@iowarp/clio-coder 0.4.3 → 0.4.5

package/CHANGELOG.md

@@ -2,6 +2,159 @@
 
 All notable changes to Clio Coder are documented in this file. The format follows [Keep a Changelog](https://keepachangelog.com/en/1.1.0/) and versions follow Semantic Versioning; pre-1.0 minor releases may include incompatible changes.
 
+## 0.4.5 - 2026-09-07
+
+### Added
+- Add operator-reviewed, per-workspace consent for project safety, hooks, and settings. `config trust safety|hooks|settings` previews exact source bytes and a full SHA-256 digest; `--hash` approves that reviewed version and `--revoke` withdraws consent. Canonical workspace identity and separate surface records prevent approval from silently extending to another repository or configuration kind (S3-01).
+- Add private provider request-body and terminal-response diagnostics through `CLIO_CODER_PROVIDER_DUMP_PATH`. The opt-in sink requires an absolute, operator-owned mode-0600 regular file, preserves the actual request and event stream, and redacts known credentials from diagnostic copies (S9-04).
+- Add known-good and failing reference fixtures for every task in the main behavioral model suite, a tool-keyed argument-schema corpus, and a 20-question bundled-document recall corpus. The schema and retrieval contracts run without a model; they do not claim to measure a model's sensitivity to tool descriptions (S8-05, S8-06, S8-07).
+- Add a runnable model-required tool-surface suite for file-tail reads, fresh shell cwd and expected URL rejection, with per-tool success, failure and block counts. Controlled passing and broken trials exercise the full suite/runner/grader path; live provider trials remain unrun (S8-06).
+- Workbench run-window search and filters, an optional running-only worker strip, searchable application help and keyboard shortcuts, and an About record showing GUI and connected Clio versions and capabilities.
+
+### Changed
+- Document npm, pnpm, Bun, Yarn, cached runners, release tarballs, and the pinned pnpm source workflow. Expose `upgrade --post-install` for local migration checks after updates by another package manager, without a registry lookup or reinstall. Source upgrade and recovery guidance now names pnpm, and the source installer requires package managers only for dependency/build work.
+- Clarify that committed verifier catalogs define checks but do not approve repository script execution. The reported automatic-execution defect was refuted by the existing confirmation and approved-safety policy, with the exact Node verifier case pinned by a regression contract (DOG-010).
+- Document shell tool state, cwd, timeout and actual host networking; distinguish `CLIO_CODER_DISABLE_RETRIEVE_TOOLS` from an OS network sandbox while retaining `CLIO_CODER_NO_NETWORK_TOOLS` as a compatibility alias. Tool-data trust guidance and image capability descriptions deliberately update stable prompt bytes without reordering prompt sections (S2-04, S4-02, S4-05, S7-02).
+- Allow an operator process to choose native Anthropic cache retention with `CLIO_CODER_ANTHROPIC_CACHE_RETENTION=none|short|long` across both central streaming paths. Explicit call options take precedence, unsupported long retention remains governed by provider compatibility, and unset preserves SDK behavior (S9-02).
+- Give working-set eviction markers durable short `rN` recall aliases, retain historical references, and avoid alias reuse across session branches. The audit's UUID-only parser claim was stale: `src/domains/context/working-set/fold.ts:21` already accepted arbitrary non-whitespace tokens; the missing feature was stable short aliases (S4-04).
+- Correct audit assumptions verified against the moved tree: hook declaration hashes were normalized and truncated at `src/domains/middleware/hooks.ts:143-144`, not full file hashes; ordinary result annotations appended at the original `src/tools/registry.ts:1259-1282`; v4 eval artifacts use `result.artifacts.sessionLedgers` rather than a nonexistent `result.paths` (`src/domains/eval/schema/artifact.ts:53`). Regression coverage follows the actual production contracts (S3-01, S4-03, S8-02).
+- Pin the existing nonretryable behavior for unsupported-thinking HTTP 400 responses. `src/domains/session/retry.ts:90` delegates to the SDK classifier and `src/interactive/turn-recovery.ts:230` checks it before retrying; a real SDK contract confirms one request. The audit's repeated-400 claim is refuted, and no unsupported adaptive-thinking fallback is invented (S9-03).
+- Report docs recall at the shipped k=5 rather than requiring an arbitrary ranking-weight change to fail: equivalent or better rankings remain valid. The 20-question corpus retrieves all 20 target sections, with an unrelated-query negative control; the ranker's sorting and top-k selection remain unchanged (`src/tools/context/docs-engine.ts:625`, `:633`; S8-07).
