From 5c2bfbf20f9dbd00c220f52d944cc60bdf5726ba Mon Sep 17 00:00:00 2001
From: John Osumi <931193+sumitake@users.noreply.github.com>
Date: Mon, 27 Jul 2026 23:39:24 -0700
Subject: [PATCH] fix(changelog): sort fragments descending so most recent
 lands on top

build-changelog.py sorted changelog.d/ fragments ascending by filename,
which placed the oldest entry at the top of [Unreleased] and the newest
at the bottom -- backwards from the Keep a Changelog convention this
file's own header cites. Reverse the sort, update the two tests that
pinned the old order, and regenerate CHANGELOG.md from the corrected
compiler (content unchanged, only reordered).

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
---
 CHANGELOG.md                                  | 1318 +++++++++--------
 ...-27-changelog-fragment-order-descending.md |    9 +
 changelog.d/README.md                         |    2 +-
 scripts/build-changelog.py                    |   13 +-
 scripts/test_build_changelog.py               |    6 +-
 5 files changed, 686 insertions(+), 662 deletions(-)
 create mode 100644 changelog.d/2026-07-27-changelog-fragment-order-descending.md

diff --git a/CHANGELOG.md b/CHANGELOG.md
index 4d3da8e..db2aba0 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -12,476 +12,330 @@ The public changelog intentionally records policy, compatibility, and migration
 
 <!-- changelog-fragments:start (auto-generated by build-changelog.py — do not hand-edit) -->
 
-### Added
+### Fixed
 
-- Add a digest-pinned activation-only third-party notice/license tree for CPython 3.13.14, Nuitka 4.1.3, Expat, HACL*, libb2, mpdecimal, mimalloc, and Hedley.
-- Extend SPDX 2.3 release evidence with component packages, embedded-component relationships, and license conclusions that no longer mislabel the native runtime as wholly PolyForm-licensed.
-- Add a closed co-packaged runtime setup client for read-only status, idempotent managed-state preparation, and bounded Grok device login without exposing provider recipes or caller-selected paths.
+- `build-changelog.py` now sorts `changelog.d/` fragments in **reverse**
+  lexical order (newest filename first) instead of ascending order. The
+  compiled `[Unreleased]` block previously placed the oldest fragment at the
+  top and the newest at the bottom — backwards from the Keep a Changelog
+  convention this file's own header cites (most recent change on top).
+  `CHANGELOG.md` is regenerated from the corrected sort; only the ordering
+  changed, no entries were added, removed, or reworded.
 
-### Changed
+### Fixed
 
-- Reject noncanonical package-qualified release tags, move the arm64 activation verifier to `macos-15`, and fail activation archives on missing, extra, linked, hardlinked, unsafe, or content-drifted third-party legal members.
-- Keep the native child environment scrubbed while passing only a closed generic/Codex-Desktop host-context observation; the signed runtime derives and validates provider state from the OS login identity.
-- Fail closed with typed `platform_unsupported` when POSIX user identity APIs are unavailable, before manifest or artifact ownership checks can raise on non-POSIX hosts.
+- agent-collab 4.5.1 makes managed containment a rare structural signal rather
+  than an output heuristic.
+- Make managed containment provider-agnostic and structural: authenticated
+  provider state resolves from the canonical user HOME, caller checkouts stay
+  read-only by default, and each request receives a private temporary workspace
+  for agentic tools, edits, builds, and reasoning.
+- Seal `opencode/build` as output-only to the caller. OpenCode may work inside
+  its private workspace, but the trusted primary reviews and applies returned
+  material instead of granting the provider direct caller-worktree mutation.
+- Reserve `containment_error` for failure to establish the boundary before
+  launch or positive write-escape/protected-state evidence. A successfully
+  blocked access attempt proves containment worked; return code, empty output,
+  and stderr wording cannot manufacture a containment failure.
+- Keep authentication, protocol/output, timeout, provider, teardown, and
+  cleanup failures orthogonal. Disable in-request binary updates, require
+  bounded descendant teardown and positively verified temporary cleanup, and
+  treat routine direct-CLI fallback as a managed-path reliability defect.
 
-### Breaking
+<!-- release: agent-collab 4.5.1 -->
+### Changed
 
-- Rename the public `ai-merge-resolve` skill to `merge-resolve`, including its generated command and auto-apply policy filename. Existing installations must invoke `/agent-collab:merge-resolve` and rename `.claude/ai-merge-policy.yaml` to `.claude/merge-resolve-policy.yaml` when that opt-in file is used.
+- Rebuild the darwin-arm64 provider runtime from final workspace `1.0.823`
+  commit `d08b6382710d6d5910d64cf011bcac873a2e1c03`, Developer-ID sign it, and
+  notarize it through Apple submission
+  `c6d29dec-5351-467d-883e-0b862734567d`.
+- Replace the policy-only placeholder with a closed activation manifest that
+  pins the complete standalone bundle at SHA-256
+  `2cea10cff2030d0238661667cf8d1b83cf9885dc6f4a03b0db4365e891b04f47`.
+  The rebuilt runtime includes the v4.5.1 provider-agnostic containment,
+  canonical-user-HOME authentication, private request workspace, bounded
+  execution/teardown/cleanup, OpenCode Go, output conformance, and lifecycle
+  continuity repairs from the final merged workspace.
 
-### agent-collab 3.0.0 — breaking unified-package consolidation
+### Tests
 
-- **Breaking:** retire `claude-collab`, `codex-collab`,
-  `antigravity-collab`, `codex-tools`, and `glm-worker` immediately. Together
-  with the already-retired `grok-worker`, they are removed from the
-  marketplace, release inventory, active documentation, and generated package
-  surface without presets, tombstones, dependencies, or compatibility shims.
-  The historical `agent-collab-plugin`, `gemini-collab`, and `grok-collab`
-  package identities are also treated as retired exact aliases. The clean
-  `sumitake/agent-collab` repository is the marketplace source; a repository
-  name is not itself an installed legacy package.
-- Add `agent-collab 3.0.0` as the only package and release. It resolves the
-  primary, model family, active model, host runtime, and session dynamically.
-  `codex-tools` → the managed Codex backend in `agent-collab`; `glm-worker`
-  → the managed OpenCode backend, with `opencode/glm-5.2` retained as the
-  current Zhipu-family model preset.
-- Add a narrow signed-native-runtime manifest, standalone public coordinator,
-  and verifier. Exact route/action, authority, and artifact-author provenance
-  checks cover Gemini, Codex, OpenCode, Grok 4.5, and Composer. Grok 4.5 is
-  limited to sealed read-only architecture, governance, and huge-context
-  actions; generic advisory or worker roles cannot select it. OpenCode build
-  is explicitly mutation-capable workspace-write authority, distinct from
-  read-only plan. Response family
-  is derived from the artifact-author model on every call, including OpenCode
-  model switches; structured provider/model parsing rejects ambiguous lineage
-  and incidental substring matches. Applicable non-governance worker requests
-  may carry an exact artifact snapshot so its author family is also excluded.
-  Contradictory or unknown response provenance is rejected. Runtime
-  stdout and stderr are bounded while the process is running, with process-
-  group termination and reaping on output-limit or unexpected collector
-  failures. The release
-  tree contains no unsigned
-  placeholder artifact; all native routes are typed unavailable until the
-  private build/sign system supplies the notarized binary. A
-  policy-only release may ship with an empty artifact manifest and no runtime.
-  Native activation remains blocked until the Darwin-arm64 artifact advertises
-  the full matrix and supplies commit-bound Developer ID, hardened-runtime, and
-  notarization evidence.
-- Split the local signed-tag tool and GitHub release workflow by canonical
-  package mode. Policy-only mode proves the manifest/archive contain no runtime;
-  activation alone invokes the strict macOS signing/notarization verifier.
-- Bind the exact captured artifact independently from the instruction prompt in
-  sealed native JSON: base64 bytes, SHA-256, byte size, author model, and
-  derived author family are verified before launch. Ambiguous active-model
-  lineage remains unknown even when a stale asserted family is present;
-  governance fails closed and non-governance worker artifacts warn when author
-  independence is unknown.
-- Add native Codex packaging with a `.codex-plugin/plugin.json` manifest and
-  generated `.agents/plugins/marketplace.json`, while retaining the
-  Claude-compatible package manifest. Release consistency requires both host
-  manifests to identify the same sole `agent-collab` package and version.
-- Make policy-only readiness deterministic on every host: the manifest is
-  parsed and validated before the Darwin-arm64 activation gate, an empty
-  artifact set remains typed unavailable, and runtime tests explicitly
-  simulate the supported target rather than inheriting the CI host platform.
-- Add a provider-free migration doctor, duplicate-package routing block,
-  dynamic known/unknown host preflight, and policy-only safe mode. Safe mode
-  disables every native model route. Async inbox readiness is available only
-  after a current host observation and the public coordinator never sends;
-  reinstalling a retired package is not a rollback. The doctor parses enabled
-  and installed-disabled Codex plugin tables from `~/.codex/config.toml`,
-  preserves source-host provenance, and emits removal commands for the owning
-  package manager. Empty primary
-  configuration is re-observed on every request so ZCode model switches take
-  effect immediately. `codex/build` and `auto/worker` are coordinator-only,
-  typed-unavailable contracts and never widen the signed required runtime
-  matrix or promote into advisory authority. Malformed rows fail as
-  `config_error`. Missing or hostile home-directory resolution now blocks with
-  a typed inventory error. Python 3.10 uses a strict exact-table compatibility
-  parser for Codex plugin selection, including escaped-key and multiline-string
-  defenses, instead of substring matching or silently skipping the registry.
-- Add a clean-history public-export gate. Deleted backend sources remain in the
-  private history until the separately authorized rewrite and residual audit;
-  direct visibility changes or exports from the unsanitized clone are blocked.
-  The gate scans every reachable blob as bytes, recursively inspects nested
-  archives under cumulative depth/member/size bounds, semantically detects
-  statically constructed provider argv, applies only narrow harmless-fixture
-  masking, and rejects provider-backend archive directories, symlink, or other
-  unsafe tree modes. It separately inspects every ref, direct blob or tree
-  target, annotated-tag object/message, and release-tag form/target.
-- Pin every pull-request workflow to GitHub-hosted `ubuntu-latest`; public PR
-  code can no longer execute on a persistent self-hosted runner, and
-  the mutable `RUNNER_TARGET` repository variable has been removed.
-- Grant CodeQL the additional read-only `actions: read` scope required to
-  associate and upload pull-request analysis results; all other workflow token
-  permissions remain explicitly least-privilege.
-- Keep CodeQL enforceable while the sanitized repository is still private:
-  complete analysis now retains SARIF as a bounded workflow artifact when Code
-  Scanning is unavailable, then switches automatically to Code Scanning upload
-  once the repository becomes public.
-- Require releases to originate from a verified signed annotated tag whose
-  target commit is the checked-out commit on `origin/main`. Both the local
-  release tool and GitHub workflow enforce the same ancestry boundary, and
-  the release job force-materializes the remote annotated tag object before
-  history inspection so the checkout action's peeled commit ref cannot be
-  mistaken for an unsigned or lightweight tag. The
-  hardened-runtime verification parses the actual numeric code-signing flags.
-  Runtime and release verification also inspect the executable as a thin arm64
-  Mach-O with exactly one macOS `LC_BUILD_VERSION` for minimum macOS 14.0.
-  The operator-owned Developer ID Team ID is pinned independently in reviewed
-  `signing_policy.py`; the manifest cannot select its own signer, and the
-  unconfigured anchor blocks activation until matching signing/notarization
-  credentials are provisioned.
+- Verify the imported handoff byte-for-byte, re-run the Developer ID,
+  hardened-runtime, secure-timestamp, Apple-notarization, Mach-O, contract,
+  member-inventory, and whole-bundle gates, then build and reopen the canonical
+  activation archive.
 
