@iowarp/clio-coder 0.3.1 → 0.3.3

package/CHANGELOG.md

@@ -1,440 +1,300 @@
 # Changelog
 
-Public release notes for Clio Coder are documented here. This file is kept
-intentionally short for users, operators, and community contributors. The
-implementation detail and verification notes behind each entry live in the
-commit history, where every change carries the transcript and gates that
-produced it.
-
-Versions follow semantic versioning for a pre-1.0 project: minor versions may
-still change interfaces.
+All notable changes to Clio Coder are documented in this file. The format follows [Keep a Changelog](https://keepachangelog.com/en/1.1.0/) and versions follow Semantic Versioning; pre-1.0 minor releases may include incompatible changes.
+
+## 0.3.3 - 2026-08-21
+
+### Changed
+- Unified transcript detail under `/output minimal|default|verbose`, with consistent per-block and all-block tool/thinking overrides that reset when the output level is reapplied.
+- Folded Bash execution bodies by default while retaining concise command, outcome, timing, size, and bounded failure evidence on the transcript row (#166, #177).
+- Rendered reasoning as stream-ordered thinking segments and made interview prompts true fullscreen workspaces (#171).
+
+### Fixed
+- Preserved live, interrupted, and replayed reasoning order and token provenance, including provider-reported zero-output turns.
+- Preserved complete replay bodies for HTML export and aggregated multi-call replay receipts.
+- Kept failure excerpts and mutation diffs inside narrow terminal frames, including at 40 columns.
+- Replaced internal tool-call labels such as `bash(...)` with operator-facing action descriptions in live, replayed, blocked, and exported transcript rows.
+- Refreshed the footer immediately after `/output` changes and kept explicit fold choices scoped to the intended tool or thinking stretch.
+- Rechecked commit-attribution repository state and repaired missing or damaged cached hook wrappers before reuse.
+
+## 0.3.2 - 2026-08-20
+
+### Added
+- Evidence-aware Git commit attribution, with an Advanced setting to disable it without changing commit messages.
+- Fullscreen terminal mode, terminal-native Mermaid and LaTex rendering, smooth-streaming controls, instant-shell startup, prompt-history navigation, and improved model, settings, resume, task, decision, and workspace-output views.
+- HTML transcript export (with Markdown export retained), live tool-progress and numbered edit/write diffs, and richer tool lifecycle details.
+- Directory-scoped `CLIO-CODER.override.md` instructions, project-rule propagation to workers, an installed-skills marketplace, and source/codewiki assets in published packages.
+- Compile-cache support for interactive, run, ACP, and worker boot paths; codewiki indexing and several tool implementations now load on demand.
+- A Pi SDK boundary/upgrade checklist and declaration-surface checks; Pi SDK libraries are updated to 0.84.0.
+
+### Changed
+- Consolidated slash-command spelling and prompt-template argument handling; retired aliases now fail closed while preserving the editor draft.
+- Replaced the LM Studio SDK path with an HTTP adapter. `lmstudio` is canonical; `lmstudio-native` remains a compatibility alias for persisted settings.
+- Improved local-model selection, residency, context sizing, reasoning controls, retries, OpenAI-compatible streaming, and token accounting.
+- Strengthened ACP v1 session, workspace, permission, output-bound, and error contracts for external clients.
+- Improved terminal rendering, transcript streaming, timing, export, and session replay behavior.
+- `docs/html` is no longer included in npm packages; Markdown guides remain available.
+
+### Fixed
+- Preserved prompt submission order during instant-shell startup and restored transcript rendering in fullscreen mode.
+- Kept rejected slash-command drafts editable and aligned footer, receipt, and ledger usage for completed or cancelled turns.
+- Prevented session switches during streaming from creating phantom entries; fixed task-board branch selection and persisted `/tree` pins.
+- Prevented concurrent dispatch processes from overwriting run-ledger rows (#118), and hardened worker compile-cache isolation (#148).
+- Fixed LM Studio duplicate-load behavior (#113), llama.cpp residency failures (#127, #134), runtime alias handling (#119), and probed context-window precedence (#129).
+- Restored documented headless JSON/event output and CLI exit-code behavior (#122, #123); corrected thinking-level resolution (#128), stalled-stream reporting (#131), and reasoning-token estimates (#132).
+- Isolated tests from user configuration (#110, #111), and corrected documentation claims (#117).
+
+### Security
+- Hardened worker and session safety-policy consistency, OAuth cancellation, workspace output reads, and ACP permission/cancellation handling.
+- Added publish-time version-coherence checks (#124) and removed unsafe or misleading default behaviors in credentials migration and package serving.
 
