From dfae14ce1880283530a95eb065798580f0476573 Mon Sep 17 00:00:00 2001 From: John Osumi <931193+sumitake@users.noreply.github.com> Date: Mon, 3 Aug 2026 22:07:27 -0700 Subject: [PATCH 1/2] readme: consolidate What's-new stack, name engineering-process skills, state delegate-selection order Removes the released v4.3.5-v4.6.0 What's-new sections (history lives in CHANGELOG.md; the untagged v4.7.0-v4.9.0 tail stays until released), adds decision-map/prototype/architecture-review to the Skill surface enumeration, and spells out the capability-availability-cost selection law in the cost-tiered delegation bullet. Co-Authored-By: Claude Fable 5 --- README.md | 154 +----------------- .../2026-08-04-readme-consolidation.md | 3 + 2 files changed, 12 insertions(+), 145 deletions(-) create mode 100644 changelog.d/2026-08-04-readme-consolidation.md diff --git a/README.md b/README.md index 47a2f94..1a41342 100644 --- a/README.md +++ b/README.md @@ -67,7 +67,14 @@ trust: named explicitly per call today, with automatic cost-aware worker routing the next step on that path; an explicit target never silently substitutes another provider, and model plus reasoning effort are disclosed per invocation, so - cost and quality stay auditable. + cost and quality stay auditable. Delegate selection follows a fixed order: + capability first (the delegate must clear the task's quality bar — an + under-capable cheap choice that forces rework costs more than it saves), + availability second (an exhausted quota pool is infeasible, not merely + expensive), and only then cost rank, preferring routes that conserve the + primary's own family pool — models of one vendor family draw one shared + quota, so a cheaper same-family model still spends the budget that funds + frontier work. - **A hard security boundary around providers.** Provider CLIs are reached only through a signed, notarized native runtime with per-member digest verification, socket-activated zero-idle execution, and typed-unavailable @@ -181,150 +188,6 @@ Contributors need no access to the private build/sign system. See `docs/third-party-skill-provenance.md` records per-file provenance. No coordinator, provider, or routing surface is touched. -## What's new - v4.6.0 - -- **A Claude Code host observes its own active model.** Claude Code does not - export the model to the environment, so a Claude host resolved - `active_model='unknown'` and was the only host family that could never reach - a governance-ready identity; every governance route failed closed with - `unknown_family`. The model is now observed from the live session's own - transcript, mirroring the existing Codex rollout contract: strict - lowercase-UUID session key before any path join, the same ownership, - symlink, hardlink and permission predicates, post-open `fstat` - re-validation, a bounded tail read, and strict JSON decoding. - `CLAUDE_CONFIG_DIR` is honoured, so a relocated installation resolves too. - Model validation is by shape rather than a pinned list, so future models - resolve with no code change. Identity on a Claude host is observation-only: - every field is recorded non-empty, so configuration cannot fill an - unobserved session into governance eligibility, and a model that is not - anthropic-shaped fails closed rather than reassigning the host-derived - family. - -## What's new - v4.5.4 - -- **Gemini governance accepts the access-only ephemeral containment mode.** - The public client's proof v1 contract still admits exactly - `write_contained_shared_home`. The proof v2 contract now admits exactly two - raw case-sensitive containment strings, `write_contained_shared_home` and - `nonwriteback_ephemeral_home`, matching the producer's access-only canary - mode. A v2 result's containment must equal the independently supplied proof - containment exactly; mixed, crossed, hybrid, unknown, or non-string values - fail closed, and v1 responses remain shared-home-only. Governance readiness - recognizes either exact mode as capability-only and never authorizes - execution. This closes the false `runtime Gemini result contract mismatch` - protocol error on both lanes (workspace issue #2422). - -## What's new - v4.5.3 - -- **New Codex inbox-monitor starts are idle-token free.