-### agent-collab 3.0.1 — clean public distribution
+### Fixed
 
-- Publish the unified policy/client package from the audited clean-history
-  `sumitake/agent-collab` marketplace without importing private pull-request
-  refs, tags, releases, workflow artifacts, or provider implementation history.
-- Localize contribution governance and security reporting so contributors and
-  plugin users do not need access to the private build/sign system.
-- Remove host-specific labels and session-owner metadata, regenerate both
-  marketplaces and all skills, and retain the policy-only fail-closed runtime
-  state until a separately verified signed native artifact is available.
+- Restore the unreleased v4.5.0 source line to the canonical policy-only
+  package shape by removing the retained v4.4.2 production runtime bundle and
+  publishing an empty, schema-v3 runtime manifest.
+- Keep the OpenCode Go policy and skill changes in v4.5.0 while making the
+  source tree eligible for the governed private build/sign/notarize pipeline.
 
-### agent-collab 3.1.0 — source-available licensing and neutral guidance
+### Why
 
-- License the public repository and installed package under the unmodified
-  PolyForm Strict License 1.0.0. Copyright remains with John Osumi; commercial
-  use requires explicit written approval administered by Osumi Consulting LLC.
-- Make `AGENTS.md` the sole canonical public repository guide and retain
-  `CLAUDE.md` only as an `@AGENTS.md` compatibility loader.
-- Require contributor-rights evidence and package exact legal documents,
-  SHA-256 evidence, and an SPDX 2.3 SBOM in the policy-only release.
+- A populated runtime is admissible to the private builder only when the
+  requested source is the exact commit behind a trusted signed release tag.
+  Carrying the older runtime into an untagged v4.5.0 commit made the source
+  neither a valid policy-only input nor a valid signed activation input.
 
-### agent-collab 3.3.0 — managed Gemini governance and reliable provider state
+<!-- release: agent-collab 4.4.1 -->
+### Changed
 
-- Add a distinct broker-only `gemini/governance` action with exact Gemini 3.1
-  Pro/high selection, immutable artifact binding, shared-HOME/PTY containment
-  evidence, response hashing, and public-client proof-digest validation.
-- Keep Gemini advisory and long-context separate and explicitly ineligible as
-  governance evidence; automatic governance now maps Gemini and Grok to their
-  explicit governance actions while Codex remains advisory.
-- Advance the signed-runtime route contract to version 2 across policy,
-  manifests, schemas, archive/release verification, generated skills, and
-  deterministic tests.
-- Document canonical passwd HOME as the managed-provider reliability policy
-  without relaxing family exclusion, authority separation, bounded lifecycle,
-  or the prohibition on raw provider fallbacks.
-- Make Codex, Gemini, OpenCode, Grok, and Composer uniformly broker-only and
-  bind provider startup to the signed guardian's acknowledged pre-exec gate;
-  only local runtime management retains direct exact-artifact execution.
+- **Rebuilt, re-signed, and re-notarized the darwin-arm64 provider runtime**
+  from the current workspace source closure. The bundle shipped in the
+  rolled-back v4.4.0 tag-only cut predated several runtime-behavior changes,
+  including the public-client digest pin; a runtime built before that pin
+  rejects the client this package actually ships.
 
-### agent-collab 3.3.0 — closed standalone provider bundle
+- **The signed runtime now advertises the `codex/governance` route.** This is a
+  capability expansion: v4.3.3 added the route to the public client's parser
+  allowlist and JSON schema while the shipped runtime deliberately did not
+  claim it, and the v4.4.1 runtime is built from a source closure where it is a
+  real read-only contract.
 
-- Route managed Gemini, OpenCode, Grok, and Composer requests through an explicit, digest-bound
-  launchd socket broker that starts for one request and returns to zero idle
-  processes. Add closed install, status, rollback, and uninstall lifecycle
-  commands with transactional prior-version restoration and no direct fallback.
-- Replace the failed onefile launch path with manifest schema 2, native contract
-  3, and broker transport 2 over one closed standalone bundle. Bind its identity
-  to the sorted role/mode/size/digest/Mach-O facts of every member; publish only
-  exact immutable `0500` files; verify the kernel-reported entrypoint and the
-  complete lifecycle state before provider dispatch. Provider protocol 1 and
-  all existing route-authority boundaries remain unchanged.
-- Resolve the OpenCode model per request from live OpenCode/ZCode observation,
-  explicit central configuration, or the fixed `opencode/glm-5.2` preset while
-  ignoring ambient and row-level model fallbacks.
-- Reject duplicate/non-finite broker responses and state before typed parsing.
-- Preserve typed `cancelled` and `input_limit` Grok/Composer failures, require
-  exact terminal-state validation, and document the one bounded cancellation
-  retry and comprehensive architecture-reviewed Composer coding-packet policy.
-- Strip the Codex Desktop Seatbelt marker from broker-dispatched work so every
-  Grok/Composer attempt validates its own nested read-only sandbox, preserve
-  closed provider-child environments, and keep runtime management direct-only.
-- Propagate client disconnect through managed OpenCode, Grok, and Composer
-  calls, reap provider child groups, discard partial output, prohibit retry of
-  disconnect cancellation, and fail with typed `timeout` before setup when the
-  managed-boundary deadline reserve is exhausted.
-- Harden repository configuration with full-SHA Action pin enforcement while
-  retaining squash-only, signed, linear, review-thread-resolved releases.
-- Align OpenCode preflight with issuance model resolution; key immutable broker
-  versions by both artifact and manifest digests; preserve complete rollback
-  state across failures and no-op reactivation; reject unverified rollback
-  targets; treat a never-installed root as typed uninstalled/unavailable; and
-  map bounded `launchctl` failures to closed lifecycle results.
+- **`codex/governance` is now REQUIRED at the release gates.** All three
+  independent copies of the contract allowlist —
+  `verify_runtime_release.py`, `build_plugin_archive.py`, and
+  `check-public-export-safety.py` — move from a ten-route to an
+  eleven-route required set, keeping exact-set equality. Release gates
+  validate what this repository is about to publish, so requiring the route
+  stops a future cut from silently dropping a governance capability. The
+  public client deliberately keeps it OPTIONAL, because it validates whatever
+  is already installed, including older field artifacts that predate the
+  route. The two postures are intentionally opposite.
 
-### agent-collab 3.5.0 — authenticated dispatcher canaries
+### Tests
 
-- Add exact Darwin dispatcher peer proof and a request-free, digest-bound
-  hello/ready handshake before any green provider request is sent.
-- Add a token-gated internal `adoption_canary` coordinator operation bound to
-  one candidate tuple and route allowlist without exposing a user-selectable
-  provider path, model, auth root, or policy route.
-- Keep the selector legacy-blue by default. Apply a separate local bound to the
-  request-free handshake so a proven pre-request green failure retains time for
-  independently proven blue without shortening the original request deadline;
-  a failure at or after request send never retries another lane.
+- Enforce the contract set at the real `verify_release` call site in both
+  directions: omitting `codex/governance` is rejected, and an unenumerated
+  extra route is rejected. Pin that all three gate copies agree exactly, and
+  that the client keeps the opposite (optional) posture.
+- Derive the contract fixtures in `test_plugin_archive.py` and
+  `test_release_evidence.py` from the builder's own allowlist instead of
+  restating ten routes inline. Both hardcoded copies had silently rotted the
+  moment the required set changed; deriving them makes that impossible.
+- Update the route-shipping test to the new reality (route now advertised) while
+  still asserting it remains accepted-but-not-required.
 
-### agent-collab 3.5.0 — provider update continuity
+agent-collab 4.5.0 routes the packaged OpenCode default through
+`opencode-go/glm-5.2`, recognizes
+Kimi as Moonshot-family provenance, and adds an opt-in
+`AGENT_COLLAB_OPENCODE_PROVIDER=opencode-go` host guard that rejects standard
+metered OpenCode Zen models, malformed provider policy, namespace lookalikes,
+and late policy drift before runtime launch.
 
-- Add a strict, legacy-default blue/green broker selector so a newly installed
-  client can continue using the separately verified legacy broker while a
-  content-derived dispatcher lane is staged.
-- Preserve blue on missing, invalid, unproven, refused, or timed-out green
-  connections before any send attempt; never retry another lane after a
-  connection succeeds. Each request captures one lane ordering so an in-flight
-  blue request completes even if the next request atomically selects green.
-- Add closed stage, status, no-provider ping, canonical-lock probe, selector
-  commit, candidate abort, committed-control recovery, and retiring-blue drain
-  operations. Green uses a distinct content-derived label/socket; commitment
-  never bootouts blue, and recovery never changes desired provider binaries.
-- Keep one canonical Gemini/Grok/OpenCode lock across blue and green for the
-  complete request through provider teardown. Credential-free contention and
-  acquisition probes let every installed client prove that namespace before
-  green traffic is enabled.
-- Permit a bounded two-selector overlap when both entries are the unified
-  `agent-collab` package, allowing Codex to retain its old cache while a distinct
-  candidate selector is proven. Retired package names remain blocking, and old
-  client retirement stays behind the private fresh-session finalization gate.
-- Block every packaged mutating broker/dispatcher lifecycle operation from the
-  Codex seatbelt before lifecycle reads or writes while retaining read-only
-  status and probes.
+### agent-collab 4.3.5 — 2026-07-25
 
-### Fixed
-- Notarization is now verified with the code-object-native `codesign --verify --strict --test-requirement '=notarized'` instead of `spctl --assess --type execute`, at BOTH the release CI gate (`verify_runtime_release.py`) and runtime activation in the client (`runtime_client.py`). The runtime entrypoint is a bare command-line Mach-O, not a `.app` bundle, and `spctl --type execute` only assesses `.app` bundles — it always rejects a bare executable ("the code is valid but does not seem to be an app"), a false negative that would fail every otherwise-valid activation release at the notarization step AND every client activation. The `notarized` codesign requirement binds to the CDHash and rejects unsigned, ad-hoc, and Developer-ID-signed-but-not-notarized binaries by exit code; both call-sites fail closed on tool error. The check is combined with `--check-notarization` (see the online-verification entry) so it forces the online Apple notary lookup and succeeds on a clean host — a bare Mach-O cannot have a notarization ticket stapled, so without the online lookup `=notarized` would depend on the host's local notarization trust state and fail-close on any clean host.
+#### Fixed
 
-### agent-collab 3.5.2 — launchd dispatcher peer readiness
+- Accept exact legacy Gemini governance proof v1 and recovery-capable proof v2
+  as disjoint public success contracts so a verified retained v1 lane remains
+  callable while a v2 runtime is staged.
+- Select v2 validation whenever any recovery discriminator is present. Reject
+  partial, hybrid, coerced, contradictory, or cross-field-mismatched results
+  instead of falling back to the legacy contract.
+- Name both exact public proof keysets explicitly and document the verified
+  child-runtime/private-pipe trust boundary. The proof hash is a consistency
+  check rather than a signature; complete v1 remains accepted only for
+  retained-lane rollback continuity.
 
-- Distinguish the root-owned launchd listener credential from the
-  operator-owned sealed runtime process when authenticating a staged
-  dispatcher on macOS.
-- Retry only the exact root-plus-pid-1 launchd handoff sentinel under the
-  existing handshake deadline, with capped exponential sleeps and immediate
-  failure for malformed state or socket errors.
-- Re-prove the stable process start identity, exact executable, signed
-  artifact, socket identity, and final kernel peer PID before sending hello.
+### agent-collab 4.4.2 — 2026-07-25
 
-### agent-collab 4.0.4 - adoption protocol boundary
+### Fixed
 
-- Preserve the sealed provider-adoption request and response on public runtime
-  protocol v2 while carrying them inside the private dispatcher protocol-v1
-  bridge, matching the one-time authority registry and frozen dispatcher.
+- Reject managed `execute` responses whose `result.text` is missing,
+  non-string, empty, whitespace-only, Unicode-invisible/filler-only,
+  replacement-glyph-only, terminal-control-only, or malformed instead of
+  accepting a false-positive `status=ok`.
+  Invalid success is a terminal `protocol_error` and cannot enter automatic
+  family fallback. `readiness` remains exempt, and typed containment, timeout,
+  teardown, and provider failures retain their classifications.
 
-### agent-collab 4.0.3 — dispatcher lifecycle control protocol
+- Ship a content-addressed execute-output conformance contract with a frozen
+  Unicode-16 blankness table so the public client can fail closed even when an
+  older signed runtime emits a defective success envelope. Include it in the
+  canonical release archive beside `runtime_client.py` and verify exact bytes.
 
