@iowarp/clio-coder 0.3.0

package/CHANGELOG.md

@@ -0,0 +1,407 @@
+# Changelog
+
+Public release notes for Clio Coder are documented here. This file is kept
+intentionally short for users, operators, and community contributors. The
+implementation detail and verification notes behind each entry live in the
+commit history, where every change carries the transcript and gates that
+produced it.
+
+Versions follow semantic versioning for a pre-1.0 project: minor versions may
+still change interfaces.
+
+## 0.3.0 - 2026-08-14
+
+- Renamed every namespace the tool occupies on a user's machine from `clio` to `clio-coder` ahead of the first npm publish, so the future clio-core, clio-agent, and clio-kit tools can coexist with it: the installed binary and every command example are now `clio-coder`, XDG config/state/cache directories use a `clio-coder` segment, the project context directory is `.clio-coder/`, the generated handbook is `CLIO-CODER.md`, environment variables are `CLIO_CODER_*`, and extension manifests are `clio-coder-extension.*`. The product name in prose remains Clio Coder, and code-internal identifiers, event names, and receipt fields are unchanged. There are no migration shims: this ships in the first published release, so there is no installed base to migrate.
+- Marked v0.3.0 prominently as experimental in the CLI/TUI startup experience and repository front page: behavior and interfaces may break or change without notice.
+- Added the agent ledger, a bounded coordination surface the concurrent workers of one dispatch share. A worker in a multi-run dispatch posts typed entries over its existing control lane: a claim staking path scopes so peers stop duplicating work, a cited finding a peer can corroborate, or a review of another entry by id. Every worker receives the board at spawn framed as untrusted peer data and live deltas over stdin, and reads answer from a local mirror with an explicit staleness watermark rather than blocking on a round trip. The orchestrator is the sole writer and stamps every attribution field from its own admission record, so a worker cannot forge authorship; posts are capped at twenty per run; rendering labels each finding corroborated, uncorroborated, or an ungrounded lead and never merges peer output into a consensus, so the single-worker finding that matters stays visible. Each run's receipt seals its contribution count and digest, and a run with no peers never sees the tool.
+- Made compete candidates diverge on purpose instead of racing four near-identical attempts. Each candidate receives one engineering stance from a closed set (minimal diff, test-first, refactor-tolerant, spec-literal) as a one-line dynamic prompt message that leaves the task, recipe, and result contract untouched, and the judge now reports where the candidates disagreed rather than only which one won.
+- Fixed active session branches staying active through production compaction, post-compaction replay, and editor `!command` sidecars. Switching to an older `/tree` branch no longer lets the most recently appended abandoned sibling silently replace provider context.
+- Made global CLI startup parsing one strict, order-independent pass. Interleaved `--skill`, `--api-key`, and context flags no longer expose a secret as a mistaken subcommand, command recognition and dispatch now share one registry, and misspelled leading options fail closed instead of disappearing.
+- Made ACP connect, turn, and permission deadlines mandatory schedulable bounds. Zero can no longer disable a request timer, oversized values can no longer overflow Node into an approximately 1 ms timeout, and CLI, settings, direct adapter, and transport paths share the same defaults and timer ceiling.
+- Stopped automatic retries after a failed attempt has executed a potentially state-changing tool call, including a tool that returned an error after partial work. Clio does not yet isolate ordinary retry workspaces, so launching a successor in the same checkout could consume partial edits; read-only, model-startup, and transport failures remain retryable. Removed the disconnected workspace-transaction implementation and direct-only tests that falsely implied this boundary was wired.
+- Removed unreachable pre-release scaffolds, obsolete barrels, empty tombstones, and the superseded auth selector, then enabled TypeScript unused-local and unused-parameter checks so dead implementation residue fails the build instead of accumulating.
+- Added the soak, a benchmark whose subject is Clio rather than the model. Every other suite measures what a model produced and passes a run whose receipt never sealed, whose seal does not authenticate, or whose stream republished its own transcript. `benchmarks/soak/clio-soak.yaml` inverts that: a weak model that never repairs the fixture passes because the machinery behaved, and a strong model that repairs it fails the moment Clio breaks a promise about itself. Three sibling suites gate what their own surface can answer, for write boundaries, bounded loops, and SIGINT chaos. It runs offline against a local target, because a gate on Clio's own invariants that needs a cloud key is not a gate.
+- Made invariant metrics fail closed by construction. `src/domains/eval/metrics/invariants.ts` reduces receipt, session, process, and write-boundary promises from the journal each eval item leaves behind, and every reader is total: a metric it could not compute is absent rather than false, because a threshold on an absent metric fails closed while a fabricated value is indistinguishable from a check that passed. Each metric has a test proving it fails on a corrupted artifact.
+- Made eval token accounting observed rather than assumed. Usage is folded out of a runner's live stdout as it arrives, so truncating the operator-facing artifact cannot erase it. A runner that observed no usage reports `tokens.measured: false` and no counts at all, never a zero, and reports say how many runs a total covers. Eval artifacts moved to version 4 with a discriminated `summary.tokens`; the parser refuses counts beside `measured: false`, a `tokens.total` threshold on an unmeasured artifact fails closed, and a comparison against an unmeasured side reports an unmeasured delta.
+- Added receipt-derived accounting for surfaces that publish no usage stream. `clio-coder fleet run --json` drains its workers' events, so a bounded loop's cost never reached the stream fold. `receiptUsage.*` reads what the run sealed and authenticated, carries its own provenance, and never merges with or masquerades as stream-observed `tokens.*`. An incomplete or unauthenticated receipt set reports unmeasured and no counts.
+- Added per-step write boundaries. Fleet contract v4 declares a `writes` path allowlist per step, `readonly` being the empty one, and the orchestrator verifies the claim after the fact by diffing the checkout against a pinned baseline, rolling back unauthorized changes, and sealing a verdict carrying its own digest and that baseline. This is detect-and-rollback, never sandboxing: nothing prevents a write, and confinement an agent cannot escape needs OS-level isolation this does not provide. A path that cannot be cleanly restored is reported and left for the operator rather than guessed at.
+- Added bounded check/repair loops and the shipped SDLC chains. A `loop` declares `maxAttempts`, a check, and an agent repair, and compilation unrolls it into conditional nodes so the plan stays one deterministic hashed DAG with a receipt per attempt. The declared bound is the promise: attempts never exceed it, every attempt after the first is `recovery`, and a spent bound reports `loop_bound_exhausted` rather than a green it did not earn. Verification staleness is scheduler-enforced.
+- Added deterministic `code` steps. A step names a command id from the repo-owned registry at `.clio-coder/fleets/commands.yaml`, never a shell string a model authored, and an unknown id or missing registry fails contract validation before anything dispatches. A code step holds no capacity lease and carries no execution role or authority grant.
+- Added headless session continuity. `clio-coder run --session <id>` appends to an existing session and `--continue` to the most recent one for the working directory. Continuation is a hard requirement rather than a hint: a session that cannot be resumed exits 2 before any model call, because an answer written without the history the caller asked for is worse than no answer. The session id is discoverable from the surface that ran the turn, and stdout stays the assistant's answer alone.
+- Made process-safe dispatch admission durable. Capacity leases are the expiring global and per-node authority, with acquisition, retry rebinding, heartbeat, drain, and reservation transfer serialized by one cross-process lock. The lease bound fails admission closed rather than dropping a lease, a plan slot belongs to an assignment so a retry never queues behind itself, and the operator's machine-wide drain is TTL-bounded so an abandoned drain cannot wedge the host.