** The canonical leased - local process keeps its existing 10-second filesystem interval, but the - Codex adapter no longer creates or retains a goal for liveness. State checks - now occur only on real activation, event, status, stop, or failure turns. - Legacy cleanup completes only a monitor goal proven by its structured - creation transcript and after the host proves its exec remains independently - live and controllable; otherwise it returns - `legacy_goal_detach_unavailable` without mutating either lifecycle. - Pre-4.5.3 sessions whose legacy goal cannot be safely detached may continue - receiving host-scheduled empty model turns until that goal is explicitly - stopped; every such turn is constrained to no exec or state poll. - Without a proven host-native event wake, Codex reports the honest - `degraded_no_event_wake` result instead of `armed`. Claude and Antigravity - monitor lifecycles are unchanged. - -## What's new - v4.5.2 - -- **Broker status separates process configuration from momentary activity.** - Successful status reports `persistent_process=false` only after the exact - live launchd transcript proves that neither top-level - `KeepAlive`/`RunAtLoad` properties nor structured event triggers are - configured. Any event-trigger block is intentionally persistence-like: - ambiguity blocks readiness instead of being mislabeled socket-only. - `persistence_state` preserves the full `nonpersistent` / `persistent` / - `unproven` result; an unproven live format yields - `persistent_process=null` and fails readiness closed. A separate, optional - `process_idle` boolean-or-null reports bounded point-in-time quiescence only - when that idle probe actually ran; null means unmeasured, never idle. An - in-flight request or post-request grace therefore cannot make an otherwise - proven callable lane unavailable. Both new status observations are additive - and optional for rolling-upgrade consumers. Mutating lifecycle operations - never use either observation and still require their full idle proof. - -## What's new - v4.5.1 - -- **Containment is structural, provider-agnostic, and rare by design.** Managed - providers authenticate from the canonical user HOME while the caller - checkout remains read-only. Each request receives a private temporary - workspace in which the provider may use tools, edit, build, and reason - agentically; OpenCode build returns output-only material for trusted-primary - application. A blocked access attempt is containment success, not an - invocation failure. Structural containment failure is reserved for a - pre-launch boundary that cannot be established or positive evidence that a - write escaped the allowed paths or changed protected source/credentials. - Authentication, protocol/output, timeout, provider, teardown, and cleanup - failures remain orthogonal. Managed execution does not use output/stderr - heuristics or routine direct CLI fallbacks. -- **The repaired runtime is co-packaged again.** The darwin-arm64 standalone - runtime was rebuilt from final workspace `1.0.823` commit - `d08b6382710d6d5910d64cf011bcac873a2e1c03`, Developer-ID signed, and Apple - notarized as submission `c6d29dec-5351-467d-883e-0b862734567d`. The closed - activation manifest pins bundle SHA-256 - `2cea10cff2030d0238661667cf8d1b83cf9885dc6f4a03b0db4365e891b04f47`; - release verification rejects any byte, member, signature, contract, or - notarization drift. - -## What's new - v4.5.0 - -- **OpenCode Go is the packaged default.** Managed OpenCode requests now - default to `opencode-go/glm-5.2`, Kimi models carry Moonshot provenance, and - hosts can enforce the subscription with - `AGENT_COLLAB_OPENCODE_PROVIDER=opencode-go`. The guard rejects standard - metered OpenCode Zen models, malformed policy, namespace lookalikes, live - provider drift, and late envelope drift before native execution. - -## What's new - v4.4.2 - -- **Execute success now requires usable output at both trust boundaries.** - The private runtime rejects provider executions that complete with missing, - empty, whitespace-only, Unicode-invisible/filler-only, - replacement-glyph-only, terminal-control-only, or malformed-terminal text. - The public client independently enforces the same content-addressed - conformance contract and frozen Unicode-16 blankness table against stale - signed runtimes. The canonical release archive carries the exact contract - beside the client. Response classification retains the original absolute - request deadline and returns typed `timeout` if a large blank/control stream - consumes the remaining budget. Readiness remains - structurally separate, while typed containment, deadline, teardown, and - provider failures retain their existing classifications. - -## What's new - v4.4.1 - -- **Freshly built native runtime.