-- Send lifecycle ping and lock-probe control messages on the sealed dispatcher
-  protocol-v1 contract so a staged dispatcher can be proven before activation.
-- Keep typed lifecycle failures on runtime protocol v2 and reject swapped,
-  malformed, or extra-field success and failure responses.
+- Enforce exact CSI byte-class ordering and a closed OSC/C1 support matrix,
+  rejecting malformed sequences and unsupported control strings rather than
+  stripping printable residue into an apparent answer.
 
-### agent-collab 4.0.2 — protocol-v1 blue lifecycle bridge
+- Retain the original absolute request deadline through direct and broker
+  response parsing. Classification of a near-limit blank/control stream now
+  returns typed `timeout` if it consumes the remaining budget.
 
-- Keep normal protocol-v2 routing fail-closed against protocol-v1 runtimes and
-  responses while allowing dispatcher lifecycle control to prove the exact
-  signed v1 blue baseline needed for make-before-break staging.
-- Stage and verify protocol-v2 green without rewriting or stopping v1 blue, and
-  derive the selected blue protocol from its immutable manifest during mutable
-  control-plane recovery.
+### Added
 
-### agent-collab 4.0.1 — intent-check effort contract correction
+- **`cut_release.py` runtime-currency gate (fail-closed).** An activation
+  release now refuses to cut when any `runtime:`-scoped merge landed after the
+  commit that last staged `plugins/agent-collab/runtime/` — the failure mode
+  that shipped a 4.2.0-era runtime in the rolled-back v4.4.0 tag-only cut.
+  Explicit operator override: `--allow-stale-runtime` (loud warning). Unit
+  tests cover pass/stale/missing/override/wiring paths.
 
-- Fixed `intent-check` routing guidance so Gemini governance rows use their
-  required high effort, while rudimentary Codex advisory intent comparisons
-  remain low and the sealed Grok governance fallback remains high.
+- visual-review + ui-to-code: direct the primary to magnify detail-bound regions
+  (host-native zoom/crop or a full-resolution code-execution crop) before reading
+  them, per the confidently-wrong sub-patch-detail failure documented in Anthropic's
+  crop-tool cookbook. Additive guidance only; the skills' no-image-transport honesty
+  boundary is unchanged.
 
-### agent-collab 4.0.0 — Grok 4.5 model and effort unification
+### Fixed
+- SECURITY.md support matrix: `3.x` → `4.x` (current major per plugin.json 4.3.1; staleness audit).
 
-- **Breaking:** advance the fixed public/native runtime protocol to v2. Older
-  public clients and signed runtimes now reject each other instead of silently
-  using the retired Composer model or an outdated request shape.
-- Route Grok architecture, governance, huge-context, and compatibility codegen
-  through the same `xai/grok-4.5` author model. `composer/codegen` remains a
-  public compatibility route with output-only authority, not a separate model.
-- Seal review effort from the task: architecture and governance use high,
-  huge-context synthesis uses medium, and callers cannot override those review
-  profiles. Codegen requires `simple_codegen`, `standard_codegen`, or
-  `complex_codegen`, with respective low, medium, and high effort floors.
-- Keep all model, tool, sandbox, credential, environment, filesystem, and
-  application authority out of the public codegen row. The trusted primary
-  still owns applying output, integration review, testing, git, and release.
+### Changed
+- Root `README.md` opening rewritten purpose-first (operator-directed overhaul): why governed multi-agent collaboration exists (family blind spots, disclosed reward-hacking, unaccountable authority loops), what it delivers, and how governance is implemented — followed by the unchanged technical sections; stale intro version pin removed (version lives in "Current package"). Package README gains a purpose-bridge paragraph. Doc-only, no version bump.
 
-### agent-collab 3.5.1 — fail-closed dispatcher boundary
+### agent-collab 4.3.4 — 2026-07-24
 
-- Treat malformed or noncanonical dispatcher-client output after the
-  request-bearing child launches as a post-request failure, preventing a
-  possible second execution through blue after green acceptance.
-- Preserve typed unsupported-platform behavior when POSIX `fcntl` is absent,
-  while failing lifecycle locking closed before filesystem I/O.
+### Fixed
 
-### Changed
-- `build_plugin_archive.py` now sources the activation runtime bundle from an out-of-tree signed handoff via `--bundle-source <leaf .bundle dir>` instead of the git checkout — the signed runtime ships as a release asset and is never committed. The committed `runtime-manifest.json` alone decides the mode (design decision D1): an activation manifest without `--bundle-source` is a hard error (never a silent policy-only downgrade), a policy-only manifest forbids the flag, and an in-tree `runtime/` conflicts with an external source. The bundle source is treated as hostile input (symlink argument rejected before resolution; bounded non-following enumeration; member-set equality; per-member O_NOFOLLOW regular-file/uid/nlink/mode/size/sha256 checks with the strict 0o500 install mode preserved), and its payloads are re-read + re-digested through fresh descriptors at pack time.
-- `verify_archive` is rearchitected to **regenerate the canonical tar from trusted inputs and byte-compare** rather than parse a possibly-hostile archive: it never hands candidate tar bytes to `tarfile`. A shared deterministic `USTAR` serializer (used by both build and verify) reproduces the canonical tar with runtime payloads zero-filled; the candidate is only bounded-inflated and then sliced at offsets the verifier computed. Every structural property — headers, exact typeflags, ordering, padding, EOF, dialect, and the absence of hidden PAX/GNU/sparse records — is bound by the byte-compare outside the runtime ranges; each runtime payload is bound to the frozen-manifest digest; the archived `runtime-manifest.json` bytes are bound to the frozen snapshot. Reading the candidate is fd-only (`O_NOFOLLOW`/`O_NONBLOCK` + `fstat`, no path-swap window) under hard compressed- and decompressed-size caps, with a canonical gzip-header check and single-stream (no trailing/concatenated data) validation. The archive is built into an exclusive temp that is verified before an atomic rename, so a failed build never leaves a publishable artifact. Hardened through a 2-round up-front adversarial design review of the hostile-archive-reading threat model (the regenerate-and-compare pivot) before implementation.
+- Fixed `migration_doctor` reporting `provider_routing="BLOCKED"` for the shipped runtime.
+  Readiness compared the client's full acceptance set against the manifest, so the accepted
+  but deliberately unadvertised `codex/governance` route marked the entire runtime invalid.
+  Readiness is now judged against a required baseline (`REQUIRED_CONTRACTS`), with
+  `OPTIONAL_CONTRACTS` holding routes a signed artifact may advertise but need not ship.
+
+- qa-verify: instruct callers to phrase QA constraints at evidence level rather than
+  presence level (the inspector must produce what it checked; name likely shortcuts;
+  bound with an out-of-scope list), per the approve-everything verifier failure mode
+  documented in Anthropic's outcome-grader cookbook. Additive guidance only; the
+  PASS/FAIL verdict contract is unchanged.
 
 ### Added
-- Regression test locking in that a host-normalized runtime bundle (directory 0o755, member files 0o500) verifies and resolves — the empirically-confirmed state produced by every supported installer (Claude Code, Codex, Antigravity/agy, and the broker's sealed copies: 2356/2356 installed member files were 0o500, none 0o700). This closes release-pipeline design item §9.7 as empirically non-reproduced: no source-mode loosening is made (it would be unnecessary and would open a direct-execution-of-owner-writable-source bypass); the loader already handles the real install correctly.
 
-### agent-collab 4.0.5 - Gemini governance proof v2
+<!-- release: agent-collab 4.4.0 -->
 
-- Validate Gemini governance evidence against the provider runtime `2.0.0`
-  proof contract `2` tuple instead of conflating it with the public bundle
-  manifest contract, and require governance response provenance to identify
-  that same compatible runtime while rejecting legacy, crossed, and
-  mixed-provenance version tuples.
+- **Domain-expert skill pack (16 new skills).** New pure-prompt, host-neutral
+  expertise skills alongside the existing collaboration/governance set:
+  `rust-engineer`, `go-engineer`, `elixir-engineer`, `sql-engineer`,
+  `kubernetes-specialist`, `terraform-engineer`, `sre-engineer`,
+  `incident-responder`, `mlops-engineer`, `llm-architect`,
+  `postgres-engineer`, `data-engineer`, `eval-engineer`,
+  `prompt-regression-tester`, `hallucination-investigator`, and
+  `ai-writing-auditor`. Authored under workspace ownership, informed by the
+  MIT-licensed VoltAgent subagent corpora at pinned SHAs (947b44ca /
+  5605c9c1) after an untrusted-input security audit; all supply-chain
+  patterns flagged by that audit (third-party installers, external MCP
+  endpoints, fictional tools) are excluded by construction. No coordinator,
+  provider, or delegation surface is touched.
 
-### agent-collab 4.1.0 - Signed lane contract anchor
+### agent-collab 4.3.3 — 2026-07-24
 
-- Bind schema-3 runtime artifacts, selector-v2 lanes, dispatcher protocol-2
-  reservations, and Gemini governance proof to one authenticated runtime
-  contract anchor while preserving exact committed legacy normal lanes.
+### Fixed
 
-### agent-collab 4.1.1 — 2026-07-20
+- Allow verified development or future runtime manifests to advertise the
+  `codex/governance` route by adding it to the public client's manifest parser
+  allowlist and the matching JSON schema enumeration. The currently shipped
+  signed and notarized public runtime manifest remains unchanged at its honest
+  ten-route capability set, so it does not claim the unshipped route and
+  continues to return typed unavailable for it.
 
-#### Fixed
+### Tests
 
-- Make `broker-status` use the same canonical selector view as request routing,
-  so a valid selector-v1 selected dispatcher is no longer misclassified as an
-  obsolete single-broker installation.
-- Require the selected immutable lane, launchd job, socket, and closed liveness
-  exchange to pass before broker status is ready. Migration-doctor `READY` now
-  requires this executable proof as well as the signed runtime manifest.
-- Require the one-shot launchd job to return idle and every retained fallback
-  lane to remain independently verifiable before status can claim executable
-  readiness, matching the topology that request routing will actually accept.
-- Advertise a retained lane as rollback-capable, and include it as a request
-  fallback, only when its own launchd job is currently loaded. Retained job
-  availability is a point-in-time snapshot and does not deactivate a healthy
-  selected lane.
-- Treat a selectorless legacy broker as installed but unavailable even when its
-  old socket responds, because current request routing cannot capture an
-  executable lane without the same canonical selector proof.
-- Keep liveness compatible with a verified dispatcher-v1 selected lane while a
-  dispatcher-v2 candidate is staged, so the previous lane remains executable
-  until the new lane is fully proved and atomically selected.
-- Preserve typed timeout, output-limit, and teardown results after a dispatcher
-  accepts a request instead of collapsing those local completion failures into
-  a misleading `protocol_error`; accepted work still never retries another lane.
-- Wait for a selected dispatcher-v1 one-shot job to return idle before exposing
-  its response to the next caller, closing the launchd teardown window without
-  serializing the concurrent dispatcher-v2 scheduler.
-- Bound that dispatcher-v1 idle proof by the request's existing absolute broker
-  deadline, including every `launchctl` collection and final polling sleep, so
-  teardown verification cannot silently start or overrun a fresh timeout.
-- Resolve Codex Desktop's active OpenAI model from its exact current rollout
-  when `CODEX_ACTIVE_MODEL` is absent. The reader is fixed-root, bounded,
-  no-follow, same-owner, single-file, and fail-closed on ambiguous, writable,
-  linked, malformed, oversized, concurrently growing, or conflicting identity
-  evidence.
+- Pin the distinction between the client's accepted contract vocabulary and
+  the exact routes advertised by the current signed public runtime.
 
-#### Verification
+### agent-collab 4.3.2 — 2026-07-24
 
-- Added RED/GREEN regressions for selector-v1 projection, legacy selected-lane
-  liveness, selectorless legacy false-positive rejection, one-shot idle
-  completion, invalid retained-lane rejection,
-  unloaded retained-job rollback and fallback suppression,
-  accepted-request timeout typing and no-fallback behavior, legacy one-shot
-  response teardown, deadline reuse, bounded launchctl collection, and capped
-  polling, failed dispatcher ping, manifest-only doctor readiness, safe Codex
-  rollout identity, and ambiguous, growing, or unsafe rollout rejection.
+#### Fixed
 
-### Fixed
+- Enforce one end-to-end monotonic timeout across coordinator preflight,
+  automatic reviewer candidates, runtime verification, and provider launch.
+  Each fallback is resealed with only the remaining budget.
+- Stop automatic fallback after a timed-out or teardown-unproven accepted
+  request, preventing a second provider worker from overlapping uncertain
+  cleanup.
+- Permit automatic fallback only for a typed pre-acceptance `unavailable`
+  result. Authentication, quota, containment, output, protocol, provider, and
+  every other post-launch result are terminal, so one review request cannot
+  silently become a second provider invocation.
+- Keep selected-dispatcher callability distinct from lifecycle quiescence so
+  migration doctor no longer reports a responsive lane unavailable merely
+  because another bounded request is active. Bound the status-only quiescence
+  observation to one second instead of waiting the full 30-second cold-start
+  allowance; lifecycle operations retain their full idle proof.
 