+- Made context budgeting distinguish a target-reported limit from Clio's planning assumption. A router can answer `/props` with `n_ctx: 0` while a model-specific probe or LM Studio detail row records the selected model's context, including its currently loaded window rather than its larger theoretical maximum; selection is exact-id and target status names the source. A target that declares no window now receives Clio's explicit 131,072-token assumption with a human-visible warning to probe it, and a reported window below 128,000 warns on every runtime tier instead of quietly shrinking a session to the obsolete 8K fallback.
+- Fixed `clio-coder run --agent --json` republishing its segment transcript. Every message in an `agent_end` had already crossed the wire as its own `message_end`; on a two-minute run that was 24 KB restating 19 KB, and the ratio grew with the answer. Both `--json` wire projections now live in one module and make the same promise: content crosses exactly once.
+- Fixed a suite's declared `thresholds.fail` deciding nothing at run time. Only a later `eval gate` invocation read it, so a run that broke a declared threshold still exited zero. A gate now reaches per-run metrics, so the failure names the run rather than an aggregate, and an assertion whose metric was never measured fails closed in both layers.
+- Updated the Pi engine dependencies to 0.83.0. `src/engine/` is now the one place pi types enter the codebase; no file outside it imports `@earendil-works/*`, type-only included.
+- Made the default `clio-coder --help` describe the command surface a person needs to read while preserving the complete surface for scripts and agents. Harness-oriented commands are grouped under `clio-coder dev`, `clio-coder --help --all` reveals both sets, and the former top-level command forms continue to resolve unchanged.
+- Reorganized the interactive application into focused controller, presentation, input, event-projection, process-shell, transcript, ticker, editor, slash-command, and overlay lifecycle modules. The TUI's public behavior and command surface are unchanged; the decomposition gives lifecycle, input, overlay, and rendering contracts independent test seams instead of concentrating them in a 3,600-line entrypoint.
+- Fixed direct shell interpolation while opening provider URLs on macOS and Linux. Interactive OAuth authorization, device-code, and console URLs once entered an `exec()` command after only double-quote escaping, so backticks or command substitutions in provider-supplied text could execute before the browser opened; `open` and `xdg-open` now receive the URL as a distinct `spawn()` argument. Windows still starts its browser through `cmd /c start`, so this change removes the original `exec()` construction there but does not claim a shell-free Windows launch.
+- Made retries distinguish a self-hosted model that is loading from an ordinary rate limit. Unloaded or loading-model errors now qualify for retry with a 15-second minimum delay that still honors the configured maximum, so disk and VRAM loading does not spend the usual short backoff sequence before the target can serve a request.
+- Corrected damage-control matching so it evaluates commands that will execute rather than prose a file will contain. Writing documentation that quotes `rm -rf /`, a migration that contains `DROP TABLE`, or a classifier fixture no longer trips a command-pattern block; the same destructive command remains subject to policy when passed to a command-bearing tool, and destination paths still receive path-based checks.
+- Reworked project-context bootstrap around the dedicated `context-bootstrap` agent and a generated local handbook. `CLIO-CODER.md` is a gitignored runtime artifact rather than this repository's canonical instructions; the agent uses ordinary binding and default route resolution while honoring a legacy Scout binding, an existing handbook informs generation rather than silently cancelling it, and default initialization preserves it until an explicit `--apply` or `--rewrite` action. Bootstrap retains the previous handbook provenance when a run generates nothing and reads project identity from the manifests, build files, citation records, and README forms each ecosystem uses instead of assuming a Node package.
+- Made `clio-coder context refresh` update only the existing handbook sections the rebuilt codewiki owns, leaving model- and human-authored prose stable, and made context status name a partial generated wiki as incomplete rather than presenting it as coverage it has not earned. Context reset preserves the wiki by default and its help names that exception, so a destructive action is not hidden behind a generic reset.
+- Rebuilt generated wikis around a depth-scaled, index-derived page plan and isolated page writers. A bounded planner may refine the deterministic candidate, but each `wiki-writer` dispatch is confined to staging, receives a bounded source set and no Git tool, checkpoints one page at a time, and promotes the coherent pages it wrote while recording the rest for `clio-coder context wiki --update`. Deterministic assembly regenerates navigation from pages on disk, drops empty pages so they remain owed, and records unresolved links and citations for the next update rather than fabricating complete coverage.
+- Hardened the skill substrate from discovery through evaluation. A `SKILL.md` must be bounded valid UTF-8 text and a discovered root must contain the content it advertises; scalar or sequence tool declarations resolve to Clio's actual tool surface and warn on unenforceable names. `clio-coder skills eval` now measures the precedence-winning copy activation would load and reports its origin and hash, while install and update constrain GitHub paths to the cloned repository, validate a staged replacement before an atomic swap, preserve the installed copy on failure, and detect post-install drift against the recorded or catalog-pinned normalized hash.
+- Fixed worker budgets so late-run guardrails preserve the artifact a worker was admitted to produce. The reserve and soft limit now end broad discovery rather than read, write, edit, or the closed `orientation` product's `code_nav` delivery surface; executed calls remain bounded by the lifetime cap, refused calls do not spend it, free refusals carry their own bounded backstop, and loop escalation scales with the worker's admitted budget instead of the interactive threshold.
+- Made provider thinking controls and usage accounting describe what actually reached a model. `thinking: off` now sends an explicitly mapped off effort for supported effort-level families, while families with no such mapping continue to omit the field and LM Studio native reports its transport cannot send template thinking controls. Reasoning tokens remain accounted even when Clio suppresses the thought text, so an incorrect reasoning-never classification cannot make the server's observed usage disappear.
+- Made the npm release contract follow the runtime resources an installed CLI actually resolves. One shared release manifest now drives the package gate and tests, source analysis checks literal package-root paths against the allowlist, bundled HTML remains present for `clio-coder docs`, and generated repository-local handbooks cannot leak from a release checkout into the tarball.
+- Changed how the TUI treats a slash command it does not recognize. A command-shaped token now fails with `/<token> is not a command. Type /help for the list.` instead of being sent to the model as ordinary chat. This removes the fall-through that previously let four renamed spellings, `/status`, `/hotkeys`, `/skills`, `/connect`, `/disconnect`, `/receipts`, and every typo reach the model as a question about itself. The accepted cost is that one command-shaped word followed by prose now resolves as a command, so `/tmp is full` fails; the escape is a leading backslash, and `\/tmp is full` reaches the model unchanged.
+- Fixed `clio-coder uninstall --remove-binary` reporting that it removed a dangling launcher symlink while leaving it in place, which left a broken `clio-coder` on `PATH` after an uninstall that exited zero. Launcher ownership is now the resolved identity of this installation's own entry, so a link into a different clio-coder installation and a symlink whose target is a directory are both preserved with an actionable warning, and only a link that resolves to this installation, or a dangling link naming a clio-coder entry, is removed.
+- Fixed `clio-coder reset` and `clio-coder uninstall` reporting global success after a partial delete. Both now attempt every selected root, collect per-path failures instead of throwing the first one, rebuild the skeleton, name each surviving path with its reason, and exit 1 with the exact invocation to rerun.
+- Fixed `clio-coder trace --help` failing with `unknown trace flag: --help` and exiting 2 while every other subcommand answered on stdout with status 0. `clio-coder trace` usage also now says that `clio-coder trace ui` needs a source checkout, which is where the viewer ships; from an installed package the other trace subcommands read the same database.
