@iowarp/clio-coder 0.4.3 → 0.4.4

package/CHANGELOG.md

@@ -2,6 +2,67 @@
 
 All notable changes to Clio Coder are documented in this file. The format follows [Keep a Changelog](https://keepachangelog.com/en/1.1.0/) and versions follow Semantic Versioning; pre-1.0 minor releases may include incompatible changes.
 
+## 0.4.4 - 2026-09-05
+
+Trust spine: typed claims, executable validation, and decision provenance. Answers the NSF "Beyond Code" findings where the harness still trusted prose or sniffed files.
+
+### Added
+- A Deno test validates that class tokens used across Workbench components exist in the stylesheet (#311).
+- Lint holds `docs/guide/configuration-reference.md` against `DEFAULT_SETTINGS`: the new `configuration-reference` hygiene check fails when a settings key has no row in the settings-key table or a row names a key path the defaults no longer carry.
+- The `limitation` tool records what a turn could not verify and why. The finish contract settles on a successful `limitation` receipt inside the same window as the mutation scan; the seven prose patterns that used to satisfy it are gone, so wording alone can no longer pass the gate. The tool is on the six mutating recipes, and the operating contract tells the model to call it.
+- One strict loader for the version-1 scientific validation contract (`src/domains/safety/validation-contract.ts`), shared by rigor, `verifiers author`, doctor, and the startup hint. Rigor rises to `high` only when the contract parses; an invalid contract is diagnosed with the field and cap named, and `VALIDATION.md` is advisory prose that never raises rigor on its own.
+- The `decide` tool records a design choice with the alternatives the model rejected and why, as an `origin: "agent"` decision-ledger entry beside operator `ask_user` answers. A repeat key supersedes the earlier agent decision; an operator decision is never overwritten by the model. Dispatch seals every active decision ref onto the run request, envelope, and receipt under integrity coverage, and Clio-controlled commits carry one `Clio-Decision: <interviewId>/<key>` trailer per ref from the receipt or the live board.
+- Recorded decisions reach the surfaces that cite them. Evidence resolves a sealed receipt's `decisionRefs` against the linked session's active path, records the resolved arguments in `overview.json`, and raises a resolved or missing-reference finding per ref in both readable documents. Handoff and oracle briefings carry each decision's alternatives and rationale, and wiki page writers receive up to twelve active decisions matching their page's sources and cite the refs in the body and optional `decisions` frontmatter.
+- The read-only `evidence` tool shares the CLI inventory and trust projections, with overview, findings, and verified gate decisions for provenance inspections. Provenance requires this tool, and Verifier can use it. Accountability reports unverified successful runs and ungrounded validation claims in `/view`, `clio-coder usage`, and the observability contract. Historical index rows contribute zero to the new counters when the required fields are absent.
+- Verifier catalog version 2 adds two executable check kinds beside `command`. `numeric-compare` runs the command, parses its stdout as a JSON object of numbers or number arrays, and judges it against a repository-relative reference file under `relative`, `absolute`, or `ulp` tolerances (every named bound must hold; missing keys, shape and length mismatches, `NaN`, and infinity fail), reporting each key's worst deviation and the tolerance it failed. `perf-budget` judges the measured wall time against `budget: {wallTimeMs, tolerance?}` or a baseline that `clio-coder verifiers baseline <id>` records, reporting measured time, effective budget, and ratio. The `verify` tool and dispatch host verification both run the judgement and seal the report (`report` on the host-verification check, under receipt integrity); a failing judgement is a check failure with the report in the detail. Version 1 catalogs still load with every check as `kind: command`. `verifiers add` and `edit` take `--kind`, `--reference`, `--tolerance`, `--budget-ms`, `--budget-relative`, and `--baseline`; `verifiers author` lists an incomplete `numeric-compare` check for every validation-contract artifact that declares `numerical_tolerances`, with the command left for the operator.
+- Operator tasks carry optional acceptance through repeatable `--expect` and `--verify` flags in the CLI and `/tasks add`. Shared dispatch normalizers validate paths and bounded checks, pickup persists required board evidence, and high rigor requires a passing receipt or a limitation naming each acceptance check.