-- Type an accepted-request idle-probe failure as a teardown failure, not a
-  protocol error: `_wait_for_job_idle` now fails closed on the expected
-  `OSError` / `subprocess.SubprocessError` and on a typed
-  `_OperatorHomeUnavailable` raised by `_launchctl`'s per-call operator-home
-  re-resolution (a `ValueError` subclass, so the environmental case is caught
-  race-free while a genuine code-bug `ValueError` and an invalid job label
-  still surface).
-- Bound provider teardown by the caller deadline: `_terminate_and_reap` polls
-  to reap the SIGKILLed session-group leader within a small grace of the
-  caller deadline rather than two fixed five-second waits, and reports a
-  proven teardown only when the whole-group kill was posted AND the leader was
-  reaped, so a leader-only fallback is honestly typed as a teardown failure.
-- Bound the request-dispatch path's retained-lane availability probe by the
-  request deadline: `_launch_broker` now starts the deadline before capturing
-  lanes and threads it through `_capture_broker_lanes` → `_job_loaded` →
-  `_launchctl`, so a small-`timeout_ms` request no longer blocks on
-  launchctl's ~20s default before dispatch (lifecycle/status callers keep the
-  default bound).
-- Reject an incomplete Codex rollout tail instead of trusting the preceding
-  model context: `_codex_rollout_window` fails closed on a non-newline-
-  terminated final record, so a concurrently written model-changing record can
-  no longer yield stale governance-ready identity.
+#### Safety
 
-- Added a strict, fail-closed grammar for signed release-tag messages: exact field
-  set in canonical order, no duplicates or unknown fields, no trailing material,
-  lowercase-hex digests, ASCII-only, bare-basename asset names, and a
-  `vMAJOR.MINOR.PATCH` tag validator intended to run before a tag name reaches any ref or
-  path. Not yet wired to a release path — it is the parsing substrate the
-  activation cut will use (agent-collab 4.1.0).
+- Notarization, signature, provenance, route authority, and selector checks are
+  unchanged. Install, update, rollback, commit, drain, and other lifecycle
+  operations still require a proven non-persistent process state.
 
-### agent-collab 4.2.1 — 2026-07-21
+### agent-collab 4.3.1 — 2026-07-23
 
 #### Fixed
 
-- Align the closed coordinator schema with the collaboration-skill contract for
-  read-only OpenCode planning and review. `opencode/plan` now accepts the exact
-  optional artifact snapshot (`content` plus `author_model`) so the client can
-  preserve artifact bytes, provenance, and family-exclusion evidence instead of
-  rejecting a correctly constructed request before managed execution.
+- Keep provider adoption callable after a dispatcher update commits by using
+  the exact verified `selected` lane when no staged `candidate` exists.
+- Bind both staged and committed canary paths to the co-packaged signed and
+  notarized runtime identity, preserving fail-closed behavior on any selector
+  mismatch or transient verification failure.
 
 #### Verification
 
-- Added a coordinator regression for an artifact-bound `opencode/plan` request;
-  the test fails on 4.2.0 with `request fields violate the closed coordinator
-  schema` and passes with the corrected review-contract set.
+- Added regression coverage for staged-candidate, committed-selected,
+  identity-mismatch, and notarization-unavailable paths.
 
-### agent-collab 4.2.2 — 2026-07-21
+### agent-collab 4.3.0 — 2026-07-22
 
-#### Fixed
+#### Added
 
-- Verify notarization online at both the release gate (`verify_runtime_release.py`)
-  and consumer activation (`runtime_client.py`) by adding `--check-notarization` to
-  the `codesign --test-requirement '=notarized'` check. A bare Mach-O cannot have a
-  notarization ticket stapled, so without the online lookup the requirement is
-  satisfied only by the notarizing host's local trust state and fail-closes on any
-  clean host — the CI runner (which blocked the first activation release) and every
-  fresh end-user install. Empirically fail-closed when the Apple notary is
-  unreachable, and it rejects unsigned, ad-hoc, and Developer-ID-signed-unnotarized
-  binaries on macOS 14 and 15.
+- Added `start-inbox-monitor`, a generated portable skill with native Codex,
+  Claude, and Antigravity lifecycle adapters, typed startup outcomes, positive
+  singleton proof, and explicit no-schedule/no-sandbox-bypass boundaries.
 
-### agent-collab 4.2.2 - first activation release
+### Changed
 
-First public activation release: the plugin now ships the signed and notarized
-native runtime committed in the repository, so the documented marketplace install
-(`/plugin marketplace add`) delivers a working activation build under any operator
-umask, including umask 002 whose group-writable checkout the previous exact-mode
-and safe-envelope checks both rejected.
+- Restyle the public root `README.md` toward the reference project layout: add CI,
+  CodeQL, and secret-scan badges, a non-goals section, and a capability list; surface
+  only the latest release and link the full `CHANGELOG.md` for history; refresh the
+  now-shipped activation and runtime notes; and move the license section to the end.
 
-### Added
+### agent-collab 4.2.4 — 2026-07-22
 
-- Commit the Developer ID signed and notarized darwin-arm64 native runtime bundle
-  (38 members) in the repository and advertise it through a schema-version-3
-  activation manifest, pinning `EXPECTED_DEVELOPER_ID_TEAM` to the Osumi Consulting
-  LLC team in `signing_policy.py`. The plugin remains source-available under the
-  PolyForm Strict License 1.0.0; commercial licensing is administered by Osumi
-  Consulting LLC.
+#### Fixed
 
-### Changed
+- **Broker-verification notarization tri-state (issue #36 path-2).** Extend the Phase-1
+  consumer-activation notarization tri-state to the broker-verification / lifecycle path in
+  `runtime_client.py`. A transient *online-but-notary-unreachable* outage during a broker
+  operation (install, status, stage/commit/abort, rollback, drain, recover, uninstall) is now
+  reported as a retryable `RuntimeStatus.UNAVAILABLE` instead of a mis-typed hard
+  `INTEGRITY_ERROR` / `PROVIDER_ERROR` / `PROTOCOL_ERROR`. Genuine integrity failures
+  (signature, digest, membership) keep their hard status unchanged; activation continues to
+  gate on `status == OK`, so re-typing changes reporting and retryability only, never whether an
+  unverified runtime is adopted or spawned. Implemented via a `_BrokerNotarizationUnavailable`
+  marker re-typed at the single `_verify_published_version` source flatten, a `retryable` field
+  threaded through `_BrokerMutationFailure` (rollback still runs), and earlier
+  `except _BrokerNotarizationUnavailable` handlers at the broker terminals. The dispatcher-bridge
+  probe path (non-authoritative for adoption) and dead code are out of scope.
 
-- Treat the git checkout as a trusted source under the trust-the-checkout model:
-  the host already executes the plugin's Python control plane from the checkout, so
-  the native runtime tolerates the operator umask permission bits on the source
-  while keeping content integrity (per-member SHA-256, Developer ID signature,
-  notarization, Mach-O checks) and the exact broker-store mode unchanged. The
-  `AGENTS.md` runtime policy is updated to distinguish the strict private broker
-  store from the tolerant git source.
-- Package the committed in-tree runtime in `build_plugin_archive`, binding the whole
-  archive to the release commit, alongside the external sealed handoff path.
+### Added
 
-### Fixed
+- Coordinator/host_policy: the `("codex","governance")` first-class **synchronous**
+  governance-review route (operator-directed 2026-07-22), mirroring
+  `gemini/governance` (prompt + artifact) with a pinned reviewer model + governance
+  effort. Enables a proof-backed synchronous Codex governance review that anchors a
+  Tier-3 peer review without the async inbox. Additive route (`ROUTE_ACTIONS`,
+  `AUTHORITIES`, `GOVERNANCE_CONTRACTS`, `REVIEW_CONTRACTS`, `DIRECT_CONTRACTS`,
+  a row-validation case); existing contracts are unchanged. Companion workspace
+  change adds the runtime emission + the `validate_codex_governance_proof` gate.
 
-- Runtime: the dispatcher bridge document (`runtime_client._dispatcher_bridge_document`)
-  now emits the canonical seven-key schema for every protocol version, instead of
-  over-sending the request reservation (`execution_key` / `request_size` /
-  `request_sha256`) for v2. The receiving bridge validator (workspace
-  `provider_runtime._validate_dispatcher_bridge_document`, and its tests) accepts
-  exactly seven keys and derives the reservation from `request` itself, so the
-  over-send made a fresh selector-v2 dispatcher fail its first bridge exchange with
-  "dispatcher bridge document is invalid". The reservation still crosses the trust
-  boundary on the wire hello frame (where the bridge's freshly computed values are
-  used); echoing it in the same-trust-domain bridge document added no integrity
-  value. Fixes fresh v2 dispatcher activation.
+- The signed runtime bundle can now be distributed by committing it to the public
+  git repository, so the documented marketplace install (`/plugin marketplace add`)
+  delivers a working activation build under any operator umask — including umask
+  002, whose group-writable checkout the previous exact-`0o500` and safe-envelope
+  checks both rejected. The plugin checkout is now treated as a trusted **source**
+  under the trust-the-checkout model: the host already executes the plugin's Python
+  control plane from the same tree, so a peer who can write the checkout already
+  owns the verifier, and the source permission-mode rejection (which blocked normal
+  clones) is dropped in favor of a floor that requires owner read+execute and no
+  special bits while tolerating group/other bits. Content integrity is unchanged —
+  per-member SHA-256, Developer-ID signature, notarization, and Mach-O checks are
+  untouched — and the privately-extracted **broker store** keeps its exact `0o500`
+  check. `build_plugin_archive` now packages the committed in-tree runtime (with
+  optional git-`HEAD` `100755`/`100644` provenance binding it to the release tag)
+  in addition to the external sealed `--bundle-source` handoff. (agent-collab 4.1.1)
 
 ### agent-collab 4.2.3 — 2026-07-21
 
@@ -515,320 +369,476 @@ and safe-envelope checks both rejected.
   remains a separately-scoped Tier-3 effort gated on a feasibility spike (a bare
   Mach-O cannot be stapled, so it is not turnkey).
 
-- The signed runtime bundle can now be distributed by committing it to the public
-  git repository, so the documented marketplace install (`/plugin marketplace add`)
-  delivers a working activation build under any operator umask — including umask
-  002, whose group-writable checkout the previous exact-`0o500` and safe-envelope
-  checks both rejected. The plugin checkout is now treated as a trusted **source**
-  under the trust-the-checkout model: the host already executes the plugin's Python
-  control plane from the same tree, so a peer who can write the checkout already
-  owns the verifier, and the source permission-mode rejection (which blocked normal
-  clones) is dropped in favor of a floor that requires owner read+execute and no
-  special bits while tolerating group/other bits. Content integrity is unchanged —
-  per-member SHA-256, Developer-ID signature, notarization, and Mach-O checks are
-  untouched — and the privately-extracted **broker store** keeps its exact `0o500`
-  check. `build_plugin_archive` now packages the committed in-tree runtime (with
-  optional git-`HEAD` `100755`/`100644` provenance binding it to the release tag)
-  in addition to the external sealed `--bundle-source` handoff. (agent-collab 4.1.1)
+### Fixed
 
-### Added
+- Runtime: the dispatcher bridge document (`runtime_client._dispatcher_bridge_document`)
+  now emits the canonical seven-key schema for every protocol version, instead of
+  over-sending the request reservation (`execution_key` / `request_size` /
+  `request_sha256`) for v2. The receiving bridge validator (workspace
+  `provider_runtime._validate_dispatcher_bridge_document`, and its tests) accepts
+  exactly seven keys and derives the reservation from `request` itself, so the
+  over-send made a fresh selector-v2 dispatcher fail its first bridge exchange with
+  "dispatcher bridge document is invalid". The reservation still crosses the trust
+  boundary on the wire hello frame (where the bridge's freshly computed values are
+  used); echoing it in the same-trust-domain bridge document added no integrity
+  value. Fixes fresh v2 dispatcher activation.
 