** The darwin-arm64 provider runtime is rebuilt, - Developer-ID signed, and notarized from the current workspace source closure, - replacing a bundle that predated several runtime-behavior changes. v4.4.0 was - cut tag-only and rolled back for exactly that reason; `cut_release.py` now - carries a fail-closed runtime-currency gate so a stale bundle cannot ship. - -## What's new - v4.4.0 - -- **Domain-expert skill pack.** Sixteen new pure-prompt, host-neutral - expertise skills (languages, infrastructure/SRE, data/AI, LLM evals, and - writing quality) join the collaboration/governance set, grouped separately - in the skills table so the package's collaboration core stays scannable. - Authored under workspace ownership after an untrusted-input audit of the - MIT-licensed VoltAgent subagent corpora (pinned source SHAs recorded in the - package README's attribution note and the changelog fragment); no - coordinator, provider, or routing surface is touched. - -## What's new - v4.3.5 - -- **Continuity-safe Gemini governance proofs.** The public runtime client now - accepts the exact legacy proof-v1 contract and the exact recovery-capable - proof-v2 contract as disjoint schemas. Any v2 discriminator selects strict - v2 validation with no fallback to v1, preserving callable retained lanes - while rejecting partial, hybrid, coerced, or contradictory recovery claims. - The documented trust boundary makes explicit that these are consistency - proofs carried by a verified child runtime, not cryptographic signatures. - The full, versioned release history is in [CHANGELOG.md](CHANGELOG.md). ## System architecture @@ -686,6 +549,7 @@ handoff. The unified package includes review, intent, code/security, QA, logic, brainstorming, debate, research, long-context, visual-workflow, delegation, orchestration, +engineering-process (`decision-map`, `prototype`, `architecture-review`), readiness, teamwork, migration, native inbox-monitor lifecycle, and explicit managed-routing skills under the single `/agent-collab:*` namespace. Provider targets are request parameters, not plugin identities. diff --git a/changelog.d/2026-08-04-readme-consolidation.md b/changelog.d/2026-08-04-readme-consolidation.md new file mode 100644 index 0000000..e89f12d --- /dev/null +++ b/changelog.d/2026-08-04-readme-consolidation.md @@ -0,0 +1,3 @@ +### Changed + +- README: consolidated the accumulated "What's new" stack to the unreleased tail (v4.7.0–v4.9.0) with the existing CHANGELOG pointer covering released history; named the engineering-process skills (`decision-map`, `prototype`, `architecture-review`) in the Skill surface enumeration; stated the delegate-selection order (capability, then availability, then pool-conserving cost rank) in the cost-tiered delegation bullet. From 9fc052c8d205c6fa1ffc2ec18024722eed3f65c9 Mon Sep 17 00:00:00 2001 From: John Osumi <931193+sumitake@users.noreply.github.com> Date: Mon, 3 Aug 2026 22:12:59 -0700 Subject: [PATCH 2/2] readme: restore released What's-new sections pending changelog compilation (codex P2) CHANGELOG.md currently holds only [Unreleased]; released history lives in uncompiled fragments, so the What's-new stack is the only reader-facing versioned history until a release cut compiles it. Consolidation deferred to that cut. Skill-surface and delegate-selection edits unchanged. Co-Authored-By: Claude Fable 5 --- README.md | 144 ++++++++++++++++++ .../2026-08-04-readme-consolidation.md | 2 +- 2 files changed, 145 insertions(+), 1 deletion(-) diff --git a/README.md b/README.md index 1a41342..2dc8b4d 100644 --- a/README.md +++ b/README.md @@ -188,6 +188,150 @@ Contributors need no access to the private build/sign system. See `docs/third-party-skill-provenance.md` records per-file provenance. No coordinator, provider, or routing surface is touched. +## What's new - v4.6.0 + +- **A Claude Code host observes its own active model.