 ## 0.3.1 - 2026-08-16
 
-- Made a dispatched worker visible while it runs. `/run` and `/delegate` stream into the transcript as a worker block: an attributed header naming the agent, its route or protocol, and its run id; the worker's prose down a rail; a coalesced tool line; and a receipt footer whose failure reason wraps as prose above it. Dispatch lifecycle events fold into one entry per assignment, so a failover reads as one run with an ↻ line per earlier attempt, and a late event from a superseded attempt moves nothing. A model-started run lands folded under the tool call that spawned it, so a fan-out of three reads top to bottom in spawn order, folded cards stack without blank rows, and `Alt+O` folds or unfolds the newest tool call or worker block. Every board row, footer chip, and transcript block leads with who asked for the run: hollow for the operator, filled for the model, a quiet dot for Clio's own. The session records a `workerRun` entry where a block opens, so a `/resume` redraws the block from that entry plus the sealed receipt, bounded exactly like a live one, and a run whose receipt is gone settles as `receipt unavailable`. `--share` on `/run` and `/delegate`, and `/share [runId]` afterwards, hand a worker's bounded receipt text to the main agent as operator text under a `[worker result] <agent> · run <id> · <outcome> · shared by the operator` header, which the operating contract now names so the model treats it as steering rather than an unattributed tool result; bare `/share` picks the newest finished run the operator started and skips agent-origin runs the model already holds. A structured worker answer renders as prose on the rail instead of one line-wrapped JSON string, a mutation report reading as its changed paths, validations with verdict glyphs, summary, and commit line, while the model still receives the raw payload. A replayed operator turn after `/fork` or `/resume` shows what the operator typed rather than the composed prompt with its system-reminder scaffolding. The transcript ledger prints a written file's byte count rather than the length of its confirmation sentence.
-- Added the interop discovery domain. `src/domains/interop` owns knowing which other coding agents are installed: a registry with one pure-data entry per known agent, bounded detection that resolves binaries without a shell and reports `unknown` when a probe cannot answer, and a decision record in `state/interop.json` that only an operator decision writes. `clio-coder configure --interop` and the first-run wizard turn a detection report into consent proposals, show the exact `delegation.agents` YAML before asking, and append an accepted peer through the serialized settings writer; a decline is remembered by fingerprint and stays silent until the binary's version or path moves, and one review that answers n, n, y keeps all three decisions. `clio-coder doctor` gains a row per detected agent, a warning for a configured peer whose command no longer resolves, and one aggregate row for foreign skills, and still writes nothing. The `/interop` overlay lists agents as Detected, Configured, and Declined with one key each to connect or decline, the boot line names installed peers that are unconfigured and undecided, and the `delegation.agents` row in `/settings` gains add and remove actions. Foreign agent directories become a `noWritePaths` policy class from the registry, so Clio never writes into another agent's directory, and foreign prompt roots such as `~/.claude/commands`, `~/.codex/prompts`, and `~/.config/opencode/command` load into `/prompts` trusted at user scope while their project counterparts stay behind `skills.trustProjectCompatRoots`. Detection never spawns a foreign work command, never reads a foreign session store, and never wires a peer without an answer.
-- Fixed every prompt template being unreachable from the TUI. `/demo` and any other `/name` that a loaded template owns now submits through the expansion path instead of failing as `is not a command`; an untrusted project template refuses with a named reason, and headless prints that refusal and exits 1.
-- Implemented the documented `clio-coder acp --cwd PATH` and `--permission-timeout MS`. Both had appeared in `docs/acp.md` since v0.3.0 and were rejected as unknown options. `--cwd` changes into the workspace before boot and `--permission-timeout` overrides `delegation.defaults.permissionTimeoutMs` for that server only; a rejected invocation writes usage to stderr and leaves the protocol channel untouched. ACP `_meta` keys now live under the `clio-coder/` namespace rather than `clio.coder/`.
-- Made the agent ledger reachable and made the main model read it. No builtin recipe declared the ledger tool, so a fanned-out worker was never offered it, and three seams between the dispatch call site, the local spawner, and the fleet transports each dropped the control-lane callback that carries a post; a live three-scout fan-out sealed a board with zero entries. Every builtin that can be fanned out now declares the ledger, every spawn path forwards the full option set, a post that lands before the run has attribution is held in order and appended once it does, a backgrounded parallel batch keeps its board open until collect, and a detached batch closes its board on the collection that settles it. A settled parallel dispatch, a compete result, and monitor collect for a detached batch now carry one `agent ledger (<n> entries, sequence <w>)` section after the per-run lines with the same bounded render, attribution, and corroboration and dispute marks a worker sees, reserved out of the output ceiling so truncation never drops it; a board nobody posted to is omitted, so a single-run dispatch is byte-identical to before. Corroboration keys citations in workspace-relative form, so one file cited by relative and absolute path reads as one corroborated finding. A new composition suite drives the real recipes, bundle, and dispatch and monitor tools with only the worker process faked.
-- Refused an unrunnable review fan-out at admission rather than after approval. A review gate with more than one task, a review under a non-parallel mode, a compete with review or several tasks, an unparseable request set, or an unknown mode never parks for approval and returns the executor's own shape error, so the operator no longer approves a plan the executor rejects in milliseconds and the model is told how to gate a fan-out: run it without review, then dispatch one integration task with review.
-- Answered an identical worker escalation with the operator's earlier decision. The escalate posture keeps a per-run memory keyed by tool plus canonical arguments; a parked call already decided in this run is released with the remembered grant or cancelled with a reason naming the earlier request, both audited as `operator:remembered`, ending the loop where each approved card only bought the next identical card. A different command is still a new decision.
-- Fixed a coder run losing its entire final answer on the synthesis-locked repair round. The lock only set `tool_choice: none`, llama.cpp honoured that by disabling its tool-call parser while the template still rendered every tool schema, and the model's tool markup came back as content the loop guard removed. A locked worker round on OpenAI-family APIs now removes tools from the request, so plain text is the only move left; Anthropic keeps `tool_choice: none`. When the loop guard does remove a reply, the repair rounds, the receipt, and the fallback notice now say that the reply held only tool-call markup and was removed, instead of `result must be valid JSON`.
-- Made the mutation-contract refusal show the value that would have passed. An empty `validations` array is told it was empty and given one shaped entry; wrong keys are told which keys an entry carries; the coder recipe states the same requirement where the model reads its result guidance.
-- Fixed a `/run --model` override stranding a llama.cpp router with one instance slot. A model that will come back tag-pinned may only take an unprotected slot; when the load would fit only by evicting the configured worker model it declines up front with a will-not-fit notice naming that resident and its role, so the swap that could not be undone is never made.
-- Corrected tool timing across the transcript, receipts, and `toolStats`. The registry reports how long a call sat parked on a permission card and the tool adapter subtracts it, and the transcript prefers the registry's own span over the engine frame, so an operator's approval wait is no longer sealed as tool execution time. The park closes at the operator's decision rather than at the verdict, so an approved call's own execution is no longer subtracted with the wait; a review dispatch that fanned out for 224 seconds had settled as a 15ms line (#82).
-- Read every model JSON payload through one shared reader. `parseJsonObjectPayload` in `src/core/json-payload.ts` walks the whole message, the first fenced block, and the outermost brace span, and tries every candidate span in turn, so a fenced code report, judge verdict, verifier report, terminal result contract, or context handbook whose body nests its own fence is no longer refused for its wrapping. Conformance did not widen: a candidate still has to parse to an object and every field check stays where it was.
-- Fixed `clio-coder context init` losing complete handbooks. Citations carrying a line anchor (`src/cart.ts:40-42`) or written as a call (`priceCart()`) are grounded by the path or name underneath, so a handbook whose Gotchas and Architecture sections cited real files no longer falls under the grounding floor; the local import convention is measured from the relative specifiers the indexer extracted, reported only on a clear majority, instead of asserting `.js` because a `tsconfig.json` exists; and the fallback notice names `context-bootstrap` and says the handbook was not produced instead of `Scout unavailable`.
-- Named reachability as reachability. An LM Studio turn that failed with `connect ENETUNREACH` no longer advises resizing a model that was never asked to load; `describeLoadFailure` recognises connect-level errnos and says the server did not answer.
-- Fixed the benchmark adapters. HumanEval manifests count generation errors and failed tasks separately, keep the model and target profile through grading, and record where each completion came from, and `regrade --out <run-dir>` rescores a finished 164-task run from its stored attempts in seconds without calling a model. SciCode steps are graded with the dependency header they were promised and the return line upstream supplies, the prompt reaches the model as prose rather than an indented code block, and `snapshot-step` lets a step solved by hand or through the TUI reach the grader. The Terminal-Bench container mirrors the operator's own fleet per node, runtime and thinking level included, probes the worker endpoint in preflight, writes one manifest per episode, and its installer installs `curl` when neither downloader is present, prints the output that produced a failure, and returns rather than exits when sourced so the harness's tmux signal still fires.
-- Renamed the remaining surfaces the 0.3.0 rename missed. The process title is `clio-coder` and a worker reads `clio-coder-worker:<agent>` in `ps` and `htop`; the fleet node key is `clioCoderEntry` and the eval flag is `--clio-coder-entry`, with both old spellings still read; `CLIO_CODER_MAX_DISPATCH_RUNS` is the canonical guardrail spelling and `CLIO_CODER_MAX_RUNS` still reads. Removed the `identity` setting that shipped in every generated `settings.yaml` and that nothing read; an existing file with the key still loads. Declared the package as a CLI with an `exports` map naming only `./package.json`, so the 778 shipped source files are no longer an unversioned deep-import surface. Corrected the runtime plugin path to `~/.config/clio-coder/runtimes/`, the tool count to twenty in every place it was stated, and the glossary. Replaced one operator's node names, model ids, and addresses in source comments, docs, scripts, soak configurations, and benchmark adapters with neutral placeholders and `CLIO_CODER_*` environment variables, and attributed the identity fragment to the Gnosis Research Center at Illinois Tech and the IOWarp team.
-- Reworked the settings and configuration surfaces of the TUI. `/settings` is a transactional Settings Center grouped as CORE, ROUTING, RUNTIME, and EXPERIENCE; every edit builds a change plan and asks Apply this session, Apply and save globally, or Cancel, a global save writes only the leaves the mutation touched, and `/output` and `/thinking` apply to the session rather than silently rewriting the file. Fleet profiles, agent bindings, and targets are editable rows: Settings → Fleet is an entity workbench with add, remove, node-pin, and unbind flows, and Settings → Targets is a console with use, probe, connect, and remove per row. `/targets`, `/fleet`, `/scoped-models`, bare `/thinking`, and bare `/output` deep-link into the matching section, `/settings <section>` reaches every other one, and the bespoke overlays those commands opened are gone; running and retrying dispatches stay on the `Alt+W` Fleet Runs board. Below 72 columns the overlay drills down one page at a time under a breadcrumb, Esc moves up exactly one level at every width, and `/` filters rows by label, path, and description. A scoped-model reference whose target is unconfigured is kept and disclosed rather than silently dropped at load.
-- Recast the rest of the TUI around the same doctrine: an adaptive welcome launchpad, a composer that reads unmistakably as the place to type, a voice-first transcript with a two-cell hanging indent, slash commands presented as a grouped palette, a quiet two-zone footer that discloses status progressively and degrades notices without losing their dismiss key, one orange activity signal per surface, and a decision prompt that wears the orange frame and names its accept key. An `ask_user` prompt is now the size of the question it asks: a two-option confirmation is a bottom-anchored bar rather than a full-height modal, and only a multi-question round or a later interview round takes the full surface. `/memory` reaches every entry through a filterable master-detail overlay, a narrow list footer keeps the key that opens its detail pane, a skill suggestion line no longer steals the reply glyph from the answer, and the footer says nothing about reasoning tokens when a turn spent none.
-- Rebuilt the trace viewer on the docs blueprint design system: brand assets and a version chip on the masthead, semantic palette tokens that reserve action orange for running state, interactive waterfall lanes with tool tick markers, a run search filter that survives live polling, truthful `$0.00` spend, and contract tests for tool durations, payload truncation honesty, and process status badges.
-- Made time correct across the runtime. Durations are measured on `performance.now()` and never on two wall-clock reads, so an NTP step or a laptop resume cannot publish a time-to-first-token that never happened or abort a healthy stream through the stall watchdog; a backwards clock is counted rather than clamped into silence. Every operator-facing timestamp renders through one `format-time.ts` module in the operator's own timezone, so `/tree`, `/fork`, `/resume`, `/memory` step rows, the banner's handoff freshness, and the `/export` filename no longer read a UTC instant as local and land a whole calendar day off for anyone far from UTC. Lockfiles and capacity leases record host, pid, and birth token, so a sibling host sharing a state directory never steals a live holder's lock or slot and a live holder keeps its lock however long it takes; the four lock implementations that disagreed on staleness by a factor of 26 are one. `runs.json` eviction spends its cap on finished rows and keeps live ones, eval ids can no longer collide within a millisecond, and a run whose owner died mid-dispatch is finalized on store open. The test harness gained a frozen, steppable clock, and the panels that raced the wall clock read it.
-- Made a stalled stream abort and retry instead of waiting forever. `retry.streamStallMs` (default 180000, 0 disables) arms a deadline at `agent_start` that every engine event pushes out; when it passes with nothing from the stream the run is aborted through the same path Esc uses and walks the existing retry ladder, so a headless run, a fleet worker, or an ACP client no longer needs a human at the keyboard. Silence during tool execution does not count. The await-watchdog counts a worker's own stream as progress, so a dispatch that produced thousands of events is no longer reported as `no progress`.
-- Fixed the result-contract repair round. The directive now rides as a tool result paired with a synthetic assistant call, which every served template treats as a history append instead of re-rendering the whole prompt (11,352 tokens reprocessed as a user turn against 407 as a tool result on a warmed 15k prefix), which OpenAI's and Anthropic's validators accept, and whose zero usage the context estimator skips; before that last change every dispatched worker died one round after its terminal message with `Cannot read properties of undefined (reading 'totalTokens')`. LM Studio no longer reports `cacheRead: 0` for a stat it does not have.
-- Made LM Studio residency fit the context and keep one instance. A just-in-time load beside another resident model is capped at 131,072 tokens and the clamp is reported before the first turn, raised with `CLIO_CODER_LMSTUDIO_CORESIDENT_CONTEXT`; a model that is already resident is reused rather than loaded a second time; configured models carry the plane they serve so a forced eviction names its role; and a turn under 2 tok/s for 30 seconds emits a `degraded` notice listing the resident set. The planner budgets against the window the backend has actually loaded rather than a catalog maximum, so the 80% compaction trigger no longer sits above the limit a backend fails at.
-- Added the outward exposure tier to `ask_user`. A skill marks a gate whose confirmation leaves the machine as `exposure: outward`, and that gate parks for the operator at both supervised levels instead of being auto-answered, so filing a public issue can no longer go through in 24ms without a human; `full-auto` is untouched and an unrecognised tier reads as outward. The read-only exploration nudge advises once per turn instead of forcing a second model round, and the footer tools row leads with the registered tool count so a session whose only call was a dispatch no longer reads `tools none`. A turn that claims worker results without a dispatch call to back them draws an honesty notice.
-- Moved generated artifacts out of the working tree. The `artifact` tool's defaults resolve to `.clio-coder/artifacts/PLAN.md`, `REVIEW.md`, and `REPORT.md`, which is gitignored, so a report-writing turn no longer drops a root-level file into a repository a second agent is working in; an explicit `path` still writes exactly where it says. `docs/artifact-placement.md` states the contract.
-- Made the package carry Clio's own source and code map. `files` gains `src/**` and the build ends by indexing exactly the packed file set into `dist/assets/codewiki.json`, so an installed Clio can read her own source and answer questions about herself; the twelve tree-sitter grammars are vendored into `dist/assets/grammars/` in place of two grammar packages costing ~72MB per install, and `chalk`, `diff`, `uuid`, `yaml`, `typebox`, and `undici` are bundled into `dist/` and moved to devDependencies. A pack-install smoke installs the tarball into a scratch prefix and proves `--version` and `context index` from there. The release workflow verifies artifacts and never publishes; `npm publish` is a manual maintainer step, and a contract test guards that no publish path is re-added.
-- Collapsed the git skill pipeline to three stages, `file-ticket`, `fix-issue`, and `ship`, retiring `commit-crafting`, `create-pr`, `investigate-issue`, and `review-changes`; the coder and git-master builtins rebind to the survivors and the catalog is re-pinned.
-- Fixed a pasted slash command with a trailing newline landing in the composer without running, shadow workers reading as `sh:`-prefixed agent names rather than as internal processes with their own footer rows and receipt ids, and evidence attribution claiming an overlapping sibling run's entry as its own; an entry inside two run windows now lists both candidates and appears in each bundle.
-- Made `clio-coder doctor` treat a home Clio has never written to as not set up rather than broken. It prints one `WARN installation not set up yet` row naming `clio-coder`, `clio-coder configure`, and `doctor --fix`, exits 0, and creates nothing, so the `--fix` that follows is stamped as an install rather than a repair; once any root exists the per-row report and exit 1 are unchanged.
-- Made an upgrade say so. `install.json` records `upgradedFrom` when the version changes, `clio-coder doctor` shows `upgraded <when> from <version>`, and the first interactive launch on the new version shows one footer notice naming the transition, the commands and skills that moved, and the CHANGELOG section, then records `noticedVersion` so it never repeats; headless and ACP boots stay silent. `clio-coder upgrade --dry-run` names the recorded and current versions it would move between and says plainly when no migrations are registered, and the post-install and local paths report `0.3.0 -> 0.3.1` rather than the binary's own version twice. Nothing about the 0.3.0 to 0.3.1 upgrade needs a hand step: `identity:` still loads and is ignored, `clioEntry` and `CLIO_CODER_MAX_RUNS` still read.
+### Added
+- Live worker transcript blocks, receipts, sharing, folding, and durable replay for `/run` and `/delegate`.
+- Interoperability discovery and opt-in configuration for compatible coding agents, with protected foreign-agent directories and prompt roots.
+- An agent-ledger surface for coordinated worker findings and a transactional Settings Center for routing, runtime, and experience settings.
+- Stream-stall retries, authoritative timing/timezone handling, packaged source/code maps, improved trace viewing, and clearer upgrade notices.
+
+### Changed
+- Reworked the TUI around adaptive launch, composer, transcript, footer, permission, and narrow-terminal layouts.
+- Improved fleet admission, result contracts, benchmark adapters, local-model residency, artifacts, and release packaging.
+- Renamed remaining user-facing runtime identifiers to `clio-coder`; legacy settings and environment spellings remain readable where noted.
+
+### Fixed
+- Restored TUI prompt-template invocation and implemented documented ACP `--cwd` and `--permission-timeout` options.
+- Preserved synthesis-locked worker answers, prevented unsafe llama.cpp model overrides, and corrected tool durations (#82).
+- Fixed handbook grounding, reachability diagnostics, JSON result parsing, pasted slash commands, and resumed/forked prompt display.
+- Fixed cancelled-turn replay/accounting, credentials corruption safeguards, doctor diagnostics, configuration layout, and missing-artifact errors.
+
+### Security
+- Remembered identical per-run escalation decisions without widening different requests.
+- Added outward-exposure confirmation, safer artifact defaults, protected foreign-agent paths, and stricter credential, URL-opening, and permission behavior.
 
 ## 0.3.0 - 2026-08-14
 
-- Renamed every namespace the tool occupies on a user's machine from `clio` to `clio-coder` ahead of the first npm publish, so the future clio-core, clio-agent, and clio-kit tools can coexist with it: the installed binary and every command example are now `clio-coder`, XDG config/state/cache directories use a `clio-coder` segment, the project context directory is `.clio-coder/`, the generated handbook is `CLIO-CODER.md`, environment variables are `CLIO_CODER_*`, and extension manifests are `clio-coder-extension.*`. The product name in prose remains Clio Coder, and code-internal identifiers, event names, and receipt fields are unchanged. There are no migration shims: this ships in the first published release, so there is no installed base to migrate.
-- Marked v0.3.0 prominently as experimental in the CLI/TUI startup experience and repository front page: behavior and interfaces may break or change without notice.
-- Added the agent ledger, a bounded coordination surface the concurrent workers of one dispatch share. A worker in a multi-run dispatch posts typed entries over its existing control lane: a claim staking path scopes so peers stop duplicating work, a cited finding a peer can corroborate, or a review of another entry by id. Every worker receives the board at spawn framed as untrusted peer data and live deltas over stdin, and reads answer from a local mirror with an explicit staleness watermark rather than blocking on a round trip. The orchestrator is the sole writer and stamps every attribution field from its own admission record, so a worker cannot forge authorship; posts are capped at twenty per run; rendering labels each finding corroborated, uncorroborated, or an ungrounded lead and never merges peer output into a consensus, so the single-worker finding that matters stays visible. Each run's receipt seals its contribution count and digest, and a run with no peers never sees the tool.
-- Made compete candidates diverge on purpose instead of racing four near-identical attempts. Each candidate receives one engineering stance from a closed set (minimal diff, test-first, refactor-tolerant, spec-literal) as a one-line dynamic prompt message that leaves the task, recipe, and result contract untouched, and the judge now reports where the candidates disagreed rather than only which one won.
-- Fixed active session branches staying active through production compaction, post-compaction replay, and editor `!command` sidecars. Switching to an older `/tree` branch no longer lets the most recently appended abandoned sibling silently replace provider context.
-- Made global CLI startup parsing one strict, order-independent pass. Interleaved `--skill`, `--api-key`, and context flags no longer expose a secret as a mistaken subcommand, command recognition and dispatch now share one registry, and misspelled leading options fail closed instead of disappearing.
-- Made ACP connect, turn, and permission deadlines mandatory schedulable bounds. Zero can no longer disable a request timer, oversized values can no longer overflow Node into an approximately 1 ms timeout, and CLI, settings, direct adapter, and transport paths share the same defaults and timer ceiling.
-- Stopped automatic retries after a failed attempt has executed a potentially state-changing tool call, including a tool that returned an error after partial work. Clio does not yet isolate ordinary retry workspaces, so launching a successor in the same checkout could consume partial edits; read-only, model-startup, and transport failures remain retryable. Removed the disconnected workspace-transaction implementation and direct-only tests that falsely implied this boundary was wired.
-- Removed unreachable pre-release scaffolds, obsolete barrels, empty tombstones, and the superseded auth selector, then enabled TypeScript unused-local and unused-parameter checks so dead implementation residue fails the build instead of accumulating.
-- Added the soak, a benchmark whose subject is Clio rather than the model. Every other suite measures what a model produced and passes a run whose receipt never sealed, whose seal does not authenticate, or whose stream republished its own transcript. `benchmarks/soak/clio-soak.yaml` inverts that: a weak model that never repairs the fixture passes because the machinery behaved, and a strong model that repairs it fails the moment Clio breaks a promise about itself. Three sibling suites gate what their own surface can answer, for write boundaries, bounded loops, and SIGINT chaos. It runs offline against a local target, because a gate on Clio's own invariants that needs a cloud key is not a gate.
-- Made invariant metrics fail closed by construction. `src/domains/eval/metrics/invariants.ts` reduces receipt, session, process, and write-boundary promises from the journal each eval item leaves behind, and every reader is total: a metric it could not compute is absent rather than false, because a threshold on an absent metric fails closed while a fabricated value is indistinguishable from a check that passed. Each metric has a test proving it fails on a corrupted artifact.
-- Made eval token accounting observed rather than assumed. Usage is folded out of a runner's live stdout as it arrives, so truncating the operator-facing artifact cannot erase it. A runner that observed no usage reports `tokens.measured: false` and no counts at all, never a zero, and reports say how many runs a total covers. Eval artifacts moved to version 4 with a discriminated `summary.tokens`; the parser refuses counts beside `measured: false`, a `tokens.total` threshold on an unmeasured artifact fails closed, and a comparison against an unmeasured side reports an unmeasured delta.
-- Added receipt-derived accounting for surfaces that publish no usage stream. `clio-coder fleet run --json` drains its workers' events, so a bounded loop's cost never reached the stream fold. `receiptUsage.*` reads what the run sealed and authenticated, carries its own provenance, and never merges with or masquerades as stream-observed `tokens.*`. An incomplete or unauthenticated receipt set reports unmeasured and no counts.
-- Added per-step write boundaries. Fleet contract v4 declares a `writes` path allowlist per step, `readonly` being the empty one, and the orchestrator verifies the claim after the fact by diffing the checkout against a pinned baseline, rolling back unauthorized changes, and sealing a verdict carrying its own digest and that baseline. This is detect-and-rollback, never sandboxing: nothing prevents a write, and confinement an agent cannot escape needs OS-level isolation this does not provide. A path that cannot be cleanly restored is reported and left for the operator rather than guessed at.
-- Added bounded check/repair loops and the shipped SDLC chains. A `loop` declares `maxAttempts`, a check, and an agent repair, and compilation unrolls it into conditional nodes so the plan stays one deterministic hashed DAG with a receipt per attempt. The declared bound is the promise: attempts never exceed it, every attempt after the first is `recovery`, and a spent bound reports `loop_bound_exhausted` rather than a green it did not earn. Verification staleness is scheduler-enforced.
-- Added deterministic `code` steps. A step names a command id from the repo-owned registry at `.clio-coder/fleets/commands.yaml`, never a shell string a model authored, and an unknown id or missing registry fails contract validation before anything dispatches. A code step holds no capacity lease and carries no execution role or authority grant.
-- Added headless session continuity. `clio-coder run --session <id>` appends to an existing session and `--continue` to the most recent one for the working directory. Continuation is a hard requirement rather than a hint: a session that cannot be resumed exits 2 before any model call, because an answer written without the history the caller asked for is worse than no answer. The session id is discoverable from the surface that ran the turn, and stdout stays the assistant's answer alone.
-- Made process-safe dispatch admission durable. Capacity leases are the expiring global and per-node authority, with acquisition, retry rebinding, heartbeat, drain, and reservation transfer serialized by one cross-process lock. The lease bound fails admission closed rather than dropping a lease, a plan slot belongs to an assignment so a retry never queues behind itself, and the operator's machine-wide drain is TTL-bounded so an abandoned drain cannot wedge the host.
-- Made context budgeting distinguish a target-reported limit from Clio's planning assumption. A router can answer `/props` with `n_ctx: 0` while a model-specific probe or LM Studio detail row records the selected model's context, including its currently loaded window rather than its larger theoretical maximum; selection is exact-id and target status names the source. A target that declares no window now receives Clio's explicit 131,072-token assumption with a human-visible warning to probe it, and a reported window below 128,000 warns on every runtime tier instead of quietly shrinking a session to the obsolete 8K fallback.
-- Fixed `clio-coder run --agent --json` republishing its segment transcript. Every message in an `agent_end` had already crossed the wire as its own `message_end`; on a two-minute run that was 24 KB restating 19 KB, and the ratio grew with the answer. Both `--json` wire projections now live in one module and make the same promise: content crosses exactly once.
-- Fixed a suite's declared `thresholds.fail` deciding nothing at run time. Only a later `eval gate` invocation read it, so a run that broke a declared threshold still exited zero. A gate now reaches per-run metrics, so the failure names the run rather than an aggregate, and an assertion whose metric was never measured fails closed in both layers.
-- Updated the Pi engine dependencies to 0.83.0. `src/engine/` is now the one place pi types enter the codebase; no file outside it imports `@earendil-works/*`, type-only included.
-- Made the default `clio-coder --help` describe the command surface a person needs to read while preserving the complete surface for scripts and agents. Harness-oriented commands are grouped under `clio-coder dev`, `clio-coder --help --all` reveals both sets, and the former top-level command forms continue to resolve unchanged.
-- Reorganized the interactive application into focused controller, presentation, input, event-projection, process-shell, transcript, ticker, editor, slash-command, and overlay lifecycle modules. The TUI's public behavior and command surface are unchanged; the decomposition gives lifecycle, input, overlay, and rendering contracts independent test seams instead of concentrating them in a 3,600-line entrypoint.
-- Fixed direct shell interpolation while opening provider URLs on macOS and Linux. Interactive OAuth authorization, device-code, and console URLs once entered an `exec()` command after only double-quote escaping, so backticks or command substitutions in provider-supplied text could execute before the browser opened; `open` and `xdg-open` now receive the URL as a distinct `spawn()` argument. Windows still starts its browser through `cmd /c start`, so this change removes the original `exec()` construction there but does not claim a shell-free Windows launch.
-- Made retries distinguish a self-hosted model that is loading from an ordinary rate limit. Unloaded or loading-model errors now qualify for retry with a 15-second minimum delay that still honors the configured maximum, so disk and VRAM loading does not spend the usual short backoff sequence before the target can serve a request.
-- Corrected damage-control matching so it evaluates commands that will execute rather than prose a file will contain. Writing documentation that quotes `rm -rf /`, a migration that contains `DROP TABLE`, or a classifier fixture no longer trips a command-pattern block; the same destructive command remains subject to policy when passed to a command-bearing tool, and destination paths still receive path-based checks.
-- Reworked project-context bootstrap around the dedicated `context-bootstrap` agent and a generated local handbook. `CLIO-CODER.md` is a gitignored runtime artifact rather than this repository's canonical instructions; the agent uses ordinary binding and default route resolution while honoring a legacy Scout binding, an existing handbook informs generation rather than silently cancelling it, and default initialization preserves it until an explicit `--apply` or `--rewrite` action. Bootstrap retains the previous handbook provenance when a run generates nothing and reads project identity from the manifests, build files, citation records, and README forms each ecosystem uses instead of assuming a Node package.
-- Made `clio-coder context refresh` update only the existing handbook sections the rebuilt codewiki owns, leaving model- and human-authored prose stable, and made context status name a partial generated wiki as incomplete rather than presenting it as coverage it has not earned. Context reset preserves the wiki by default and its help names that exception, so a destructive action is not hidden behind a generic reset.
-- Rebuilt generated wikis around a depth-scaled, index-derived page plan and isolated page writers. A bounded planner may refine the deterministic candidate, but each `wiki-writer` dispatch is confined to staging, receives a bounded source set and no Git tool, checkpoints one page at a time, and promotes the coherent pages it wrote while recording the rest for `clio-coder context wiki --update`. Deterministic assembly regenerates navigation from pages on disk, drops empty pages so they remain owed, and records unresolved links and citations for the next update rather than fabricating complete coverage.
-- Hardened the skill substrate from discovery through evaluation. A `SKILL.md` must be bounded valid UTF-8 text and a discovered root must contain the content it advertises; scalar or sequence tool declarations resolve to Clio's actual tool surface and warn on unenforceable names. `clio-coder skills eval` now measures the precedence-winning copy activation would load and reports its origin and hash, while install and update constrain GitHub paths to the cloned repository, validate a staged replacement before an atomic swap, preserve the installed copy on failure, and detect post-install drift against the recorded or catalog-pinned normalized hash.
-- Fixed worker budgets so late-run guardrails preserve the artifact a worker was admitted to produce. The reserve and soft limit now end broad discovery rather than read, write, edit, or the closed `orientation` product's `code_nav` delivery surface; executed calls remain bounded by the lifetime cap, refused calls do not spend it, free refusals carry their own bounded backstop, and loop escalation scales with the worker's admitted budget instead of the interactive threshold.
-- Made provider thinking controls and usage accounting describe what actually reached a model. `thinking: off` now sends an explicitly mapped off effort for supported effort-level families, while families with no such mapping continue to omit the field and LM Studio native reports its transport cannot send template thinking controls. Reasoning tokens remain accounted even when Clio suppresses the thought text, so an incorrect reasoning-never classification cannot make the server's observed usage disappear.
-- Made the npm release contract follow the runtime resources an installed CLI actually resolves. One shared release manifest now drives the package gate and tests, source analysis checks literal package-root paths against the allowlist, bundled HTML remains present for `clio-coder docs`, and generated repository-local handbooks cannot leak from a release checkout into the tarball.
-- Changed how the TUI treats a slash command it does not recognize. A command-shaped token now fails with `/<token> is not a command. Type /help for the list.` instead of being sent to the model as ordinary chat. This removes the fall-through that previously let four renamed spellings, `/status`, `/hotkeys`, `/skills`, `/connect`, `/disconnect`, `/receipts`, and every typo reach the model as a question about itself. The accepted cost is that one command-shaped word followed by prose now resolves as a command, so `/tmp is full` fails; the escape is a leading backslash, and `\/tmp is full` reaches the model unchanged.
-- Fixed `clio-coder uninstall --remove-binary` reporting that it removed a dangling launcher symlink while leaving it in place, which left a broken `clio-coder` on `PATH` after an uninstall that exited zero. Launcher ownership is now the resolved identity of this installation's own entry, so a link into a different clio-coder installation and a symlink whose target is a directory are both preserved with an actionable warning, and only a link that resolves to this installation, or a dangling link naming a clio-coder entry, is removed.
-- Fixed `clio-coder reset` and `clio-coder uninstall` reporting global success after a partial delete. Both now attempt every selected root, collect per-path failures instead of throwing the first one, rebuild the skeleton, name each surviving path with its reason, and exit 1 with the exact invocation to rerun.
-- Fixed `clio-coder trace --help` failing with `unknown trace flag: --help` and exiting 2 while every other subcommand answered on stdout with status 0. `clio-coder trace` usage also now says that `clio-coder trace ui` needs a source checkout, which is where the viewer ships; from an installed package the other trace subcommands read the same database.
-- Fixed `clio-coder configure --list` and the first-run runtime menu writing fixed-width rows sized for roughly 88 columns, which ran model hints to 141 columns on an 80-column terminal. The plain-stdout configure surfaces now measure the terminal and degrade by restacking rather than by dropping information.
-- Fixed error messages that named a command which could not change the outcome. An invalid `settings.yaml` now names the file, the keys, and `clio-coder reset --config --force` rather than `clio-coder doctor --fix`, which by design never rewrites settings content; an interrupted install that leaves a missing chunk reports reinstall instructions; and `clio-coder run --no-context-files` explains that global options precede the subcommand instead of reporting an unknown option.
-- Fixed a cancelled turn poisoning every later turn in the same session. The durable closing turn a cancel writes carries no provider `usage`, because no model call produced it, and it was recorded `stopReason: "stop"`, which walked it past the context estimator's aborted-or-error guard. The next turn then failed in roughly 30 ms with `Cannot read properties of undefined (reading 'totalTokens')` and no network call, and kept failing for the life of the session, because the process that wrote the record never re-read it and every later read did. The closing turn is now recorded `aborted`, which is what happened. Replay learned the same distinction: an aborted turn that carries its own text and no provider `errorMessage` is a notice Clio wrote itself and renders as that text alone, while a genuine mid-stream abort keeps its error line.
-- Fixed `clio-coder auth login` destroying the credentials it could not parse. Every write to `credentials.yaml` is a whole-file rewrite of the parsed view with no backup, and the parser answered a YAML error by returning an empty store, so a single login serialized that emptiness over the secrets and took the file from 211 bytes to 112. What made it likely rather than obscure is that `clio-coder doctor` called the file OK and `clio-coder auth list` showed every provider `disconnected`, the same word it uses for a provider you never logged into, so the operator is told they are logged out and then does the one thing that looks like recovery. Reading now reports what was lost on the way in, a write over invalid YAML or an unreadable shape refuses and names the file and the reason with a non-zero exit, the in-memory view is no longer updated ahead of the disk write, and `auth list` and `auth status` warn instead of understating. The refusal is bounded so a first login still works: absent, empty, comment-only, and empty-mapping files are clean rather than damaged, and only a non-empty mapping in neither known shape is refused.
-- Fixed `clio-coder doctor` reporting a root it cannot use as a healthy directory. The four root rows tested existence, which is true for a regular file and for a mode-000 directory, so doctor exited 0 and `clio-coder doctor --fix` one command later died on `Expected directory` and printed no report at all. Each root is now checked for being a directory that is readable, writable, and traversable, and the row names which of those failed; a `--fix` that throws records a `repair` row and still prints the rest of the report; and the metadata row no longer calls an `install.json` that is present and merely unreadable missing.
-- Added `[s] stop turn` at the permission prompt, which previously offered no exit from a repeating approval loop. `s` denies the call and ends the run through the same path the loop guard uses, closing the turn with a durable notice naming the tool, answering every call the turn had parked, and suppressing the re-notify that would otherwise open the next one. Escape is unchanged and still answers exactly one call.
-- Fixed `/cost` and the footer usage line rendering one process-lifetime accumulator that only a new session ever reset, so a resumed session showed the previous session's totals under the resumed session's id, and a process that resumed and sent nothing reported zero for a session holding tens of thousands of tokens on disk. Resume, `/tree` switch, and `/fork` reseed those totals from the session's own ledger, skipping turns marked aborted or error along with the all-zero usage block a cancelled partial persists.
-- Made `clio-coder doctor` report the session and credential damage its own loaders already see. A `session store` row fails when `state/sessions` is gone while state metadata remains, which previously left doctor byte-identical to a healthy run in both text and `--json`; damaged ledgers are parsed with the reader `clio-coder run --continue` uses and the row names up to three `path:line` damage points before summarizing the rest. The credentials row consults the same damage reason the storage layer reports, so an unparseable store fails the row with the YAML reason and an unreadable one names the path and the remedy rather than a raw `EACCES` string. The `invalid JSON skipped` line prints once per damaged line per process instead of six times.
-- Made `clio-coder usage report` distinguish a missing store from zero activity, and gave it the token and cost facts it never carried. Text names `session store missing at <path>` and `receipt store missing at <path>`, the opportunities section says the inputs are absent rather than concluding `none`, and `--json` emits `session-store-missing` and `receipt-store-missing` facts. Token and cost rows are folded from the same per-call ledger fold `/cost` reads, which now lives in `src/domains/session/usage.ts` and is imported by both surfaces, so the headless report and the TUI cannot drift into two answers for one ledger.
-- Fixed writers recreating state the operator had just removed. `clio-coder uninstall` reported `removed Clio Coder state` and then a live process resurrected `runs.json` from memory on quit, holding runs whose receipts no longer existed, so `clio-coder fleet status` billed them while `clio-coder usage report` said zero for the same week. One shared guard in `src/core/xdg.ts` now covers the session shutdown checkpoint, tree and meta persistence, the audit log, recent-models, and the dispatch ledger. It reads the resolved XDG cache rather than probing the path, because a bare existence check cannot tell a removed root from a first run that has not created one yet, and a probe-based guard would have silently disabled the audit writer on fresh installs. Separately, `clio-coder uninstall --dry-run` no longer leaves npm debug logs in `$HOME/.npm/_logs`, which the documented side-effect-free preview wrote on every invocation.
-- Fixed `clio-coder auth login` printing its success line and exiting 0 after a write the storage layer had refused, which reported a stored credential that was never written. Every credential-writing CLI path now consults the storage damage reason after the write and reports the refusal with a non-zero exit, and the interactive auth overlay consults the same reason instead of claiming success on the refused write.
-- Made `clio-coder reset` and `clio-coder uninstall` say what they are about to destroy and what survives. The reset preview lists each root's real children with counts and gives every scope a note, and the help defers to that listing rather than describing it. Uninstall enumerates the per-project `.clio-coder/` directories recorded in session metadata and names `clio-coder context reset --all` before the roots and the launcher are touched, because the record it reads lives inside a root it is about to remove and the cleaner is a subcommand of the binary `--remove-binary` is about to delete. Per-project directories are still not removed by uninstall; this makes the ordering visible rather than closing the gap.
-- Made a failed settings reload render as one width-clamped notice from the shared settings formatter instead of an inspect dump and a stack trace that corrupted the frame. Read, parse, and schema failures are distinguished, the remedy matches the kind and leads the detail so frame clamping cuts context rather than the fix, the raw YAML source fragment is gone, and the previous good configuration stays active. Doctor's settings row and the thrown error use the same helpers.
-- Fixed `clio-coder targets --probe` writing fixed-width rows that ignored the terminal. The id column never truncates, url and model truncate with an ellipsis, `--json` stays untruncated, and surplus width goes to url and model before the tier column, which had let four distinct hosts render identically at 120 columns while the group header already carried the tier.
-- Added slash aliases for the spellings people actually type: `/exit` resolves to `/quit`, `/config` to `/settings`, and `/compact` to `/context compact`, with aliases offered in tab completion ranked below their canonical commands. A rejected unknown command now clears the composer rather than leaving the text to concatenate with the next keystrokes into a message to the model.
-- Made the TUI tell the truth about a denied tool call and about usage the ledger was hiding. A denial renders as the dialog outcome and status alone, the collapsed row reads `bash(id) ✗ blocked` instead of claiming the call `ran`, and no parked-approval line survives the decision. `/context compact` persists its summarization usage on the compaction entry and moves `/cost` immediately, so a real model call stops being invisible to every usage surface. A cancelled turn now persists estimated usage marked `estimated: true` in the shape a completed turn uses, rather than the all-zero block the cancel path used to write beside real streamed text, and `/cost` readers skip it. `/tree` shows the fork parent and the compaction and branch nodes, and replay no longer dumps `custom:promptRecompiled` JSON into the transcript. The stop-turn notice no longer doubles the usage line onto the empty assistant entry it splits open, and a settled entry holding nothing renders nothing instead of an empty bubble.
-- Made overlay footers say what Esc will do from where the overlay is right now. The verb was derived from whether an overlay committed anything, which produced `cancel` on half of them and `close` on the other half while neither word described the key: a list overlay clears a typed filter on the first Esc and closes on the second, and the footer said `close` through both. The caller names the action now, out of a fixed vocabulary of `close`, `clear filter`, and `back`, and `/models` and `/resume`, which close on the first Esc, say so instead of advertising a filter they do not clear. Every overlay uses one filter vocabulary.
-- Fixed a repair masquerading as an install. `initializeClioHome` stamped `installedAt` when it had only repaired an existing home, so the install date moved every time doctor rebuilt the skeleton. A repair writes `repairedAt`, `install.json` accepts either stamp, and doctor prints whichever exist. The doctor damage row groups identical messages instead of repeating one error three times.
-- Made every cost surface claim only what something measured. The cost aggregate could not tell nothing-priced from priced-at-zero, so the footer asserted `$0.00` before any turn had run while `/cost` on the same session said no usage was recorded, and after a real turn against a target that publishes no pricing both printed the literal words `cost unknown` where a number belongs. The aggregate carries its call count, one formatter answers every surface, and a surface with no priced call shows no cost field at all. Usage and cost are separate claims: the tokens were counted whatever the pricing did, so the session total stays on screen and only the cost field disappears. A fixed-width cell that owns a cost column cannot drop the field, so it says `not measured` in words rather than inventing a number.
-- Made the footer describe the branch on screen rather than the whole ledger file. `current.jsonl` is append-only, so after a `/tree` switch the abandoned sibling turns are still in the file: the transcript stopped showing them while the session total, `/cost`, and the last-turn status line kept counting and describing them. All three now fold through the same active-path lineage the transcript replays, on `/tree`, `/resume`, and `/fork`. The footer's chip strip also ranks its chips, so the chip budget and the width budget both shed per-turn detail first and the session total last; it used to slice whatever sat at the end of the list, which cost an 80-column terminal both the total and the cost chip while spending the whole budget on per-turn detail. Two fields the ledger does not record are left neutral on a rescoped line rather than reconstructed: the watchdog peak, and reasoning tokens no provider reported.
-- Made the installer and uninstaller describe one `PATH` the same way. `scripts/install-local.sh` compared the resolved `clio-coder` against its own link path as raw strings, only when the bin directory was already on `PATH`, and never on a dry run, which is why a shadowing install could go unreported in exactly the case where the other `clio-coder` is the only one a bare name reaches. Both sides are resolved through their symlinks before they are compared, and the installer prints the same `another clio-coder is on your PATH at <path>` warning and check command that `clio-coder uninstall` prints. The README install block clones the release ref, carries verbatim the `export PATH` line the installer prints when the bin directory is not on `PATH`, verifies with the launcher's resolved path, and asks `command -v clio-coder` rather than comparing `--version` output, because two installs of the same release report the same version while the bare name still resolves to the other one. The warning names the divergence; it does not reorder anyone's `PATH`.
-- Added a reserved `clio:` frontmatter block so a Clio skill stays a portable skill. Catalog skills carried `registry-id`, `source-url`, and audit fields at the top level of their frontmatter, mixed in with the community-standard keys every agent loader reads. `name`, `description`, `version`, `license`, and `allowed-tools` now stay exactly as the wider ecosystem expects, and everything Clio-specific moves under one `clio:` mapping extended with provenance, origin, eval status, model size, and agent bindings. A Clio skill dropped into any `.claude/skills` directory loads unchanged with the block ignored, and loaded by Clio Coder it carries its full marketplace metadata. The loader reads the nested block first and falls back to the flat keys for already-installed copies, install writes the nested form, and the pinned content hash covers it.
-- Added sixteen ported skills and a `git-master` builtin agent, taking the catalog from sixteen skills to thirty-two. Every port was rewritten to the catalog bar rather than copied, with provenance and origin recorded in its `clio` block and eval status honest at `untested` for the ports that have not been evaluated. `git-master` owns bounded git operations end to end and binds the six rewritten git skills, while `coder` binds only commit-crafting and review-changes on role fit, because binding injects skill names as guidance and the rest would misdirect an implementation loop. Two limits are recorded rather than papered over: `ast-grep` is bound to the main agent only, because the scout role's read-only tool class cannot admit an execute-class tool and the clean path is a typed read-only tool that does not exist yet, and `worktree-create` stays sequential because no worker recipe carries bash. `coding-standards` and `tech-spec` enter as provisional under a documented trial field.
-- Reorganized the thirty-two skill catalog into seven category folders, `research`, `coding`, `git`, `planning`, `context`, `workflow`, and `meta`, and renamed the skills to carry their job instead of their source repository's branding. The `piv-` prefix is gone in favor of `commit-crafting`, `review-changes`, `investigate-issue`, and `create-pr`, `plan-create-prd` becomes `product-requirements`, `plan-architecture` becomes `architecture`, and `plan-create-stories` becomes `backlog`, with titles, descriptions, eval headers, cross-references, source URLs, and the builtin agent bindings all moving together. The pin script discovers packages recursively and renders `registry.yaml` grouped by category, and marketplace discovery probes one category level down. The move also surfaced a packaging defect it fixes: the release manifest shipped only `cut-it`, so an installed package could not have resolved `git-master`'s bound skills, and it now ships `workflow/cut-it` and the whole `git` category.
-- Smoke-checked the entire skill catalog against a 30B local model through the real eval harness, one transcript-verified scenario per skill. The campaign surfaced a judge that scored instruction prose instead of transcripts and a permission gate that blocked every git call headless, so the git scenarios gained seeded repository fixtures and the expected results were rephrased to observable behavior. Five skill bodies were corrected from what the runs showed, each skill records a dated smoke result, and `smoke-checked` is a documented eval status; skills the cutoff reached first remain honestly at `scenarios-recorded`.
-- Added `queued_user_turn` to the `--json` wire protocol. A steer or follow-up typed while a turn is still running used to enter the run with nothing on the stream to mark it, so a `--json` consumer saw the model react to text it had never been told about. The frame is emitted at injection time, when the queued text actually enters the run rather than when it was typed, and it carries the same text the model receives. It is a new frame on a public wire, so consumers that switch on frame kind should expect it.
-- Removed the four-second freeze on opening a workspace and took the redraw cost off the transcript's length. Codewiki startup ran a synchronous `statSync` sweep that blocked the event loop for 3342 ms on this repository and now costs 12 ms. TUI dirty-frame render fell from 10 ms to roughly 0.14 ms at 400 turns, because the frames above the viewport are a frozen prefix that is composed once instead of re-rendered every keystroke. Workspace enumeration no longer holds the loop for a 34 ms floor; a cooperative async walk yields between batches, and the worst block observed under validation is 9 ms to 15 ms.
-- Made the settings center's three-column layout start at a real 120-column terminal. The description earned its own column at a threshold of 116, but two nested frames sit above that body and each costs a border and a pad, so a 120-column terminal only ever presents 112 columns and the layout never appeared outside a 124-column window. The floor is 112, and the contract test pins both sides of the boundary at the body widths a 120- and a 119-column terminal actually produce.
-- Added a fleet roster to the compiled session prompt, so the orchestrator can see the agents it may dispatch instead of guessing. `agent: "auto"` now baselines from task shape, sending code work to `coder`, tests to `tester`, docs to `documenter`, review to `verifier`, and research to `researcher`, where it previously resolved to the read-only `scout` for everything.
-- Replaced the delegation incentive with a rule the model can evaluate: two or more independent file-scoped subtasks, or any broad exploration, goes to workers, while synthesis, validation, and a single narrow change stay with the orchestrator. A file handed to a worker is not the orchestrator's to edit, and an admission refusal is reported rather than silently worked around.
-- Made the run summary the orchestrator reads carry what the worker did. A mutation-class run whose mutating calls all failed now reports that nothing was written instead of a bare successful exit.
-- Made sealed results measurable against the run's own tool events. A reported changed path the run wrote verifies, one whose only write was refused fails, one that exists but was never touched seals quality unmeasured, and one that exists nowhere fails outright. A passing validation claim that no executed command supports downgrades to unmeasured with the claim named, while a check the recognizer cannot tie to a claim is reported unmatched rather than called fabricated.
-- Added capability-mismatch refusal at dispatch admission. Pointing a read-only recipe at mutation work is rejected before a worker exists, and only when the caller pinned the id, the task classifies as mutation, and the recipe's postcondition is a report. Anything short of that admits with a flag on the receipt, and `agent: auto` never refuses.
-- Gave workers the workspace root and a bounded top-level listing on every dispatch, closing the case of a worker spending a fifth of its call budget locating the repository.
-- Added operator-initiated backgrounding. `Alt+S` converts a running attached dispatch into a detached batch, the runs continue, and collection is unchanged. Review gates, compete, pipelines, Scout fleet plans, and time-boxed calls refuse the conversion and say why.
-- Added `monitor` with `mode="tools"`, which reports what a run executed from the event tail and the receipt's integrity-checked totals.
-- Made scratch directories under `/var` write like `/tmp`. `/var` stays protected with `/var/tmp` and `/var/folders` carved out, `/run` joins the protected list, and a pathless `artifact` call no longer writes into a system root without confirmation.
-- Made compound bash earn recognition. A `&&` chain is evaluated at its most restrictive recognized member and refused as a whole if any member is unrecognized, and an `sh -c` wrapper is read through to its inner command rather than around it.
-- Made a headless denial name the form that would have been recognized. A headless run cannot answer a permission prompt, so an agent that hit the wall used to retry variants until the loop guard ended the turn.
-- Fixed project-context bootstrap being dead on llama.cpp. That server refuses any request carrying both a response schema and tools, and every bootstrap dispatch carries tools; the conflict is now refused at admission and the run goes straight to the prompt-parser fallback. A failed bootstrap reports the real error instead of "did not return an assistant response", and a `--rewrite` that fell back to the existing handbook says so and exits 1.
-- Made interactive turns visible to `clio-coder trace`, recorded as runs under a `session` assignment id with one event per tool call. A missing database now reads as an empty state naming its path rather than raw sqlite text, and the `node:sqlite` experimental warning is gone from trace commands unless `--trace-warnings` is passed.
-- Made the TUI read the tool verdict the registry issues instead of pattern-matching output text, which had rendered a failing test whose output contained the word "cancelled" as a policy block. The verdict persists through `/export` and `/resume`.
-- Fixed a headless run whose turn ends on a terminating artifact printing nothing and exiting 0. The artifact content is the answer and now reaches stdout.
-- Made `clio-coder skills eval` measure the skill instead of the harness. Arms are hermetic and run at full-auto in disposable workspaces, so an exec-class call is no longer scored as a skill failure; `--allow-network` opts back into network tools. The judge scores transcript evidence only, and an unparseable judge verdict is `unmeasured` at exit 3 rather than a verdict.
-- Published `skills/skill-marketplace.json` beside the pinned registry, so an install can point `CLIO_CODER_SKILL_MARKETPLACE_INDEX` at it and resolve bare names. `clio-coder skills install` takes several names and `--category`, `search` matches that same category vocabulary, and `inspect` on a marketplace name says the skill is not installed rather than denying it exists.
-- Fixed the Skills Hub listing fifteen installable-looking rows in an environment with no marketplace configured. The rows came from a third source nothing else consulted; the hub now builds from the same discovery the installer uses, and a fresh environment gets an empty state naming the two real ways to get a skill.
-- Fixed `--help` executing, rejecting, or being swallowed across the `targets`, `context`, `fleet`, and `auth` subcommands. Every one answers with usage on stdout at exit 0 and executes nothing.
-- Gave the artifact loaders one not-found voice. `clio-coder eval report`, `clio-coder evidence inspect`, `clio-coder evolve manifest validate`, and `clio-coder components diff` named raw filesystem errors; they now name the id or path that was missing, and `clio-coder docs` prints its absolute served directory from any working directory.
-- Reconciled the `clio-coder auth login` and `clio-coder configure --list` runtime inventories, which drew from one source and looked like two products. Each screen now says what it shows and names the command that shows the rest.
-- Fixed builtin fleet contracts listing as invalid on a fresh checkout, where a missing command registry is setup and not corruption. Those entries render as setup with the exact file and keys to create, while a registry that binds wrong ids stays invalid.
-- Stopped `clio-coder configure` presenting two alphabetically-first catalog ids as recommendations and seeding `defaultModel: gpt-4` when none was given. A catalog-backed runtime reports its catalog size and requires `--model`.
-- Made overlays respect the width they are given. The permission overlay wraps its safety text and keeps `[s] stop` at every width, hints elide by priority rather than position, and `/view` drops to one pane rather than squeezing two into noise. Verified at 40, 80, and 120 columns.
-- Made `thinking: max` reachable. Dispatch validation rejected it and route selection threw on it mid-run, so the level was unreachable through the dispatch tool, `clio-coder run`, and the CLI; the level list now has one source and a drift test fails any file that respells it.
+### Added
+- The first npm-published `clio-coder` command and namespace: binary, XDG roots, project directory, handbook, environment variables, and extension manifests use `clio-coder` naming.
+- Agent ledgers, intentional compete stances, durable dispatch capacity leases, deterministic execution plans, typed worker contracts, and transactional worker attempts.
+- Soak and invariant evaluation suites, receipt-derived accounting, per-step write-boundary checks, bounded check/repair loops, deterministic fleet code steps, and headless session continuation.
+- Improved context bootstrap/refresh and generated-wiki workflows, hardened skill discovery/install/evaluation, and updated Pi engine dependencies to 0.83.0.
+
+### Changed
+- `clio-coder --help` now emphasizes the human-facing command surface; `--help --all` retains the full scripting and harness surface.
+- Reorganized TUI internals without changing its public command surface, and made context budgeting favor target-reported limits.
+- Unknown slash commands now fail closed; use a leading backslash for command-shaped prose.
+
+### Fixed
+- Preserved active session branches across compaction and replay, made startup option parsing strict, and bounded ACP deadlines.
+- Stopped automatic retries after potentially state-changing tool calls.
+- Fixed JSON transcript duplication, evaluation threshold enforcement, cancellation recovery, usage totals, uninstall/reset reporting, and narrow-terminal configuration output.
+- Corrected provider URL launching, damage-control matching, credentials handling, doctor reporting, and trace help behavior.
+
+### Security
+- Replaced shell interpolation when opening provider URLs on macOS/Linux with argument-safe process spawning.
+- Made dispatch plans immutable and receipt-backed, enforced worker attestation and write-boundary recovery, and fail-closed on malformed durable contracts, unknown skills, and unsafe retries.
+
 ## 0.2.9 - 2026-08-05
 