+- Fixed `clio-coder configure --list` and the first-run runtime menu writing fixed-width rows sized for roughly 88 columns, which ran model hints to 141 columns on an 80-column terminal. The plain-stdout configure surfaces now measure the terminal and degrade by restacking rather than by dropping information.
+- Fixed error messages that named a command which could not change the outcome. An invalid `settings.yaml` now names the file, the keys, and `clio-coder reset --config --force` rather than `clio-coder doctor --fix`, which by design never rewrites settings content; an interrupted install that leaves a missing chunk reports reinstall instructions; and `clio-coder run --no-context-files` explains that global options precede the subcommand instead of reporting an unknown option.
+- Fixed a cancelled turn poisoning every later turn in the same session. The durable closing turn a cancel writes carries no provider `usage`, because no model call produced it, and it was recorded `stopReason: "stop"`, which walked it past the context estimator's aborted-or-error guard. The next turn then failed in roughly 30 ms with `Cannot read properties of undefined (reading 'totalTokens')` and no network call, and kept failing for the life of the session, because the process that wrote the record never re-read it and every later read did. The closing turn is now recorded `aborted`, which is what happened. Replay learned the same distinction: an aborted turn that carries its own text and no provider `errorMessage` is a notice Clio wrote itself and renders as that text alone, while a genuine mid-stream abort keeps its error line.
+- Fixed `clio-coder auth login` destroying the credentials it could not parse. Every write to `credentials.yaml` is a whole-file rewrite of the parsed view with no backup, and the parser answered a YAML error by returning an empty store, so a single login serialized that emptiness over the secrets and took the file from 211 bytes to 112. What made it likely rather than obscure is that `clio-coder doctor` called the file OK and `clio-coder auth list` showed every provider `disconnected`, the same word it uses for a provider you never logged into, so the operator is told they are logged out and then does the one thing that looks like recovery. Reading now reports what was lost on the way in, a write over invalid YAML or an unreadable shape refuses and names the file and the reason with a non-zero exit, the in-memory view is no longer updated ahead of the disk write, and `auth list` and `auth status` warn instead of understating. The refusal is bounded so a first login still works: absent, empty, comment-only, and empty-mapping files are clean rather than damaged, and only a non-empty mapping in neither known shape is refused.
+- Fixed `clio-coder doctor` reporting a root it cannot use as a healthy directory. The four root rows tested existence, which is true for a regular file and for a mode-000 directory, so doctor exited 0 and `clio-coder doctor --fix` one command later died on `Expected directory` and printed no report at all. Each root is now checked for being a directory that is readable, writable, and traversable, and the row names which of those failed; a `--fix` that throws records a `repair` row and still prints the rest of the report; and the metadata row no longer calls an `install.json` that is present and merely unreadable missing.
+- Added `[s] stop turn` at the permission prompt, which previously offered no exit from a repeating approval loop. `s` denies the call and ends the run through the same path the loop guard uses, closing the turn with a durable notice naming the tool, answering every call the turn had parked, and suppressing the re-notify that would otherwise open the next one. Escape is unchanged and still answers exactly one call.
+- Fixed `/cost` and the footer usage line rendering one process-lifetime accumulator that only a new session ever reset, so a resumed session showed the previous session's totals under the resumed session's id, and a process that resumed and sent nothing reported zero for a session holding tens of thousands of tokens on disk. Resume, `/tree` switch, and `/fork` reseed those totals from the session's own ledger, skipping turns marked aborted or error along with the all-zero usage block a cancelled partial persists.
+- Made `clio-coder doctor` report the session and credential damage its own loaders already see. A `session store` row fails when `state/sessions` is gone while state metadata remains, which previously left doctor byte-identical to a healthy run in both text and `--json`; damaged ledgers are parsed with the reader `clio-coder run --continue` uses and the row names up to three `path:line` damage points before summarizing the rest. The credentials row consults the same damage reason the storage layer reports, so an unparseable store fails the row with the YAML reason and an unreadable one names the path and the remedy rather than a raw `EACCES` string. The `invalid JSON skipped` line prints once per damaged line per process instead of six times.
+- Made `clio-coder usage report` distinguish a missing store from zero activity, and gave it the token and cost facts it never carried. Text names `session store missing at <path>` and `receipt store missing at <path>`, the opportunities section says the inputs are absent rather than concluding `none`, and `--json` emits `session-store-missing` and `receipt-store-missing` facts. Token and cost rows are folded from the same per-call ledger fold `/cost` reads, which now lives in `src/domains/session/usage.ts` and is imported by both surfaces, so the headless report and the TUI cannot drift into two answers for one ledger.
+- Fixed writers recreating state the operator had just removed. `clio-coder uninstall` reported `removed Clio Coder state` and then a live process resurrected `runs.json` from memory on quit, holding runs whose receipts no longer existed, so `clio-coder fleet status` billed them while `clio-coder usage report` said zero for the same week. One shared guard in `src/core/xdg.ts` now covers the session shutdown checkpoint, tree and meta persistence, the audit log, recent-models, and the dispatch ledger. It reads the resolved XDG cache rather than probing the path, because a bare existence check cannot tell a removed root from a first run that has not created one yet, and a probe-based guard would have silently disabled the audit writer on fresh installs. Separately, `clio-coder uninstall --dry-run` no longer leaves npm debug logs in `$HOME/.npm/_logs`, which the documented side-effect-free preview wrote on every invocation.
+- Fixed `clio-coder auth login` printing its success line and exiting 0 after a write the storage layer had refused, which reported a stored credential that was never written. Every credential-writing CLI path now consults the storage damage reason after the write and reports the refusal with a non-zero exit, and the interactive auth overlay consults the same reason instead of claiming success on the refused write.
+- Made `clio-coder reset` and `clio-coder uninstall` say what they are about to destroy and what survives. The reset preview lists each root's real children with counts and gives every scope a note, and the help defers to that listing rather than describing it. Uninstall enumerates the per-project `.clio-coder/` directories recorded in session metadata and names `clio-coder context reset --all` before the roots and the launcher are touched, because the record it reads lives inside a root it is about to remove and the cleaner is a subcommand of the binary `--remove-binary` is about to delete. Per-project directories are still not removed by uninstall; this makes the ordering visible rather than closing the gap.
+- Made a failed settings reload render as one width-clamped notice from the shared settings formatter instead of an inspect dump and a stack trace that corrupted the frame. Read, parse, and schema failures are distinguished, the remedy matches the kind and leads the detail so frame clamping cuts context rather than the fix, the raw YAML source fragment is gone, and the previous good configuration stays active. Doctor's settings row and the thrown error use the same helpers.
+- Fixed `clio-coder targets --probe` writing fixed-width rows that ignored the terminal. The id column never truncates, url and model truncate with an ellipsis, `--json` stays untruncated, and surplus width goes to url and model before the tier column, which had let four distinct hosts render identically at 120 columns while the group header already carried the tier.
+- Added slash aliases for the spellings people actually type: `/exit` resolves to `/quit`, `/config` to `/settings`, and `/compact` to `/context compact`, with aliases offered in tab completion ranked below their canonical commands. A rejected unknown command now clears the composer rather than leaving the text to concatenate with the next keystrokes into a message to the model.