+- An opt-in `--strict` switch for `scripts/smoke-real-home.sh` causes the real-home release smoke to fail when doctor exits 1 on failing rows, while default runs continue to tolerate operator fleet state (#293).
+- A current release-cut checklist in `docs/process/release-cut-checklist.md` and paired blueprint for maintainers to verify and publish releases (#298).
+- ACP registry submission assets including `assets/acp-registry/agent.json` and `assets/acp-registry/icon.svg` with submission documentation in `docs/architecture/acp.md` (#314).
+
+### Changed
+- Retry admission rebinds a held plan-reservation member under the async state-file lock, so a dispatch attempt waiting on the cross-process capacity lock yields the event loop instead of spinning in `Atomics.wait` (#319). Plan preparation still takes the synchronous lock because the tool registry's `prepareAdmissionArguments` hook cannot yield.
+- Document that headless Antigravity reports permission_mode always-proceed under mode plan and sandbox, and that Clio grades enforcement as approximated (#281).
+- The runs.json ledger carries version 1 on RunEnvelope records, treating legacy unversioned rows as version 1 and skipping records with any other version.
+- Claude CLI workers now accept the built-in recipes. The `claude-code` runtime declares its external agent loop the way Antigravity does, so a recipe budget is admitted as `external-one-shot` with the per-tool count recorded as unobserved instead of refusing the dispatch. Claude Code CLI stays under Subscriptions in `configure --list` and keeps its `claude-cli` auth status; retries and orchestrator eligibility are unchanged (#280).
+- The Claude Code CLI worker now uses the same hardened transport as the Antigravity worker. `claude` receives only the allowlisted environment instead of the whole process environment, so provider keys and Clio gates no longer reach it. The user turn travels on stdin rather than argv; system text remains in `--append-system-prompt`. The admitted `cwd` is honored and refused when it escapes the workspace root, stdout is read through the bounded line reader (1 MiB per line, 8 MiB total) and a violation ends the run as an error, and cancellation terminates the POSIX process group even when the immediate CLI exits before its descendants. Windows retains direct-child cancellation (#279).
+- The dispatch board reads observability's run projection. One fold owns lifecycle events, worker progress, receipt trust, retries, cancellation, fleet positions, and evidence readiness; the board keeps ordering, selection, and rendering. Terminal status and accounting come from the same projection the observability contract publishes.
+
+### Fixed
+- ACP permission cancellation now aborts the active turn before releasing parked tools, preventing an extra provider request while Workbench settles an unanswered approval (#341).
+- The deterministic behavioral machinery suite declares the `default` target used by its dispatch fixture, so all 26 cases produce an artifact that `eval report` and self-comparison can load with strict execution provenance validation (#342).
+- Compete respects a candidate receipt's effective read-only autonomy when finalizing work. Generated `.clio-coder/codewiki.json` and `.clio-coder/state.json` are excluded from writer staging and judge branch diffs even when the caller's `.gitignore` update is uncommitted or the runtime files were already staged. Authored edits, including tracked Clio project configuration, still commit and apply; unrelated staged and unstaged caller changes remain intact (#347).
+- Host verification memoization and batch deduplication now include the check identity, kind, execution timeout, numerical tolerances, performance bounds, and reference or baseline contents. Different judgments cannot inherit an earlier pass, while identical valid checks retain evidence reuse and provenance (#333).
+- Host numerical verification now judges bounded command stdout, matching ordinary verify. JSON diagnostics on stderr cannot supply a missing measurement or invalidate valid stdout; stderr remains available in the command artifact (#334).
+- High-rigor task acceptance now requires validation evidence from the owning workspace. Verifier receipts retain declaration source and execution details, so a passing same-named examples check cannot satisfy a root check. Intended package and catalog checks, exact root package commands, and scoped limitation receipts remain supported (#335).
+- Skills with an allowed-tools list, including coding-standards and the related coding workflows, can record the finish contract's limitation receipt. Explicit tool denials and restrictions on unrelated actions remain enforced (#336).