+- Pin the Pi provider, agent, and terminal SDKs to 0.85.1; preserve historical Anthropic thinking effort across session persistence and adapt overlay bounds and scrollbar styling to the public terminal APIs.
+- Use pinned pnpm for repository dependencies, application workspaces, contributor scripts, and CI. Keep npm registry packaging and npm consumer installation compatibility checks.
+
+### Fixed
+- Keep grep, find, and ls bound to the active compiled safety policy after project policy edits or trust revocation, so search output and offloaded results retain the same zero-access protections as direct reads until restart.
+- Keep `clio-coder doctor` diagnosis from creating a credentials file when none exists; explicit `doctor --fix` still creates or repairs it (DOG-001).
+- Give read-only execution denials guidance for independent native inspection and operator-controlled autonomy changes, while preserving execution, write, and protected-read restrictions (DOG-002).
+- Link workers dispatched by headless runs to their parent run, preserving distinct assignment identities across retries, monitoring, and recorded route outcomes (DOG-004).
+- Preserve partial text and thinking once when a turn is cancelled, including persisted history, resume, and export; keep deliberate cancellation separate from LiteLLM route-failure advice (DOG-003, DOG-005).
+- Retain the policy rule and cause in terminal headless denials, carry policy provenance into tool-end events, and count blocked calls separately from execution errors in run receipts (DOG-006).
+- Let headless runs exit normally after using FIFO steering, including when the writer remains connected or never connects, while preserving read-only pipe access (DOG-011).
+- Keep operator credentials, settings, skill authority and workspace trust records protected when an approved project safety policy disables project defaults. Existing independent skill-authority checks already prevented skill writes in this case, refuting that portion of the audit; the credential-default bypass was real (S1-01, S1-04; `src/domains/safety/skill-authority.ts:39-43`).
+- Require confirmation for shell variables and interpreter inline programs, and for undeclared repository test/build scripts. Approved safety declarations can admit scripts; approval of hooks or settings grants no such authority. npm confirmation includes script and lifecycle bodies (S1-02, S1-03).
+- Show compiled safety provenance, effective defaults and workspace trust in text and JSON `config inspect`; aggregate permission outcomes and the granted/requested event-window rate in usage reports, leaving an empty denominator unavailable (S1-05, S1-06).
+- Withhold unapproved or changed project configuration, explain skipped files and review commands at startup, and parse the exact bytes that were admitted. Adding a local override or relocating a safety policy invalidates approval; relative safety paths retain their admitted source location. Malformed unapproved policy cannot block default execution. Published project hooks recheck consent and content before execution, so edits and revocation stop them without waiting for reload and reach the interactive transcript (S3-01).
+- Filter command-hook and ACP child environments through the shared safe environment builder while preserving explicit ACP credentials and Git-attribution opt-out. Pin built-in ACP adapter recipes to `@zed-industries/claude-code-acp@0.16.2` and `@agentclientprotocol/codex-acp@1.10.0` (S3-02, S3-03).
+- Classify non-GET/HEAD web requests and any request body as outward writes. Validate every web-fetch destination and redirect, reject private/reserved DNS answers by default, pin the checked address for the socket connection, and remove caller headers across origins. An explicit operator environment opt-in enables private-network retrieval (S2-01, S2-02).
+- Strip secret-shaped variables and shell startup injection from both inherited and login-shell environments. A failed environment capture no longer falls back to a login shell that could reintroduce credentials (S2-03).
+- Filter zero-access paths and content in search and directory producers before rendering or writing overflow artifacts, including fallback grep modes; report withheld counts without revealing protected names (S4-01).
+- Mark retrieved content as untrusted data and flag instruction-shaped external tool text through builtin middleware. Preserve the advisory warning under tail, bounded, and metadata-only result shaping without discarding the source or exceeding result budgets (S4-02, S4-03).
+- Refuse overlapping or undeclared parallel checkout writers before dispatch admission, preserving canonical disjoint scopes, isolated worktrees, explicit writer serialization, and read-only peers. Use native path separators when comparing scopes (S5-01).
+- Preserve immutable Git recovery refs for every fleet review-loop check and compete candidate cleanup, including uncommitted losing work and restart recovery. Capture uses an isolated index with hooks, filesystem monitors and configured clean/process filters disabled, leaving the operator's HEAD and index unchanged. Winner results disclose how to find the retained refs; ignored files and external filesystem state remain outside these checkpoints (S5-02).