+- Made the TUI tell the truth about a denied tool call and about usage the ledger was hiding. A denial renders as the dialog outcome and status alone, the collapsed row reads `bash(id) ✗ blocked` instead of claiming the call `ran`, and no parked-approval line survives the decision. `/context compact` persists its summarization usage on the compaction entry and moves `/cost` immediately, so a real model call stops being invisible to every usage surface. A cancelled turn now persists estimated usage marked `estimated: true` in the shape a completed turn uses, rather than the all-zero block the cancel path used to write beside real streamed text, and `/cost` readers skip it. `/tree` shows the fork parent and the compaction and branch nodes, and replay no longer dumps `custom:promptRecompiled` JSON into the transcript. The stop-turn notice no longer doubles the usage line onto the empty assistant entry it splits open, and a settled entry holding nothing renders nothing instead of an empty bubble.
+- Made overlay footers say what Esc will do from where the overlay is right now. The verb was derived from whether an overlay committed anything, which produced `cancel` on half of them and `close` on the other half while neither word described the key: a list overlay clears a typed filter on the first Esc and closes on the second, and the footer said `close` through both. The caller names the action now, out of a fixed vocabulary of `close`, `clear filter`, and `back`, and `/models` and `/resume`, which close on the first Esc, say so instead of advertising a filter they do not clear. Every overlay uses one filter vocabulary.
+- Fixed a repair masquerading as an install. `initializeClioHome` stamped `installedAt` when it had only repaired an existing home, so the install date moved every time doctor rebuilt the skeleton. A repair writes `repairedAt`, `install.json` accepts either stamp, and doctor prints whichever exist. The doctor damage row groups identical messages instead of repeating one error three times.
+- Made every cost surface claim only what something measured. The cost aggregate could not tell nothing-priced from priced-at-zero, so the footer asserted `$0.00` before any turn had run while `/cost` on the same session said no usage was recorded, and after a real turn against a target that publishes no pricing both printed the literal words `cost unknown` where a number belongs. The aggregate carries its call count, one formatter answers every surface, and a surface with no priced call shows no cost field at all. Usage and cost are separate claims: the tokens were counted whatever the pricing did, so the session total stays on screen and only the cost field disappears. A fixed-width cell that owns a cost column cannot drop the field, so it says `not measured` in words rather than inventing a number.
+- Made the footer describe the branch on screen rather than the whole ledger file. `current.jsonl` is append-only, so after a `/tree` switch the abandoned sibling turns are still in the file: the transcript stopped showing them while the session total, `/cost`, and the last-turn status line kept counting and describing them. All three now fold through the same active-path lineage the transcript replays, on `/tree`, `/resume`, and `/fork`. The footer's chip strip also ranks its chips, so the chip budget and the width budget both shed per-turn detail first and the session total last; it used to slice whatever sat at the end of the list, which cost an 80-column terminal both the total and the cost chip while spending the whole budget on per-turn detail. Two fields the ledger does not record are left neutral on a rescoped line rather than reconstructed: the watchdog peak, and reasoning tokens no provider reported.
+- Made the installer and uninstaller describe one `PATH` the same way. `scripts/install-local.sh` compared the resolved `clio-coder` against its own link path as raw strings, only when the bin directory was already on `PATH`, and never on a dry run, which is why a shadowing install could go unreported in exactly the case where the other `clio-coder` is the only one a bare name reaches. Both sides are resolved through their symlinks before they are compared, and the installer prints the same `another clio-coder is on your PATH at <path>` warning and check command that `clio-coder uninstall` prints. The README install block clones the release ref, carries verbatim the `export PATH` line the installer prints when the bin directory is not on `PATH`, verifies with the launcher's resolved path, and asks `command -v clio-coder` rather than comparing `--version` output, because two installs of the same release report the same version while the bare name still resolves to the other one. The warning names the divergence; it does not reorder anyone's `PATH`.
+- Added a reserved `clio:` frontmatter block so a Clio skill stays a portable skill. Catalog skills carried `registry-id`, `source-url`, and audit fields at the top level of their frontmatter, mixed in with the community-standard keys every agent loader reads. `name`, `description`, `version`, `license`, and `allowed-tools` now stay exactly as the wider ecosystem expects, and everything Clio-specific moves under one `clio:` mapping extended with provenance, origin, eval status, model size, and agent bindings. A Clio skill dropped into any `.claude/skills` directory loads unchanged with the block ignored, and loaded by Clio Coder it carries its full marketplace metadata. The loader reads the nested block first and falls back to the flat keys for already-installed copies, install writes the nested form, and the pinned content hash covers it.
+- Added sixteen ported skills and a `git-master` builtin agent, taking the catalog from sixteen skills to thirty-two. Every port was rewritten to the catalog bar rather than copied, with provenance and origin recorded in its `clio` block and eval status honest at `untested` for the ports that have not been evaluated. `git-master` owns bounded git operations end to end and binds the six rewritten git skills, while `coder` binds only commit-crafting and review-changes on role fit, because binding injects skill names as guidance and the rest would misdirect an implementation loop. Two limits are recorded rather than papered over: `ast-grep` is bound to the main agent only, because the scout role's read-only tool class cannot admit an execute-class tool and the clean path is a typed read-only tool that does not exist yet, and `worktree-create` stays sequential because no worker recipe carries bash. `coding-standards` and `tech-spec` enter as provisional under a documented trial field.
+- Reorganized the thirty-two skill catalog into seven category folders, `research`, `coding`, `git`, `planning`, `context`, `workflow`, and `meta`, and renamed the skills to carry their job instead of their source repository's branding. The `piv-` prefix is gone in favor of `commit-crafting`, `review-changes`, `investigate-issue`, and `create-pr`, `plan-create-prd` becomes `product-requirements`, `plan-architecture` becomes `architecture`, and `plan-create-stories` becomes `backlog`, with titles, descriptions, eval headers, cross-references, source URLs, and the builtin agent bindings all moving together. The pin script discovers packages recursively and renders `registry.yaml` grouped by category, and marketplace discovery probes one category level down. The move also surfaced a packaging defect it fixes: the release manifest shipped only `cut-it`, so an installed package could not have resolved `git-master`'s bound skills, and it now ships `workflow/cut-it` and the whole `git` category.
+- Smoke-checked the entire skill catalog against a 30B local model through the real eval harness, one transcript-verified scenario per skill. The campaign surfaced a judge that scored instruction prose instead of transcripts and a permission gate that blocked every git call headless, so the git scenarios gained seeded repository fixtures and the expected results were rephrased to observable behavior. Five skill bodies were corrected from what the runs showed, each skill records a dated smoke result, and `smoke-checked` is a documented eval status; skills the cutoff reached first remain honestly at `scenarios-recorded`.
+- Added `queued_user_turn` to the `--json` wire protocol. A steer or follow-up typed while a turn is still running used to enter the run with nothing on the stream to mark it, so a `--json` consumer saw the model react to text it had never been told about. The frame is emitted at injection time, when the queued text actually enters the run rather than when it was typed, and it carries the same text the model receives. It is a new frame on a public wire, so consumers that switch on frame kind should expect it.
+- Removed the four-second freeze on opening a workspace and took the redraw cost off the transcript's length. Codewiki startup ran a synchronous `statSync` sweep that blocked the event loop for 3342 ms on this repository and now costs 12 ms. TUI dirty-frame render fell from 10 ms to roughly 0.14 ms at 400 turns, because the frames above the viewport are a frozen prefix that is composed once instead of re-rendered every keystroke. Workspace enumeration no longer holds the loop for a 34 ms floor; a cooperative async walk yields between batches, and the worst block observed under validation is 9 ms to 15 ms.
+- Made the settings center's three-column layout start at a real 120-column terminal. The description earned its own column at a threshold of 116, but two nested frames sit above that body and each costs a border and a pad, so a 120-column terminal only ever presents 112 columns and the layout never appeared outside a 124-column window. The floor is 112, and the contract test pins both sides of the boundary at the body widths a 120- and a 119-column terminal actually produce.
+- Added a fleet roster to the compiled session prompt, so the orchestrator can see the agents it may dispatch instead of guessing. `agent: "auto"` now baselines from task shape, sending code work to `coder`, tests to `tester`, docs to `documenter`, review to `verifier`, and research to `researcher`, where it previously resolved to the read-only `scout` for everything.
+- Replaced the delegation incentive with a rule the model can evaluate: two or more independent file-scoped subtasks, or any broad exploration, goes to workers, while synthesis, validation, and a single narrow change stay with the orchestrator. A file handed to a worker is not the orchestrator's to edit, and an admission refusal is reported rather than silently worked around.
+- Made the run summary the orchestrator reads carry what the worker did. A mutation-class run whose mutating calls all failed now reports that nothing was written instead of a bare successful exit.
+- Made sealed results measurable against the run's own tool events. A reported changed path the run wrote verifies, one whose only write was refused fails, one that exists but was never touched seals quality unmeasured, and one that exists nowhere fails outright. A passing validation claim that no executed command supports downgrades to unmeasured with the claim named, while a check the recognizer cannot tie to a claim is reported unmatched rather than called fabricated.
+- Added capability-mismatch refusal at dispatch admission. Pointing a read-only recipe at mutation work is rejected before a worker exists, and only when the caller pinned the id, the task classifies as mutation, and the recipe's postcondition is a report. Anything short of that admits with a flag on the receipt, and `agent: auto` never refuses.
+- Gave workers the workspace root and a bounded top-level listing on every dispatch, closing the case of a worker spending a fifth of its call budget locating the repository.
+- Added operator-initiated backgrounding. `Alt+S` converts a running attached dispatch into a detached batch, the runs continue, and collection is unchanged. Review gates, compete, pipelines, Scout fleet plans, and time-boxed calls refuse the conversion and say why.
+- Added `monitor` with `mode="tools"`, which reports what a run executed from the event tail and the receipt's integrity-checked totals.
+- Made scratch directories under `/var` write like `/tmp`. `/var` stays protected with `/var/tmp` and `/var/folders` carved out, `/run` joins the protected list, and a pathless `artifact` call no longer writes into a system root without confirmation.
+- Made compound bash earn recognition. A `&&` chain is evaluated at its most restrictive recognized member and refused as a whole if any member is unrecognized, and an `sh -c` wrapper is read through to its inner command rather than around it.
+- Made a headless denial name the form that would have been recognized. A headless run cannot answer a permission prompt, so an agent that hit the wall used to retry variants until the loop guard ended the turn.
+- Fixed project-context bootstrap being dead on llama.cpp. That server refuses any request carrying both a response schema and tools, and every bootstrap dispatch carries tools; the conflict is now refused at admission and the run goes straight to the prompt-parser fallback. A failed bootstrap reports the real error instead of "did not return an assistant response", and a `--rewrite` that fell back to the existing handbook says so and exits 1.
+- Made interactive turns visible to `clio-coder trace`, recorded as runs under a `session` assignment id with one event per tool call. A missing database now reads as an empty state naming its path rather than raw sqlite text, and the `node:sqlite` experimental warning is gone from trace commands unless `--trace-warnings` is passed.
+- Made the TUI read the tool verdict the registry issues instead of pattern-matching output text, which had rendered a failing test whose output contained the word "cancelled" as a policy block. The verdict persists through `/export` and `/resume`.
+- Fixed a headless run whose turn ends on a terminating artifact printing nothing and exiting 0. The artifact content is the answer and now reaches stdout.
+- Made `clio-coder skills eval` measure the skill instead of the harness. Arms are hermetic and run at full-auto in disposable workspaces, so an exec-class call is no longer scored as a skill failure; `--allow-network` opts back into network tools. The judge scores transcript evidence only, and an unparseable judge verdict is `unmeasured` at exit 3 rather than a verdict.
+- Published `skills/skill-marketplace.json` beside the pinned registry, so an install can point `CLIO_CODER_SKILL_MARKETPLACE_INDEX` at it and resolve bare names. `clio-coder skills install` takes several names and `--category`, `search` matches that same category vocabulary, and `inspect` on a marketplace name says the skill is not installed rather than denying it exists.
+- Fixed the Skills Hub listing fifteen installable-looking rows in an environment with no marketplace configured. The rows came from a third source nothing else consulted; the hub now builds from the same discovery the installer uses, and a fresh environment gets an empty state naming the two real ways to get a skill.
+- Fixed `--help` executing, rejecting, or being swallowed across the `targets`, `context`, `fleet`, and `auth` subcommands. Every one answers with usage on stdout at exit 0 and executes nothing.
+- Gave the artifact loaders one not-found voice. `clio-coder eval report`, `clio-coder evidence inspect`, `clio-coder evolve manifest validate`, and `clio-coder components diff` named raw filesystem errors; they now name the id or path that was missing, and `clio-coder docs` prints its absolute served directory from any working directory.
+- Reconciled the `clio-coder auth login` and `clio-coder configure --list` runtime inventories, which drew from one source and looked like two products. Each screen now says what it shows and names the command that shows the rest.
+- Fixed builtin fleet contracts listing as invalid on a fresh checkout, where a missing command registry is setup and not corruption. Those entries render as setup with the exact file and keys to create, while a registry that binds wrong ids stays invalid.
+- Stopped `clio-coder configure` presenting two alphabetically-first catalog ids as recommendations and seeding `defaultModel: gpt-4` when none was given. A catalog-backed runtime reports its catalog size and requires `--model`.
+- Made overlays respect the width they are given. The permission overlay wraps its safety text and keeps `[s] stop` at every width, hints elide by priority rather than position, and `/view` drops to one pane rather than squeezing two into noise. Verified at 40, 80, and 120 columns.
+- Made `thinking: max` reachable. Dispatch validation rejected it and route selection threw on it mid-run, so the level was unreachable through the dispatch tool, `clio-coder run`, and the CLI; the level list now has one source and a drift test fails any file that respells it.
+## 0.2.9 - 2026-08-05
+
+- Added deterministic `code` steps to fleet contracts and execution plans. A step names a command id from the repo-owned registry at `.clio/fleets/commands.yaml`, never a shell string a model authored, and an unknown id or a missing registry fails contract validation before anything dispatches. A code step holds no capacity lease, carries no execution role or authority grant, and returns the typed `code-report` contract; under `onFailure: continue` its verbatim output is the input to the step that repairs it.
+- Added bounded check/repair loops and shipped three SDLC fleets. A `loop` declares `maxAttempts`, a check (a registered command or a gate agent), and an agent repair; compilation unrolls it into conditional nodes so the plan stays one deterministic hashed DAG with whole-plan admission and a receipt per attempt. Verification staleness is scheduler-enforced: a workspace step landing after a green re-runs it before any dependent may rely on it. `build-test`, `build-review`, and `sdlc` ship from `src/domains/agents/fleets/`, and a project `.clio/fleets/<name>.md` shadows a builtin.
+- Added a durable trace store: every run is mirrored into a rebuildable WAL SQLite database beside the ledger, with a fail-closed schema version, seven Clio-mapped tables, and one documented rowid-cursor query. Writes are bounded and secret-redacted, run off the worker event pump, and drop display-only progress before any lifecycle, terminal, tool, attempt, or usage fact; a trace failure degrades the mirror, never the dispatch it observes.
+- Added `clio trace` (`runs`, `phases`, `tail --follow`, `procs`, a single read-only `sql` SELECT, and `ui`) plus a no-build localhost-only waterfall viewer under `apps/trace-viewer`, outside the published package. Component dollar columns stay empty where no authoritative producer supplies them, and the viewer says "not recorded" rather than inventing a breakdown.
+- Added per-step write boundaries. Fleet contract v4 declares a `writes` path allowlist per step, `readonly` being the empty one, and the orchestrator verifies the claim after the fact by diffing the checkout against a pinned baseline, rolling back unauthorized changes, and failing the step with `writes_boundary_violation` naming the paths and the declaration. This is detect-and-rollback rather than sandboxing; a path that cannot be restored cleanly is reported and left for the operator instead of guessed at.
+- Updated the Pi engine dependencies to 0.80.6, including native `max` thinking-level support and upstream runtime, accounting, and protocol fixes.
+- Made singular `dispatch({agent, task, briefing, detach})` first-class while preserving batch `tasks`, pinned task/briefing separation through approval, and rejected briefing-only or ambiguous `task`+`tasks` calls.
+- Made native-worker initialization fail closed on the same `worker_announce` wire-version handshake locally and over SSH, then required a full identity and resource attestation before the first model call.
+- Required a nonempty receipt-sealed final answer for successful native and ACP delegation, with deterministic `worker_final_output_missing` failure and no automatic retry; added prose-free steering provenance and advanced receipt integrity to strict v15, whose reader rejects every earlier format.
+- Made model-facing dispatch and collect output distinguish verified receipt integrity, evidence verification, briefing provenance, and bounded project-context provenance, and tightened collect-before-synthesis and bounded Scout spot-check guidance without restoring forced routing.
+- Unified ordinary synchronous and detached model dispatch over one per-tool run consumer: synchronous calls auto-wait on the registered drain, while detached calls return run ids and leave that same drain running so the parent model can monitor or steer mid-run. The interactive operator/TUI can monitor and steer an active synchronous native run through the dispatch contract; ACP runs remain monitorable but have no steering channel. Review and compete retain direct gate-sensitive drains so reviewer/judge output is staged before their receipt-facing settlement path.
+- Added one prompts-domain-compiled Clio worker harness with deterministic canonical tool slicing, stable/dynamic prompt separation, and read-only reviewer/judge parity; added strict per-agent `budget` frontmatter, Scout `18/4/true` and Coder `50/5/true` profiles, native and Claude SDK enforcement, and fail-closed explicit-budget admission for black-box subprocess runtimes while preserving the operator hard cap.
+- Hardened dispatch authority and provenance: approval now uses one registry-owned, deeply immutable resolved plan (effective agent, target, model, node id/kind/host, every bounded gate role, and cost ceiling); approval rendering and execution consume that same trusted artifact, execution fails closed on route or ceiling drift, forged plan fields are ignored, and receipts identify the actual one-shot approval or full-auto decision.
+- Added write-ahead, integrity-covered coordinator evidence for review verdicts, compete winners, and supervised/full-auto winner application; reviewer/judge output is staged before receipt settlement and reconstructed only from a verified receipt after restart, and evidence bundles now include `gate-decisions.json`.
+- Closed external-agent policy gaps by canonicalizing standardized ACP locations for path-bearing reads and mutations, rejecting contradictory tool metadata, unenforceable profiles, and authority narrowing before launch, representing external tool inventory as unknown, supporting bounded read-only ACP reviewer/judge roles, and bounding resistant ACP process groups on abort, stall, failure, and successful teardown.
+- Made protected-artifact boundaries durable across session append, synchronous flush, reload, reset, restart, local/shared-filesystem dispatch, and compete worktrees with a write-ahead recovery journal, merge-time protected-diff check, and fail-closed degraded mode.
+- Made iterative compaction cumulative, surfaced compaction failures distinctly from legitimate no-ops, and isolated repository-scoped memory by canonical repository identity in interactive and headless agent prompts.
+- Made compete worktree ownership transactional and segment-safe, with all admitted workers settled before cleanup, durable coordinator/worker process leases, PID-reuse-resistant termination of hard-crash orphans at orchestrator startup, and restart preservation of a pending or recovered winner while losers are removed.
+- Made broad repository exploration model-authored: the chat harness and middleware no longer force Scout routing or block direct reads, while the operating contract, Scout catalog description, and an advisory after 9 or more manual read-only calls steer delegation. Dispatched Scout workers retain the 18-call exploration-to-synthesis guardrail, and the task-aware Fleet Runs UI exposes live tools, tokens, priced cost, retries, steering acknowledgements, and per-run cancellation.
+- Added strict versioned agent recipes and typed terminal result contracts. Malformed custom recipes are quarantined, built-in schema failures stop startup, Scout citations must be grounded in the worker's own live reads, and a postcondition that was never reached is recorded as `not-reached` rather than fabricated as a quality failure.
+- Added one deterministic `ExecutionPlan` v2 DAG with whole-plan preflight, capacity-bounded waves, authenticated handoffs, requested/approved authority on every task, and a strict resolved-plan v3 boundary with explicit deadlines. Older or partial durable forms are rejected rather than migrated or accepted through aliases.
+- Added process-safe global and per-node admission with durable expiring leases, deterministic priority/FIFO queues, finite deadlines, retry reservation rebinding, TTL-bounded operator drain, and cross-process owner-liveness checks. Placement spreads by durable lease usage, but leases remain the authority under the state lock.
+- Added a two-lane worker protocol and pre-call attestation of protocol, process group, host, settings and WorkerSpec digests, runtime, target, endpoint, model, tool surface, and resource facts. Local and remote aborts terminate the whole process group; display backpressure cannot delay heartbeats, acknowledgements, or receipt-bearing frames.
+- Added measured joint route resolution across agent, target, model, runtime, and node. Hard constraints eliminate before deterministic Pareto ranking; route history v3 aggregates only compatible capability evidence, retires older files, and invalidates buckets on tool-surface or endpoint drift.
+- Added operator-scoped active routing for read-only-capability work in researcher, verifier, reviewer, and judge roles. Shadow remains the default; activation requires named role/posture settings and exact-route readiness evidence, and no-ready-candidate, manual pin, and `failover: none` paths fail closed.
+- Added bounded `agent: auto` evaluation and typed Scout phase escalation. Agent authority, tools, skills, result contract, locality, and governance remain hard filters; authority-changing transitions require an authenticated plan approval or existing full-auto authority, and agent automation stays shadow by default with per-agent/per-role readiness.
+- Added transactional attempt isolation for editing work. Every assignment owns baseline-pinned attempt worktrees, winning changes are checked for outcome, receipt integrity, result conformance, quality gate, protected artifacts, ancestry, and destination cleanliness before apply, and a refused winner is preserved with recovery instructions.
+- Advanced receipt integrity to strict v15, route policy to v4, route history to v3, ExecutionPlan to v2, and resolved dispatch plans to v3. Current readers accept only the current format for each boundary; earlier forms are rejected or explicitly retired.
+- Clarified the compact main and worker harness prompts with an explicit direct-tool inventory and a strict distinction between tools, fleet agents, and operator-activated skills, preventing capability questions from triggering irrelevant fleet queries.
+- Grounded generated wikis in detected repository instructions and their declared source-of-truth documents, added dirty-working-tree evidence and source-tree freshness metadata, tightened capability-claim guidance, let the bound documenter worker profile control its thinking level, and raised the local tool-bearing turn ceiling to the configured 32K default so long-context documenters are not artificially constrained to 16K.
+
+## 0.2.8 - 2026-07-07
+
+- Redesigned the tool surface into seven planes with consolidated observe,
+  execute, orchestrate, retrieve, interact, mutate, and artifact tools.
+- Added session task tracking with the `tasks` tool, `/tasks`, open-task
+  continuation nudges, and receipt-backed task evidence.
+- Added richer dispatch controls: `monitor`, `steer`, pipeline dispatch,
+  ad-hoc specialist personas, and worker permission escalation.
+- Rebuilt context indexing around codewiki schema v4, a separate
+  agent-authored wiki layer, `/context refresh`, worker context injection, and
+  one ignore policy for grep/find visibility.
+- Added prompt manifests, eval provenance, public benchmark manifests, unified
+  observation truncation envelopes, `/export`, and deeper per-tool usage docs.
+- Improved the interactive UI with a shared TUI design system, slash-command
+  argument completion, a `/context` hub, clearer permission queues, and better
+  skill-loading guidance.
+- Fixed safety and autonomy edge cases around approval denials, symlink path
+  checks, loop-guard recovery, external worker tool profiles, reasoning-off
+  models, and source-tree awareness in nested repositories.
+- Reworked local model residency: local inference targets are treated as
+  multi-model servers with finite VRAM, one shared reconciler drives llama.cpp
+  routers, LM Studio, and Ollama, co-resident models such as a scout beside
+  the main coder are protected symmetrically, residency mutations against one
+  server are serialized across processes, and the `CLIO_RESIDENCY=observe`
+  and `lifecycle: user-managed` opt-outs now work on every runtime path.
+- Added native shadow-agent fleet routing: `/agents` lists shadow agents and
+  `/fleet` binds native agents to target/model worker profiles, including
+  changing a bound profile's model from the bindings tab.
+- Enforced loop-guard synthesis lockouts mechanically for the main agent and
+  dispatched workers: locked turns can only answer (request-level
+  `tool_choice: none`), dead tool-call markup is sanitized out of locked
+  answers, and a result-stagnation detector blocks byte-identical retry
+  escalations that evaded the verbatim detector.
+- Conditioned the harness for local models with measured fixes: a
+  deterministic tool-routing order in the system prompt, task-board reminders
+  on enumerated multi-step requests, a validation nudge on successful edits,
+  recovery guidance with sanctioned pivots on blocked calls and denials,
+  ask_user gated to genuine decisions, bundled-docs retrieval repairs, and
+  observation-budget stubs that end retry traps.
+- Made the TUI truthful under pressure: context meters draw the autocompact
+  reserve with its own glyph, the dispatch board renders at the terminal's
+  real width, overflowing rows drop whole facts behind an ellipsis instead of
+  clipping mid-number, permission overlays show the parked call's target
+  (including worker escalations, sanitized at the trust boundary), and
+  blocked or aborted tool calls settle instead of spinning forever.
+- Fixed accounting: aborted turns keep their real token usage, headless run
+  receipts sum usage across all agent segments, guard blocks are recorded as
+  blocked safety decisions, and worker tool-call caps count blocked attempts.
+- Fixed session integrity across `/tree`, `/fork`, resume, and compaction so
+  abandoned sibling turns are never replayed, copied, or summarized.
+- Hardened worker IPC: subprocesses drain stdout before exit, streaming no
+  longer amplifies quadratically, and internal generator dispatches (wiki
+  update, context bootstrap) get a wall-clock deadline with progress output.
+- Fixed deadline timers that could silently never fire in a quiet process:
+  ACP request timeouts, dispatch and internal-generator deadlines, the
+  dispatch drain grace, and worker escalation timeouts now hold the event
+  loop until they fire or are cleared.
+- Updated the model catalog: the Qwopus3.6 Coder entries carry the upstream
+  presence-penalty sampler default, and reasoning-never model families no
+  longer receive or replay thinking fields.
+- Aligned the documentation corpus with v0.2.8, added worker-dispatch and
+  provider-adapter guides, and refreshed the HTML docs viewer with new
+  interactive blueprints.
+- Breaking: legacy tool names such as `glob`, `workspace_context`,
+  `docs_search`, `run_task`, `validate_frontend`, `write_plan`,
+  `write_review`, `create_skill`, and `dispatch_batch` were removed in favor of
+  the consolidated tool surface.
+
+## 0.2.7 - 2026-07-02
+
+- Added five reviewed marketplace skills: `scientific-debugging`,
+  `experiment-protocol`, `design-council`, `credentials`, and
+  `workflow-distiller`.
+- Added executable skill evals, enforced skill tool surfaces, and registry
+  integrity pins for catalog skills.
+- Added credential damage control with zero-access credential storage,
+  secret-value redaction in evidence bundles, and a read-only
+  `credential_present` tool.
+- Added `clio usage report`, headless main-agent receipts, dispatch evidence
+  bundles, high-rigor validation prompts, and evidence-linked change manifests.
+- Reduced package size, tightened the release workflow, refreshed
+  documentation, and fixed several dispatch, lifecycle, skill, and loop-guard
+  reliability issues.
+
+## 0.2.6 - 2026-06-24
+
+- Added VRAM-aware local model residency so interactive, headless, and worker
+  runs reconcile model load/evict behavior through one path.
+- Added first-class customization surfaces: layered project settings,
+  path-scoped rules, operator profiles, user hooks, and `clio config inspect`.
+- Added self-orientation through the `docs_search` tool and `clio docs`
+  viewer.
+- Added SciCode benchmark support, coverage gates, deterministic repeat lanes,
+  and refreshed guides and HTML blueprints.
+- Fixed a dispatched-run residency gap that could leave Ollama models resident
+  and overflow VRAM.
+
+## 0.2.5 - 2026-06-23
+
+- Added the `alcf` runtime for Argonne ALCF Sophia/Metis inference targets over
+  Globus OAuth.
+- Added ALCF model metadata, gateway-specific documentation, authenticated
+  provider discovery, and strict OpenAI-compatible payload handling.
+- Added contract coverage for ALCF OAuth selection, runtime discovery, and
+  strict reasoning-payload behavior.
+
+## 0.2.4 - 2026-06-23
+
+- Added agent fleet management with agent-to-profile bindings, profile CRUD,
+  fault-tolerant dispatch, and a `/fleet` overlay.
+- Isolated dispatch tests from the real run ledger and pinned several dispatch
+  invariants with regression coverage.
+- Made receipt digests deterministic across hosts and refreshed the pi engine,
+  Claude SDK, Anthropic SDK, Biome, TypeBox, undici, uuid, and tsx
+  dependencies.
+
+## 0.2.3 - 2026-06-17
+
+- Rebuilt the interactive command surface around a declarative slash-command
+  registry and full-screen hubs for help, agents, prompts, extensions, targets,
+  skills, settings, and receipts.
+- Introduced the enforced autonomy model with an always-on safety net, clearer
+  approval and safety notices, and stricter tool admission across chat,
+  workers, headless runs, and ACP delegations.
+- Added subscription and delegation runtimes including `anthropic-max`,
+  `claude-code`, `claude-sdk`, Claude Code over ACP, and `antigravity-code`
+  workers.
+- Added `clio context-index`, deterministic multi-language codewiki indexing,
+  `code_nav`, scratch offloading for large tool results, middleware hooks, live
+  agent steering, and richer receipt tool activity.
+- Reworked Clio's on-disk roots, settings ownership, lifecycle commands,
+  model-target vocabulary, and observability workflows.