+- Slash argument completion now reads loaded agent recipes, configured targets and known models, installed skills, and session tasks from the interactive app contracts (#303).
+- Workbench desktop notification mute preference now persists in local storage across page reloads (#322).
+- ACP close and reopen starts a fresh conversation on the same child process, clearing provider history and turn ancestry while switching the task board to the new session. Explicit session loading still restores the saved conversation and tasks (#312).
+- Sessions without interactive ask_user now receive one passive marketplace reminder per matching skill per session, including its installation command, without starting an interview or recording a decline (#317).
+- Setting interface.panes.enabled=embedded refuses with a visible reason instead of silently degrading to guest detection (#294).
+- ACP production stdout now uses the bounded queue through its output guard, waits for drain before sending more frames, and closes with a typed error when stalled output exceeds the existing 1 MiB UTF-8 byte budget, including the first frame that stalls the stream (#309).
+- Dispatch to a subprocess worker no longer fails at prompt compilation when the recipe offers the canonical `context` tool. The Claude CLI declares tool support, so `context` survived tool narrowing while the compiler correctly treated the subprocess surface as unattached, and every built-in recipe that lists `context` (architect, scout, oracle, researcher, and others) was refused with a `hasCanonicalContext` mismatch. The attached-context fact is now derived from the runtime kind, and bound skills are neither promised in the prompt nor stamped on the worker spec for a runtime that never receives Clio's tools.
+- Ollama eviction now releases only models this Clio process successfully pinned on the same server, preserving models loaded by operators or other clients (#313).
+- Deprecation warnings for the legacy lmstudio-native runtime id now route through warnLegacyNaming, reporting the planned v0.7.0 removal and deduping per process.
+- Fleet run preview diagnostics and approval overlays now format cost totals through the shared formatter so amounts at or above one cent render with two decimals instead of four.
+- Default path policy now marks project and user skill roots read-only for workers and the orchestrator, alongside the existing skill-authority guard; operator installs continue through the CLI (#300).
+- Scratch offload sweeps now report non-ENOENT filesystem errors in a skipped count instead of silently swallowing them.
+- Model discovery no longer treats target status with an undefined model source as a live catalog.
+- The upgrade command now gates test seams behind NODE_ENV=test so testing environment variables are ignored in production.
+- Marketplace offer reminders now collapse catalog descriptions to one line, strip square-bracketed directive markers, and cap description text at 200 characters (#316).
+- Damage-control no longer treats command quotations in `dispatch` and `tasks` prose as shell execution. Execute-class calls still use the same blocked command patterns (#286).
+- Doctor state storage inspection now shares the lifecycle presenter byte formatting helper instead of keeping a private copy with differing units, printing consistent byte sizes across doctor, reset, and uninstall.
+- The `coding-standards` skill (0.4.0) declares an `allowed-tools` surface again (`read`, `grep`, `find`, `ls`, `code_nav`, `bash`, `write`, `edit`) instead of no narrowing at all, so a solo run can both read and write code.
+- ACP delegation usage now carries `totalTokens` and `costUsd`, merged with the same rule the ACP server uses: an explicit total or cost from the peer is taken as reported, otherwise the total is the sum of input, output, and cache tokens and the cost stays 0.
+- The dispatch typed-intent reason-code table now documents `legacy_scope_inferred` as the warn that `path-scope.ts` emits when prose inference resolves a leading `../` run against the dispatch root, instead of calling it an unemitted compatibility id.
+- The `muse-glimmer-30b` catalog notes, runtime preference, and guidance now say the reasoning strength dial is driven per request through `chatTemplateKwargs.byLevel` on llama.cpp and reported as undeliverable on LM Studio, instead of claiming no per-request field exists.
+- `clio-coder eval run` spawns a `clio-coder-run` task as an argv instead of a `sh -c` line, so the task deadline reaches the Clio process itself and the exit code the runner reports is Clio's own. Through dash the shell stayed the parent: the deadline's SIGTERM stopped the shell while Clio finished the turn, wrote its report artifact, sealed a succeeded receipt with exit 0, and exited 0, and the item was recorded as `runner_failed` beside an ok receipt with `receipt.outcomeMatchesExit` false. A run the deadline reaches is now canceled, and its receipt records the cancellation with the exit status the runner reports. The SIGKILL grace after that SIGTERM is five seconds, long enough for Clio's coordinated shutdown to seal the interrupted run's receipt. The context-init and context-index eval runners now spawn through the same argv form. (#275)
+
+### Removed
+- Retired slash command hints for former command spellings are removed so unrecognized commands fall through to the standard unknown command error.
+- The unused `--kv-cache-mode` command-line flag and its run override field are removed because no runtime reads them.
+
 ## 0.4.3 - 2026-09-05
 
 This release adds Archify architecture maps and experimental Antigravity research delegation, and tightens thinking controls, session memory, compaction and execution evidence. Usage and cost reports retain explicit coverage limits; full evidence reconciliation is deferred to v0.4.5 or later.
@@ -13,6 +74,7 @@ This release adds Archify architecture maps and experimental Antigravity researc
 - `.clio-coder/artifacts/maps/` is a placement class (human transient) in `docs/architecture/artifact-placement.md`; `docs/guide/skills-marketplace.md` documents remote entries and overlays with archify as the worked example, and `docs/architecture/context-engine.md` documents the seed's guarantees.
 - A distinct, permanently read-only `world-knowledge` shadow agent handles current open-world discovery, ecosystem comparisons, broad external context, and advisory second opinions. Its compact result contract separates supported facts and source identifiers from synthesis, uncertainties, and follow-up verification, and it reports honestly when native discovery/search is unavailable instead of treating URL retrieval as search or fabricating citations.
 - Reusable `branch-closeout` Git skill (`skills/git/branch-closeout/`) for proving merged work on canonical remotes, inspecting dirty or ignored worktree state, safely removing registered worktrees through Git, deleting local branches, optionally removing contributor fork branches, and auditing surviving repository references.
+- The trace viewer shows each run's `source` (`dispatch` or `session`) as a small badge beside the run id on the run list and beside the status on the run page, matching the SOURCE column `clio-coder trace runs` already prints. The list filter matches the badge text, so typing `session` narrows the list to interactive turns. A mirror whose rows carry no `source` field renders no badge. Contract: `apps/trace-viewer/tests/client-smoke.test.mjs`. (#289)
 
 ### Changed
 - The local and hosted CI gate checks skill pins once through lint, removing the duplicate explicit pass. The full contract/smoke, trace-viewer and release-package checks remain in place; contributor guidance distinguishes focused checks from the complete release gate.
@@ -21,6 +83,7 @@ This release adds Archify architecture maps and experimental Antigravity researc
 - First-run onboarding can offer **Antigravity CLI — experimental local delegation** only after a valid primary target exists. The optional step never changes chat/background pointers or enables dangerous full access; it can create a `world-knowledge-external` fleet profile and bind `world-knowledge`. Noninteractive `configure` gains `--bind-agent <agentId>` alongside `--agent-profile`, and model/target listings preserve live labels and source/freshness.
 - Hardened the entire Git skill suite under `skills/git/` (`file-ticket`, `fix-issue`, `ship`, `worktree-create`, `worktree-merge`, `resolve-merge-conflicts`). Added formal argument contracts with structural parsing; made workflow bodies project-agnostic without hardcoding repos, remotes, or branch names while preserving the canonical-main-only policy in `CONTRIBUTING.md`; required confirmation before every outward ticket action including duplicate issue comments; decoupled unsupported RCA automation claims from `fix-issue`; separated `ship` into explicit `commit`, `pr`, maintainer-local, and `closeout` modes; corrected rebase ours/theirs reversal semantics and added conflict matrices covering binary, rename, modify/delete, and lockfile conflicts; supported configurable roots, safe path derivation, and strategy controls in worktree operations; and expanded evals across all skills.
 - Branch and worktree closeout is now an explicit final development step: prove the merged result, inspect local state, remove registered worktrees through Git, delete local scaffolding, and report every surviving branch, stash, local-only tag, and canonical remote head. The canonical repository keeps only `main`: maintainer topic and compact release-candidate branches such as `v043` stay local, contributors submit branches from their forks, and dotted names such as `v0.4.3` are reserved for immutable release tags.
+- Every catalog SKILL.md that describes headless `ask_user` now states the same behavior the `clio-coder run` help text does: the tool is not registered, so any call is refused as an unregistered tool rather than answered. Fifteen skills take a patch bump for the correction.
 
 ### Fixed
 - Dedicated memory, compaction and native worker admission now discover cold LiteLLM target metadata before resolving thinking controls; sharing a gateway URL with chat no longer hides a missing target probe. Memory keeps discovery within its existing cancellation/deadline boundary, rechecks known endpoint capacity at actual launch, and does not turn cancelled metadata into endpoint failure. Compaction now sends its intended thinking-off request through the simple stream API. Workers keep their approved route and reservation while discovery runs within the invocation's cancellation and admission deadline; late cancelled metadata cannot launch a worker. Unknown runtime declarations remain unguessed.

package/README.md

@@ -383,7 +383,7 @@ clio-coder --version
 From source, pinned to this version:
 
 ```bash
-git clone --branch v0.4.3 https://github.com/iowarp/clio-coder.git
+git clone --branch v0.4.4 https://github.com/iowarp/clio-coder.git
 cd clio-coder
 npm ci
 npm run install:local

package/dist/{acp-H2NGRPWO.js → acp-WNAYYF4F.js}

@@ -6,15 +6,14 @@ import {
 } from "./chunk-2VTFPG5O.js";
 import {
   runClioCommand
-} from "./chunk-AX2THNSA.js";
+} from "./chunk-UEPWCCTY.js";
 import "./chunk-4WR7VSYB.js";
 import "./chunk-I7XBWTYH.js";
-import "./chunk-PUVDKJ2Y.js";
+import "./chunk-3ODX73FK.js";
 import "./chunk-ZTJUVLTU.js";
 import {
   printError
-} from "./chunk-VPKWYKEY.js";
-import "./chunk-5TSRNF4G.js";
+} from "./chunk-JCI2ROMZ.js";
 import "./chunk-GHS5EBTQ.js";
 import "./chunk-D7E7WCDF.js";
 import "./chunk-IWHMRKLL.js";
@@ -127,4 +126,4 @@ async function runAcpCommand(args, options = {}) {
 export {
   runAcpCommand
 };
-//# sourceMappingURL=acp-H2NGRPWO.js.map
+//# sourceMappingURL=acp-WNAYYF4F.js.map

package/dist/{agents-TL5LLUQP.js → agents-3OKXHLOI.js}

@@ -1,67 +1,69 @@
 import { createRequire as __clioCreateRequire } from "node:module"; const require = __clioCreateRequire(import.meta.url);
-import {
-  SafetyDomainModule
-} from "./chunk-YQWYVTMC.js";
-import "./chunk-MUW2BDDH.js";
+import "./chunk-JQLNNIKT.js";
 import "./chunk-GWZNEVM2.js";
 import "./chunk-5ICU3EUH.js";
 import {
   ConfigDomainModule,
   loadDomains
-} from "./chunk-WBKFA554.js";