-- Coordinator/host_policy: the `("codex","governance")` first-class **synchronous**
-  governance-review route (operator-directed 2026-07-22), mirroring
-  `gemini/governance` (prompt + artifact) with a pinned reviewer model + governance
-  effort. Enables a proof-backed synchronous Codex governance review that anchors a
-  Tier-3 peer review without the async inbox. Additive route (`ROUTE_ACTIONS`,
-  `AUTHORITIES`, `GOVERNANCE_CONTRACTS`, `REVIEW_CONTRACTS`, `DIRECT_CONTRACTS`,
-  a row-validation case); existing contracts are unchanged. Companion workspace
-  change adds the runtime emission + the `validate_codex_governance_proof` gate.
+### agent-collab 4.2.2 - first activation release
 
-### agent-collab 4.2.4 — 2026-07-22
+First public activation release: the plugin now ships the signed and notarized
+native runtime committed in the repository, so the documented marketplace install
+(`/plugin marketplace add`) delivers a working activation build under any operator
+umask, including umask 002 whose group-writable checkout the previous exact-mode
+and safe-envelope checks both rejected.
 
-#### Fixed
+### Added
 
-- **Broker-verification notarization tri-state (issue #36 path-2).** Extend the Phase-1
-  consumer-activation notarization tri-state to the broker-verification / lifecycle path in
-  `runtime_client.py`. A transient *online-but-notary-unreachable* outage during a broker
-  operation (install, status, stage/commit/abort, rollback, drain, recover, uninstall) is now
-  reported as a retryable `RuntimeStatus.UNAVAILABLE` instead of a mis-typed hard
-  `INTEGRITY_ERROR` / `PROVIDER_ERROR` / `PROTOCOL_ERROR`. Genuine integrity failures
-  (signature, digest, membership) keep their hard status unchanged; activation continues to
-  gate on `status == OK`, so re-typing changes reporting and retryability only, never whether an
-  unverified runtime is adopted or spawned. Implemented via a `_BrokerNotarizationUnavailable`
-  marker re-typed at the single `_verify_published_version` source flatten, a `retryable` field
-  threaded through `_BrokerMutationFailure` (rollback still runs), and earlier
-  `except _BrokerNotarizationUnavailable` handlers at the broker terminals. The dispatcher-bridge
-  probe path (non-authoritative for adoption) and dead code are out of scope.
+- Commit the Developer ID signed and notarized darwin-arm64 native runtime bundle
+  (38 members) in the repository and advertise it through a schema-version-3
+  activation manifest, pinning `EXPECTED_DEVELOPER_ID_TEAM` to the Osumi Consulting
+  LLC team in `signing_policy.py`. The plugin remains source-available under the
+  PolyForm Strict License 1.0.0; commercial licensing is administered by Osumi
+  Consulting LLC.
 
 ### Changed
 
-- Restyle the public root `README.md` toward the reference project layout: add CI,
-  CodeQL, and secret-scan badges, a non-goals section, and a capability list; surface
-  only the latest release and link the full `CHANGELOG.md` for history; refresh the
-  now-shipped activation and runtime notes; and move the license section to the end.
+- Treat the git checkout as a trusted source under the trust-the-checkout model:
+  the host already executes the plugin's Python control plane from the checkout, so
+  the native runtime tolerates the operator umask permission bits on the source
+  while keeping content integrity (per-member SHA-256, Developer ID signature,
+  notarization, Mach-O checks) and the exact broker-store mode unchanged. The
+  `AGENTS.md` runtime policy is updated to distinguish the strict private broker
+  store from the tolerant git source.
+- Package the committed in-tree runtime in `build_plugin_archive`, binding the whole
+  archive to the release commit, alongside the external sealed handoff path.
 
-### agent-collab 4.3.0 — 2026-07-22
+### agent-collab 4.2.2 — 2026-07-21
 
-#### Added
+#### Fixed
 
-- Added `start-inbox-monitor`, a generated portable skill with native Codex,
-  Claude, and Antigravity lifecycle adapters, typed startup outcomes, positive
-  singleton proof, and explicit no-schedule/no-sandbox-bypass boundaries.
+- Verify notarization online at both the release gate (`verify_runtime_release.py`)
+  and consumer activation (`runtime_client.py`) by adding `--check-notarization` to
+  the `codesign --test-requirement '=notarized'` check. A bare Mach-O cannot have a
+  notarization ticket stapled, so without the online lookup the requirement is
+  satisfied only by the notarizing host's local trust state and fail-closes on any
+  clean host — the CI runner (which blocked the first activation release) and every
+  fresh end-user install. Empirically fail-closed when the Apple notary is
+  unreachable, and it rejects unsigned, ad-hoc, and Developer-ID-signed-unnotarized
+  binaries on macOS 14 and 15.
 
-### agent-collab 4.3.1 — 2026-07-23
+### agent-collab 4.2.1 — 2026-07-21
 
 #### Fixed
 
-- Keep provider adoption callable after a dispatcher update commits by using
-  the exact verified `selected` lane when no staged `candidate` exists.
-- Bind both staged and committed canary paths to the co-packaged signed and
-  notarized runtime identity, preserving fail-closed behavior on any selector
-  mismatch or transient verification failure.
+- Align the closed coordinator schema with the collaboration-skill contract for
+  read-only OpenCode planning and review. `opencode/plan` now accepts the exact
+  optional artifact snapshot (`content` plus `author_model`) so the client can
+  preserve artifact bytes, provenance, and family-exclusion evidence instead of
+  rejecting a correctly constructed request before managed execution.
 
 #### Verification
 
-- Added regression coverage for staged-candidate, committed-selected,
-  identity-mismatch, and notarization-unavailable paths.
-
-### agent-collab 4.3.2 — 2026-07-24
-
-#### Fixed
+- Added a coordinator regression for an artifact-bound `opencode/plan` request;
+  the test fails on 4.2.0 with `request fields violate the closed coordinator
+  schema` and passes with the corrected review-contract set.
 
-- Enforce one end-to-end monotonic timeout across coordinator preflight,
-  automatic reviewer candidates, runtime verification, and provider launch.
-  Each fallback is resealed with only the remaining budget.
-- Stop automatic fallback after a timed-out or teardown-unproven accepted
-  request, preventing a second provider worker from overlapping uncertain
-  cleanup.
-- Permit automatic fallback only for a typed pre-acceptance `unavailable`
-  result. Authentication, quota, containment, output, protocol, provider, and
-  every other post-launch result are terminal, so one review request cannot
-  silently become a second provider invocation.
-- Keep selected-dispatcher callability distinct from lifecycle quiescence so
-  migration doctor no longer reports a responsive lane unavailable merely
-  because another bounded request is active. Bound the status-only quiescence
-  observation to one second instead of waiting the full 30-second cold-start
-  allowance; lifecycle operations retain their full idle proof.
-
-#### Safety
-
-- Notarization, signature, provenance, route authority, and selector checks are
-  unchanged. Install, update, rollback, commit, drain, and other lifecycle
-  operations still require a proven non-persistent process state.
-
-### agent-collab 4.3.3 — 2026-07-24
+- Added a strict, fail-closed grammar for signed release-tag messages: exact field
+  set in canonical order, no duplicates or unknown fields, no trailing material,
+  lowercase-hex digests, ASCII-only, bare-basename asset names, and a
+  `vMAJOR.MINOR.PATCH` tag validator intended to run before a tag name reaches any ref or
+  path. Not yet wired to a release path — it is the parsing substrate the
+  activation cut will use (agent-collab 4.1.0).
 
 ### Fixed
 
-- Allow verified development or future runtime manifests to advertise the
-  `codex/governance` route by adding it to the public client's manifest parser
-  allowlist and the matching JSON schema enumeration. The currently shipped
-  signed and notarized public runtime manifest remains unchanged at its honest
-  ten-route capability set, so it does not claim the unshipped route and
-  continues to return typed unavailable for it.
+- Type an accepted-request idle-probe failure as a teardown failure, not a
+  protocol error: `_wait_for_job_idle` now fails closed on the expected
+  `OSError` / `subprocess.SubprocessError` and on a typed
+  `_OperatorHomeUnavailable` raised by `_launchctl`'s per-call operator-home
+  re-resolution (a `ValueError` subclass, so the environmental case is caught
+  race-free while a genuine code-bug `ValueError` and an invalid job label
+  still surface).
+- Bound provider teardown by the caller deadline: `_terminate_and_reap` polls
+  to reap the SIGKILLed session-group leader within a small grace of the
+  caller deadline rather than two fixed five-second waits, and reports a
+  proven teardown only when the whole-group kill was posted AND the leader was
+  reaped, so a leader-only fallback is honestly typed as a teardown failure.
+- Bound the request-dispatch path's retained-lane availability probe by the
+  request deadline: `_launch_broker` now starts the deadline before capturing
+  lanes and threads it through `_capture_broker_lanes` → `_job_loaded` →
+  `_launchctl`, so a small-`timeout_ms` request no longer blocks on
+  launchctl's ~20s default before dispatch (lifecycle/status callers keep the
+  default bound).
+- Reject an incomplete Codex rollout tail instead of trusting the preceding
+  model context: `_codex_rollout_window` fails closed on a non-newline-
+  terminated final record, so a concurrently written model-changing record can
+  no longer yield stale governance-ready identity.
 
-### Tests
+### agent-collab 4.1.1 — 2026-07-20
 
-- Pin the distinction between the client's accepted contract vocabulary and
-  the exact routes advertised by the current signed public runtime.
+#### Fixed
 
-### Added
+- Make `broker-status` use the same canonical selector view as request routing,
+  so a valid selector-v1 selected dispatcher is no longer misclassified as an
+  obsolete single-broker installation.
+- Require the selected immutable lane, launchd job, socket, and closed liveness
+  exchange to pass before broker status is ready. Migration-doctor `READY` now
+  requires this executable proof as well as the signed runtime manifest.
+- Require the one-shot launchd job to return idle and every retained fallback
+  lane to remain independently verifiable before status can claim executable
+  readiness, matching the topology that request routing will actually accept.
+- Advertise a retained lane as rollback-capable, and include it as a request
+  fallback, only when its own launchd job is currently loaded. Retained job
+  availability is a point-in-time snapshot and does not deactivate a healthy
+  selected lane.
+- Treat a selectorless legacy broker as installed but unavailable even when its
+  old socket responds, because current request routing cannot capture an
+  executable lane without the same canonical selector proof.
+- Keep liveness compatible with a verified dispatcher-v1 selected lane while a
+  dispatcher-v2 candidate is staged, so the previous lane remains executable
+  until the new lane is fully proved and atomically selected.
+- Preserve typed timeout, output-limit, and teardown results after a dispatcher
+  accepts a request instead of collapsing those local completion failures into
+  a misleading `protocol_error`; accepted work still never retries another lane.
+- Wait for a selected dispatcher-v1 one-shot job to return idle before exposing
+  its response to the next caller, closing the launchd teardown window without
+  serializing the concurrent dispatcher-v2 scheduler.
+- Bound that dispatcher-v1 idle proof by the request's existing absolute broker
+  deadline, including every `launchctl` collection and final polling sleep, so
+  teardown verification cannot silently start or overrun a fresh timeout.
+- Resolve Codex Desktop's active OpenAI model from its exact current rollout
+  when `CODEX_ACTIVE_MODEL` is absent. The reader is fixed-root, bounded,
+  no-follow, same-owner, single-file, and fail-closed on ambiguous, writable,
+  linked, malformed, oversized, concurrently growing, or conflicting identity
+  evidence.
 
-<!-- release: agent-collab 4.4.0 -->
+#### Verification
 
-- **Domain-expert skill pack (16 new skills).** New pure-prompt, host-neutral
-  expertise skills alongside the existing collaboration/governance set:
-  `rust-engineer`, `go-engineer`, `elixir-engineer`, `sql-engineer`,
-  `kubernetes-specialist`, `terraform-engineer`, `sre-engineer`,
-  `incident-responder`, `mlops-engineer`, `llm-architect`,
-  `postgres-engineer`, `data-engineer`, `eval-engineer`,
-  `prompt-regression-tester`, `hallucination-investigator`, and
-  `ai-writing-auditor`. Authored under workspace ownership, informed by the
-  MIT-licensed VoltAgent subagent corpora at pinned SHAs (947b44ca /
-  5605c9c1) after an untrusted-input security audit; all supply-chain
-  patterns flagged by that audit (third-party installers, external MCP
-  endpoints, fictional tools) are excluded by construction. No coordinator,
-  provider, or delegation surface is touched.
+- Added RED/GREEN regressions for selector-v1 projection, legacy selected-lane
+  liveness, selectorless legacy false-positive rejection, one-shot idle
+  completion, invalid retained-lane rejection,
+  unloaded retained-job rollback and fallback suppression,
+  accepted-request timeout typing and no-fallback behavior, legacy one-shot
+  response teardown, deadline reuse, bounded launchctl collection, and capped
+  polling, failed dispatcher ping, manifest-only doctor readiness, safe Codex
+  rollout identity, and ambiguous, growing, or unsafe rollout rejection.
 
-- qa-verify: instruct callers to phrase QA constraints at evidence level rather than
-  presence level (the inspector must produce what it checked; name likely shortcuts;
-  bound with an out-of-scope list), per the approve-everything verifier failure mode
-  documented in Anthropic's outcome-grader cookbook. Additive guidance only; the
-  PASS/FAIL verdict contract is unchanged.
+### agent-collab 4.1.0 - Signed lane contract anchor
 
-### agent-collab 4.3.4 — 2026-07-24
+- Bind schema-3 runtime artifacts, selector-v2 lanes, dispatcher protocol-2
+  reservations, and Gemini governance proof to one authenticated runtime
+  contract anchor while preserving exact committed legacy normal lanes.
 
-### Fixed
+### agent-collab 4.0.5 - Gemini governance proof v2
 
-- Fixed `migration_doctor` reporting `provider_routing="BLOCKED"` for the shipped runtime.
-  Readiness compared the client's full acceptance set against the manifest, so the accepted
-  but deliberately unadvertised `codex/governance` route marked the entire runtime invalid.
-  Readiness is now judged against a required baseline (`REQUIRED_CONTRACTS`), with
-  `OPTIONAL_CONTRACTS` holding routes a signed artifact may advertise but need not ship.
+- Validate Gemini governance evidence against the provider runtime `2.0.0`
+  proof contract `2` tuple instead of conflating it with the public bundle
+  manifest contract, and require governance response provenance to identify
+  that same compatible runtime while rejecting legacy, crossed, and
+  mixed-provenance version tuples.
+
+### Added
+- Regression test locking in that a host-normalized runtime bundle (directory 0o755, member files 0o500) verifies and resolves — the empirically-confirmed state produced by every supported installer (Claude Code, Codex, Antigravity/agy, and the broker's sealed copies: 2356/2356 installed member files were 0o500, none 0o700). This closes release-pipeline design item §9.7 as empirically non-reproduced: no source-mode loosening is made (it would be unnecessary and would open a direct-execution-of-owner-writable-source bypass); the loader already handles the real install correctly.
 
 ### Changed
-- Root `README.md` opening rewritten purpose-first (operator-directed overhaul): why governed multi-agent collaboration exists (family blind spots, disclosed reward-hacking, unaccountable authority loops), what it delivers, and how governance is implemented — followed by the unchanged technical sections; stale intro version pin removed (version lives in "Current package"). Package README gains a purpose-bridge paragraph. Doc-only, no version bump.
+- `build_plugin_archive.py` now sources the activation runtime bundle from an out-of-tree signed handoff via `--bundle-source <leaf .bundle dir>` instead of the git checkout — the signed runtime ships as a release asset and is never committed. The committed `runtime-manifest.json` alone decides the mode (design decision D1): an activation manifest without `--bundle-source` is a hard error (never a silent policy-only downgrade), a policy-only manifest forbids the flag, and an in-tree `runtime/` conflicts with an external source. The bundle source is treated as hostile input (symlink argument rejected before resolution; bounded non-following enumeration; member-set equality; per-member O_NOFOLLOW regular-file/uid/nlink/mode/size/sha256 checks with the strict 0o500 install mode preserved), and its payloads are re-read + re-digested through fresh descriptors at pack time.
+- `verify_archive` is rearchitected to **regenerate the canonical tar from trusted inputs and byte-compare** rather than parse a possibly-hostile archive: it never hands candidate tar bytes to `tarfile`. A shared deterministic `USTAR` serializer (used by both build and verify) reproduces the canonical tar with runtime payloads zero-filled; the candidate is only bounded-inflated and then sliced at offsets the verifier computed. Every structural property — headers, exact typeflags, ordering, padding, EOF, dialect, and the absence of hidden PAX/GNU/sparse records — is bound by the byte-compare outside the runtime ranges; each runtime payload is bound to the frozen-manifest digest; the archived `runtime-manifest.json` bytes are bound to the frozen snapshot. Reading the candidate is fd-only (`O_NOFOLLOW`/`O_NONBLOCK` + `fstat`, no path-swap window) under hard compressed- and decompressed-size caps, with a canonical gzip-header check and single-stream (no trailing/concatenated data) validation. The archive is built into an exclusive temp that is verified before an atomic rename, so a failed build never leaves a publishable artifact. Hardened through a 2-round up-front adversarial design review of the hostile-archive-reading threat model (the regenerate-and-compare pivot) before implementation.
 
-### Fixed
-- SECURITY.md support matrix: `3.x` → `4.x` (current major per plugin.json 4.3.1; staleness audit).
+### agent-collab 3.5.1 — fail-closed dispatcher boundary
 
-- visual-review + ui-to-code: direct the primary to magnify detail-bound regions
-  (host-native zoom/crop or a full-resolution code-execution crop) before reading
-  them, per the confidently-wrong sub-patch-detail failure documented in Anthropic's
-  crop-tool cookbook. Additive guidance only; the skills' no-image-transport honesty
-  boundary is unchanged.
+- Treat malformed or noncanonical dispatcher-client output after the
+  request-bearing child launches as a post-request failure, preventing a
+  possible second execution through blue after green acceptance.
+- Preserve typed unsupported-platform behavior when POSIX `fcntl` is absent,
+  while failing lifecycle locking closed before filesystem I/O.
 
-### Added
+### agent-collab 4.0.0 — Grok 4.5 model and effort unification
 
-- **`cut_release.py` runtime-currency gate (fail-closed).** An activation
-  release now refuses to cut when any `runtime:`-scoped merge landed after the
-  commit that last staged `plugins/agent-collab/runtime/` — the failure mode
-  that shipped a 4.2.0-era runtime in the rolled-back v4.4.0 tag-only cut.
-  Explicit operator override: `--allow-stale-runtime` (loud warning). Unit
-  tests cover pass/stale/missing/override/wiring paths.
+- **Breaking:** advance the fixed public/native runtime protocol to v2. Older
+  public clients and signed runtimes now reject each other instead of silently
+  using the retired Composer model or an outdated request shape.
+- Route Grok architecture, governance, huge-context, and compatibility codegen
+  through the same `xai/grok-4.5` author model. `composer/codegen` remains a
+  public compatibility route with output-only authority, not a separate model.
+- Seal review effort from the task: architecture and governance use high,
+  huge-context synthesis uses medium, and callers cannot override those review
+  profiles. Codegen requires `simple_codegen`, `standard_codegen`, or
+  `complex_codegen`, with respective low, medium, and high effort floors.
+- Keep all model, tool, sandbox, credential, environment, filesystem, and
+  application authority out of the public codegen row. The trusted primary
+  still owns applying output, integration review, testing, git, and release.
 
-### agent-collab 4.4.2 — 2026-07-25
+### agent-collab 4.0.1 — intent-check effort contract correction
 
-### Fixed
+- Fixed `intent-check` routing guidance so Gemini governance rows use their
+  required high effort, while rudimentary Codex advisory intent comparisons
+  remain low and the sealed Grok governance fallback remains high.
 
-- Reject managed `execute` responses whose `result.text` is missing,
-  non-string, empty, whitespace-only, Unicode-invisible/filler-only,
-  replacement-glyph-only, terminal-control-only, or malformed instead of
-  accepting a false-positive `status=ok`.
-  Invalid success is a terminal `protocol_error` and cannot enter automatic
-  family fallback. `readiness` remains exempt, and typed containment, timeout,
-  teardown, and provider failures retain their classifications.
+### agent-collab 4.0.2 — protocol-v1 blue lifecycle bridge
 
-- Ship a content-addressed execute-output conformance contract with a frozen
-  Unicode-16 blankness table so the public client can fail closed even when an
-  older signed runtime emits a defective success envelope. Include it in the
-  canonical release archive beside `runtime_client.py` and verify exact bytes.
+- Keep normal protocol-v2 routing fail-closed against protocol-v1 runtimes and
+  responses while allowing dispatcher lifecycle control to prove the exact
+  signed v1 blue baseline needed for make-before-break staging.
+- Stage and verify protocol-v2 green without rewriting or stopping v1 blue, and
+  derive the selected blue protocol from its immutable manifest during mutable
+  control-plane recovery.
 
-- Enforce exact CSI byte-class ordering and a closed OSC/C1 support matrix,
-  rejecting malformed sequences and unsupported control strings rather than
-  stripping printable residue into an apparent answer.
+### agent-collab 4.0.3 — dispatcher lifecycle control protocol
 
-- Retain the original absolute request deadline through direct and broker
-  response parsing. Classification of a near-limit blank/control stream now
-  returns typed `timeout` if it consumes the remaining budget.
+- Send lifecycle ping and lock-probe control messages on the sealed dispatcher
+  protocol-v1 contract so a staged dispatcher can be proven before activation.
+- Keep typed lifecycle failures on runtime protocol v2 and reject swapped,
+  malformed, or extra-field success and failure responses.
 
-### agent-collab 4.3.5 — 2026-07-25
+### agent-collab 4.0.4 - adoption protocol boundary
 
-#### Fixed
+- Preserve the sealed provider-adoption request and response on public runtime
+  protocol v2 while carrying them inside the private dispatcher protocol-v1
+  bridge, matching the one-time authority registry and frozen dispatcher.
 
-- Accept exact legacy Gemini governance proof v1 and recovery-capable proof v2
-  as disjoint public success contracts so a verified retained v1 lane remains
-  callable while a v2 runtime is staged.
-- Select v2 validation whenever any recovery discriminator is present. Reject
-  partial, hybrid, coerced, contradictory, or cross-field-mismatched results
-  instead of falling back to the legacy contract.
-- Name both exact public proof keysets explicitly and document the verified
-  child-runtime/private-pipe trust boundary. The proof hash is a consistency
-  check rather than a signature; complete v1 remains accepted only for
-  retained-lane rollback continuity.
+### agent-collab 3.5.2 — launchd dispatcher peer readiness
 
-agent-collab 4.5.0 routes the packaged OpenCode default through
-`opencode-go/glm-5.2`, recognizes
-Kimi as Moonshot-family provenance, and adds an opt-in
-`AGENT_COLLAB_OPENCODE_PROVIDER=opencode-go` host guard that rejects standard
-metered OpenCode Zen models, malformed provider policy, namespace lookalikes,
-and late policy drift before runtime launch.
+- Distinguish the root-owned launchd listener credential from the
+  operator-owned sealed runtime process when authenticating a staged
+  dispatcher on macOS.
+- Retry only the exact root-plus-pid-1 launchd handoff sentinel under the
+  existing handshake deadline, with capped exponential sleeps and immediate
+  failure for malformed state or socket errors.
+- Re-prove the stable process start identity, exact executable, signed
+  artifact, socket identity, and final kernel peer PID before sending hello.
 