** Claude Code does not + export the model to the environment, so a Claude host resolved + `active_model='unknown'` and was the only host family that could never reach + a governance-ready identity; every governance route failed closed with + `unknown_family`. The model is now observed from the live session's own + transcript, mirroring the existing Codex rollout contract: strict + lowercase-UUID session key before any path join, the same ownership, + symlink, hardlink and permission predicates, post-open `fstat` + re-validation, a bounded tail read, and strict JSON decoding. + `CLAUDE_CONFIG_DIR` is honoured, so a relocated installation resolves too. + Model validation is by shape rather than a pinned list, so future models + resolve with no code change. Identity on a Claude host is observation-only: + every field is recorded non-empty, so configuration cannot fill an + unobserved session into governance eligibility, and a model that is not + anthropic-shaped fails closed rather than reassigning the host-derived + family. + +## What's new - v4.5.4 + +- **Gemini governance accepts the access-only ephemeral containment mode.** + The public client's proof v1 contract still admits exactly + `write_contained_shared_home`. The proof v2 contract now admits exactly two + raw case-sensitive containment strings, `write_contained_shared_home` and + `nonwriteback_ephemeral_home`, matching the producer's access-only canary + mode. A v2 result's containment must equal the independently supplied proof + containment exactly; mixed, crossed, hybrid, unknown, or non-string values + fail closed, and v1 responses remain shared-home-only. Governance readiness + recognizes either exact mode as capability-only and never authorizes + execution. This closes the false `runtime Gemini result contract mismatch` + protocol error on both lanes (workspace issue #2422). + +## What's new - v4.5.3 + +- **New Codex inbox-monitor starts are idle-token free.** The canonical leased + local process keeps its existing 10-second filesystem interval, but the + Codex adapter no longer creates or retains a goal for liveness. State checks + now occur only on real activation, event, status, stop, or failure turns. + Legacy cleanup completes only a monitor goal proven by its structured + creation transcript and after the host proves its exec remains independently + live and controllable; otherwise it returns + `legacy_goal_detach_unavailable` without mutating either lifecycle. + Pre-4.5.3 sessions whose legacy goal cannot be safely detached may continue + receiving host-scheduled empty model turns until that goal is explicitly + stopped; every such turn is constrained to no exec or state poll. + Without a proven host-native event wake, Codex reports the honest + `degraded_no_event_wake` result instead of `armed`. Claude and Antigravity + monitor lifecycles are unchanged. + +## What's new - v4.5.2 + +- **Broker status separates process configuration from momentary activity.** + Successful status reports `persistent_process=false` only after the exact + live launchd transcript proves that neither top-level + `KeepAlive`/`RunAtLoad` properties nor structured event triggers are + configured. Any event-trigger block is intentionally persistence-like: + ambiguity blocks readiness instead of being mislabeled socket-only. + `persistence_state` preserves the full `nonpersistent` / `persistent` / + `unproven` result; an unproven live format yields + `persistent_process=null` and fails readiness closed. A separate, optional + `process_idle` boolean-or-null reports bounded point-in-time quiescence only + when that idle probe actually ran; null means unmeasured, never idle. An + in-flight request or post-request grace therefore cannot make an otherwise + proven callable lane unavailable. Both new status observations are additive + and optional for rolling-upgrade consumers. Mutating lifecycle operations + never use either observation and still require their full idle proof. + +## What's new - v4.5.1 + +- **Containment is structural, provider-agnostic, and rare by design.** Managed + providers authenticate from the canonical user HOME while the caller + checkout remains read-only. Each request receives a private temporary + workspace in which the provider may use tools, edit, build, and reason + agentically; OpenCode build returns output-only material for trusted-primary + application. A blocked access attempt is containment success, not an + invocation failure. Structural containment failure is reserved for a + pre-launch boundary that cannot be established or positive evidence that a + write escaped the allowed paths or changed protected source/credentials. + Authentication, protocol/output, timeout, provider, teardown, and cleanup + failures remain orthogonal. Managed execution does not use output/stderr + heuristics or routine direct CLI fallbacks. +- **The repaired runtime is co-packaged again.