+} from "./chunk-72YIHOZQ.js";
 import "./chunk-4WR7VSYB.js";
+import {
+  SafetyDomainModule
+} from "./chunk-5636DCO5.js";
 import {
   AgentsDomainModule
-} from "./chunk-UPZU6GE4.js";
-import "./chunk-RRNP2ANY.js";
+} from "./chunk-RZDWV63N.js";
+import "./chunk-7UGL4MB5.js";
 import "./chunk-DR52UMZW.js";
-import "./chunk-RVG5JXAL.js";
-import "./chunk-2VIKGWFZ.js";
+import "./chunk-ODGTEFFI.js";
+import "./chunk-OEJSLEPW.js";
 import "./chunk-RKKLTLYB.js";
-import "./chunk-N2Z7HLVY.js";
+import "./chunk-2ASED4PZ.js";
 import {
   ensureClioState
 } from "./chunk-IGLP3ODT.js";
 import "./chunk-3M6DQK6S.js";
 import "./chunk-LCGCVYZ4.js";
-import "./chunk-LDJG7DW3.js";
+import "./chunk-2ZSONWVL.js";
 import "./chunk-NDDGJUXD.js";
-import "./chunk-CE5AX47J.js";
+import "./chunk-YECAMM3D.js";
+import "./chunk-V76WTFTW.js";
 import "./chunk-3DPEIQKN.js";
-import "./chunk-7DRAWPTZ.js";
+import "./chunk-TQAHXW6Y.js";
 import "./chunk-5MEZN6CB.js";
 import "./chunk-NEKRRTYW.js";
-import "./chunk-INY6HTFL.js";
+import "./chunk-JEIYHLOR.js";
 import "./chunk-I7XBWTYH.js";
-import "./chunk-PUVDKJ2Y.js";
+import "./chunk-3ODX73FK.js";
 import "./chunk-4O6MANBS.js";
 import {
   printError
-} from "./chunk-VPKWYKEY.js";
-import "./chunk-5TSRNF4G.js";
+} from "./chunk-JCI2ROMZ.js";
 import "./chunk-5PSMVOLM.js";
-import "./chunk-RSJ25QSL.js";
-import "./chunk-XIVNBFZS.js";
-import "./chunk-7DICMOS6.js";
-import "./chunk-HHV2GANA.js";
+import "./chunk-6QOTUPRG.js";
+import "./chunk-6Q3CYFD3.js";
 import {
   isUserVisibleAgent
-} from "./chunk-B4OAX3SI.js";
-import "./chunk-I7ZPNEJM.js";
+} from "./chunk-KFV5L5SK.js";
+import "./chunk-NXYCB2VD.js";
+import "./chunk-ECH6PKUQ.js";
+import "./chunk-DXKJURES.js";
+import "./chunk-HHV2GANA.js";
 import "./chunk-GYV6VZOC.js";
 import "./chunk-UL3WSD3F.js";
-import "./chunk-ECH6PKUQ.js";
 import "./chunk-5B2AEOW5.js";
 import "./chunk-QSNYB6ZV.js";
-import "./chunk-JGRC33J2.js";
-import "./chunk-K6BSR66V.js";
+import "./chunk-54X7T7DK.js";
+import "./chunk-I5FWO7L5.js";
+import "./chunk-6XLNIQDB.js";
+import "./chunk-4NSRCOYP.js";
 import "./chunk-QDC3K2U3.js";
 import "./chunk-2JH2WHGE.js";
-import "./chunk-HAXOFFRH.js";
-import "./chunk-R346GLFC.js";
 import "./chunk-KXDSS5WJ.js";
 import "./chunk-GHS5EBTQ.js";
 import "./chunk-D7E7WCDF.js";
+import "./chunk-HAXOFFRH.js";
+import "./chunk-R346GLFC.js";
 import "./chunk-BTK3SSSK.js";
 import "./chunk-PMZVFWSR.js";
 import "./chunk-F4EKGO4N.js";
@@ -69,9 +71,9 @@ import "./chunk-XPLRXC72.js";
 import "./chunk-IWHMRKLL.js";
 import "./chunk-UXCU4E3T.js";
 import "./chunk-LL4KHSZI.js";
-import "./chunk-JSC3U7TI.js";
 import "./chunk-S66XZJOF.js";
-import "./chunk-JIEGK6UF.js";
+import "./chunk-TOIVGRUX.js";
+import "./chunk-U6TMQNSI.js";
 import "./chunk-EBY63B7G.js";
 import "./chunk-6EJMN2Y3.js";
 import "./chunk-ID64D7PE.js";
@@ -142,4 +144,4 @@ function renderLine(spec) {
 export {
   runAgentsCommand
 };
-//# sourceMappingURL=agents-TL5LLUQP.js.map
+//# sourceMappingURL=agents-3OKXHLOI.js.map