-<!-- release: agent-collab 4.4.1 -->
-### Changed
+### Fixed
+- Notarization is now verified with the code-object-native `codesign --verify --strict --test-requirement '=notarized'` instead of `spctl --assess --type execute`, at BOTH the release CI gate (`verify_runtime_release.py`) and runtime activation in the client (`runtime_client.py`). The runtime entrypoint is a bare command-line Mach-O, not a `.app` bundle, and `spctl --type execute` only assesses `.app` bundles — it always rejects a bare executable ("the code is valid but does not seem to be an app"), a false negative that would fail every otherwise-valid activation release at the notarization step AND every client activation. The `notarized` codesign requirement binds to the CDHash and rejects unsigned, ad-hoc, and Developer-ID-signed-but-not-notarized binaries by exit code; both call-sites fail closed on tool error. The check is combined with `--check-notarization` (see the online-verification entry) so it forces the online Apple notary lookup and succeeds on a clean host — a bare Mach-O cannot have a notarization ticket stapled, so without the online lookup `=notarized` would depend on the host's local notarization trust state and fail-close on any clean host.
 
-- **Rebuilt, re-signed, and re-notarized the darwin-arm64 provider runtime**
-  from the current workspace source closure. The bundle shipped in the
-  rolled-back v4.4.0 tag-only cut predated several runtime-behavior changes,
-  including the public-client digest pin; a runtime built before that pin
-  rejects the client this package actually ships.
+### agent-collab 3.5.0 — provider update continuity
 
-- **The signed runtime now advertises the `codex/governance` route.** This is a
-  capability expansion: v4.3.3 added the route to the public client's parser
-  allowlist and JSON schema while the shipped runtime deliberately did not
-  claim it, and the v4.4.1 runtime is built from a source closure where it is a
-  real read-only contract.
+- Add a strict, legacy-default blue/green broker selector so a newly installed
+  client can continue using the separately verified legacy broker while a
+  content-derived dispatcher lane is staged.
+- Preserve blue on missing, invalid, unproven, refused, or timed-out green
+  connections before any send attempt; never retry another lane after a
+  connection succeeds. Each request captures one lane ordering so an in-flight
+  blue request completes even if the next request atomically selects green.
+- Add closed stage, status, no-provider ping, canonical-lock probe, selector
+  commit, candidate abort, committed-control recovery, and retiring-blue drain
+  operations. Green uses a distinct content-derived label/socket; commitment
+  never bootouts blue, and recovery never changes desired provider binaries.
+- Keep one canonical Gemini/Grok/OpenCode lock across blue and green for the
+  complete request through provider teardown. Credential-free contention and
+  acquisition probes let every installed client prove that namespace before
+  green traffic is enabled.
+- Permit a bounded two-selector overlap when both entries are the unified
+  `agent-collab` package, allowing Codex to retain its old cache while a distinct
+  candidate selector is proven. Retired package names remain blocking, and old
+  client retirement stays behind the private fresh-session finalization gate.
+- Block every packaged mutating broker/dispatcher lifecycle operation from the
+  Codex seatbelt before lifecycle reads or writes while retaining read-only
+  status and probes.
 
-- **`codex/governance` is now REQUIRED at the release gates.** All three
-  independent copies of the contract allowlist —
-  `verify_runtime_release.py`, `build_plugin_archive.py`, and
-  `check-public-export-safety.py` — move from a ten-route to an
-  eleven-route required set, keeping exact-set equality. Release gates
-  validate what this repository is about to publish, so requiring the route
-  stops a future cut from silently dropping a governance capability. The
-  public client deliberately keeps it OPTIONAL, because it validates whatever
-  is already installed, including older field artifacts that predate the
-  route. The two postures are intentionally opposite.
+### agent-collab 3.5.0 — authenticated dispatcher canaries
 
-### Tests
+- Add exact Darwin dispatcher peer proof and a request-free, digest-bound
+  hello/ready handshake before any green provider request is sent.
+- Add a token-gated internal `adoption_canary` coordinator operation bound to
+  one candidate tuple and route allowlist without exposing a user-selectable
+  provider path, model, auth root, or policy route.
+- Keep the selector legacy-blue by default. Apply a separate local bound to the
+  request-free handshake so a proven pre-request green failure retains time for
+  independently proven blue without shortening the original request deadline;
+  a failure at or after request send never retries another lane.
 
-- Enforce the contract set at the real `verify_release` call site in both
-  directions: omitting `codex/governance` is rejected, and an unenumerated
-  extra route is rejected. Pin that all three gate copies agree exactly, and
-  that the client keeps the opposite (optional) posture.
-- Derive the contract fixtures in `test_plugin_archive.py` and
-  `test_release_evidence.py` from the builder's own allowlist instead of
-  restating ten routes inline. Both hardcoded copies had silently rotted the
-  moment the required set changed; deriving them makes that impossible.
-- Update the route-shipping test to the new reality (route now advertised) while
-  still asserting it remains accepted-but-not-required.
+### agent-collab 3.3.0 — closed standalone provider bundle
 
-### Fixed
+- Route managed Gemini, OpenCode, Grok, and Composer requests through an explicit, digest-bound
+  launchd socket broker that starts for one request and returns to zero idle
+  processes. Add closed install, status, rollback, and uninstall lifecycle
+  commands with transactional prior-version restoration and no direct fallback.
+- Replace the failed onefile launch path with manifest schema 2, native contract
+  3, and broker transport 2 over one closed standalone bundle. Bind its identity
+  to the sorted role/mode/size/digest/Mach-O facts of every member; publish only
+  exact immutable `0500` files; verify the kernel-reported entrypoint and the
+  complete lifecycle state before provider dispatch. Provider protocol 1 and
+  all existing route-authority boundaries remain unchanged.
+- Resolve the OpenCode model per request from live OpenCode/ZCode observation,
+  explicit central configuration, or the fixed `opencode/glm-5.2` preset while
+  ignoring ambient and row-level model fallbacks.
+- Reject duplicate/non-finite broker responses and state before typed parsing.
+- Preserve typed `cancelled` and `input_limit` Grok/Composer failures, require
+  exact terminal-state validation, and document the one bounded cancellation
+  retry and comprehensive architecture-reviewed Composer coding-packet policy.
+- Strip the Codex Desktop Seatbelt marker from broker-dispatched work so every
+  Grok/Composer attempt validates its own nested read-only sandbox, preserve
+  closed provider-child environments, and keep runtime management direct-only.
+- Propagate client disconnect through managed OpenCode, Grok, and Composer
+  calls, reap provider child groups, discard partial output, prohibit retry of
+  disconnect cancellation, and fail with typed `timeout` before setup when the
+  managed-boundary deadline reserve is exhausted.
+- Harden repository configuration with full-SHA Action pin enforcement while
+  retaining squash-only, signed, linear, review-thread-resolved releases.
+- Align OpenCode preflight with issuance model resolution; key immutable broker
+  versions by both artifact and manifest digests; preserve complete rollback
+  state across failures and no-op reactivation; reject unverified rollback
+  targets; treat a never-installed root as typed uninstalled/unavailable; and
+  map bounded `launchctl` failures to closed lifecycle results.
 
-- Restore the unreleased v4.5.0 source line to the canonical policy-only
-  package shape by removing the retained v4.4.2 production runtime bundle and
-  publishing an empty, schema-v3 runtime manifest.
-- Keep the OpenCode Go policy and skill changes in v4.5.0 while making the
-  source tree eligible for the governed private build/sign/notarize pipeline.
+### agent-collab 3.3.0 — managed Gemini governance and reliable provider state
 
-### Why
+- Add a distinct broker-only `gemini/governance` action with exact Gemini 3.1
+  Pro/high selection, immutable artifact binding, shared-HOME/PTY containment
+  evidence, response hashing, and public-client proof-digest validation.
+- Keep Gemini advisory and long-context separate and explicitly ineligible as
+  governance evidence; automatic governance now maps Gemini and Grok to their
+  explicit governance actions while Codex remains advisory.
+- Advance the signed-runtime route contract to version 2 across policy,
+  manifests, schemas, archive/release verification, generated skills, and
+  deterministic tests.
+- Document canonical passwd HOME as the managed-provider reliability policy
+  without relaxing family exclusion, authority separation, bounded lifecycle,
+  or the prohibition on raw provider fallbacks.
+- Make Codex, Gemini, OpenCode, Grok, and Composer uniformly broker-only and
+  bind provider startup to the signed guardian's acknowledged pre-exec gate;
+  only local runtime management retains direct exact-artifact execution.
 
-- A populated runtime is admissible to the private builder only when the
-  requested source is the exact commit behind a trusted signed release tag.
-  Carrying the older runtime into an untagged v4.5.0 commit made the source
-  neither a valid policy-only input nor a valid signed activation input.
+### agent-collab 3.1.0 — source-available licensing and neutral guidance
 
-<!-- release: agent-collab 4.5.1 -->
-### Changed
+- License the public repository and installed package under the unmodified
+  PolyForm Strict License 1.0.0. Copyright remains with John Osumi; commercial
+  use requires explicit written approval administered by Osumi Consulting LLC.
+- Make `AGENTS.md` the sole canonical public repository guide and retain
+  `CLAUDE.md` only as an `@AGENTS.md` compatibility loader.
+- Require contributor-rights evidence and package exact legal documents,
+  SHA-256 evidence, and an SPDX 2.3 SBOM in the policy-only release.
 
-- Rebuild the darwin-arm64 provider runtime from final workspace `1.0.823`
-  commit `d08b6382710d6d5910d64cf011bcac873a2e1c03`, Developer-ID sign it, and
-  notarize it through Apple submission
-  `c6d29dec-5351-467d-883e-0b862734567d`.
-- Replace the policy-only placeholder with a closed activation manifest that
-  pins the complete standalone bundle at SHA-256
-  `2cea10cff2030d0238661667cf8d1b83cf9885dc6f4a03b0db4365e891b04f47`.
-  The rebuilt runtime includes the v4.5.1 provider-agnostic containment,
-  canonical-user-HOME authentication, private request workspace, bounded
-  execution/teardown/cleanup, OpenCode Go, output conformance, and lifecycle
-  continuity repairs from the final merged workspace.
+### agent-collab 3.0.1 — clean public distribution
 
-### Tests
+- Publish the unified policy/client package from the audited clean-history
+  `sumitake/agent-collab` marketplace without importing private pull-request
+  refs, tags, releases, workflow artifacts, or provider implementation history.
+- Localize contribution governance and security reporting so contributors and
+  plugin users do not need access to the private build/sign system.
+- Remove host-specific labels and session-owner metadata, regenerate both
+  marketplaces and all skills, and retain the policy-only fail-closed runtime
+  state until a separately verified signed native artifact is available.
 
-- Verify the imported handoff byte-for-byte, re-run the Developer ID,
-  hardened-runtime, secure-timestamp, Apple-notarization, Mach-O, contract,
-  member-inventory, and whole-bundle gates, then build and reopen the canonical
-  activation archive.
+### agent-collab 3.0.0 — breaking unified-package consolidation
 
-### Fixed
+- **Breaking:** retire `claude-collab`, `codex-collab`,
+  `antigravity-collab`, `codex-tools`, and `glm-worker` immediately. Together
+  with the already-retired `grok-worker`, they are removed from the
+  marketplace, release inventory, active documentation, and generated package
+  surface without presets, tombstones, dependencies, or compatibility shims.
+  The historical `agent-collab-plugin`, `gemini-collab`, and `grok-collab`
+  package identities are also treated as retired exact aliases. The clean
+  `sumitake/agent-collab` repository is the marketplace source; a repository
+  name is not itself an installed legacy package.
+- Add `agent-collab 3.0.0` as the only package and release. It resolves the
+  primary, model family, active model, host runtime, and session dynamically.
+  `codex-tools` → the managed Codex backend in `agent-collab`; `glm-worker`
+  → the managed OpenCode backend, with `opencode/glm-5.2` retained as the
+  current Zhipu-family model preset.
+- Add a narrow signed-native-runtime manifest, standalone public coordinator,
+  and verifier. Exact route/action, authority, and artifact-author provenance
+  checks cover Gemini, Codex, OpenCode, Grok 4.5, and Composer. Grok 4.5 is
+  limited to sealed read-only architecture, governance, and huge-context
+  actions; generic advisory or worker roles cannot select it. OpenCode build
+  is explicitly mutation-capable workspace-write authority, distinct from
+  read-only plan. Response family
+  is derived from the artifact-author model on every call, including OpenCode
+  model switches; structured provider/model parsing rejects ambiguous lineage
+  and incidental substring matches. Applicable non-governance worker requests
+  may carry an exact artifact snapshot so its author family is also excluded.
+  Contradictory or unknown response provenance is rejected. Runtime
+  stdout and stderr are bounded while the process is running, with process-
+  group termination and reaping on output-limit or unexpected collector
+  failures. The release
+  tree contains no unsigned
+  placeholder artifact; all native routes are typed unavailable until the
+  private build/sign system supplies the notarized binary. A
+  policy-only release may ship with an empty artifact manifest and no runtime.
+  Native activation remains blocked until the Darwin-arm64 artifact advertises
+  the full matrix and supplies commit-bound Developer ID, hardened-runtime, and
+  notarization evidence.
+- Split the local signed-tag tool and GitHub release workflow by canonical
+  package mode. Policy-only mode proves the manifest/archive contain no runtime;
+  activation alone invokes the strict macOS signing/notarization verifier.
+- Bind the exact captured artifact independently from the instruction prompt in
+  sealed native JSON: base64 bytes, SHA-256, byte size, author model, and
+  derived author family are verified before launch. Ambiguous active-model
+  lineage remains unknown even when a stale asserted family is present;
+  governance fails closed and non-governance worker artifacts warn when author
+  independence is unknown.
+- Add native Codex packaging with a `.codex-plugin/plugin.json` manifest and
+  generated `.agents/plugins/marketplace.json`, while retaining the
+  Claude-compatible package manifest. Release consistency requires both host
+  manifests to identify the same sole `agent-collab` package and version.
+- Make policy-only readiness deterministic on every host: the manifest is
+  parsed and validated before the Darwin-arm64 activation gate, an empty
+  artifact set remains typed unavailable, and runtime tests explicitly
+  simulate the supported target rather than inheriting the CI host platform.
+- Add a provider-free migration doctor, duplicate-package routing block,
+  dynamic known/unknown host preflight, and policy-only safe mode. Safe mode
+  disables every native model route. Async inbox readiness is available only
+  after a current host observation and the public coordinator never sends;
+  reinstalling a retired package is not a rollback. The doctor parses enabled
+  and installed-disabled Codex plugin tables from `~/.codex/config.toml`,
+  preserves source-host provenance, and emits removal commands for the owning
+  package manager. Empty primary
+  configuration is re-observed on every request so ZCode model switches take
+  effect immediately. `codex/build` and `auto/worker` are coordinator-only,
+  typed-unavailable contracts and never widen the signed required runtime
+  matrix or promote into advisory authority. Malformed rows fail as
+  `config_error`. Missing or hostile home-directory resolution now blocks with
+  a typed inventory error. Python 3.10 uses a strict exact-table compatibility
+  parser for Codex plugin selection, including escaped-key and multiline-string
+  defenses, instead of substring matching or silently skipping the registry.
+- Add a clean-history public-export gate. Deleted backend sources remain in the
+  private history until the separately authorized rewrite and residual audit;
+  direct visibility changes or exports from the unsanitized clone are blocked.
+  The gate scans every reachable blob as bytes, recursively inspects nested
+  archives under cumulative depth/member/size bounds, semantically detects
+  statically constructed provider argv, applies only narrow harmless-fixture
+  masking, and rejects provider-backend archive directories, symlink, or other
+  unsafe tree modes. It separately inspects every ref, direct blob or tree
+  target, annotated-tag object/message, and release-tag form/target.
+- Pin every pull-request workflow to GitHub-hosted `ubuntu-latest`; public PR
+  code can no longer execute on a persistent self-hosted runner, and
+  the mutable `RUNNER_TARGET` repository variable has been removed.
+- Grant CodeQL the additional read-only `actions: read` scope required to
+  associate and upload pull-request analysis results; all other workflow token
+  permissions remain explicitly least-privilege.
+- Keep CodeQL enforceable while the sanitized repository is still private:
+  complete analysis now retains SARIF as a bounded workflow artifact when Code
+  Scanning is unavailable, then switches automatically to Code Scanning upload
+  once the repository becomes public.
+- Require releases to originate from a verified signed annotated tag whose
+  target commit is the checked-out commit on `origin/main`. Both the local
+  release tool and GitHub workflow enforce the same ancestry boundary, and
+  the release job force-materializes the remote annotated tag object before
+  history inspection so the checkout action's peeled commit ref cannot be
+  mistaken for an unsigned or lightweight tag. The
+  hardened-runtime verification parses the actual numeric code-signing flags.
+  Runtime and release verification also inspect the executable as a thin arm64
+  Mach-O with exactly one macOS `LC_BUILD_VERSION` for minimum macOS 14.0.
+  The operator-owned Developer ID Team ID is pinned independently in reviewed
+  `signing_policy.py`; the manifest cannot select its own signer, and the
+  unconfigured anchor blocks activation until matching signing/notarization
+  credentials are provisioned.
 
-- agent-collab 4.5.1 makes managed containment a rare structural signal rather
-  than an output heuristic.
-- Make managed containment provider-agnostic and structural: authenticated
-  provider state resolves from the canonical user HOME, caller checkouts stay
-  read-only by default, and each request receives a private temporary workspace
-  for agentic tools, edits, builds, and reasoning.
-- Seal `opencode/build` as output-only to the caller. OpenCode may work inside
-  its private workspace, but the trusted primary reviews and applies returned
-  material instead of granting the provider direct caller-worktree mutation.
-- Reserve `containment_error` for failure to establish the boundary before
-  launch or positive write-escape/protected-state evidence. A successfully
-  blocked access attempt proves containment worked; return code, empty output,
-  and stderr wording cannot manufacture a containment failure.
-- Keep authentication, protocol/output, timeout, provider, teardown, and
-  cleanup failures orthogonal. Disable in-request binary updates, require
-  bounded descendant teardown and positively verified temporary cleanup, and
-  treat routine direct-CLI fallback as a managed-path reliability defect.
+### Breaking
+
+- Rename the public `ai-merge-resolve` skill to `merge-resolve`, including its generated command and auto-apply policy filename. Existing installations must invoke `/agent-collab:merge-resolve` and rename `.claude/ai-merge-policy.yaml` to `.claude/merge-resolve-policy.yaml` when that opt-in file is used.
+
+### Added
+
+- Add a digest-pinned activation-only third-party notice/license tree for CPython 3.13.14, Nuitka 4.1.3, Expat, HACL*, libb2, mpdecimal, mimalloc, and Hedley.
+- Extend SPDX 2.3 release evidence with component packages, embedded-component relationships, and license conclusions that no longer mislabel the native runtime as wholly PolyForm-licensed.
+- Add a closed co-packaged runtime setup client for read-only status, idempotent managed-state preparation, and bounded Grok device login without exposing provider recipes or caller-selected paths.
+
+### Changed
+
+- Reject noncanonical package-qualified release tags, move the arm64 activation verifier to `macos-15`, and fail activation archives on missing, extra, linked, hardlinked, unsafe, or content-drifted third-party legal members.
+- Keep the native child environment scrubbed while passing only a closed generic/Codex-Desktop host-context observation; the signed runtime derives and validates provider state from the OS login identity.
+- Fail closed with typed `platform_unsupported` when POSIX user identity APIs are unavailable, before manifest or artifact ownership checks can raise on non-POSIX hosts.
 
 <!-- changelog-fragments:end -->
 
diff --git a/changelog.d/2026-07-27-changelog-fragment-order-descending.md b/changelog.d/2026-07-27-changelog-fragment-order-descending.md
new file mode 100644
index 0000000..08da68f
--- /dev/null
+++ b/changelog.d/2026-07-27-changelog-fragment-order-descending.md
@@ -0,0 +1,9 @@
+### Fixed
+
+- `build-changelog.py` now sorts `changelog.d/` fragments in **reverse**
+  lexical order (newest filename first) instead of ascending order. The
+  compiled `[Unreleased]` block previously placed the oldest fragment at the
+  top and the newest at the bottom — backwards from the Keep a Changelog
+  convention this file's own header cites (most recent change on top).
+  `CHANGELOG.md` is regenerated from the corrected sort; only the ordering
+  changed, no entries were added, removed, or reworded.
diff --git a/changelog.d/README.md b/changelog.d/README.md
index 0b48acc..ba0627d 100644
--- a/changelog.d/README.md
+++ b/changelog.d/README.md
@@ -27,7 +27,7 @@ This directory holds **per-PR changelog fragments** that compile into `CHANGELOG
 
 `scripts/build-changelog.py` is the compiler:
 
-- **Build mode** (default): reads `changelog.d/*.md` in sorted order, concatenates content, inserts the result into the `## [Unreleased]` section of `CHANGELOG.md`. Idempotent.
+- **Build mode** (default): reads `changelog.d/*.md` in reverse-sorted order (newest filename first), concatenates content, inserts the result into the `## [Unreleased]` section of `CHANGELOG.md`. Idempotent.
 - **Check mode** (`--check`): builds to a temp file and diffs against the current `CHANGELOG.md`. Exit 0 if they match; exit 1 with diff if they don't. CI uses this mode.
 - **Dry-run mode** (`--dry-run`): prints what would be compiled without writing.
 
diff --git a/scripts/build-changelog.py b/scripts/build-changelog.py
index 9b73d5a..028f3ad 100644
--- a/scripts/build-changelog.py
+++ b/scripts/build-changelog.py
@@ -27,8 +27,11 @@
       - changelog.d/README.md
       - changelog.d/.gitkeep
       - changelog.d/.skip-* (any file starting with `.skip-`)
-  * Fragment ordering: lexical sort of filename. Conventional naming uses
-    zero-padded incrementing IDs or PR numbers so order is intentional.
+  * Fragment ordering: reverse-lexical sort of filename (newest first).
+    Conventional naming uses date-prefixed or zero-padded incrementing IDs, so
+    reverse order puts the most recently landed change nearest the top of
+    ``[Unreleased]`` — matching Keep a Changelog's most-recent-on-top
+    convention instead of burying it at the bottom of the section.
   * The compiler inserts fragments BETWEEN the ``## [Unreleased]`` line and
     the first ``###`` sub-heading (or end of section if no sub-headings).
     Existing inline entries under ``## [Unreleased]`` are PRESERVED below the
@@ -64,14 +67,16 @@
 
 
 def list_fragments() -> list[Path]:
-    """Return sorted list of fragment files under changelog.d/.
+    """Return reverse-sorted list of fragment files under changelog.d/.
 
+    Reverse-lexical by filename, so the newest-dated/highest-numbered
+    fragment comes first (most recent on top of ``[Unreleased]``).
     Reserved names skipped: README.md, .gitkeep, .skip-*
     """
     if not FRAGMENTS_DIR.is_dir():
         return []
     fragments: list[Path] = []
-    for entry in sorted(FRAGMENTS_DIR.iterdir()):
+    for entry in sorted(FRAGMENTS_DIR.iterdir(), reverse=True):
         if not entry.is_file():
             continue
         if entry.name == "README.md":
diff --git a/scripts/test_build_changelog.py b/scripts/test_build_changelog.py
index addd4b1..ea7a822 100644
--- a/scripts/test_build_changelog.py
+++ b/scripts/test_build_changelog.py
@@ -102,14 +102,14 @@ class ListFragmentsTests(_RepoCase):
     def test_empty_dir(self) -> None:
         self.assertEqual(build_changelog.list_fragments(), [])
 
-    def test_picks_up_md_files_in_sorted_order(self) -> None:
+    def test_picks_up_md_files_in_reverse_sorted_order(self) -> None:
         self.write_fragment("0002-second.md", "second")
         self.write_fragment("0001-first.md", "first")
         self.write_fragment("0010-tenth.md", "tenth")
         result = build_changelog.list_fragments()
         self.assertEqual(
             [p.name for p in result],
-            ["0001-first.md", "0002-second.md", "0010-tenth.md"],
+            ["0010-tenth.md", "0002-second.md", "0001-first.md"],
         )
 
     def test_skips_reserved_names(self) -> None:
@@ -141,7 +141,7 @@ def test_returns_content_in_order(self) -> None:
         self.write_fragment("0002-b.md", "content-b\n")
         fragments = build_changelog.list_fragments()
         self.assertEqual(
-            build_changelog.read_fragments(fragments), ["content-a", "content-b"]
+            build_changelog.read_fragments(fragments), ["content-b", "content-a"]
         )
 
     def test_strips_trailing_whitespace_only(self) -> None: