@iowarp/clio-coder 0.3.4 → 0.3.7

package/CHANGELOG.md

@@ -2,6 +2,69 @@
 
 All notable changes to Clio Coder are documented in this file. The format follows [Keep a Changelog](https://keepachangelog.com/en/1.1.0/) and versions follow Semantic Versioning; pre-1.0 minor releases may include incompatible changes.
 
+## 0.3.7 - 2026-08-24
+
+### Added
+- Typed dispatch intent and host-run verification (#155). The singular request and every `tasks[]` item accept one `intent` object (`read_roots`, `write_roots`, `relevant_paths`, `expected_outputs`, `verification: [{check, timeout_ms?}]`); `gate: "<check>"` is the one shorthand for a single verification entry. Paths are normalized to sorted, duplicate-free repository-relative POSIX paths with entry and byte caps, and absolute, escaping, or malformed entries fail before approval. A `check` is a declared id resolved through the verify tool's `DeclaredCheck` projection (package scripts and `.clio-coder/verifiers.yaml`) at admission, so model text never becomes argv; the resolved argv, cwd, and timeout are frozen into the execution snapshot and the plan hash, and the approval artifact renders them. After a successful worker attempt the orchestrator runs each check through the code-step runner with no shell and the closed environment allowlist, memoizes successful evidence on the workspace fingerprint plus argv, cwd, and allowlisted environment values, and seals `hostVerification` (`verified`, `rejected`, or `skipped` with per-check argv, exit code, duration, bounded output tail, memo provenance, and artifact path) into the receipt. A rejected check turns the run into `host_verification_rejected`, which suppresses automatic retry. Review and compete accept the intent paths but refuse verification entries, as does the Claude Code subprocess runtime, each with a named reason. The receipt seals `intent` on the native worker path and the Claude Code and ACP delegation paths alike. Receipt integrity moves to v16 and covers `intent` and `hostVerification`; the existing `verification` evidence object keeps its name. Dispatch output, `monitor`, and the Fleet Runs card render `host_verification=<status>` beside `evidence_verification`.
+- `/btw <question>` asks one side question beside the session (refs #41). The round sends the compiled message history as read-only input under a short fixed instruction with no tools, streams the answer into an overlay, and appends nothing to the session JSONL, the transcript, the context ledger, or the task board, so a fleet run's workers are never briefed from it. Esc cancels a streaming round; a `/btw` during an in-flight turn is refused rather than queued. The round's usage is counted in `/cost` under a `side questions` row and is excluded from the turn count.
+- Opt-in desktop notifications (#204). `terminal.notify: true` emits one content-free terminal notification when a turn ends, when a detached batch settles, and when a worker permission or `ask_user` request parks. The title is fixed, the body comes from a closed vocabulary, control characters are stripped, and the body is bounded to 128 bytes. OSC 777 is the default and OSC 9 is used on iTerm2, Windows Terminal, and ConEmu, never both for one event. Headless, ACP, and non-TTY runs never emit one.
+- Single-writer token, checkout writer lease, and worktree-per-task (#207). `writers: 1` on a parallel dispatch or an ExecutionPlan admits at most one write-scope step at a time in declared order while read-scope steps stay concurrent; the agent ledger's claims remain advisory. The first checkout writer takes a lease under the state dir keyed by the canonical checkout path and carrying pid, process birth token, and acquisition time; a live sibling process is refused with `checkout_writer_lease_held` naming the holder pid, and a dead owner is reclaimed. `worktree: true` with `apply: "merge"` (default) or `"preserve"` runs a writer task on `clio/task/<runId>` under `.clio-coder/worktrees/<runId>/`, maps the worker cwd, write roots, and protected artifacts into it, and runs declared host verification there before merging; a conflict fails closed as `worktree_merge_conflict` and preserves the branch, and a protected-path change fails closed. The receipt gains `worktree: {path, branch, diffHash, apply, applied, reason?}`, receipt integrity moves to v17, and the approval artifact renders worktree, apply, and the frozen merge destination. Non-git checkouts, read-only agents, compete mode, and a cwd outside the checkout are refused with named reasons.
+- Fleet authoring CLI (#209). `clio-coder fleet new <name> --from <builtin>` copies `build-review`, `build-test`, or `sdlc` into `.clio-coder/fleets/` and refuses an existing destination, an unsafe stem, or an unknown builtin. `fleet validate <name> [--json]` runs the same preflight `fleet run` performs (parse, graph, command bindings, agent resolution, plan compile, write-boundary preflight) with no state-dir write, ledger row, reservation, or worker. `fleet graph <name> [--json]` prints the compiled waves with each step's kind, agent or command, scope, dependencies, and write boundary, and expands loop check and repair nodes. `fleet commands init` discovers package scripts, justfile recipes, Makefile targets, and pyproject script and tool entries through the verifier discovery and writes a fully commented `commands.yaml` draft; uncommenting confirms an entry and an existing registry is never replaced. `fleet run <name> --resume <runId>` replays the successful, integrity-valid prefix recorded in a durable fleet-run record under the state dir, reports replayed steps with their original receipt references, refuses a changed plan hash with a per-step diff, and refuses differing `--var` values. The existing `fleet resume` admission-control subcommand is unchanged.
+- `/fleet run <name> [--var k=v ...]` previews a fleet contract before anything dispatches (#208). The route preflight sends each step's compiled task, so a contract that validates from the CLI previews from the TUI, and a `--var` value may be quoted to carry spaces (`--var task="add a pow function"`). The approval overlay lists the steps by wave with kind, agent and resolved target (or command id and the exact argv from `commands.yaml`), scope, and declared write boundary, then the budget ceiling the run is admitted under; a contract that fails preflight opens the same overlay with its diagnostics and no accept key. Enter dispatches through one shared fleet-run path in the dispatch domain (`executeFleetRun`) so admission, autonomy, receipts, gate decisions, write-boundary enforcement, and the durable ledger are identical to `clio-coder fleet run`; Esc dispatches nothing and writes nothing. `clio-coder fleet run` runs through that same path and both surfaces write the durable fleet-run record, so a run started from the TUI can be resumed with `fleet run --resume`. The Fleet Runs board gains a phase column (`w<n> <stepId>`) on rows a fleet plan dispatched, empty on every other row; the compact island keeps its fixed width and shows the column only when the agent label still fits. `/fleet` alone still opens Settings → Fleet, and `/fleet run` during an in-flight turn is refused rather than queued.
+- `/handoff <goal>` carries a session's working state into a fresh session (#206). The goal is required and gated: under 12 characters, or a non-goal such as "continue" or "resume", is refused with the rule named. One out-of-turn model round with no tools extracts decisions, facts, files, commands, and open questions as JSON against a fixed schema; every list and string is bounded, and over-bound output is truncated with a visible marker rather than refused. Every file path is checked against the session's own read ledger (folded through the active `/tree` path) and never against the filesystem, so a path the session never touched is dropped and listed under `dropped (not in this session's read ledger)`. Extracted decisions merge with the settled decision board, which wins. The document opens for review with `e` for `$EDITOR`; Esc cancels with nothing written. On accept Clio mints a session, seeds it with the reviewed document as data labelled by its origin session, replays the old session's skill activations, and leaves the old session untouched apart from one terminal note naming the target. A handoff never writes a memory promotion candidate and never calls the task-memory bank. Its usage is counted in `/cost` under a `handoffs` row and excluded from the turn count.
+- `/oracle <question>` and the `oracle` shadow advisor (#210). The recipe is read-only, unreachable from `/run`, and never receives a forked transcript: `/oracle` packs a bounded digest as dispatch briefing data (settled decisions from the decision board, open tasks from the task board, the last compaction summary when one exists, and the question), capped at 12 KiB with per-section caps and a truncation marker and filtered to the active `/tree` branch. The run is a singular read-only internal dispatch through the ordinary path, so admission, receipts, and the Fleet Runs island apply; its `oracle-report` contract carries a verdict, the strongest challenge, what would change its mind, and the decisions it cited, and the rendered answer reaches the main agent as an operator note the way `/share` does. `/oracle` during an in-flight turn is refused rather than queued.
+- Opt-in turn-end watchdog (#210). `watchdog: {enabled: false, target?, cadenceToolCalls?}` is hot reloaded. With `enabled: true`, a turn that changed the tree is reviewed by one read-only `verifier` dispatch briefed with the turn's coalesced diff (per-path last-write-wins, bounded to 12 KiB) and the task board's current scope; its failed checks become one transcript notice naming the count and the first three, a passing report emits nothing, and a turn with no file mutations never fires. `watchdog.target` routes the run at a cheap local model; `cadenceToolCalls: N` also fires it every N tool calls inside a turn. At most one watchdog run is in flight at a time and an overlapping trigger is dropped and counted. It never auto-follows, never queues a turn, and never mutates. Headless and ACP runs never fire it.
+- Durable out-of-turn usage and Settings Center rows for notifications and the watchdog (#211, refs #41, #204, #206, #210). A `/btw` side question or a `/handoff` extraction round appends nothing to the session JSONL by contract, so the spend now goes to its own store at `<stateDir>/usage/out-of-turn.jsonl`: one JSON line per priced call carrying the label, session id, the repo identity the session ledger is filed under, timestamp, target, attributed model id, and provider usage, written with one append per row and kept as a bounded ring of 1000 rows rewritten atomically under the state-file lock. `clio-coder usage report` folds that store beside the session ledgers into the window's tokens, cost, and per-model totals, and prints `turns`, `side questions`, and `handoffs` counts on both the text and `--json` surfaces, subtracting labelled calls from the turn count exactly as `/cost` does; an archive with no labelled call renders byte-identical to before. `terminal.notify` gains a boolean row under EXPERIENCE › Terminal, and `watchdog.enabled`, `watchdog.target`, and `watchdog.cadenceToolCalls` gain rows under a new EXPERIENCE › Watchdog section. The two optional keys render their absence as `(session target)` and `(turn end only)` while their editors open on the stored value or empty, never on that prose; submitting an empty value removes the key from `settings.yaml` rather than storing a blank, and a cadence below one is refused with the bound named, matching the config validator. Settings Center wording is pinned word for word to the settings template where it overlaps.
+- `mode: "council"`, the read-only sibling of compete (#212). Two to five members run the same singular task concurrently on local and HTTP targets with no mutation. Members come from a configured `workers.rosters.<name>.members[]` roster (`{label, target, model?, thinking?, color?}`, validated at config load for two to five members, unique labels matching `[a-z][a-z0-9_-]{0,31}`, theme color tokens or six-digit hex, no unknown keys, hot reloaded) or from inline `members`; exactly one of `roster` or `members` is accepted. `synthesis: none | judge | vote` (default `none`), `rounds: 1..3` (default `1`), and `judge` only with judge synthesis. Refusals are typed: `council_roster_unknown`, `council_members_out_of_range`, `council_member_label_duplicate`, `council_member_target_unknown`, `council_member_remote_node` (a route that resolves to an SSH fleet node is refused before approval), `council_synthesis_requires_judge_settings`, and `council_verification_unsupported`. A council request that names no `agent` seats the builtin `researcher` rather than the dispatch default `coder`, whose write requirement the council profile cannot satisfy. Admission pins every member and the judge to `read-only` autonomy and an internal `council-read-only` tool profile holding exactly `read`, `grep`, `find`, `ls`, `code_nav`, and `context`, enforced through ordinary worker admission rather than prompt text. The resolved plan expands every member in every round plus the judge, so the approval artifact lists each member's label, target, model, thinking, node, color, round, and synthesis, and the plan hash binds all of it. Round one gives every member the same task and briefing; each later round gives a member the other members' prior answers as labelled untrusted briefing data (never its own), bounded to 8 KiB with a truncation marker, with a failed peer marked rather than quoted. `vote` computes a deterministic strict majority over the final round's structured `verdict` fields with no model call and reports `no_verdict_field` or `no_majority` when it cannot; `judge` runs one read-only judge under a fixed prompt with every final answer as labelled briefing. The dispatch result carries one section per member and one synthesis section, `details.council` holds the typed `council-report` (`{members: [{label, runId, round, answer, verdict?, failed?}], synthesis: {kind, text?, verdict?, tally?, judgeRunId?}}`), and the result is an error only when a final-round member or the judge failed. Every member run seals its own receipt; `none` and `vote` seal one coordinator-only zero-token synthesis receipt that carries no member provenance and publish its enqueued and completed lifecycle events so the Fleet Runs board and `/share` see it, and the judge receipt is the synthesis receipt in judge mode, each pointing backward at every final member run through gate provenance. `monitor` reports the council role and group, the Fleet Runs board projection carries `council: {group, label, color?, round}` for a later grid, and receipt integrity moves to v18 with the `council` field. The grid and `/council` are a separate change.
+- Council rendering and `/council` (#213). The `Alt+W` Fleet Runs board folds a council group into one card in the position of its first row: a side-by-side grid with one column per member while every column keeps at least 34 cells, otherwise the whole group stacks, because a grid where only some columns are readable is worse than none. Each column shows the member label in its roster color (a theme token paints as that token, `#rrggbb` paints literally through the xterm cube without truecolor, anything else takes the accent), the target and model, the round and status, and up to four rows of the run's bounded answer tail; a council that ran several rounds keeps one column per member at its newest round, and the synthesis run renders full width under the members. The compact island shows one card per council naming the group, member count, and round. `/council [--roster <name>] [--rounds <n>] [--synthesis judge|vote|none] <task>` owns no dispatch path of its own: it builds dispatch-tool arguments spelled exactly as the tool declares them and admits them through the tool registry, so supervised autonomy parks the same approval overlay a model-asked council would. `--roster` falls back to `workers.rosters.default`; with neither the command refuses and names the setting rather than guessing from the only roster present. Rounds and synthesis bounds are enforced where the operator typed them, and a `/council` during an in-flight turn is refused rather than queued. `/share <synthesis runId>` brings every final-round member's labelled answer and the synthesis line (mode, verdict, tally, judge run) into the main context as one bounded prose block, never the raw payload; `/share <member runId>` labels that member's answer with its roster label; a synthesis whose sealed text does not parse is shared verbatim.
+- Fleet contract v5: `kind: plan`, `kind: gate`, per-step target or profile, and top-level `writers` (#214). Version literal `5` joins the contract; readers of 1 to 4 refuse `plan`, `gate`, `target`, `profile`, and `writers` by name, exactly as they refuse `writes` below 4, and ExecutionPlan versioning is unchanged. An agent step, a loop check agent, or a loop repair agent may declare `target: <targetId>` or `profile: <workers.profiles key>` (never both); resolution shares the `/run --target` and `/run --agent-profile` request fields, and an unknown id refuses at preflight naming it, in `fleet validate`, `fleet run`, and the `/fleet run` preview, which now reports a route the process cannot resolve as a named diagnostic instead of rendering `route unresolved`. A `kind: gate` step names a validator agent, one repository-relative `path` that becomes its whole derived write boundary (a separate `writes` is refused), and a `run` command whose argv carries the gate path as the single whole-token `{{path}}` substitution; after the author settles, the coordinator runs the command with no shell against the untouched tree and requires red, a green baseline fails the step as `gate_not_discriminating`, the receipt seals `fleetGate: {path, pathHash}`, and a loop may use `check: {kind: gate, gate: <id>}`, in which case only verbatim `FAIL` lines from the check reach the repair agent. A `kind: plan` step (agent defaults to the builtin `architect`) declares `roster`, `maxTasks: 1..16`, optional `proposals: true`, its own scope and `writes`, and an optional route default; the architect returns a `delegation-plan` result contract (`{tasks: [{id, agent, description, depends_on, writes, mode?}]}`) that a pure validator checks for roster membership, task count, unique ids, resolvable acyclic dependencies, and writes inside the plan step's boundary, each failure a named `delegation_plan_*` reason that fails the step and splices nothing. `delegation-plan` is an admitted worker result contract, so the architect step reaches the model. On success the coordinator records the deterministic plan hash on the durable fleet run record and the scheduler splices the tasks into the live plan after the wave settles: every spliced task passes the same preflight, reservation, admission group, writer-token grouping, post-step write-boundary enforcement, and durable settlement record as a static step, depends on the plan step plus its declared dependencies, inherits the plan step's target or profile, and seals lineage to the plan step's run. `proposals: true` first runs every roster member read-only with the same task and hands the architect their `PROPOSAL <agent>` sections as briefing bounded to 12,000 bytes. `fleet graph` names a gate or plan step by its contract kind with the gate path and run command or the roster and `maxTasks`, and a step whose receipt succeeded but whose gate baseline or delegation plan failed settles as failed with `reason=<name>` in `fleet run` output and the `/fleet run` notice. The approval artifact renders target or profile, gate path, run command, and baseline command, and plan roster, maxTasks, and proposals; `fleet run --resume` replays the static prefix up to the first plan step and reruns it rather than reconstructing prior dynamic tasks. Receipt integrity moves to v19 with the `fleetGate` field.
+- Resource library (#215). The marketplace index machinery that carries skills now carries agent recipes, prompt templates, and fleet contracts. Every index entry accepts `kind: skill | agent | prompt | fleet` (default `skill`, so every existing index parses unchanged) and optional typed `requires: [skill:x, agent:y, prompt:p, fleet:z]`, resolved recursively across the selected catalog and the private catalog; a missing, malformed, or cyclic requirement refuses the entry with `library_requirement_missing`, `library_requirement_malformed`, or `library_requirement_cycle` naming the chain. `clio-coder library list|search [--kind k] [--json]`, `library add <ref> [--from <catalog|path>] [--with-requirements] [--yes]`, `library use <kind> <name>`, `library sync`, `library push`, and `library remote confirm <url>` land as one literal dynamic import. `add` resolves requirements against the pin store and the destination path, lists satisfied ones separately, refuses on unsatisfied ones unless `--with-requirements` installs them first in dependency order, prints every destination and SHA-256 before writing, and writes nothing without `--yes`. An agent installs to `<configDir>/agents/<name>.md` after the recipe schema and policy checks, a prompt to `<configDir>/prompts/<name>.md` after the prompt loader, a fleet to a new user fleet root `<configDir>/fleets/<name>.md` after `parseFleetContract` (precedence is builtin, then user, then project), and a skill through the existing installer; every install is pinned by typed ref and hash in `<configDir>/library-pins.yaml` through the safe resource write. A private catalog at `library.catalog` (default `<configDir>/library.yaml`) overlays same-ref marketplace entries and resolves relative sources beside itself. Git-backed sync is opt-in: `library.sync: false` (the default) refuses `sync` and `push` with `library_sync_disabled` before any process spawns; with it on, the repository's remote must be named `library` and match a confirmed URL (`library remote confirm`, which refuses `library_remote_mismatch` when it differs from `library.remote`), `sync` runs `git fetch library` then `git merge --ff-only FETCH_HEAD`, and `push` runs `git push library`, each an argv vector with no shell. Share archives gain `agent` and `fleet` entry types (`share export --agents --fleets`, included in `--all`), imported into the user roots after the same validation. The Skills Hub keeps rendering skills only; its kind tabs are a separate change.
+- Skills Hub kind tabs and `/library` (#216). The hub carries one tab per resource library kind (Skills, Agents, Prompts, Fleets), switched with `←`/`→`, the key vocabulary the Settings Center already uses to move between sections; the frame title names the active tab and the footer states its row count. The Skills tab is unchanged. The other three list their kind from the same `discoverLibrary()` the CLI's `library list --kind` reads, with origin, version, installed or available, the short pin hash, and the names of any unresolved requirements in the warning token; a catalog entry the library refuses appears as a diagnostic row rather than being omitted. `i` installs through the same classify, plan, and write sequence `library add` runs, behind a framed confirmation that states every destination and SHA-256 and writes nothing on Esc; an entry with unresolved requirements is refused by name on the first `i`, and a second `i` opens the install-with-requirements confirmation naming every entry it would write in dependency order. `Enter` on an installed row inserts `/run <agent> ` for an agent, the `/<id> ` invocation for a prompt, `/skill <name> ` for a skill, and for a fleet closes the hub and opens the `/fleet run` approval preview; a row that is not installed says so and points at `i`. `/library [kind]` opens the hub on that tab and `/library` alone on Skills, where `/skill` still opens. Tab support lives in the shared list overlay, so untabbed overlays are unchanged.
+### Changed
+- `clio-coder fleet run` now executes through the same `executeFleetRun` path as `/fleet run`, so admission, autonomy, receipts, gate decisions, write-boundary enforcement, and the durable fleet-run record under `<stateDir>/fleet-runs/<runId>.json` are identical from both surfaces, and a run started from either can be resumed with `fleet run --resume` (#208, #209). The `fleet resume` admission-control subcommand is unchanged.
+- Fleet contracts resolve from three roots with fixed precedence: builtin, then the new user root `<configDir>/fleets/`, then the project's `.clio-coder/fleets/` (#215). A project contract still shadows a user one of the same name.
+- `share export --all` now includes agent recipes and fleet contracts beside the existing entry types, and `share import` validates them through the recipe schema and `parseFleetContract` before writing (#215). Archives without those entry types import unchanged.
+- The `/fleet run` approval preview reports a step route the process cannot resolve as a named preflight diagnostic instead of rendering `route unresolved` (#214).
+- `clio-coder usage report` prints `turns`, `side questions`, and `handoffs` counts on the text and `--json` surfaces (#211). An archive with no labelled out-of-turn call reports zero side questions and handoffs and the same tokens, cost, and per-model totals as before.
+- Receipt integrity moves from v15 to v19 across this release: v16 adds `intent` and `hostVerification` (#155), v17 adds `worktree` (#207), v18 adds `council` (#212), and v19 adds `fleetGate` (#214). Receipts sealed by 0.3.6 fail verification under 0.3.7 and are never read as evidence; they are not migrated.
+- `clio-coder --help` lists `library` beside `skills`.
+- The `/fleet run` approval, `/handoff` review, and Skills Hub install confirmation overlays match Enter, Esc, and the arrows by key name rather than raw bytes, so they answer under the kitty keyboard protocol, where Esc arrives as `CSI 27 u`, and ignore key-release events.
+
+## 0.3.6 - 2026-08-23
+
+0.3.5 was published by mistake and withdrawn; its content ships here.
+
+### Added
+- `docs/middleware-and-components.md` documents every built-in middleware registration: id, hooks, trigger, and what does not trigger it.
+- Permission and `ask_user` dialogs now derive closed consequence tiers from typed request, scope, reversibility, origin, exposure, and authority facts (#169). Conversational answers, workspace authority, outward consequences, safety-net confirmations, system changes, and worker escalations receive distinct titles and semantic tokens, while caller prose cannot lower a tier or alter the underlying decision protocol.
+- Typed invocation-level dispatch budget envelopes (#175). Recipes keep an exact default unless they author a maximum, dispatch can request a phase and preauthorize a retry, result-contract revision, or review revision ceiling inside both recipe and operator policy, and immutable policy, request, effective, clamp, and escalation facts are sealed into receipts and shown by monitor, fleet status, and the live fleet card. Architect retains its 32-call default and now permits explicitly admitted runs up to its authored maximum.
+- The `Alt+W` Fleet Runs board shows live worker progress on operator request (#168). `Enter` opens the selected run's detail: the phase, the running call as `<tool> <verb> <object>`, and the bounded tail of the worker's own prose with a `/view dispatch:<runId>` link to the rest. The default list stays compact, so a fan-out of scouts costs one card each until an operator opens one.
+- Reviewed task-memory promotion in `/memory` and `clio-coder memory promote` (#176). Selected knowledge and procedural entries can become unapproved durable proposals with explicit validated repo, global, runtime, or agent scope. Promotion redacts before persistence, preserves session and evidence provenance, and keeps private status excluded.
+
+### Changed
+- Python and Cargo project metadata, bootstrap guidance, and verifier discovery now parse TOML through one shared `smol-toml` boundary with an operation-scoped file cache (#153). Parsed structure replaces table-header scanning, and malformed documents fail closed.
+- The Fleet Runs board and the transcript's worker block now read one bounded projection of the dispatch event stream instead of folding it separately, so the two surfaces cannot disagree about what a worker is saying or touching. The projection keeps 40 lines and 4096 bytes of answer tail, 8 distinct tool names, and 4 recent actions, and accepts 16 KB of streamed bytes per 250 ms; what the bounds refuse is counted and named rather than dropped silently.
+- Worker tool activity now carries a redacted action descriptor beside the tool name. The descriptor is composed where the arguments are trusted (the tool registry's admission path, the Claude tool mapper, and the ACP update mapper) from a fixed verb vocabulary and a fixed argument-field allowlist, with credentials scrubbed, escape sequences stripped, and the result bounded to 64 characters. Raw argument objects still never cross the worker stdout seam, and reasoning content is still never displayed.
+
+### Fixed
+- Approval overlays now derive call targets from a per-tool field allowlist. Unlisted arguments are shown only by field name, type, and size, so an unexpected credential or pasted document cannot be copied into the rendered frame (#200).
+- Worker tool starts and finishes now share a call id when their producer has one. The transcript and Fleet Runs pair concurrent calls by that id, while older streams without ids continue to match by tool name (#201).
+- Proactive task memory now reuses deterministic tool-result disposition digests with explicit source provenance (#173). Operation fingerprints remain separate for loop and repeated-failure identity, while redaction and byte caps apply before diagnostics reach the task bank or background policy.
+- The llama.cpp router's `sleeping` state now reads as not resident (#192), and `clio-coder targets` reports `resident: none` while preserving the reported context-slot metadata.
+- Response model-id presence is now an explicit `responseModelIdObservation` state (#193, #202). The short-lived `servedModel` and `servedCalls` names are replaced by requested and attributed model ids plus counts named for each observation state. Pre-#193 ledgers remain readable under the labeled `legacy-difference-only` state, and providers outside the stream tap retain the `responseModel` fallback without implying that presence was observed.
+- The selected live model's capability probe now starts at boot (#195), so the first `/context` view and footer show the probed context window before any model turn.
+- The permission dialog now anchors above the composer (#194) and recomputes that placement when the terminal resizes.
+- Permission dialog clearance now comes from the live editor and footer render heights on every frame instead of a fixed five-row margin. Empty and multiline composers remain unobscured in both terminal modes, including after a resize (#194).
+- Tool-result offload scratch files older than fourteen days are now swept at boot (#196). A resumed transcript now says when the retention sweep removed the file instead of presenting its stale path as a live full-output pointer (#203).
+- A skill suggestion no longer costs the first turn on local models (#184). Every surface that teaches the protocol (the first-turn reminder, the `context(scope="skills")` listing footer, and the operator-gate denial) now says to open with the `Suggested skill:` line and continue the task in the same turn; none instructs the model to wait. A turn that makes the suggestion and stops with only listing calls behind it is continued once with a reminder that only the operator loads a skill.
+- Three envelope noise sources on local targets are gone (#191). An always-on reasoning model printed the thinking clamp three ways (`thinking medium resolved to forced`, `medium was ignored because thinking is always on`, and the combined line); only the combined line prints now, once per target, model, and level change. A workspace with no `CLIO-CODER.md` states `<handbook>none …</handbook>` where the handbook would have been injected, so the model stops spending its first tool call on a read that returns ENOENT. `clio-coder --resume` and `--continue` still fail closed, and the error now says that sessions are resumed from the `/resume` picker inside the app.
+- A turn is attributed to the reported response model id under LM Link peer routing (#185, #202). The response's `model` field is recorded as `responseModel` when it differs from the request. The footer, `/cost`, `clio-coder usage report`, and dispatch receipts use the shared requested model id, attributed model id, and response model id observation vocabulary. The LM Link peer warning is emitted once per distinct fact instead of once per turn.
+- The `/resume` picker previews the operator's first prompt (#188). The first user entry of a session is the composed prompt, with the `<system-reminder>` block and any `[Skill request]` preamble ahead of the operator's words, so every row read `<system-reminder> [Skills] 9 installed…` and the filter matched them all. The preview is now the persisted `operatorText`, the scaffolding-stripped text for older sessions, the next turn when the first carries no operator words, and the first assistant text when none does.
+- The context ledger is populated right after `/resume` (#189). Before the first new turn of a process, `/context` and the footer meter now read the window from the live target resolution (falling back to the window the resumed session recorded) and the token facts from the session's last persisted snapshot, which measured the same messages; the selected model's live capability probe runs at resume so the window is the probed one. `context window unknown · 0 tokens` is reserved for a session with no target and no history.
+- `/context` names the configured working-set policy instead of the last applied one (#190). A fresh session at the shipped default reads `policy structural-v1 · no events yet` rather than `policy none`; `context.workingSet.enabled: false` reads `disabled`; a policy changed after an event shows `(last event by <policy>)`. The eviction trigger stays at `compaction.threshold`: the replay tables price each event by the cold prefix it re-prefills, and batching from the threshold down to the target is what keeps the event count down.
+- A llama.cpp context window is the per-request share, not the server total (#187). `--ctx-size` is split evenly across `--parallel` slots unless `--kv-unified`, so a router started with `--ctx-size 786432 --parallel 4 --no-kv-unified` now resolves to a 196,608-token window instead of 786,432, which is where autocompact was armed at a size the server would never admit. The probe reads the long and short flag spellings and the last kv flag given, `/context` prints `196,608 (786,432 / 4 slots)` with `probed window`, and `clio-coder targets` names the split in its `ctx` note and a probe note.
+- A parked permission request always offers allow, deny, and stop (#186). The composer rail switches to `CONFIRM` and carries the dialog's keys while a prompt owns the keyboard, so the `Enter send` hint can no longer contradict a dialog that sits forty rows away on a tall terminal. `Enter` allows only from an empty composer: with a draft present the habitual send key is inert, both surfaces read `[Backspace] clear draft` in its place, and only deletion keys reach the editor. `Esc` is labeled `deny`, which is what it does. A request that parks while another overlay holds the screen is re-presented as soon as that overlay closes.
+
 ## 0.3.4 - 2026-08-22
 
 ### Added
@@ -12,10 +75,10 @@ All notable changes to Clio Coder are documented in this file. The format follow
 - A six-axis canonical trust status for runs (#154): artifact integrity, validation grounding, independent review, context provenance, autonomy enforcement, and completion evidence, each with explicit `absent`, `unknown`, and `not_applicable` states and a named source and authority. Composition never promotes one axis from another; the no-promotion rules are enforced at the adapters and the evidence composition boundary. Evidence bundles gain `trust-status.json`.
 - Non-destructive working-set eviction. When context pressure crosses `compaction.threshold`, Clio now records which tool-result bodies and closed-turn thinking blocks leave the model's working set instead of rewriting them out of the session. The bodies stay in the ledger, the transcript keeps showing them, and each one is replaced in model replay by a one-line marker naming the ref, the reason, the size, and the exact call that brings it back.
 - Exact recall by ref. The model reads an evicted body back with `context(scope="recall", ref="<turnId>")`; the operator reads one into the transcript with `/context recall <ref>`, which never enters model context. A recall does not un-evict: the marker stays byte-identical so the provider prefix cache is untouched, and repeated recalls of one ref are the churn signal.
-- Two eviction policies. `structural-v1` is the default: it selects by what the session did since (`stale_after_mutation`, `superseded_read`, `failure_resolved`, `listing_consumed`, `thinking_turn_closed`) and falls back to age only under pressure. `age-horizon` reproduces the previous age-based selection, minus results whose body is below `context.workingSet.minEvictableTokens`. Replayed over the seeded procedural corpora with the summary stage modeled, `structural-v1` cuts the number of lossy summary compactions per 300-turn science trace from 21.5 to 8.8 at a 64k budget and from 8.9 to 3.1 at 128k, retains at or above `age-horizon` at every budget, and beats random eviction on precision by 2.3x or more; the default-policy rule, the cold-prefix cost it pays for finer batching, and the full grid are under `benchmarks/results/context-replay/`.
+- Two eviction policies. `structural-v1` is the default: it selects by what the session did since (`stale_after_mutation`, `superseded_read`, `failure_resolved`, `listing_consumed`, `thinking_turn_closed`) and falls back to age only under pressure. `age-horizon` reproduces the previous age-based selection, minus results whose body is below `context.workingSet.minEvictableTokens`. Replayed over the seeded procedural corpora with the summary stage modeled, `structural-v1` cuts the number of lossy summary compactions per 300-turn science trace from 21.5 to 8.8 at a 64k budget and from 8.9 to 3.1 at 128k, retains at or above `age-horizon` at every budget, and beats random eviction on precision by 2.3x or more.
 - `/context` reports the working set: policy, evicted items, evicted tokens, events, recalls, and churn. Evicted tool rows carry a dim `evicted · <reason>` tag in the transcript.
 - Cache-honesty attribution for eviction. An applied event stamps `working_set_evict` on the next assistant entry's `promptCache.expectedColdReasons`, and `/context` reports `last cold turn: working-set eviction (expected)` instead of warning about a cold backend it caused itself.
-- `clio-coder context replay --sessions <path>...` replays Clio ledgers, and `--synthetic <ids>` replays seeded procedural science-coding corpora (`science-long`, `refactor`, `exploration`), through the live eviction code with `none`, `random`, and `oracle` controls and reports retention, precision, tokens evicted, recall tokens, cold prefix tokens, saturation, turns to first summary, and summaries per trace under a modeled summary stage; `clio-coder context working-set --session <id|path>` prints one session's working-set fold and path index. The procedural corpora replace the private Claude Code transcripts the first tables were built on, so the committed tables under `benchmarks/results/context-replay/` rebuild byte for byte on any checkout.
+- `clio-coder context replay --sessions <path>...` replays Clio ledgers, and `--synthetic <ids>` replays seeded procedural science-coding corpora (`science-long`, `refactor`, `exploration`), through the live eviction code with `none`, `random`, and `oracle` controls and reports retention, precision, tokens evicted, recall tokens, cold prefix tokens, saturation, turns to first summary, and summaries per trace under a modeled summary stage; `clio-coder context working-set --session <id|path>` prints one session's working-set fold and path index. The procedural corpora replace the private Claude Code transcripts the first tables were built on; generated replay tables are local artifacts rather than versioned benchmark results.
 - New guide: `docs/context-working-set.md`.
 
 ### Changed

package/CONTRIBUTING.md

@@ -73,14 +73,14 @@ publish is a manual maintainer step. The ordered procedure for a cut lives in
 2. Run `npm run ci:release`. It runs the full `ci` gate, then
    `scripts/check-release.mjs`, which verifies the built `dist/` and audits
    the exact npm package contents.
-3. Land the release commit on `main` and let the `ci` workflow go green on
-   that commit.
+3. Land the release commit on `main`. There is no need to wait on the `ci`
+   workflow before tagging: the release workflow runs the same gate itself.
 4. Tag and push: `git tag -a vX.Y.Z && git push origin vX.Y.Z`. The tag must
    match `package.json`'s version; the release workflow refuses mismatches.
-5. `.github/workflows/release.yml` requires a successful `ci` run for the
-   tagged commit, verifies the tag against `package.json`, builds `dist/`,
-   runs `scripts/check-release.mjs`, and creates the GitHub release with the
-   tarball attached. It does not publish to npm.
+5. `.github/workflows/release.yml` verifies the tag against `package.json`,
+   runs `npm run ci:release` on the tagged tree, and creates the GitHub
+   release with the tarball attached and the version's `CHANGELOG.md` section
+   as the body. It does not publish to npm.
 6. A maintainer publishes from the tagged commit with `npm publish`;
    `prepublishOnly` runs the same `ci:release` gate first.
 

package/README.md

@@ -160,6 +160,11 @@ numbered diffs, and `!` runs a shell command in the same transcript.
 | Branch, revisit, or pick up a session | `/tree`, `/fork`, `/resume`, `/new` |
 | Delegate to a fleet agent and watch it work | `/run coder "..."`, `/tasks`, `Alt+W` |
 | Load a skill or bootstrap project context | `/skill <name>`, `/context init` |
+| Ask a side question without touching the session, or get a read-only second opinion | `/btw <question>`, `/oracle <question>` |
+| Put the same question to several models at once and read one synthesis | `/council --synthesis vote "..."` |
+| Preview and run a multi-step fleet contract, resumable from the CLI | `/fleet run <name>` |
+| Install agents, prompts, fleets, and skills from a catalog | `/library`, `/library agents` |
+| Carry the working state into a fresh session | `/handoff <goal>` |
 | Save a self-contained HTML transcript | `/export` (an explicit `.md` path keeps Markdown) |
 | Everything else | `/help` |
 
@@ -215,9 +220,15 @@ fleet:
       maxWorkers: 1
 ```
 
-`clio-coder doctor` preflights every node, `clio-coder fleet list|run|status`
-drives and observes work, and `clio-coder fleet drain|resume` closes or reopens
-admission without interrupting running work. Nodes share the project
+`clio-coder doctor` preflights every node. `clio-coder fleet list` names the
+builtin and discovered contracts, `clio-coder fleet new|validate|graph`
+authors a fleet contract from a builtin and checks it without dispatching
+anything, `clio-coder fleet run|status` drives and observes work (`fleet run
+--resume <runId>` replays a settled prefix), and `clio-coder fleet
+drain|resume` closes or reopens admission without interrupting running work.
+Contracts may declare a single writer, a gate step that must go red before the
+author is trusted, and a plan step whose architect delegates bounded tasks to
+a roster at run time. Nodes share the project
 filesystem at the same absolute path, and a target URL resolves on the node the
 worker runs on, so `localhost` means that node's own inference server. The
 end-to-end walkthrough, including a recorded multi-node demo, is in
@@ -263,7 +274,7 @@ dist-tag instead.
 From source, pinned to this release:
 
 ```bash
-git clone --branch v0.3.4 https://github.com/iowarp/clio-coder.git
+git clone --branch v0.3.7 https://github.com/iowarp/clio-coder.git
 cd clio-coder
 npm run install:local
 export PATH="$HOME/.local/bin:$PATH"
@@ -289,7 +300,7 @@ Full lifecycle details, including `reset` and the upgrade path, are in
 
 ## Status
 
-The current release is **v0.3.4**, installable from npm as
+The current release is **v0.3.7**, installable from npm as
 [`@iowarp/clio-coder`](https://www.npmjs.com/package/@iowarp/clio-coder) or
 from source. Clio Coder is still experimental: we ship quickly, interfaces may
 change between minor versions, and model-specific behavior varies by target, so

package/dist/{acp-S5R4RR5B.js → acp-SK4MD6MM.js}

@@ -6,26 +6,26 @@ import {
 } from "./chunk-2VTFPG5O.js";
 import {
   runClioCommand
-} from "./chunk-4JUF2NNX.js";
-import "./chunk-E25LMLRW.js";
+} from "./chunk-MXI6J5JF.js";
+import "./chunk-YD734TPH.js";
 import "./chunk-HKIYEGME.js";
-import "./chunk-KOHPCX4K.js";
-import "./chunk-YCWGATWI.js";
+import "./chunk-DOOEX22V.js";
+import "./chunk-465YSENW.js";
 import {
   printError
-} from "./chunk-ED4KHGC3.js";
+} from "./chunk-PPAMZ32Z.js";
 import "./chunk-5TSRNF4G.js";
-import "./chunk-AD2SYQYC.js";
-import "./chunk-4OC57DA6.js";
+import "./chunk-JRIO5UD2.js";
+import "./chunk-UHXRNZ2J.js";
+import "./chunk-4DGYLA73.js";
 import "./chunk-LL4KHSZI.js";
-import "./chunk-4VP4KH3K.js";
+import "./chunk-SST6Z5JA.js";
 import {
   MAX_TIMER_DELAY_MS
 } from "./chunk-FQ4SKYE4.js";
+import "./chunk-4ZG3XFUR.js";
 import "./chunk-IKCO5N3L.js";
 import "./chunk-3I7MS7N2.js";
-import "./chunk-SST6Z5JA.js";
-import "./chunk-4ZG3XFUR.js";
 import "./chunk-APJ265NV.js";
 import "./chunk-YXLYO42X.js";
 import "./chunk-BNAZZHFG.js";
@@ -126,4 +126,4 @@ export {
   resolveAcpCwd,
   runAcpCommand
 };
-//# sourceMappingURL=acp-S5R4RR5B.js.map
+//# sourceMappingURL=acp-SK4MD6MM.js.map

package/dist/{agents-P6DMMVZY.js → agents-2FN2K6ME.js}

@@ -1,62 +1,68 @@
 import { createRequire as __clioCreateRequire } from "node:module"; const require = __clioCreateRequire(import.meta.url);
 import {
-  AgentsDomainModule,
   SafetyDomainModule
-} from "./chunk-X6COSD2O.js";
-import "./chunk-K6WL7QZT.js";
+} from "./chunk-J7PIKKWC.js";
+import "./chunk-JTSEDYVQ.js";
 import {
   ensureClioState
-} from "./chunk-VAWWTKDP.js";
+} from "./chunk-3HAPLH5M.js";
 import {
   ConfigDomainModule,
   loadDomains
-} from "./chunk-KRPY7NTG.js";
-import "./chunk-E25LMLRW.js";
-import "./chunk-QKMUKYO7.js";
-import "./chunk-4BPJXDWC.js";
+} from "./chunk-BMWK7ZIZ.js";
+import "./chunk-YD734TPH.js";
+import "./chunk-RVG5JXAL.js";
+import {
+  AgentsDomainModule
+} from "./chunk-UVDSQ6LW.js";
+import "./chunk-DR52UMZW.js";
+import "./chunk-C4JBQ5SR.js";
 import "./chunk-2SFS6XQE.js";
 import "./chunk-ZWLZP4ZT.js";
+import "./chunk-KCMKRQX4.js";
 import "./chunk-IR4CFBFN.js";
 import "./chunk-UOV2BYIW.js";
-import "./chunk-7RXG6QRZ.js";
+import "./chunk-OBMAI2DP.js";
+import "./chunk-GH5622CP.js";
+import "./chunk-HWUFFB6L.js";
+import "./chunk-DJNLUABN.js";
 import {
   isUserVisibleAgent
 } from "./chunk-AOCYTWAV.js";
 import "./chunk-MV3K5QF2.js";
-import "./chunk-FYYLNIL5.js";
 import "./chunk-UL3WSD3F.js";
 import "./chunk-ECH6PKUQ.js";
 import "./chunk-5B2AEOW5.js";
 import "./chunk-CGKSTWHD.js";
 import "./chunk-XPLRXC72.js";
-import "./chunk-RD5U66HV.js";
-import "./chunk-KOHPCX4K.js";
-import "./chunk-YCWGATWI.js";
+import "./chunk-SROCI7ZU.js";
+import "./chunk-DOOEX22V.js";
+import "./chunk-465YSENW.js";
 import {
   printError
-} from "./chunk-ED4KHGC3.js";
+} from "./chunk-PPAMZ32Z.js";
 import "./chunk-5TSRNF4G.js";
-import "./chunk-AD2SYQYC.js";
-import "./chunk-4OC57DA6.js";
-import "./chunk-LL4KHSZI.js";
-import "./chunk-4VP4KH3K.js";
-import "./chunk-VEZEGCGW.js";
-import "./chunk-FQ4SKYE4.js";
-import "./chunk-IKCO5N3L.js";
-import "./chunk-3I7MS7N2.js";
+import "./chunk-JRIO5UD2.js";
 import "./chunk-IHXBNWMM.js";
+import "./chunk-UHXRNZ2J.js";
+import "./chunk-4DGYLA73.js";
+import "./chunk-LL4KHSZI.js";
 import "./chunk-SST6Z5JA.js";
 import "./chunk-FO5ZOVUY.js";
 import "./chunk-R346GLFC.js";
+import "./chunk-D4MDIG46.js";
+import "./chunk-FQ4SKYE4.js";
 import "./chunk-4ZG3XFUR.js";
+import "./chunk-IKCO5N3L.js";
+import "./chunk-3I7MS7N2.js";
 import "./chunk-APJ265NV.js";
 import "./chunk-YXLYO42X.js";
 import "./chunk-BNAZZHFG.js";
 import "./chunk-6EJMN2Y3.js";
 import "./chunk-WEPFGWHJ.js";
-import "./chunk-HXG4IURW.js";
+import "./chunk-X2KV5FXT.js";
 import "./chunk-ZGVHUX3M.js";
-import "./chunk-TTNYS3EA.js";
+import "./chunk-OB5HIGJY.js";
 import "./chunk-IWHMRKLL.js";
 import {
   init_esm_shims
@@ -109,11 +115,12 @@ async function runAgentsCommand(args) {
 function renderLine(spec) {
   const shape = `${spec.audience}/${spec.category}/${spec.capabilityClass}/${spec.latencyClass}`;
   const skills = spec.skills.length > 0 ? ` skills=${spec.skills.join(",")}` : "";
-  const budget = spec.budget ? `${spec.budget.toolCalls}/${spec.budget.readReserve}/${spec.budget.synthesis ? "synthesize" : "stop"}` : "operator-default";
+  const maximum = spec.budget.maximum ? `..${spec.budget.maximum.toolCalls}/${spec.budget.maximum.readReserve}` : "";
+  const budget = `${spec.budget.toolCalls}/${spec.budget.readReserve}${maximum}/${spec.budget.synthesis ? "synthesize" : "stop"}`;
   process.stdout.write(`${spec.id.padEnd(20)} ${shape.padEnd(48)} ${spec.description}${skills} budget=${budget}
 `);
 }
 export {
   runAgentsCommand
 };
-//# sourceMappingURL=agents-P6DMMVZY.js.map
+//# sourceMappingURL=agents-2FN2K6ME.js.map