+- State in the fork picker and after a successful fork that workspace files are not rewound and existing edits remain; failed forks never emit a success notice (S6-01).
+- Carry bounded image blocks alongside tool text through registry admission, middleware, observation budgets, and main/worker adapters. Vision-capable routes can read PNG, JPEG, GIF and WebP content and inspect retained frontend screenshots; unsupported routes receive an explicit image limitation. Screenshot scratch files are cleaned after capture (S7-01, S7-02).
+- Measure temporary eval workspaces against a harness-owned file-hash baseline, counting modifications, additions, deletions and symlink changes; omit unavailable patch metrics instead of reporting fabricated zeros (S8-01).
+- Retain complete discovered eval session ledgers before trial cleanup, including failed trials and multiple sessions, in private transcript artifacts. Reject symlinked sources and artifact destinations, retain available interrupted ledgers with an incomplete-evidence diagnostic, and preserve the primary trial failure plus available stdout when evidence capture fails. External runners that produce no ledger remain explicitly without a full transcript (S8-02).
+- Expose an empirical noise band in behavioral comparisons while keeping safety-family regressions at zero tolerance. A change inside the band remains unresolved rather than proving equivalence (S8-03).
+- Check declared grader code and dependencies for content or symlink changes before grading and after verifier execution. Already changed graders do not execute, and tampering detected after execution cannot produce a successful trial; both fail as grader-integrity infrastructure failures (S8-04).
+- Preserve the full Anthropic tool array during a required-tool round while retaining the named tool choice and request-local removal of incompatible thinking fields; local-server tool narrowing is unchanged (S9-01).
+- Validate required history-summary sections, ordering and progress subsections outside Markdown fences before publishing a compaction checkpoint. Keep split-turn summaries separate, retain the prior context when validation fails, and exercise actual publication failures plus recorded checkpoint replay and explicitly synthetic fact-preservation fixtures. Existing output-limit and cancellation rejection already handled truncated streams at original `src/domains/session/compaction/compact.ts:647`; that portion of the audit was stale (S10-01).
+- Refuse interactive slash commands in headless `run` before session startup instead of sending their text to the model; preserve named skill invocations, prompt templates, and ordinary task text.
+- Declare the internal bootstrap researcher's repository scope so JSON-escaped handbook text cannot trigger a malformed-path refusal before generation, including the structured-output fallback path.
+- Keep parallel tool declarations and the latest operator request intact across compaction; reject truncated or canceled checkpoints, wire TUI and ACP cancellation through production summaries, and stop canceled pre-submit requests before chat admission.
+- Parse authored handbooks with fenced code blocks and HTML comments correctly: a `# comment` inside a fenced example no longer rejects `CLIO-CODER.md` or drops its conventions and invariants from `--apply` and `--adopt`, and fenced `##` lines are no longer split into sections or rewritten on serialization.
+- Keep whole-index work off the prompt and tool hot paths: the codewiki worker receives a reference to the committed artifact instead of a structured clone of the parsed index, an unchanged `code_nav` reconciliation returns only the fingerprint, and the compiled prompt's project-type and codewiki markers read recorded state and artifact presence instead of parsing the artifact and re-walking the tree.
+- Keep OpenRouter model transport, endpoint, and compatibility metadata coherent when Pi's catalog selects Anthropic Messages; preserve configured OpenAI-compatible endpoints and unknown-model fallback.
+- Declare writable staging subtrees for internal wiki dispatch, report pending pages explicitly in CLI outcomes, and retain the Git baseline needed to reuse completed first-publication checkpoints.
+- Compare summary compaction with full-context estimates on both sides and describe unchanged or increased context without claiming reclamation.
+- Preserve ordinary authored handbooks and bounded exact prefixes in session and opted-in worker context; disclose omitted sources and invalidate captured prompts after explicit context changes.
+- Keep generated handbook proposals separate from publication, preserve authored content during refresh, and retain publication provenance for the handbook actually in use.
+- Project the working set before summary compaction and support discovery and exact recall of persisted tool results hidden behind a summary.
+- Use source-content evidence for codewiki and wiki freshness, reconcile Python imports, and retain truthful wiki page outcomes, retry checkpoints, revised plans, and interrupted-publication recovery.
+- Drain active operator shell commands during shutdown and preserve bounded process-group escalation after the immediate child exits.
+- Keep multiline Workbench session titles readable and show canonical validation quality and interruption evidence in worker displays (#356, #357).
+- Keep `targets use` role flags scoped to the named roles, validate exact listed model IDs, and report only settings that changed.
+- Admit a pipeline member within its own reservation wave without charging its future waves against that member; retain other owners' reservations and active leases.
+- Add focused Windows subprocess CI coverage; cancel external Windows descendant trees with taskkill and forced escalation, retaining direct-child fallback and POSIX process groups (#282, #283).
+- Add caller-explicit Antigravity resume with bounded conversation IDs and first-init identity verification; automatic retry remains disabled (#284).
+- Clarify bounded inline explanations and precise limitations for Documenter and explicitly selected Coder recipes, strengthen Scout citation guidance, and halt pipeline dependents after failed quality (#349, #350, #361).
+- Instruct agents to verify implementation semantics against active decisions before commit and keep attribution distinct from adherence (#351).
+- Clarify source-grounded convention promotion, separate operator approval and fresh-session delivery, and preserve explicit no-edit scope during retention (#352, #364).
+- Make operator-task pickup and durable linkage explicit, distinguish acceptance requirements from results, and complete inbox commands with eligible operator IDs (#354, #366, #370).
+- Preserve proposal-only scope in task-board and continuation guidance independently of skill-install choices (#365).
+- Prefer authored skill triggers over incidental description overlap in marketplace offers and passive headless reminders (#360).
+- Expose compete on a single fleet route while preserving separate candidate and judge evidence; retain terminal summaries when canceled or timed out without reporting a winner (#348, #355).
+- Keep behavioral eval comparisons aligned across declared route variations, preserve compact mismatch identities, and print usable report commands for custom artifacts (#358, #359, #363).
+- Preserve watch-pane host failure details and distinguish local geometry refusals; retain observed worker termination signals beside missing-result failures (#362, #367).
+- Avoid blocking the event loop during retry reservation waits and use fresh capacity and budget observations (#368).
+- Preserve ACP peer token totals, explicit zero usage, and supported cost provenance without double-counting event metering (#369).
+- Validate documented settings paths against the typed settings shape, including optional fields and array/map members (#371).
+- Distinguish Workbench child-restart coverage from direct ACP same-child isolation, with child identities and history, ancestry, and task reset checks (#374).
+- Correct command documentation to describe generic unknown-command errors for retired spellings (#372).
+- The dispatch board retains active work alongside 50 settled runs, keeps newly settled runs visible, and bounds completed retry parents without reviving them when a child attempt starts (#339).
+- Condensed dispatch summaries, worker transcript rows, compact fleet rows, and monitor status show canonical deliverable validation quality separately from execution success. Failed, ungrounded, and unknown quality stay distinct, including in narrow worker displays (#345).
+- Decision revisions preserve their original ledger origin and record whether the agent or operator made the revision. Evidence no longer labels agent revisions as operator corrections; historical revisions with no recorded author remain unknown (#337).
+- Operator `/run` and approved fleet executions snapshot active decision references before admission and retain them in requests, envelopes, and sealed receipts (#340).
+- Simulated terminal-selection tests own and restore their `TERM` environment, so they pass in headless runners while retaining the production dumb-terminal refusal check (#353).
+- Relative numerical comparisons avoid intermediate subtraction overflow for finite extreme values, while retaining precision for nearby values and independent absolute and ULP checks (#338).
+- Support deterministic architecture seed generation with `clio-coder context map`, retry pending wiki pages with `clio-coder context wiki --retry-pending`, and resolve `--target` from layered project settings.
+- Support configurable inline summary allowances for `mutation-report` contracts up to 32,768 bytes via recipe `maxSummaryBytes` and dispatch `result_summary_max_bytes`, while bounding commit and architect-plan messages to 1,000 bytes.
+- Document the Archify architecture mapping pipeline across seed generation, model refinement, deliverable validation, source review, and visual review.
+
+## 0.4.4 - 2026-09-05
+
+Trust spine: typed claims, executable validation, and decision provenance. Answers the NSF "Beyond Code" findings where the harness still trusted prose or sniffed files.
+
+### Added
+- The trace viewer shows each run's `source` (`dispatch` or `session`) as a small badge beside the run id on the run list and beside the status on the run page, matching the SOURCE column `clio-coder trace runs` already prints. The list filter matches the badge text, so typing `session` narrows the list to interactive turns. A mirror whose rows carry no `source` field renders no badge. Contract: `apps/trace-viewer/tests/client-smoke.test.mjs`. (#289)
+- A Deno test validates that class tokens used across Workbench components exist in the stylesheet (#311).
+- Lint holds `docs/guide/configuration-reference.md` against `DEFAULT_SETTINGS`: the new `configuration-reference` hygiene check fails when a settings key has no row in the settings-key table or a row names a key path the defaults no longer carry.
+- The `limitation` tool records what a turn could not verify and why. The finish contract settles on a successful `limitation` receipt inside the same window as the mutation scan; the seven prose patterns that used to satisfy it are gone, so wording alone can no longer pass the gate. The tool is on the six mutating recipes, and the operating contract tells the model to call it.
+- One strict loader for the version-1 scientific validation contract (`src/domains/safety/validation-contract.ts`), shared by rigor, `verifiers author`, doctor, and the startup hint. Rigor rises to `high` only when the contract parses; an invalid contract is diagnosed with the field and cap named, and `VALIDATION.md` is advisory prose that never raises rigor on its own.
+- The `decide` tool records a design choice with the alternatives the model rejected and why, as an `origin: "agent"` decision-ledger entry beside operator `ask_user` answers. A repeat key supersedes the earlier agent decision; an operator decision is never overwritten by the model. Dispatch seals every active decision ref onto the run request, envelope, and receipt under integrity coverage, and Clio-controlled commits carry one `Clio-Decision: <interviewId>/<key>` trailer per ref from the receipt or the live board.
+- Recorded decisions reach the surfaces that cite them. Evidence resolves a sealed receipt's `decisionRefs` against the linked session's active path, records the resolved arguments in `overview.json`, and raises a resolved or missing-reference finding per ref in both readable documents. Handoff and oracle briefings carry each decision's alternatives and rationale, and wiki page writers receive up to twelve active decisions matching their page's sources and cite the refs in the body and optional `decisions` frontmatter.
+- The read-only `evidence` tool shares the CLI inventory and trust projections, with overview, findings, and verified gate decisions for provenance inspections. Provenance requires this tool, and Verifier can use it. Accountability reports unverified successful runs and ungrounded validation claims in `/view`, `clio-coder usage`, and the observability contract. Historical index rows contribute zero to the new counters when the required fields are absent.
+- Verifier catalog version 2 adds two executable check kinds beside `command`. `numeric-compare` runs the command, parses its stdout as a JSON object of numbers or number arrays, and judges it against a repository-relative reference file under `relative`, `absolute`, or `ulp` tolerances (every named bound must hold; missing keys, shape and length mismatches, `NaN`, and infinity fail), reporting each key's worst deviation and the tolerance it failed. `perf-budget` judges the measured wall time against `budget: {wallTimeMs, tolerance?}` or a baseline that `clio-coder verifiers baseline <id>` records, reporting measured time, effective budget, and ratio. The `verify` tool and dispatch host verification both run the judgement and seal the report (`report` on the host-verification check, under receipt integrity); a failing judgement is a check failure with the report in the detail. Version 1 catalogs still load with every check as `kind: command`. `verifiers add` and `edit` take `--kind`, `--reference`, `--tolerance`, `--budget-ms`, `--budget-relative`, and `--baseline`; `verifiers author` lists an incomplete `numeric-compare` check for every validation-contract artifact that declares `numerical_tolerances`, with the command left for the operator.
+- Operator tasks carry optional acceptance through repeatable `--expect` and `--verify` flags in the CLI and `/tasks add`. Shared dispatch normalizers validate paths and bounded checks, pickup persists required board evidence, and high rigor requires a passing receipt or a limitation naming each acceptance check.
+- An opt-in `--strict` switch for `scripts/smoke-real-home.sh` causes the real-home release smoke to fail when doctor exits 1 on failing rows, while default runs continue to tolerate operator fleet state (#293).
+- A current release-cut checklist in `docs/process/release-cut-checklist.md` and paired blueprint for maintainers to verify and publish releases (#298).
+- ACP registry submission assets including `assets/acp-registry/agent.json` and `assets/acp-registry/icon.svg` with submission documentation in `docs/architecture/acp.md` (#314).
+
+### Changed
+- Every catalog SKILL.md that describes headless `ask_user` now states the same behavior the `clio-coder run` help text does: the tool is not registered, so any call is refused as an unregistered tool rather than answered. Fifteen skills take a patch bump for the correction.
+- Retry admission rebinds a held plan-reservation member under the async state-file lock, so a dispatch attempt waiting on the cross-process capacity lock yields the event loop instead of spinning in `Atomics.wait` (#319). Plan preparation still takes the synchronous lock because the tool registry's `prepareAdmissionArguments` hook cannot yield.
+- Document that headless Antigravity reports permission_mode always-proceed under mode plan and sandbox, and that Clio grades enforcement as approximated (#281).
+- The runs.json ledger carries version 1 on RunEnvelope records, treating legacy unversioned rows as version 1 and skipping records with any other version.
+- Claude CLI workers now accept the built-in recipes. The `claude-code` runtime declares its external agent loop the way Antigravity does, so a recipe budget is admitted as `external-one-shot` with the per-tool count recorded as unobserved instead of refusing the dispatch. Claude Code CLI stays under Subscriptions in `configure --list` and keeps its `claude-cli` auth status; retries and orchestrator eligibility are unchanged (#280).
+- The Claude Code CLI worker now uses the same hardened transport as the Antigravity worker. `claude` receives only the allowlisted environment instead of the whole process environment, so provider keys and Clio gates no longer reach it. The user turn travels on stdin rather than argv; system text remains in `--append-system-prompt`. The admitted `cwd` is honored and refused when it escapes the workspace root, stdout is read through the bounded line reader (1 MiB per line, 8 MiB total) and a violation ends the run as an error, and cancellation terminates the POSIX process group even when the immediate CLI exits before its descendants. Windows retains direct-child cancellation (#279).
+- The dispatch board reads observability's run projection. One fold owns lifecycle events, worker progress, receipt trust, retries, cancellation, fleet positions, and evidence readiness; the board keeps ordering, selection, and rendering. Terminal status and accounting come from the same projection the observability contract publishes.
+
+### Fixed
+- ACP permission cancellation now aborts the active turn before releasing parked tools, preventing an extra provider request while Workbench settles an unanswered approval (#341).
+- The deterministic behavioral machinery suite declares the `default` target used by its dispatch fixture, so all 26 cases produce an artifact that `eval report` and self-comparison can load with strict execution provenance validation (#342).
+- Compete respects a candidate receipt's effective read-only autonomy when finalizing work. Generated `.clio-coder/codewiki.json` and `.clio-coder/state.json` are excluded from writer staging and judge branch diffs even when the caller's `.gitignore` update is uncommitted or the runtime files were already staged. Authored edits, including tracked Clio project configuration, still commit and apply; unrelated staged and unstaged caller changes remain intact (#347).
+- Host verification memoization and batch deduplication now include the check identity, kind, execution timeout, numerical tolerances, performance bounds, and reference or baseline contents. Different judgments cannot inherit an earlier pass, while identical valid checks retain evidence reuse and provenance (#333).
+- Host numerical verification now judges bounded command stdout, matching ordinary verify. JSON diagnostics on stderr cannot supply a missing measurement or invalidate valid stdout; stderr remains available in the command artifact (#334).
+- High-rigor task acceptance now requires validation evidence from the owning workspace. Verifier receipts retain declaration source and execution details, so a passing same-named examples check cannot satisfy a root check. Intended package and catalog checks, exact root package commands, and scoped limitation receipts remain supported (#335).
+- Skills with an allowed-tools list, including coding-standards and the related coding workflows, can record the finish contract's limitation receipt. Explicit tool denials and restrictions on unrelated actions remain enforced (#336).
+- Slash argument completion now reads loaded agent recipes, configured targets and known models, installed skills, and session tasks from the interactive app contracts (#303).
+- Workbench desktop notification mute preference now persists in local storage across page reloads (#322).
+- ACP close and reopen starts a fresh conversation on the same child process, clearing provider history and turn ancestry while switching the task board to the new session. Explicit session loading still restores the saved conversation and tasks (#312).
+- Sessions without interactive ask_user now receive one passive marketplace reminder per matching skill per session, including its installation command, without starting an interview or recording a decline (#317).
+- Setting interface.panes.enabled=embedded refuses with a visible reason instead of silently degrading to guest detection (#294).
+- ACP production stdout now uses the bounded queue through its output guard, waits for drain before sending more frames, and closes with a typed error when stalled output exceeds the existing 1 MiB UTF-8 byte budget, including the first frame that stalls the stream (#309).
+- Dispatch to a subprocess worker no longer fails at prompt compilation when the recipe offers the canonical `context` tool. The Claude CLI declares tool support, so `context` survived tool narrowing while the compiler correctly treated the subprocess surface as unattached, and every built-in recipe that lists `context` (architect, scout, oracle, researcher, and others) was refused with a `hasCanonicalContext` mismatch. The attached-context fact is now derived from the runtime kind, and bound skills are neither promised in the prompt nor stamped on the worker spec for a runtime that never receives Clio's tools.
+- Ollama eviction now releases only models this Clio process successfully pinned on the same server, preserving models loaded by operators or other clients (#313).
+- Deprecation warnings for the legacy lmstudio-native runtime id now route through warnLegacyNaming, reporting the planned v0.7.0 removal and deduping per process.
+- Fleet run preview diagnostics and approval overlays now format cost totals through the shared formatter so amounts at or above one cent render with two decimals instead of four.
+- Default path policy now marks project and user skill roots read-only for workers and the orchestrator, alongside the existing skill-authority guard; operator installs continue through the CLI (#300).
+- Scratch offload sweeps now report non-ENOENT filesystem errors in a skipped count instead of silently swallowing them.
+- Model discovery no longer treats target status with an undefined model source as a live catalog.
+- The upgrade command now gates test seams behind NODE_ENV=test so testing environment variables are ignored in production.
+- Marketplace offer reminders now collapse catalog descriptions to one line, strip square-bracketed directive markers, and cap description text at 200 characters (#316).
+- Damage-control no longer treats command quotations in `dispatch` and `tasks` prose as shell execution. Execute-class calls still use the same blocked command patterns (#286).
+- Doctor state storage inspection now shares the lifecycle presenter byte formatting helper instead of keeping a private copy with differing units, printing consistent byte sizes across doctor, reset, and uninstall.
+- The `coding-standards` skill (0.4.0) declares an `allowed-tools` surface again (`read`, `grep`, `find`, `ls`, `code_nav`, `bash`, `write`, `edit`) instead of no narrowing at all, so a solo run can both read and write code.
+- ACP delegation usage now carries `totalTokens` and `costUsd`, merged with the same rule the ACP server uses: an explicit total or cost from the peer is taken as reported, otherwise the total is the sum of input, output, and cache tokens and the cost stays 0.
+- The dispatch typed-intent reason-code table now documents `legacy_scope_inferred` as the warn that `path-scope.ts` emits when prose inference resolves a leading `../` run against the dispatch root, instead of calling it an unemitted compatibility id.
+- The `muse-glimmer-30b` catalog notes, runtime preference, and guidance now say the reasoning strength dial is driven per request through `chatTemplateKwargs.byLevel` on llama.cpp and reported as undeliverable on LM Studio, instead of claiming no per-request field exists.
+- `clio-coder eval run` spawns a `clio-coder-run` task as an argv instead of a `sh -c` line, so the task deadline reaches the Clio process itself and the exit code the runner reports is Clio's own. Through dash the shell stayed the parent: the deadline's SIGTERM stopped the shell while Clio finished the turn, wrote its report artifact, sealed a succeeded receipt with exit 0, and exited 0, and the item was recorded as `runner_failed` beside an ok receipt with `receipt.outcomeMatchesExit` false. A run the deadline reaches is now canceled, and its receipt records the cancellation with the exit status the runner reports. The SIGKILL grace after that SIGTERM is five seconds, long enough for Clio's coordinated shutdown to seal the interrupted run's receipt. The context-init and context-index eval runners now spawn through the same argv form. (#275)
+
+### Removed
+- Retired slash command hints for former command spellings are removed so unrecognized commands fall through to the standard unknown command error.
+- The unused `--kv-cache-mode` command-line flag and its run override field are removed because no runtime reads them.
+
 ## 0.4.3 - 2026-09-05
 
 This release adds Archify architecture maps and experimental Antigravity research delegation, and tightens thinking controls, session memory, compaction and execution evidence. Usage and cost reports retain explicit coverage limits; full evidence reconciliation is deferred to v0.4.5 or later.

package/CONTRIBUTING.md

@@ -13,41 +13,51 @@ Keep changes small, explicit, and easy to verify from git history.
 Requirements:
 
 - Node.js `>=22.19.0`
-- npm
+- pnpm 10.34.5 (pinned in `packageManager`) and npm for package compatibility checks
 - Linux or macOS for full parity. Windows is best effort until a stable release.
 
+Enable pnpm through Corepack (`corepack enable pnpm`), or install the pinned version locally.
+The root workspace includes both applications. pnpm owns dependency installation;
+Workbench still uses Deno for its host and tests.
+
 Bootstrap:
 
 ```bash
-npm ci
-npm run typecheck
-npm run lint
-npm run test
-npm run build
+pnpm install --frozen-lockfile
+pnpm run typecheck
+pnpm run lint
+pnpm run test
+pnpm run build
 ```
 
 Local and GitHub PR gate (fast, deterministic):
 
 ```bash
-npm run ci
+pnpm run ci
 ```
 
 This runs type checking, lint (including boundaries, documentation drift and
 skill pins), one build, the contract/smoke suite, and the trace-viewer suite.
-Use `npm run skills:check` when checking skill pins on their own; it is already
+Use `pnpm run skills:check` when checking skill pins on their own; it is already
 included in `lint` and `ci`.
 
+The GitHub `ci` job runs the release gate on Ubuntu. The separate
+`windows-subprocess` job uses Node 22 on `windows-latest` and runs typecheck
+plus the Antigravity subprocess, Bash settlement, and Windows process-tree
+contracts. It is a focused Windows lane, not the full suite. Native Windows
+local checks provide local evidence; they do not establish a hosted CI pass.
+
 Release gate (for maintainers before tags or release artifacts):
 
 ```bash
-npm run ci:release
+pnpm run ci:release
 ```
 
 The release gate includes `ci` and adds the package audit. Running `ci` again
 on the same unchanged tree is unnecessary. Run a focused regression while
 developing a repair, then the full gate for the candidate being reviewed.
 
-Live provider validation (manual/opt-in, after `npm run build`):
+Live provider validation (manual/opt-in, after `pnpm run build`):
 
 ```bash
 node dist/cli/index.js run \
@@ -88,7 +98,7 @@ historical record, not a reusable current checklist.
    branch (`v043` for `v0.4.3`) and bumps `version` there. Never push this
    candidate branch to the canonical repository. Before the cut, retitle the
    changelog section `## <version> - YYYY-MM-DD`.
-2. Run `npm run ci:release` on the exact candidate. It runs the full `ci` gate,
+2. Run `pnpm run ci:release` on the exact candidate. It runs the full `ci` gate,
    then `scripts/check-release.mjs`, which verifies the built `dist/` and
    audits the exact npm package contents.
 3. Fetch `origin`, require the fetched `origin/main` to be the candidate's
@@ -103,7 +113,7 @@ historical record, not a reusable current checklist.
    `git push origin refs/tags/v0.4.3`. The tag must match `package.json`; the
    release workflow refuses mismatches.
 6. `.github/workflows/release.yml` verifies the tag against `package.json`,
-   runs `npm run ci:release` on the tagged tree, and creates the GitHub release
+   runs `pnpm run ci:release` on the tagged tree, and creates the GitHub release
    with the tarball attached and the version's `CHANGELOG.md` section as the
    body. It does not publish to npm.
 7. A maintainer publishes from the tagged commit with `npm publish`;
@@ -155,7 +165,7 @@ that needs them runs.
 4. Keep every PR focused. Split unrelated docs, runtime, CLI, and TUI work.
 5. Update `CHANGELOG.md` for user-visible behavior, developer workflow, or
    release status changes.
-6. Run `npm run ci` before requesting review.
+6. Run `pnpm run ci` before requesting review.
 7. Do not commit secrets, local config, generated `dist/`, or scratch plans.
 8. Push release tags as fully qualified `refs/tags/vX.Y.Z`; never push a
    similarly named branch.
@@ -178,7 +188,7 @@ The boundary checker enforces these six rules:
   graph only through declared seams, and those seams may not create an
   undeclared edge back into the closure.
 
-The checker runs as part of `npm run lint` (`scripts/check-hygiene.ts` imports
+The checker runs as part of `pnpm run lint` (`scripts/check-hygiene.ts` imports
 `tests/boundaries/check-boundaries.ts`), so a boundary violation fails the
 same lint every PR runs. The full definitions and exceptions live in
 [Architecture](docs/architecture/architecture.md#boundary-invariants).
@@ -309,6 +319,6 @@ To propose a skill:
    `clio-coder skills list`.
 5. Open a PR. A maintainer reviews against the rubric, sets `audit: pass`,
    approves the catalog version, then regenerates and checks the catalog with
-   `npm run skills:pin` and `npm run skills:check`.
+   `pnpm run skills:pin` and `pnpm run skills:check`.
 
 Full catalog conventions and install options: [skills/README.md](skills/README.md).