** The darwin-arm64 standalone + runtime was rebuilt from final workspace `1.0.823` commit + `d08b6382710d6d5910d64cf011bcac873a2e1c03`, Developer-ID signed, and Apple + notarized as submission `c6d29dec-5351-467d-883e-0b862734567d`. The closed + activation manifest pins bundle SHA-256 + `2cea10cff2030d0238661667cf8d1b83cf9885dc6f4a03b0db4365e891b04f47`; + release verification rejects any byte, member, signature, contract, or + notarization drift. + +## What's new - v4.5.0 + +- **OpenCode Go is the packaged default.** Managed OpenCode requests now + default to `opencode-go/glm-5.2`, Kimi models carry Moonshot provenance, and + hosts can enforce the subscription with + `AGENT_COLLAB_OPENCODE_PROVIDER=opencode-go`. The guard rejects standard + metered OpenCode Zen models, malformed policy, namespace lookalikes, live + provider drift, and late envelope drift before native execution. + +## What's new - v4.4.2 + +- **Execute success now requires usable output at both trust boundaries.** + The private runtime rejects provider executions that complete with missing, + empty, whitespace-only, Unicode-invisible/filler-only, + replacement-glyph-only, terminal-control-only, or malformed-terminal text. + The public client independently enforces the same content-addressed + conformance contract and frozen Unicode-16 blankness table against stale + signed runtimes. The canonical release archive carries the exact contract + beside the client. Response classification retains the original absolute + request deadline and returns typed `timeout` if a large blank/control stream + consumes the remaining budget. Readiness remains + structurally separate, while typed containment, deadline, teardown, and + provider failures retain their existing classifications. + +## What's new - v4.4.1 + +- **Freshly built native runtime.** The darwin-arm64 provider runtime is rebuilt, + Developer-ID signed, and notarized from the current workspace source closure, + replacing a bundle that predated several runtime-behavior changes. v4.4.0 was + cut tag-only and rolled back for exactly that reason; `cut_release.py` now + carries a fail-closed runtime-currency gate so a stale bundle cannot ship. + +## What's new - v4.4.0 + +- **Domain-expert skill pack.** Sixteen new pure-prompt, host-neutral + expertise skills (languages, infrastructure/SRE, data/AI, LLM evals, and + writing quality) join the collaboration/governance set, grouped separately + in the skills table so the package's collaboration core stays scannable. + Authored under workspace ownership after an untrusted-input audit of the + MIT-licensed VoltAgent subagent corpora (pinned source SHAs recorded in the + package README's attribution note and the changelog fragment); no + coordinator, provider, or routing surface is touched. + +## What's new - v4.3.5 + +- **Continuity-safe Gemini governance proofs.** The public runtime client now + accepts the exact legacy proof-v1 contract and the exact recovery-capable + proof-v2 contract as disjoint schemas. Any v2 discriminator selects strict + v2 validation with no fallback to v1, preserving callable retained lanes + while rejecting partial, hybrid, coerced, or contradictory recovery claims. + The documented trust boundary makes explicit that these are consistency + proofs carried by a verified child runtime, not cryptographic signatures. + The full, versioned release history is in [CHANGELOG.md](CHANGELOG.md). ## System architecture diff --git a/changelog.d/2026-08-04-readme-consolidation.md b/changelog.d/2026-08-04-readme-consolidation.md index e89f12d..649ba9d 100644 --- a/changelog.d/2026-08-04-readme-consolidation.md +++ b/changelog.d/2026-08-04-readme-consolidation.md @@ -1,3 +1,3 @@ ### Changed -- README: consolidated the accumulated "What's new" stack to the unreleased tail (v4.7.0–v4.9.0) with the existing CHANGELOG pointer covering released history; named the engineering-process skills (`decision-map`, `prototype`, `architecture-review`) in the Skill surface enumeration; stated the delegate-selection order (capability, then availability, then pool-conserving cost rank) in the cost-tiered delegation bullet. +- README: named the engineering-process skills (`decision-map`, `prototype`, `architecture-review`) in the Skill surface enumeration, and stated the delegate-selection order (capability, then availability, then pool-conserving cost rank) in the cost-tiered delegation bullet. What's-new consolidation is deferred to the next release cut, when the changelog fragments are compiled into `CHANGELOG.md` — until then the README stack is the only reader-facing versioned history.