+- Removed several legacy slash commands; their workflows moved into `/skill`,
+  `/targets`, `/help`, `/view`, and related hubs.
+
+## 0.2.2 - 2026-06-11
+
+- Retired built-in CLI-subprocess runtimes in favor of direct HTTP/native/pi-ai
+  targets and ACP delegation for external coding agents.
+- Added the context engine, single-threshold compaction, bounded tool results,
+  prompt-cache telemetry, and session-owned live routing.
+- Added `clio acp`, ACP delegation support, a curated skills marketplace,
+  richer skill activation, and local source install/uninstall scripts.
+- Upgraded `CLIO.md` into a project rulebook with custom sections and better
+  source-tree awareness.
+- Improved prompt-prefix stability, session-ledger append behavior, permission
+  overlays, and release verification.
+
+## 0.2.1 - 2026-06-05
+
+- Added live token-throughput telemetry, a larger context fill bar, hashed
+  prompt-envelope delivery, and prompt diagnostics in `clio run --json`.
+- Narrowed per-turn tool exposure and bounded long tool outputs to reduce
+  context pressure.
+- Retuned the footer dashboard for smaller terminals and refreshed README and
+  operator documentation.
+- Fixed headless `clio run` argument handling, unknown-agent failures,
+  dashboard layout, and prompt-diagnostic visibility.
+
+## 0.2.0 - 2026-06-03
+
+- First community alpha release for source-checkout users.
+- Added JIT skills, stronger prompt compaction, `clio init` / `/init`
+  adoption of existing project instruction files, and centralized runtime
+  target resolution.
+- Added runtime diagnostics, command-output routing, durable session JSONL
+  coverage, expanded user docs, and a portable `Ctrl+G` leader-key fallback.
+- Hardened path policy handling, headless `clio run`, prompt cache boundaries,
+  overlay rendering, session persistence, fork replay, and TUI startup.
+
+## 0.1.9 - 2026-05-17
+
+- Added `dispatch` as a first-class fleet-agent handoff tool.
+- Added `validate_frontend` for HTML/CSS/JavaScript artifacts and finish
+  evidence for typed validation tools.
+- Improved local model capability handling, GPT-OSS/Harmony parsing, active-run
+  follow-ups, and cancellation behavior.
+- Fixed reasoning replay, Harmony stream parsing, OpenAI Codex file-tool
+  schema aliases, lifecycle metadata repair, and duplicate model-capability
+  paths.
+
+## 0.1.8 - 2026-05-11
+
+- Added extensions, share archives, extension and share CLI/TUI workflows, and
+  a redesigned welcome dashboard.
+- Added model and context-window validation to `clio configure`.
+- Added a Claude Code SDK safety bridge, supervised approval IPC, a TUI
+  approval overlay, and receipt accounting for SDK safety decisions.
+- Fixed Gemini CLI token accounting and expanded tests for extensions, share
+  archives, configure validation, and supervised SDK decisions.
+
+## 0.1.7 - 2026-05-11
+
+- Added a shared safety policy engine for orchestrator and native workers.
+- Added strict project command policy parsing, typed execution tools, and
+  receipt safety summaries.
+- Changed default-mode Bash to default-deny ordinary execution unless allowed
+  by curated commands or project policy.
+- Hardened dispatch scope, external-runtime permission mapping, audit rows,
+  and worker safety parity.
+
+## 0.1.6 - 2026-05-04
+
+- Added `clio --print` / `clio -p` for one non-interactive orchestrator turn.
+- Added stdin plus argv prompt composition and stdout guarding for scriptable
+  print-mode use.
+- Reserved future JSON/RPC modes behind explicit errors and added focused CLI
+  coverage.
+
+## 0.1.5 - 2026-05-03
+
+- Public alpha release for developers and research-software teams testing a
+  terminal-first coding agent from source.
+- Shipped the interactive TUI, target-first configuration, built-in coding
+  agents, persistent sessions, project context, receipts, audit logs, evidence,
+  evals, memory, and safety modes as an integrated product surface.
+- Added `clio init`, CLIO.md parsing, codewiki indexing, clearer `/cost`
+  accounting, a redesigned `/model` popup, and CLIO-branded popup frames.
+- Documented alpha limits: source install remained the supported path, model
+  behavior varied by target, and operators were expected to review privileged
+  actions.
+
+## 0.1.4 - 2026-04-30
+
+- Added the evolution plane: component inventory, typed change manifests,
+  deterministic evidence building, local eval runs, memory records, middleware
+  hooks, protected-artifact safety, and finish-contract checks.
+- Added workspace orientation, a `workspace_context` tool, eight specialist
+  agent recipes, and a scientific-validation pack.
+- Unified llama.cpp runtime handling, improved the TUI, expanded compaction and
+  context accounting, and hardened protected-artifact behavior.
+
+## 0.1.3 - 2026-04-27
+
+- Added live tool output, bash command echo, `Ctrl+T` thinking expansion, and a
+  git-branch footer slot in the TUI.
+- Made `CLIO.md` the canonical project instruction file and improved local
+  runtime detection for LM Studio and Ollama.
+- Aligned Clio Coder's identity with IOWarp's CLIO ecosystem, updated package
+  docs, reorganized safety rule packs, and added a clean-clone smoke CI job.
+- Fixed slash autocomplete on Debian/Ubuntu, stabilized JSON envelopes for
+  `doctor` and `targets`, and improved partial tool-output rendering.
+
+## 0.1.2 - 2026-04-25
+
+- Added visible retry handling for transient provider and stream failures.
+- Improved tool, bash, edit, dashboard, hotkey, resume, prompt, receipt,
+  compaction, audit, and abort behavior in the interactive TUI.
+- Fixed retry duplication, cancellation races, oversized Bash output handling,
+  resume/fork/new behavior during active runs, provider hot-swaps, and local
+  OpenAI-compatible reasoning/tool schemas.
+
+## 0.1.1 - 2026-04-24
+
+- Added deterministic loading of project context files from the current working
+  directory upward.
+- Fixed resume, fork, and tree-switch replay for rich session entries and
+  durable tool records.
+- Fixed subprocess worker dispatch, out-of-tree SDK runtime rehydration,
+  receipt verification, dispatch heartbeat state, and the documented boundary
+  check command.
+
+## 0.1.0-exp - 2026-04-24
+
+- Initial experimental public release.
+- Shipped the interactive TUI, CLI lifecycle commands, target-first
+  configuration, runtime coverage, seven built-in agents, dispatch workers,
+  receipts, audit logs, safety modes, and XDG-aware state layout.
+- Known limits: Windows was best effort, and some remote fan-out and MCP
+  surfaces were scaffolded but not yet admitted by dispatch.

package/CODE_OF_CONDUCT.md

@@ -0,0 +1,21 @@
+# Code of Conduct
+
+Clio Coder welcomes focused, respectful technical collaboration.
+
+Expected behavior:
+
+- Be direct, factual, and constructive.
+- Critique code and decisions, not people.
+- Keep issues and pull requests on topic.
+- Disclose conflicts of interest when they affect a proposal.
+- Respect maintainer decisions on scope, roadmap, and release timing.
+
+Unacceptable behavior:
+
+- Harassment, threats, or personal attacks.
+- Posting secrets, private logs, or credentials.
+- Spam, low-effort automation, or generated noise.
+- Bypassing review, CI, branch protection, or security policy.
+
+The maintainer may edit, lock, close, hide, or ban activity that violates these
+rules.