-- Added deterministic `code` steps to fleet contracts and execution plans. A step names a command id from the repo-owned registry at `.clio/fleets/commands.yaml`, never a shell string a model authored, and an unknown id or a missing registry fails contract validation before anything dispatches. A code step holds no capacity lease, carries no execution role or authority grant, and returns the typed `code-report` contract; under `onFailure: continue` its verbatim output is the input to the step that repairs it.
-- Added bounded check/repair loops and shipped three SDLC fleets. A `loop` declares `maxAttempts`, a check (a registered command or a gate agent), and an agent repair; compilation unrolls it into conditional nodes so the plan stays one deterministic hashed DAG with whole-plan admission and a receipt per attempt. Verification staleness is scheduler-enforced: a workspace step landing after a green re-runs it before any dependent may rely on it. `build-test`, `build-review`, and `sdlc` ship from `src/domains/agents/fleets/`, and a project `.clio/fleets/<name>.md` shadows a builtin.
-- Added a durable trace store: every run is mirrored into a rebuildable WAL SQLite database beside the ledger, with a fail-closed schema version, seven Clio-mapped tables, and one documented rowid-cursor query. Writes are bounded and secret-redacted, run off the worker event pump, and drop display-only progress before any lifecycle, terminal, tool, attempt, or usage fact; a trace failure degrades the mirror, never the dispatch it observes.
-- Added `clio trace` (`runs`, `phases`, `tail --follow`, `procs`, a single read-only `sql` SELECT, and `ui`) plus a no-build localhost-only waterfall viewer under `apps/trace-viewer`, outside the published package. Component dollar columns stay empty where no authoritative producer supplies them, and the viewer says "not recorded" rather than inventing a breakdown.
-- Added per-step write boundaries. Fleet contract v4 declares a `writes` path allowlist per step, `readonly` being the empty one, and the orchestrator verifies the claim after the fact by diffing the checkout against a pinned baseline, rolling back unauthorized changes, and failing the step with `writes_boundary_violation` naming the paths and the declaration. This is detect-and-rollback rather than sandboxing; a path that cannot be restored cleanly is reported and left for the operator instead of guessed at.
-- Updated the Pi engine dependencies to 0.80.6, including native `max` thinking-level support and upstream runtime, accounting, and protocol fixes.
-- Made singular `dispatch({agent, task, briefing, detach})` first-class while preserving batch `tasks`, pinned task/briefing separation through approval, and rejected briefing-only or ambiguous `task`+`tasks` calls.
-- Made native-worker initialization fail closed on the same `worker_announce` wire-version handshake locally and over SSH, then required a full identity and resource attestation before the first model call.
-- Required a nonempty receipt-sealed final answer for successful native and ACP delegation, with deterministic `worker_final_output_missing` failure and no automatic retry; added prose-free steering provenance and advanced receipt integrity to strict v15, whose reader rejects every earlier format.
-- Made model-facing dispatch and collect output distinguish verified receipt integrity, evidence verification, briefing provenance, and bounded project-context provenance, and tightened collect-before-synthesis and bounded Scout spot-check guidance without restoring forced routing.
-- Unified ordinary synchronous and detached model dispatch over one per-tool run consumer: synchronous calls auto-wait on the registered drain, while detached calls return run ids and leave that same drain running so the parent model can monitor or steer mid-run. The interactive operator/TUI can monitor and steer an active synchronous native run through the dispatch contract; ACP runs remain monitorable but have no steering channel. Review and compete retain direct gate-sensitive drains so reviewer/judge output is staged before their receipt-facing settlement path.
-- Added one prompts-domain-compiled Clio worker harness with deterministic canonical tool slicing, stable/dynamic prompt separation, and read-only reviewer/judge parity; added strict per-agent `budget` frontmatter, Scout `18/4/true` and Coder `50/5/true` profiles, native and Claude SDK enforcement, and fail-closed explicit-budget admission for black-box subprocess runtimes while preserving the operator hard cap.
-- Hardened dispatch authority and provenance: approval now uses one registry-owned, deeply immutable resolved plan (effective agent, target, model, node id/kind/host, every bounded gate role, and cost ceiling); approval rendering and execution consume that same trusted artifact, execution fails closed on route or ceiling drift, forged plan fields are ignored, and receipts identify the actual one-shot approval or full-auto decision.
-- Added write-ahead, integrity-covered coordinator evidence for review verdicts, compete winners, and supervised/full-auto winner application; reviewer/judge output is staged before receipt settlement and reconstructed only from a verified receipt after restart, and evidence bundles now include `gate-decisions.json`.
-- Closed external-agent policy gaps by canonicalizing standardized ACP locations for path-bearing reads and mutations, rejecting contradictory tool metadata, unenforceable profiles, and authority narrowing before launch, representing external tool inventory as unknown, supporting bounded read-only ACP reviewer/judge roles, and bounding resistant ACP process groups on abort, stall, failure, and successful teardown.
-- Made protected-artifact boundaries durable across session append, synchronous flush, reload, reset, restart, local/shared-filesystem dispatch, and compete worktrees with a write-ahead recovery journal, merge-time protected-diff check, and fail-closed degraded mode.
-- Made iterative compaction cumulative, surfaced compaction failures distinctly from legitimate no-ops, and isolated repository-scoped memory by canonical repository identity in interactive and headless agent prompts.
-- Made compete worktree ownership transactional and segment-safe, with all admitted workers settled before cleanup, durable coordinator/worker process leases, PID-reuse-resistant termination of hard-crash orphans at orchestrator startup, and restart preservation of a pending or recovered winner while losers are removed.
-- Made broad repository exploration model-authored: the chat harness and middleware no longer force Scout routing or block direct reads, while the operating contract, Scout catalog description, and an advisory after 9 or more manual read-only calls steer delegation. Dispatched Scout workers retain the 18-call exploration-to-synthesis guardrail, and the task-aware Fleet Runs UI exposes live tools, tokens, priced cost, retries, steering acknowledgements, and per-run cancellation.
-- Added strict versioned agent recipes and typed terminal result contracts. Malformed custom recipes are quarantined, built-in schema failures stop startup, Scout citations must be grounded in the worker's own live reads, and a postcondition that was never reached is recorded as `not-reached` rather than fabricated as a quality failure.
-- Added one deterministic `ExecutionPlan` v2 DAG with whole-plan preflight, capacity-bounded waves, authenticated handoffs, requested/approved authority on every task, and a strict resolved-plan v3 boundary with explicit deadlines. Older or partial durable forms are rejected rather than migrated or accepted through aliases.
-- Added process-safe global and per-node admission with durable expiring leases, deterministic priority/FIFO queues, finite deadlines, retry reservation rebinding, TTL-bounded operator drain, and cross-process owner-liveness checks. Placement spreads by durable lease usage, but leases remain the authority under the state lock.
-- Added a two-lane worker protocol and pre-call attestation of protocol, process group, host, settings and WorkerSpec digests, runtime, target, endpoint, model, tool surface, and resource facts. Local and remote aborts terminate the whole process group; display backpressure cannot delay heartbeats, acknowledgements, or receipt-bearing frames.
-- Added measured joint route resolution across agent, target, model, runtime, and node. Hard constraints eliminate before deterministic Pareto ranking; route history v3 aggregates only compatible capability evidence, retires older files, and invalidates buckets on tool-surface or endpoint drift.
-- Added operator-scoped active routing for read-only-capability work in researcher, verifier, reviewer, and judge roles. Shadow remains the default; activation requires named role/posture settings and exact-route readiness evidence, and no-ready-candidate, manual pin, and `failover: none` paths fail closed.
-- Added bounded `agent: auto` evaluation and typed Scout phase escalation. Agent authority, tools, skills, result contract, locality, and governance remain hard filters; authority-changing transitions require an authenticated plan approval or existing full-auto authority, and agent automation stays shadow by default with per-agent/per-role readiness.
-- Added transactional attempt isolation for editing work. Every assignment owns baseline-pinned attempt worktrees, winning changes are checked for outcome, receipt integrity, result conformance, quality gate, protected artifacts, ancestry, and destination cleanliness before apply, and a refused winner is preserved with recovery instructions.
-- Advanced receipt integrity to strict v15, route policy to v4, route history to v3, ExecutionPlan to v2, and resolved dispatch plans to v3. Current readers accept only the current format for each boundary; earlier forms are rejected or explicitly retired.
-- Clarified the compact main and worker harness prompts with an explicit direct-tool inventory and a strict distinction between tools, fleet agents, and operator-activated skills, preventing capability questions from triggering irrelevant fleet queries.
-- Grounded generated wikis in detected repository instructions and their declared source-of-truth documents, added dirty-working-tree evidence and source-tree freshness metadata, tightened capability-claim guidance, let the bound documenter worker profile control its thinking level, and raised the local tool-bearing turn ceiling to the configured 32K default so long-context documenters are not artificially constrained to 16K.
+### Added
+- Deterministic fleet code steps, bounded check/repair loops, shipped SDLC fleets, and a durable trace store with read-only trace commands and viewer.
+- Per-step write-boundary verification, typed worker result contracts, strict worker attestation, and process-safe capacity/routing leases.
+- One compiled worker harness with explicit tool/budget profiles, model-facing dispatch/collect provenance, and transactional editing attempts.
+
+### Changed
+- Added first-class singular dispatch while retaining batch dispatch, and unified synchronous and detached run monitoring.
+- Updated Pi engine dependencies to 0.80.6 and advanced receipt, route, plan, and policy formats to their strict current versions.
+- Broadened model-authored repository exploration while retaining bounded Scout guidance and Fleet Runs visibility.
+
+### Fixed
+- Made successful native and ACP delegation require receipt-sealed final output, and made protected-artifact recovery durable across restart and worktrees.
+- Improved compaction, context provenance, routing, external-agent cancellation, and generated-wiki grounding.
+
+### Security
+- Enforced immutable approved dispatch plans, strict external-agent policy checks, bounded worker protocol frames, and fail-closed handling of older or partial durable formats.
 
 ## 0.2.8 - 2026-07-07
 
-- Redesigned the tool surface into seven planes with consolidated observe,
-  execute, orchestrate, retrieve, interact, mutate, and artifact tools.
-- Added session task tracking with the `tasks` tool, `/tasks`, open-task
-  continuation nudges, and receipt-backed task evidence.
-- Added richer dispatch controls: `monitor`, `steer`, pipeline dispatch,
-  ad-hoc specialist personas, and worker permission escalation.
-- Rebuilt context indexing around codewiki schema v4, a separate
-  agent-authored wiki layer, `/context refresh`, worker context injection, and
-  one ignore policy for grep/find visibility.
-- Added prompt manifests, eval provenance, public benchmark manifests, unified
-  observation truncation envelopes, `/export`, and deeper per-tool usage docs.
-- Improved the interactive UI with a shared TUI design system, slash-command
-  argument completion, a `/context` hub, clearer permission queues, and better
-  skill-loading guidance.
-- Fixed safety and autonomy edge cases around approval denials, symlink path
-  checks, loop-guard recovery, external worker tool profiles, reasoning-off
-  models, and source-tree awareness in nested repositories.
-- Reworked local model residency: local inference targets are treated as
-  multi-model servers with finite VRAM, one shared reconciler drives llama.cpp
-  routers, LM Studio, and Ollama, co-resident models such as a scout beside
-  the main coder are protected symmetrically, residency mutations against one
-  server are serialized across processes, and the `CLIO_RESIDENCY=observe`
-  and `lifecycle: user-managed` opt-outs now work on every runtime path.
-- Added native shadow-agent fleet routing: `/agents` lists shadow agents and
-  `/fleet` binds native agents to target/model worker profiles, including
-  changing a bound profile's model from the bindings tab.
-- Enforced loop-guard synthesis lockouts mechanically for the main agent and
-  dispatched workers: locked turns can only answer (request-level
-  `tool_choice: none`), dead tool-call markup is sanitized out of locked
-  answers, and a result-stagnation detector blocks byte-identical retry
-  escalations that evaded the verbatim detector.
-- Conditioned the harness for local models with measured fixes: a
-  deterministic tool-routing order in the system prompt, task-board reminders
-  on enumerated multi-step requests, a validation nudge on successful edits,
-  recovery guidance with sanctioned pivots on blocked calls and denials,
-  ask_user gated to genuine decisions, bundled-docs retrieval repairs, and
-  observation-budget stubs that end retry traps.
-- Made the TUI truthful under pressure: context meters draw the autocompact
-  reserve with its own glyph, the dispatch board renders at the terminal's
-  real width, overflowing rows drop whole facts behind an ellipsis instead of
-  clipping mid-number, permission overlays show the parked call's target
-  (including worker escalations, sanitized at the trust boundary), and
-  blocked or aborted tool calls settle instead of spinning forever.
-- Fixed accounting: aborted turns keep their real token usage, headless run
-  receipts sum usage across all agent segments, guard blocks are recorded as
-  blocked safety decisions, and worker tool-call caps count blocked attempts.
-- Fixed session integrity across `/tree`, `/fork`, resume, and compaction so
-  abandoned sibling turns are never replayed, copied, or summarized.
-- Hardened worker IPC: subprocesses drain stdout before exit, streaming no
-  longer amplifies quadratically, and internal generator dispatches (wiki
-  update, context bootstrap) get a wall-clock deadline with progress output.
-- Fixed deadline timers that could silently never fire in a quiet process:
-  ACP request timeouts, dispatch and internal-generator deadlines, the
-  dispatch drain grace, and worker escalation timeouts now hold the event
-  loop until they fire or are cleared.
-- Updated the model catalog: the Qwopus3.6 Coder entries carry the upstream
-  presence-penalty sampler default, and reasoning-never model families no
-  longer receive or replay thinking fields.
-- Aligned the documentation corpus with v0.2.8, added worker-dispatch and
-  provider-adapter guides, and refreshed the HTML docs viewer with new
-  interactive blueprints.
-- Breaking: legacy tool names such as `glob`, `workspace_context`,
-  `docs_search`, `run_task`, `validate_frontend`, `write_plan`,
-  `write_review`, `create_skill`, and `dispatch_batch` were removed in favor of
-  the consolidated tool surface.
+### Added
+- A consolidated seven-plane tool surface, task tracking, richer dispatch monitoring/steering, codewiki v4, exports, and improved interactive command hubs.
+- Multi-model local residency management and native shadow-agent fleet routing.
+
+### Changed
+- Improved local-model prompting, TUI pressure handling, accounting, worker IPC, deadlines, model catalog metadata, and documentation.
+
+### Fixed
+- Corrected approval, symlink, loop-guard, worker-profile, reasoning, session-branch, and timeout edge cases.
+
+### Removed
+- Legacy tools including `glob`, `workspace_context`, `docs_search`, `run_task`, `validate_frontend`, `write_plan`, `write_review`, `create_skill`, and `dispatch_batch`; use the consolidated tool surface.
 
 ## 0.2.7 - 2026-07-02
 
-- Added five reviewed marketplace skills: `scientific-debugging`,
-  `experiment-protocol`, `design-council`, `credentials`, and
-  `workflow-distiller`.
-- Added executable skill evals, enforced skill tool surfaces, and registry
-  integrity pins for catalog skills.
-- Added credential damage control with zero-access credential storage,
-  secret-value redaction in evidence bundles, and a read-only
-  `credential_present` tool.
-- Added `clio usage report`, headless main-agent receipts, dispatch evidence
-  bundles, high-rigor validation prompts, and evidence-linked change manifests.
-- Reduced package size, tightened the release workflow, refreshed
-  documentation, and fixed several dispatch, lifecycle, skill, and loop-guard
-  reliability issues.
+### Added
+- Reviewed marketplace skills, executable skill evaluations, enforced skill tool surfaces, and registry integrity pins.
+- Credential damage control, usage reports, headless receipts, dispatch evidence bundles, and high-rigor validation support.
+
+### Changed
+- Reduced package size and refreshed release and documentation workflows.
+
+### Fixed
+- Improved dispatch, lifecycle, skill, and loop-guard reliability.
+
+### Security
+- Added zero-access credential storage and secret redaction in evidence bundles.
 
 ## 0.2.6 - 2026-06-24
 
-- Added VRAM-aware local model residency so interactive, headless, and worker
-  runs reconcile model load/evict behavior through one path.
-- Added first-class customization surfaces: layered project settings,
-  path-scoped rules, operator profiles, user hooks, and `clio config inspect`.
-- Added self-orientation through the `docs_search` tool and `clio docs`
-  viewer.
-- Added SciCode benchmark support, coverage gates, deterministic repeat lanes,
-  and refreshed guides and HTML blueprints.
-- Fixed a dispatched-run residency gap that could leave Ollama models resident
-  and overflow VRAM.
+### Added
+- VRAM-aware local-model residency, layered settings, path-scoped rules, operator profiles, hooks, configuration inspection, docs search/viewing, and SciCode benchmark support.
+
+### Fixed
+- Prevented dispatched Ollama work from leaving models resident and overflowing VRAM.
 
 ## 0.2.5 - 2026-06-23
 
-- Added the `alcf` runtime for Argonne ALCF Sophia/Metis inference targets over
-  Globus OAuth.
-- Added ALCF model metadata, gateway-specific documentation, authenticated
-  provider discovery, and strict OpenAI-compatible payload handling.
-- Added contract coverage for ALCF OAuth selection, runtime discovery, and
-  strict reasoning-payload behavior.
+### Added
+- The `alcf` runtime for Argonne ALCF Sophia/Metis targets, including Globus OAuth, discovery, metadata, and gateway documentation.
+
+### Fixed
+- Enforced strict OpenAI-compatible reasoning payloads for ALCF targets.
 
 ## 0.2.4 - 2026-06-23
 
-- Added agent fleet management with agent-to-profile bindings, profile CRUD,
-  fault-tolerant dispatch, and a `/fleet` overlay.
-- Isolated dispatch tests from the real run ledger and pinned several dispatch
-  invariants with regression coverage.
-- Made receipt digests deterministic across hosts and refreshed the pi engine,
-  Claude SDK, Anthropic SDK, Biome, TypeBox, undici, uuid, and tsx
-  dependencies.
+### Added
+- Fleet management with agent/profile bindings, fault-tolerant dispatch, and a `/fleet` overlay.
+
+### Changed
+- Refreshed Pi, Claude, Anthropic, Biome, TypeBox, Undici, UUID, and TSX dependencies.
+
+### Fixed
+- Isolated dispatch tests and made receipt digests deterministic across hosts.
 
 ## 0.2.3 - 2026-06-17
 
-- Rebuilt the interactive command surface around a declarative slash-command
-  registry and full-screen hubs for help, agents, prompts, extensions, targets,
-  skills, settings, and receipts.
-- Introduced the enforced autonomy model with an always-on safety net, clearer
-  approval and safety notices, and stricter tool admission across chat,
-  workers, headless runs, and ACP delegations.
-- Added subscription and delegation runtimes including `anthropic-max`,
-  `claude-code`, `claude-sdk`, Claude Code over ACP, and `antigravity-code`
-  workers.
-- Added `clio context-index`, deterministic multi-language codewiki indexing,
-  `code_nav`, scratch offloading for large tool results, middleware hooks, live
-  agent steering, and richer receipt tool activity.
-- Reworked Clio's on-disk roots, settings ownership, lifecycle commands,
-  model-target vocabulary, and observability workflows.
-- Removed several legacy slash commands; their workflows moved into `/skill`,
-  `/targets`, `/help`, `/view`, and related hubs.
+### Added
+- Declarative slash commands and full-screen hubs; enforced autonomy and safety notices; additional subscription/delegation runtimes; codewiki indexing, middleware, live steering, and richer receipts.
+
+### Changed
+- Reworked on-disk roots, settings ownership, lifecycle commands, model-target vocabulary, and observability.
+
+### Removed
+- Retired legacy slash commands; their workflows moved to `/skill`, `/targets`, `/help`, `/view`, and related hubs.
 
 ## 0.2.2 - 2026-06-11
 
-- Retired built-in CLI-subprocess runtimes in favor of direct HTTP/native/pi-ai
-  targets and ACP delegation for external coding agents.
-- Added the context engine, single-threshold compaction, bounded tool results,
-  prompt-cache telemetry, and session-owned live routing.
-- Added `clio acp`, ACP delegation support, a curated skills marketplace,
-  richer skill activation, and local source install/uninstall scripts.
-- Upgraded `CLIO.md` into a project rulebook with custom sections and better
-  source-tree awareness.
-- Improved prompt-prefix stability, session-ledger append behavior, permission
-  overlays, and release verification.
+### Added
+- Context engine, compaction, bounded tool results, prompt-cache telemetry, ACP support, a curated skills marketplace, and local install/uninstall scripts.
+- A richer `CLIO.md` project rulebook and source-tree awareness.
+
+### Changed
+- Replaced built-in CLI-subprocess runtimes with direct HTTP/native/Pi targets and ACP delegation.
+
+### Fixed
+- Improved prompt-prefix stability, ledger appends, permission overlays, and release verification.
 
 ## 0.2.1 - 2026-06-05
 
-- Added live token-throughput telemetry, a larger context fill bar, hashed
-  prompt-envelope delivery, and prompt diagnostics in `clio run --json`.
-- Narrowed per-turn tool exposure and bounded long tool outputs to reduce
-  context pressure.
-- Retuned the footer dashboard for smaller terminals and refreshed README and
-  operator documentation.
-- Fixed headless `clio run` argument handling, unknown-agent failures,
-  dashboard layout, and prompt-diagnostic visibility.
+### Added
+- Live token-throughput telemetry, prompt-envelope hashes, and `clio run --json` prompt diagnostics.
+
+### Changed
+- Reduced context pressure through narrower tool exposure and bounded output; improved the footer for smaller terminals.
+
+### Fixed
+- Corrected headless run arguments, unknown-agent handling, dashboard layout, and prompt-diagnostic visibility.
 
 ## 0.2.0 - 2026-06-03
 
-- First community alpha release for source-checkout users.
-- Added JIT skills, stronger prompt compaction, `clio init` / `/init`
-  adoption of existing project instruction files, and centralized runtime
-  target resolution.
-- Added runtime diagnostics, command-output routing, durable session JSONL
-  coverage, expanded user docs, and a portable `Ctrl+G` leader-key fallback.
-- Hardened path policy handling, headless `clio run`, prompt cache boundaries,
-  overlay rendering, session persistence, fork replay, and TUI startup.
+### Added
+- First community alpha for source-checkout users, with JIT skills, stronger compaction, project-instruction adoption, runtime resolution, diagnostics, durable sessions, and expanded documentation.
+
+### Fixed
+- Hardened path policy, headless runs, prompt-cache boundaries, overlays, session replay, and TUI startup.
 
 ## 0.1.9 - 2026-05-17
 
-- Added `dispatch` as a first-class fleet-agent handoff tool.
-- Added `validate_frontend` for HTML/CSS/JavaScript artifacts and finish
-  evidence for typed validation tools.
-- Improved local model capability handling, GPT-OSS/Harmony parsing, active-run
-  follow-ups, and cancellation behavior.
-- Fixed reasoning replay, Harmony stream parsing, OpenAI Codex file-tool
-  schema aliases, lifecycle metadata repair, and duplicate model-capability
-  paths.
+### Added
+- First-class fleet `dispatch`, frontend artifact validation, typed finish evidence, and local-model capability improvements.
+
+### Fixed
+- Corrected reasoning replay, Harmony parsing, Codex file-tool aliases, lifecycle metadata repair, and model-capability duplication.
 
 ## 0.1.8 - 2026-05-11
 
-- Added extensions, share archives, extension and share CLI/TUI workflows, and
-  a redesigned welcome dashboard.
-- Added model and context-window validation to `clio configure`.
-- Added a Claude Code SDK safety bridge, supervised approval IPC, a TUI
-  approval overlay, and receipt accounting for SDK safety decisions.
-- Fixed Gemini CLI token accounting and expanded tests for extensions, share
-  archives, configure validation, and supervised SDK decisions.
+### Added
+- Extensions, share archives, associated CLI/TUI workflows, a redesigned welcome dashboard, configure validation, and a Claude Code SDK safety bridge.
+
+### Fixed
+- Corrected Gemini CLI token accounting and expanded extension, sharing, configuration, and supervised-SDK coverage.
 
 ## 0.1.7 - 2026-05-11
 
-- Added a shared safety policy engine for orchestrator and native workers.
-- Added strict project command policy parsing, typed execution tools, and
-  receipt safety summaries.
-- Changed default-mode Bash to default-deny ordinary execution unless allowed
-  by curated commands or project policy.
-- Hardened dispatch scope, external-runtime permission mapping, audit rows,
-  and worker safety parity.
+### Added
+- A shared safety-policy engine, strict project command policies, typed execution tools, and receipt safety summaries.
+
+### Changed
+- Default Bash now denies ordinary execution unless allowed by curated commands or project policy.
+
+### Fixed
+- Hardened dispatch scope, external-runtime permissions, audit rows, and worker safety parity.
 
 ## 0.1.6 - 2026-05-04
 
-- Added `clio --print` / `clio -p` for one non-interactive orchestrator turn.
-- Added stdin plus argv prompt composition and stdout guarding for scriptable
-  print-mode use.
-- Reserved future JSON/RPC modes behind explicit errors and added focused CLI
-  coverage.
+### Added
+- `clio --print` / `clio -p` for one non-interactive turn, with stdin/argv composition and stdout safeguards.
+
+### Changed
+- Reserved future JSON/RPC modes behind explicit errors.
 
 ## 0.1.5 - 2026-05-03
 
-- Public alpha release for developers and research-software teams testing a
-  terminal-first coding agent from source.
-- Shipped the interactive TUI, target-first configuration, built-in coding
-  agents, persistent sessions, project context, receipts, audit logs, evidence,
-  evals, memory, and safety modes as an integrated product surface.
-- Added `clio init`, CLIO.md parsing, codewiki indexing, clearer `/cost`
-  accounting, a redesigned `/model` popup, and CLIO-branded popup frames.
-- Documented alpha limits: source install remained the supported path, model
-  behavior varied by target, and operators were expected to review privileged
-  actions.
+### Added
+- Public alpha for source-install developers and research-software teams: interactive TUI, target-first configuration, coding agents, sessions, project context, receipts, audits, evidence, evaluations, memory, and safety modes.
+- `clio init`, CLIO.md parsing, codewiki indexing, improved cost/model UI, and documented alpha operating limits.
 
 ## 0.1.4 - 2026-04-30
 
-- Added the evolution plane: component inventory, typed change manifests,
-  deterministic evidence building, local eval runs, memory records, middleware
-  hooks, protected-artifact safety, and finish-contract checks.
-- Added workspace orientation, a `workspace_context` tool, eight specialist
-  agent recipes, and a scientific-validation pack.
-- Unified llama.cpp runtime handling, improved the TUI, expanded compaction and
-  context accounting, and hardened protected-artifact behavior.
+### Added
+- Evolution tooling for inventories, change manifests, evidence, evaluations, memory, middleware, protected artifacts, finish checks, workspace orientation, specialist recipes, and scientific validation.
+
+### Changed
+- Unified llama.cpp handling and improved TUI, compaction, context accounting, and protected-artifact behavior.
 
 ## 0.1.3 - 2026-04-27
 
-- Added live tool output, bash command echo, `Ctrl+T` thinking expansion, and a
-  git-branch footer slot in the TUI.
-- Made `CLIO.md` the canonical project instruction file and improved local
-  runtime detection for LM Studio and Ollama.
-- Aligned Clio Coder's identity with IOWarp's CLIO ecosystem, updated package
-  docs, reorganized safety rule packs, and added a clean-clone smoke CI job.
-- Fixed slash autocomplete on Debian/Ubuntu, stabilized JSON envelopes for
-  `doctor` and `targets`, and improved partial tool-output rendering.
+### Added
+- Live tool output, Bash echo, thinking expansion, and a Git-branch footer slot.
+
+### Changed
+- Made `CLIO.md` the canonical project instruction file and improved LM Studio/Ollama detection.
+
+### Fixed
+- Corrected Debian/Ubuntu slash autocomplete, doctor/targets JSON envelopes, and partial tool-output rendering.
 
 ## 0.1.2 - 2026-04-25
 
-- Added visible retry handling for transient provider and stream failures.
-- Improved tool, bash, edit, dashboard, hotkey, resume, prompt, receipt,
-  compaction, audit, and abort behavior in the interactive TUI.
-- Fixed retry duplication, cancellation races, oversized Bash output handling,
-  resume/fork/new behavior during active runs, provider hot-swaps, and local
-  OpenAI-compatible reasoning/tool schemas.
+### Added
+- Visible retries for transient provider and stream failures.
+
+### Changed
+- Improved interactive tool, Bash, dashboard, hotkey, resume, prompt, receipt, compaction, audit, and abort behavior.
+
+### Fixed
+- Corrected retry duplication, cancellation races, oversized Bash output, active-run session operations, provider hot-swaps, and local OpenAI-compatible reasoning/tool schemas.
 
 ## 0.1.1 - 2026-04-24
 
-- Added deterministic loading of project context files from the current working
-  directory upward.
-- Fixed resume, fork, and tree-switch replay for rich session entries and
-  durable tool records.
-- Fixed subprocess worker dispatch, out-of-tree SDK runtime rehydration,
-  receipt verification, dispatch heartbeat state, and the documented boundary
-  check command.
+### Added
+- Deterministic loading of project context files from the working directory upward.
+
+### Fixed
+- Corrected rich session replay, subprocess dispatch, out-of-tree SDK rehydration, receipt verification, dispatch heartbeats, and boundary-check documentation.
 
 ## 0.1.0-exp - 2026-04-24
 
-- Initial experimental public release.
-- Shipped the interactive TUI, CLI lifecycle commands, target-first
-  configuration, runtime coverage, seven built-in agents, dispatch workers,
-  receipts, audit logs, safety modes, and XDG-aware state layout.
-- Known limits: Windows was best effort, and some remote fan-out and MCP
-  surfaces were scaffolded but not yet admitted by dispatch.
+### Added
+- Initial experimental public release with interactive TUI, lifecycle CLI, target-first configuration, runtime support, built-in agents, dispatch workers, receipts, audit logs, safety modes, and XDG-aware state.
+
+### Security
+- Windows support was best effort; remote fan-out and MCP surfaces were scaffolded but not admitted by dispatch.