positively verified temporary cleanup, and - treat routine direct-CLI fallback as a managed-path reliability defect. +### Breaking + +- Rename the public `ai-merge-resolve` skill to `merge-resolve`, including its generated command and auto-apply policy filename. Existing installations must invoke `/agent-collab:merge-resolve` and rename `.claude/ai-merge-policy.yaml` to `.claude/merge-resolve-policy.yaml` when that opt-in file is used. + +### Added + +- Add a digest-pinned activation-only third-party notice/license tree for CPython 3.13.14, Nuitka 4.1.3, Expat, HACL*, libb2, mpdecimal, mimalloc, and Hedley. +- Extend SPDX 2.3 release evidence with component packages, embedded-component relationships, and license conclusions that no longer mislabel the native runtime as wholly PolyForm-licensed. +- Add a closed co-packaged runtime setup client for read-only status, idempotent managed-state preparation, and bounded Grok device login without exposing provider recipes or caller-selected paths. + +### Changed + +- Reject noncanonical package-qualified release tags, move the arm64 activation verifier to `macos-15`, and fail activation archives on missing, extra, linked, hardlinked, unsafe, or content-drifted third-party legal members. +- Keep the native child environment scrubbed while passing only a closed generic/Codex-Desktop host-context observation; the signed runtime derives and validates provider state from the OS login identity. +- Fail closed with typed `platform_unsupported` when POSIX user identity APIs are unavailable, before manifest or artifact ownership checks can raise on non-POSIX hosts. diff --git a/changelog.d/2026-07-27-changelog-fragment-order-descending.md b/changelog.d/2026-07-27-changelog-fragment-order-descending.md new file mode 100644 index 0000000..08da68f --- /dev/null +++ b/changelog.d/2026-07-27-changelog-fragment-order-descending.md @@ -0,0 +1,9 @@ +### Fixed + +- `build-changelog.py` now sorts `changelog.d/` fragments in **reverse** + lexical order (newest filename first) instead of ascending order. The + compiled `[Unreleased]` block previously placed the oldest fragment at the + top and the newest at the bottom — backwards from the Keep a Changelog + convention this file's own header cites (most recent change on top). + `CHANGELOG.md` is regenerated from the corrected sort; only the ordering + changed, no entries were added, removed, or reworded. diff --git a/changelog.d/README.md b/changelog.d/README.md index 0b48acc..ba0627d 100644 --- a/changelog.d/README.md +++ b/changelog.d/README.md @@ -27,7 +27,7 @@ This directory holds **per-PR changelog fragments** that compile into `CHANGELOG `scripts/build-changelog.py` is the compiler: -- **Build mode** (default): reads `changelog.d/*.md` in sorted order, concatenates content, inserts the result into the `## [Unreleased]` section of `CHANGELOG.md`. Idempotent. +- **Build mode** (default): reads `changelog.d/*.md` in reverse-sorted order (newest filename first), concatenates content, inserts the result into the `## [Unreleased]` section of `CHANGELOG.md`. Idempotent. - **Check mode** (`--check`): builds to a temp file and diffs against the current `CHANGELOG.md`. Exit 0 if they match; exit 1 with diff if they don't. CI uses this mode. - **Dry-run mode** (`--dry-run`): prints what would be compiled without writing. diff --git a/scripts/build-changelog.py b/scripts/build-changelog.py index 9b73d5a..028f3ad 100644 --- a/scripts/build-changelog.py +++ b/scripts/build-changelog.py @@ -27,8 +27,11 @@ - changelog.d/README.md - changelog.d/.gitkeep - changelog.d/.skip-* (any file starting with `.skip-`) - * Fragment ordering: lexical sort of filename. Conventional naming uses - zero-padded incrementing IDs or PR numbers so order is intentional. + * Fragment ordering: reverse-lexical sort of filename (newest first). + Conventional naming uses date-prefixed or zero-padded incrementing IDs, so + reverse order puts the most recently landed change nearest the top of + ``[Unreleased]`` — matching Keep a Changelog's most-recent-on-top + convention instead of burying it at the bottom of the section. * The compiler inserts fragments BETWEEN the ``## [Unreleased]`` line and the first ``###`` sub-heading (or end of section if no sub-headings). Existing inline entries under ``## [Unreleased]`` are PRESERVED below the @@ -64,14 +67,16 @@ def list_fragments() -> list[Path]: - """Return sorted list of fragment files under changelog.d/. + """Return reverse-sorted list of fragment files under changelog.d/. + Reverse-lexical by filename, so the newest-dated/highest-numbered + fragment comes first (most recent on top of ``[Unreleased]``). Reserved names skipped: README.md, .gitkeep, .skip-* """ if not FRAGMENTS_DIR.is_dir(): return [] fragments: list[Path] = [] - for entry in sorted(FRAGMENTS_DIR.iterdir()): + for entry in sorted(FRAGMENTS_DIR.iterdir(), reverse=True): if not entry.is_file(): continue if entry.name == "README.md": diff --git a/scripts/test_build_changelog.py b/scripts/test_build_changelog.py index addd4b1..ea7a822 100644 --- a/scripts/test_build_changelog.py +++ b/scripts/test_build_changelog.py @@ -102,14 +102,14 @@ class ListFragmentsTests(_RepoCase): def test_empty_dir(self) -> None: self.assertEqual(build_changelog.list_fragments(), []) - def test_picks_up_md_files_in_sorted_order(self) -> None: + def test_picks_up_md_files_in_reverse_sorted_order(self) -> None: self.write_fragment("0002-second.md", "second") self.write_fragment("0001-first.md", "first") self.write_fragment("0010-tenth.md", "tenth") result = build_changelog.list_fragments() self.assertEqual( [p.name for p in result], - ["0001-first.md", "0002-second.md", "0010-tenth.md"], + ["0010-tenth.md", "0002-second.md", "0001-first.md"], ) def test_skips_reserved_names(self) -> None: @@ -141,7 +141,7 @@ def test_returns_content_in_order(self) -> None: self.write_fragment("0002-b.md", "content-b\n") fragments = build_changelog.list_fragments() self.assertEqual( - build_changelog.read_fragments(fragments), ["content-a", "content-b"] + build_changelog.read_fragments(fragments), ["content-b", "content-a"] ) def test_strips_trailing_whitespace_only(self) -> None: