@iowarp/clio-coder 0.4.4 → 0.4.6

package/CHANGELOG.md

@@ -2,11 +2,126 @@
 
 All notable changes to Clio Coder are documented in this file. The format follows [Keep a Changelog](https://keepachangelog.com/en/1.1.0/) and versions follow Semantic Versioning; pre-1.0 minor releases may include incompatible changes.
 
+## 0.4.6 - 2026-09-08
+
+This release restores reliable setup with Quick Connect and simplifies the terminal transcript with three consistent output styles. New users can connect a model and start working, while existing users retain their saved settings and can inspect more detail when needed.
+
+### Added
+- Make Quick Connect the first launcher option, with Settings and Diagnostics alongside it. Connect an endpoint, supply a key when needed, filter the live model list, review, and Connect. A single model skips selection; reconnecting preserves existing preferences and fleet assignments. Add `--quick` and `--settings` shortcuts.
+
+### Changed
+- Simplify rendering to Compact, Standard (default), and Detailed output styles. Alt+O cycles the session; Settings saves a default. Accept legacy output preferences and retire `/output` with migration guidance.
+- Bound reasoning, shell output, diffs, and worker previews after terminal wrapping. Inspect full available content through `/view transcript`; keep failures and validation outcomes visible in every style.
+- Give the footer sole ownership of live activity, with accurate concurrent-tool state and background worker counts. Remove separate reasoning, tool expansion, and live-output toggles.
+- Simplify the README around installation, the first session, scientific software, and HPC. Keep advanced configuration and multi-agent workflows in collapsible sections, and expand dependency and integration acknowledgements.
+- Use one worker, no prompt prewarm, and automatic TTY streaming as shipped defaults. Preserve explicitly saved values and document the full recommended default policy.
+- Check the ACP registry version against package metadata during release audits, and make version alignment and issue reconciliation explicit release-cut steps.
+
+### Fixed
+- Preserve every own JSON measurement field in numerical verification, including names inherited by ordinary JavaScript objects. Mismatched measurements can no longer disappear during parsing and produce a false pass in ordinary or host verification (#332).
+- Fix `configure` exiting successfully at the first question after an arrow-key menu. Scope readline to active questions, use arrow selectors and editable text fields for settings, and preserve menu position on Back.
+- Use the canonical autonomy levels in the configuration menu, so saved choices match the settings schema and existing `full-auto` configurations open on the correct selection.
+- Share the target wizard across first setup, Add, and Edit, with a review and explicit Save. Preserve existing role defaults, credential references, and capability overrides; reject duplicate target ids and allow clearing model overrides. Save pasted keys per target and review optional delegation peers after the primary setup is saved.
+- Authenticate generic OpenAI- and Anthropic-compatible discovery probes with the resolved target credential, including a pasted key before the target is saved.
+- Add `configure --edit` and All Settings for validated editing of the complete user settings schema, including repair of malformed YAML, a previous-file backup, and protection against overwriting concurrent changes.
+- Keep configuration inspection and upgrade dry runs from initializing user state. Give reset explicit setup/reconnection guidance and simplify the source installer's next step to `clio-coder configure`.
+
+## 0.4.5 - 2026-09-07
+
+### Added
+- Add operator-reviewed, per-workspace consent for project safety, hooks, and settings. `config trust safety|hooks|settings` previews exact source bytes and a full SHA-256 digest; `--hash` approves that reviewed version and `--revoke` withdraws consent. Canonical workspace identity and separate surface records prevent approval from silently extending to another repository or configuration kind (S3-01).
+- Add private provider request-body and terminal-response diagnostics through `CLIO_CODER_PROVIDER_DUMP_PATH`. The opt-in sink requires an absolute, operator-owned mode-0600 regular file, preserves the actual request and event stream, and redacts known credentials from diagnostic copies (S9-04).
+- Add known-good and failing reference fixtures for every task in the main behavioral model suite, a tool-keyed argument-schema corpus, and a 20-question bundled-document recall corpus. The schema and retrieval contracts run without a model; they do not claim to measure a model's sensitivity to tool descriptions (S8-05, S8-06, S8-07).
+- Add a runnable model-required tool-surface suite for file-tail reads, fresh shell cwd and expected URL rejection, with per-tool success, failure and block counts. Controlled passing and broken trials exercise the full suite/runner/grader path; live provider trials remain unrun (S8-06).
+- Workbench run-window search and filters, an optional running-only worker strip, searchable application help and keyboard shortcuts, and an About record showing GUI and connected Clio versions and capabilities.
+
+### Changed
+- Document npm, pnpm, Bun, Yarn, cached runners, release tarballs, and the pinned pnpm source workflow. Expose `upgrade --post-install` for local migration checks after updates by another package manager, without a registry lookup or reinstall. Source upgrade and recovery guidance now names pnpm, and the source installer requires package managers only for dependency/build work.
+- Clarify that committed verifier catalogs define checks but do not approve repository script execution. The reported automatic-execution defect was refuted by the existing confirmation and approved-safety policy, with the exact Node verifier case pinned by a regression contract (DOG-010).
+- Document shell tool state, cwd, timeout and actual host networking; distinguish `CLIO_CODER_DISABLE_RETRIEVE_TOOLS` from an OS network sandbox while retaining `CLIO_CODER_NO_NETWORK_TOOLS` as a compatibility alias. Tool-data trust guidance and image capability descriptions deliberately update stable prompt bytes without reordering prompt sections (S2-04, S4-02, S4-05, S7-02).
+- Allow an operator process to choose native Anthropic cache retention with `CLIO_CODER_ANTHROPIC_CACHE_RETENTION=none|short|long` across both central streaming paths. Explicit call options take precedence, unsupported long retention remains governed by provider compatibility, and unset preserves SDK behavior (S9-02).
+- Give working-set eviction markers durable short `rN` recall aliases, retain historical references, and avoid alias reuse across session branches. The audit's UUID-only parser claim was stale: `src/domains/context/working-set/fold.ts:21` already accepted arbitrary non-whitespace tokens; the missing feature was stable short aliases (S4-04).
+- Correct audit assumptions verified against the moved tree: hook declaration hashes were normalized and truncated at `src/domains/middleware/hooks.ts:143-144`, not full file hashes; ordinary result annotations appended at the original `src/tools/registry.ts:1259-1282`; v4 eval artifacts use `result.artifacts.sessionLedgers` rather than a nonexistent `result.paths` (`src/domains/eval/schema/artifact.ts:53`). Regression coverage follows the actual production contracts (S3-01, S4-03, S8-02).
+- Pin the existing nonretryable behavior for unsupported-thinking HTTP 400 responses. `src/domains/session/retry.ts:90` delegates to the SDK classifier and `src/interactive/turn-recovery.ts:230` checks it before retrying; a real SDK contract confirms one request. The audit's repeated-400 claim is refuted, and no unsupported adaptive-thinking fallback is invented (S9-03).
+- Report docs recall at the shipped k=5 rather than requiring an arbitrary ranking-weight change to fail: equivalent or better rankings remain valid. The 20-question corpus retrieves all 20 target sections, with an unrelated-query negative control; the ranker's sorting and top-k selection remain unchanged (`src/tools/context/docs-engine.ts:625`, `:633`; S8-07).
+- Pin the Pi provider, agent, and terminal SDKs to 0.85.1; preserve historical Anthropic thinking effort across session persistence and adapt overlay bounds and scrollbar styling to the public terminal APIs.
+- Use pinned pnpm for repository dependencies, application workspaces, contributor scripts, and CI. Keep npm registry packaging and npm consumer installation compatibility checks.
+
+### Fixed
+- Keep grep, find, and ls bound to the active compiled safety policy after project policy edits or trust revocation, so search output and offloaded results retain the same zero-access protections as direct reads until restart.
+- Keep `clio-coder doctor` diagnosis from creating a credentials file when none exists; explicit `doctor --fix` still creates or repairs it (DOG-001).
+- Give read-only execution denials guidance for independent native inspection and operator-controlled autonomy changes, while preserving execution, write, and protected-read restrictions (DOG-002).
+- Link workers dispatched by headless runs to their parent run, preserving distinct assignment identities across retries, monitoring, and recorded route outcomes (DOG-004).
+- Preserve partial text and thinking once when a turn is cancelled, including persisted history, resume, and export; keep deliberate cancellation separate from LiteLLM route-failure advice (DOG-003, DOG-005).
+- Retain the policy rule and cause in terminal headless denials, carry policy provenance into tool-end events, and count blocked calls separately from execution errors in run receipts (DOG-006).
+- Let headless runs exit normally after using FIFO steering, including when the writer remains connected or never connects, while preserving read-only pipe access (DOG-011).
+- Keep operator credentials, settings, skill authority and workspace trust records protected when an approved project safety policy disables project defaults. Existing independent skill-authority checks already prevented skill writes in this case, refuting that portion of the audit; the credential-default bypass was real (S1-01, S1-04; `src/domains/safety/skill-authority.ts:39-43`).
+- Require confirmation for shell variables and interpreter inline programs, and for undeclared repository test/build scripts. Approved safety declarations can admit scripts; approval of hooks or settings grants no such authority. npm confirmation includes script and lifecycle bodies (S1-02, S1-03).
+- Show compiled safety provenance, effective defaults and workspace trust in text and JSON `config inspect`; aggregate permission outcomes and the granted/requested event-window rate in usage reports, leaving an empty denominator unavailable (S1-05, S1-06).
+- Withhold unapproved or changed project configuration, explain skipped files and review commands at startup, and parse the exact bytes that were admitted. Adding a local override or relocating a safety policy invalidates approval; relative safety paths retain their admitted source location. Malformed unapproved policy cannot block default execution. Published project hooks recheck consent and content before execution, so edits and revocation stop them without waiting for reload and reach the interactive transcript (S3-01).
+- Filter command-hook and ACP child environments through the shared safe environment builder while preserving explicit ACP credentials and Git-attribution opt-out. Pin built-in ACP adapter recipes to `@zed-industries/claude-code-acp@0.16.2` and `@agentclientprotocol/codex-acp@1.10.0` (S3-02, S3-03).
+- Classify non-GET/HEAD web requests and any request body as outward writes. Validate every web-fetch destination and redirect, reject private/reserved DNS answers by default, pin the checked address for the socket connection, and remove caller headers across origins. An explicit operator environment opt-in enables private-network retrieval (S2-01, S2-02).
+- Strip secret-shaped variables and shell startup injection from both inherited and login-shell environments. A failed environment capture no longer falls back to a login shell that could reintroduce credentials (S2-03).
+- Filter zero-access paths and content in search and directory producers before rendering or writing overflow artifacts, including fallback grep modes; report withheld counts without revealing protected names (S4-01).
+- Mark retrieved content as untrusted data and flag instruction-shaped external tool text through builtin middleware. Preserve the advisory warning under tail, bounded, and metadata-only result shaping without discarding the source or exceeding result budgets (S4-02, S4-03).
+- Refuse overlapping or undeclared parallel checkout writers before dispatch admission, preserving canonical disjoint scopes, isolated worktrees, explicit writer serialization, and read-only peers. Use native path separators when comparing scopes (S5-01).
+- Preserve immutable Git recovery refs for every fleet review-loop check and compete candidate cleanup, including uncommitted losing work and restart recovery. Capture uses an isolated index with hooks, filesystem monitors and configured clean/process filters disabled, leaving the operator's HEAD and index unchanged. Winner results disclose how to find the retained refs; ignored files and external filesystem state remain outside these checkpoints (S5-02).
+- State in the fork picker and after a successful fork that workspace files are not rewound and existing edits remain; failed forks never emit a success notice (S6-01).
+- Carry bounded image blocks alongside tool text through registry admission, middleware, observation budgets, and main/worker adapters. Vision-capable routes can read PNG, JPEG, GIF and WebP content and inspect retained frontend screenshots; unsupported routes receive an explicit image limitation. Screenshot scratch files are cleaned after capture (S7-01, S7-02).
+- Measure temporary eval workspaces against a harness-owned file-hash baseline, counting modifications, additions, deletions and symlink changes; omit unavailable patch metrics instead of reporting fabricated zeros (S8-01).
+- Retain complete discovered eval session ledgers before trial cleanup, including failed trials and multiple sessions, in private transcript artifacts. Reject symlinked sources and artifact destinations, retain available interrupted ledgers with an incomplete-evidence diagnostic, and preserve the primary trial failure plus available stdout when evidence capture fails. External runners that produce no ledger remain explicitly without a full transcript (S8-02).
+- Expose an empirical noise band in behavioral comparisons while keeping safety-family regressions at zero tolerance. A change inside the band remains unresolved rather than proving equivalence (S8-03).
+- Check declared grader code and dependencies for content or symlink changes before grading and after verifier execution. Already changed graders do not execute, and tampering detected after execution cannot produce a successful trial; both fail as grader-integrity infrastructure failures (S8-04).
+- Preserve the full Anthropic tool array during a required-tool round while retaining the named tool choice and request-local removal of incompatible thinking fields; local-server tool narrowing is unchanged (S9-01).
+- Validate required history-summary sections, ordering and progress subsections outside Markdown fences before publishing a compaction checkpoint. Keep split-turn summaries separate, retain the prior context when validation fails, and exercise actual publication failures plus recorded checkpoint replay and explicitly synthetic fact-preservation fixtures. Existing output-limit and cancellation rejection already handled truncated streams at original `src/domains/session/compaction/compact.ts:647`; that portion of the audit was stale (S10-01).
+- Refuse interactive slash commands in headless `run` before session startup instead of sending their text to the model; preserve named skill invocations, prompt templates, and ordinary task text.
+- Declare the internal bootstrap researcher's repository scope so JSON-escaped handbook text cannot trigger a malformed-path refusal before generation, including the structured-output fallback path.
+- Keep parallel tool declarations and the latest operator request intact across compaction; reject truncated or canceled checkpoints, wire TUI and ACP cancellation through production summaries, and stop canceled pre-submit requests before chat admission.
+- Parse authored handbooks with fenced code blocks and HTML comments correctly: a `# comment` inside a fenced example no longer rejects `CLIO-CODER.md` or drops its conventions and invariants from `--apply` and `--adopt`, and fenced `##` lines are no longer split into sections or rewritten on serialization.
+- Keep whole-index work off the prompt and tool hot paths: the codewiki worker receives a reference to the committed artifact instead of a structured clone of the parsed index, an unchanged `code_nav` reconciliation returns only the fingerprint, and the compiled prompt's project-type and codewiki markers read recorded state and artifact presence instead of parsing the artifact and re-walking the tree.
+- Keep OpenRouter model transport, endpoint, and compatibility metadata coherent when Pi's catalog selects Anthropic Messages; preserve configured OpenAI-compatible endpoints and unknown-model fallback.
+- Declare writable staging subtrees for internal wiki dispatch, report pending pages explicitly in CLI outcomes, and retain the Git baseline needed to reuse completed first-publication checkpoints.
+- Compare summary compaction with full-context estimates on both sides and describe unchanged or increased context without claiming reclamation.
+- Preserve ordinary authored handbooks and bounded exact prefixes in session and opted-in worker context; disclose omitted sources and invalidate captured prompts after explicit context changes.
+- Keep generated handbook proposals separate from publication, preserve authored content during refresh, and retain publication provenance for the handbook actually in use.
+- Project the working set before summary compaction and support discovery and exact recall of persisted tool results hidden behind a summary.
+- Use source-content evidence for codewiki and wiki freshness, reconcile Python imports, and retain truthful wiki page outcomes, retry checkpoints, revised plans, and interrupted-publication recovery.
+- Drain active operator shell commands during shutdown and preserve bounded process-group escalation after the immediate child exits.
+- Keep multiline Workbench session titles readable and show canonical validation quality and interruption evidence in worker displays (#356, #357).
+- Keep `targets use` role flags scoped to the named roles, validate exact listed model IDs, and report only settings that changed.
+- Admit a pipeline member within its own reservation wave without charging its future waves against that member; retain other owners' reservations and active leases.
+- Add focused Windows subprocess CI coverage; cancel external Windows descendant trees with taskkill and forced escalation, retaining direct-child fallback and POSIX process groups (#282, #283).
+- Add caller-explicit Antigravity resume with bounded conversation IDs and first-init identity verification; automatic retry remains disabled (#284).
+- Clarify bounded inline explanations and precise limitations for Documenter and explicitly selected Coder recipes, strengthen Scout citation guidance, and halt pipeline dependents after failed quality (#349, #350, #361).
+- Instruct agents to verify implementation semantics against active decisions before commit and keep attribution distinct from adherence (#351).
+- Clarify source-grounded convention promotion, separate operator approval and fresh-session delivery, and preserve explicit no-edit scope during retention (#352, #364).
+- Make operator-task pickup and durable linkage explicit, distinguish acceptance requirements from results, and complete inbox commands with eligible operator IDs (#354, #366, #370).
+- Preserve proposal-only scope in task-board and continuation guidance independently of skill-install choices (#365).
+- Prefer authored skill triggers over incidental description overlap in marketplace offers and passive headless reminders (#360).
+- Expose compete on a single fleet route while preserving separate candidate and judge evidence; retain terminal summaries when canceled or timed out without reporting a winner (#348, #355).
+- Keep behavioral eval comparisons aligned across declared route variations, preserve compact mismatch identities, and print usable report commands for custom artifacts (#358, #359, #363).
+- Preserve watch-pane host failure details and distinguish local geometry refusals; retain observed worker termination signals beside missing-result failures (#362, #367).
+- Avoid blocking the event loop during retry reservation waits and use fresh capacity and budget observations (#368).
+- Preserve ACP peer token totals, explicit zero usage, and supported cost provenance without double-counting event metering (#369).
+- Validate documented settings paths against the typed settings shape, including optional fields and array/map members (#371).
+- Distinguish Workbench child-restart coverage from direct ACP same-child isolation, with child identities and history, ancestry, and task reset checks (#374).
+- Correct command documentation to describe generic unknown-command errors for retired spellings (#372).
+- The dispatch board retains active work alongside 50 settled runs, keeps newly settled runs visible, and bounds completed retry parents without reviving them when a child attempt starts (#339).
+- Condensed dispatch summaries, worker transcript rows, compact fleet rows, and monitor status show canonical deliverable validation quality separately from execution success. Failed, ungrounded, and unknown quality stay distinct, including in narrow worker displays (#345).
+- Decision revisions preserve their original ledger origin and record whether the agent or operator made the revision. Evidence no longer labels agent revisions as operator corrections; historical revisions with no recorded author remain unknown (#337).
+- Operator `/run` and approved fleet executions snapshot active decision references before admission and retain them in requests, envelopes, and sealed receipts (#340).
+- Simulated terminal-selection tests own and restore their `TERM` environment, so they pass in headless runners while retaining the production dumb-terminal refusal check (#353).
+- Relative numerical comparisons avoid intermediate subtraction overflow for finite extreme values, while retaining precision for nearby values and independent absolute and ULP checks (#338).
+- Support deterministic architecture seed generation with `clio-coder context map`, retry pending wiki pages with `clio-coder context wiki --retry-pending`, and resolve `--target` from layered project settings.
+- Support configurable inline summary allowances for `mutation-report` contracts up to 32,768 bytes via recipe `maxSummaryBytes` and dispatch `result_summary_max_bytes`, while bounding commit and architect-plan messages to 1,000 bytes.
+- Document the Archify architecture mapping pipeline across seed generation, model refinement, deliverable validation, source review, and visual review.
+
 ## 0.4.4 - 2026-09-05
 
 Trust spine: typed claims, executable validation, and decision provenance. Answers the NSF "Beyond Code" findings where the harness still trusted prose or sniffed files.
 
 ### Added
+- The trace viewer shows each run's `source` (`dispatch` or `session`) as a small badge beside the run id on the run list and beside the status on the run page, matching the SOURCE column `clio-coder trace runs` already prints. The list filter matches the badge text, so typing `session` narrows the list to interactive turns. A mirror whose rows carry no `source` field renders no badge. Contract: `apps/trace-viewer/tests/client-smoke.test.mjs`. (#289)
 - A Deno test validates that class tokens used across Workbench components exist in the stylesheet (#311).
 - Lint holds `docs/guide/configuration-reference.md` against `DEFAULT_SETTINGS`: the new `configuration-reference` hygiene check fails when a settings key has no row in the settings-key table or a row names a key path the defaults no longer carry.
 - The `limitation` tool records what a turn could not verify and why. The finish contract settles on a successful `limitation` receipt inside the same window as the mutation scan; the seven prose patterns that used to satisfy it are gone, so wording alone can no longer pass the gate. The tool is on the six mutating recipes, and the operating contract tells the model to call it.
@@ -21,6 +136,7 @@ Trust spine: typed claims, executable validation, and decision provenance. Answe
 - ACP registry submission assets including `assets/acp-registry/agent.json` and `assets/acp-registry/icon.svg` with submission documentation in `docs/architecture/acp.md` (#314).
 
 ### Changed
+- Every catalog SKILL.md that describes headless `ask_user` now states the same behavior the `clio-coder run` help text does: the tool is not registered, so any call is refused as an unregistered tool rather than answered. Fifteen skills take a patch bump for the correction.
 - Retry admission rebinds a held plan-reservation member under the async state-file lock, so a dispatch attempt waiting on the cross-process capacity lock yields the event loop instead of spinning in `Atomics.wait` (#319). Plan preparation still takes the synchronous lock because the tool registry's `prepareAdmissionArguments` hook cannot yield.
 - Document that headless Antigravity reports permission_mode always-proceed under mode plan and sandbox, and that Clio grades enforcement as approximated (#281).
 - The runs.json ledger carries version 1 on RunEnvelope records, treating legacy unversioned rows as version 1 and skipping records with any other version.
@@ -74,7 +190,6 @@ This release adds Archify architecture maps and experimental Antigravity researc
 - `.clio-coder/artifacts/maps/` is a placement class (human transient) in `docs/architecture/artifact-placement.md`; `docs/guide/skills-marketplace.md` documents remote entries and overlays with archify as the worked example, and `docs/architecture/context-engine.md` documents the seed's guarantees.
 - A distinct, permanently read-only `world-knowledge` shadow agent handles current open-world discovery, ecosystem comparisons, broad external context, and advisory second opinions. Its compact result contract separates supported facts and source identifiers from synthesis, uncertainties, and follow-up verification, and it reports honestly when native discovery/search is unavailable instead of treating URL retrieval as search or fabricating citations.
 - Reusable `branch-closeout` Git skill (`skills/git/branch-closeout/`) for proving merged work on canonical remotes, inspecting dirty or ignored worktree state, safely removing registered worktrees through Git, deleting local branches, optionally removing contributor fork branches, and auditing surviving repository references.
-- The trace viewer shows each run's `source` (`dispatch` or `session`) as a small badge beside the run id on the run list and beside the status on the run page, matching the SOURCE column `clio-coder trace runs` already prints. The list filter matches the badge text, so typing `session` narrows the list to interactive turns. A mirror whose rows carry no `source` field renders no badge. Contract: `apps/trace-viewer/tests/client-smoke.test.mjs`. (#289)
 
 ### Changed
 - The local and hosted CI gate checks skill pins once through lint, removing the duplicate explicit pass. The full contract/smoke, trace-viewer and release-package checks remain in place; contributor guidance distinguishes focused checks from the complete release gate.
@@ -83,7 +198,6 @@ This release adds Archify architecture maps and experimental Antigravity researc
 - First-run onboarding can offer **Antigravity CLI — experimental local delegation** only after a valid primary target exists. The optional step never changes chat/background pointers or enables dangerous full access; it can create a `world-knowledge-external` fleet profile and bind `world-knowledge`. Noninteractive `configure` gains `--bind-agent <agentId>` alongside `--agent-profile`, and model/target listings preserve live labels and source/freshness.
 - Hardened the entire Git skill suite under `skills/git/` (`file-ticket`, `fix-issue`, `ship`, `worktree-create`, `worktree-merge`, `resolve-merge-conflicts`). Added formal argument contracts with structural parsing; made workflow bodies project-agnostic without hardcoding repos, remotes, or branch names while preserving the canonical-main-only policy in `CONTRIBUTING.md`; required confirmation before every outward ticket action including duplicate issue comments; decoupled unsupported RCA automation claims from `fix-issue`; separated `ship` into explicit `commit`, `pr`, maintainer-local, and `closeout` modes; corrected rebase ours/theirs reversal semantics and added conflict matrices covering binary, rename, modify/delete, and lockfile conflicts; supported configurable roots, safe path derivation, and strategy controls in worktree operations; and expanded evals across all skills.
 - Branch and worktree closeout is now an explicit final development step: prove the merged result, inspect local state, remove registered worktrees through Git, delete local scaffolding, and report every surviving branch, stash, local-only tag, and canonical remote head. The canonical repository keeps only `main`: maintainer topic and compact release-candidate branches such as `v043` stay local, contributors submit branches from their forks, and dotted names such as `v0.4.3` are reserved for immutable release tags.
-- Every catalog SKILL.md that describes headless `ask_user` now states the same behavior the `clio-coder run` help text does: the tool is not registered, so any call is refused as an unregistered tool rather than answered. Fifteen skills take a patch bump for the correction.
 
 ### Fixed
 - Dedicated memory, compaction and native worker admission now discover cold LiteLLM target metadata before resolving thinking controls; sharing a gateway URL with chat no longer hides a missing target probe. Memory keeps discovery within its existing cancellation/deadline boundary, rechecks known endpoint capacity at actual launch, and does not turn cancelled metadata into endpoint failure. Compaction now sends its intended thinking-off request through the simple stream API. Workers keep their approved route and reservation while discovery runs within the invocation's cancellation and admission deadline; late cancelled metadata cannot launch a worker. Unknown runtime declarations remain unguessed.

package/CONTRIBUTING.md

@@ -13,41 +13,51 @@ Keep changes small, explicit, and easy to verify from git history.
 Requirements:
 
 - Node.js `>=22.19.0`
-- npm
+- pnpm 10.34.5 (pinned in `packageManager`) and npm for package compatibility checks
 - Linux or macOS for full parity. Windows is best effort until a stable release.
 
+Enable pnpm through Corepack (`corepack enable pnpm`), or install the pinned version locally.
+The root workspace includes both applications. pnpm owns dependency installation;
+Workbench still uses Deno for its host and tests.
+
 Bootstrap:
 
 ```bash
-npm ci
-npm run typecheck
-npm run lint
-npm run test
-npm run build
+pnpm install --frozen-lockfile
+pnpm run typecheck
+pnpm run lint
+pnpm run test
+pnpm run build
 ```
 
 Local and GitHub PR gate (fast, deterministic):
 
 ```bash
-npm run ci
+pnpm run ci
 ```
 
 This runs type checking, lint (including boundaries, documentation drift and
 skill pins), one build, the contract/smoke suite, and the trace-viewer suite.
-Use `npm run skills:check` when checking skill pins on their own; it is already
+Use `pnpm run skills:check` when checking skill pins on their own; it is already
 included in `lint` and `ci`.
 
+The GitHub `ci` job runs the release gate on Ubuntu. The separate
+`windows-subprocess` job uses Node 22 on `windows-latest` and runs typecheck
+plus the Antigravity subprocess, Bash settlement, and Windows process-tree
+contracts. It is a focused Windows lane, not the full suite. Native Windows
+local checks provide local evidence; they do not establish a hosted CI pass.
+
 Release gate (for maintainers before tags or release artifacts):
 
 ```bash
-npm run ci:release
+pnpm run ci:release
 ```
 
 The release gate includes `ci` and adds the package audit. Running `ci` again
 on the same unchanged tree is unnecessary. Run a focused regression while
 developing a repair, then the full gate for the candidate being reviewed.
 
-Live provider validation (manual/opt-in, after `npm run build`):
+Live provider validation (manual/opt-in, after `pnpm run build`):
 
 ```bash
 node dist/cli/index.js run \
@@ -85,30 +95,35 @@ historical record, not a reusable current checklist.
 
 1. During development, keep the top changelog section at `## Unreleased`. A
    maintainer collects release work on a **local-only** compact candidate
-   branch (`v043` for `v0.4.3`) and bumps `version` there. Never push this
+   branch (`v046` for `v0.4.6`) and bumps `version` there. Never push this
    candidate branch to the canonical repository. Before the cut, retitle the
-   changelog section `## <version> - YYYY-MM-DD`.
-2. Run `npm run ci:release` on the exact candidate. It runs the full `ci` gate,
+   changelog section `## <version> - YYYY-MM-DD`, align the ACP registry manifest
+   version, and update the README's install tag and release notices.
+2. Run `pnpm run ci:release` on the exact candidate. It runs the full `ci` gate,
    then `scripts/check-release.mjs`, which verifies the built `dist/` and
    audits the exact npm package contents.
 3. Fetch `origin`, require the fetched `origin/main` to be the candidate's
-   ancestor, then fast-forward local `main` with `git merge --ff-only v043`.
+   ancestor, then fast-forward local `main` with `git merge --ff-only v046`.
    Re-run the release gate if the candidate changed and verify local `main`
    equals the reviewed candidate SHA.
 4. Fetch once more and stop on unexpected movement. With explicit maintainer
    authorization, push only `refs/heads/main:refs/heads/main`; no topic or
    release-candidate branch is pushed to canonical `origin`.
 5. Require CI for that exact `main` SHA to pass. Create the annotated tag on
-   that commit and push only it: `git tag -a v0.4.3` followed by
-   `git push origin refs/tags/v0.4.3`. The tag must match `package.json`; the
+   that commit and push only it: `git tag -a v0.4.6` followed by
+   `git push origin refs/tags/v0.4.6`. The tag must match `package.json`; the
    release workflow refuses mismatches.
 6. `.github/workflows/release.yml` verifies the tag against `package.json`,
-   runs `npm run ci:release` on the tagged tree, and creates the GitHub release
+   runs `pnpm run ci:release` on the tagged tree, and creates the GitHub release
    with the tarball attached and the version's `CHANGELOG.md` section as the
    body. It does not publish to npm.
 7. A maintainer publishes from the tagged commit with `npm publish`;
    `prepublishOnly` runs the same `ci:release` gate in release mode first.
-8. Verify the release and tag, then delete the local compact candidate branch.
+8. Verify the release and tag. Reconcile milestone tickets against tagged
+   implementation and acceptance evidence; plain issue references and release
+   tags do not close tickets. Verify automatic closures, explicitly close
+   completed tickets that remain open, and carry incomplete work forward before
+   closing the milestone. Then delete the local compact candidate branch.
    The canonical remote returns to its steady state: `main` plus immutable
    release tags and GitHub releases, with no release branch.
 
@@ -155,7 +170,7 @@ that needs them runs.
 4. Keep every PR focused. Split unrelated docs, runtime, CLI, and TUI work.
 5. Update `CHANGELOG.md` for user-visible behavior, developer workflow, or
    release status changes.
-6. Run `npm run ci` before requesting review.
+6. Run `pnpm run ci` before requesting review.
 7. Do not commit secrets, local config, generated `dist/`, or scratch plans.
 8. Push release tags as fully qualified `refs/tags/vX.Y.Z`; never push a
    similarly named branch.
@@ -178,7 +193,7 @@ The boundary checker enforces these six rules:
   graph only through declared seams, and those seams may not create an
   undeclared edge back into the closure.
 
-The checker runs as part of `npm run lint` (`scripts/check-hygiene.ts` imports
+The checker runs as part of `pnpm run lint` (`scripts/check-hygiene.ts` imports
 `tests/boundaries/check-boundaries.ts`), so a boundary violation fails the
 same lint every PR runs. The full definitions and exceptions live in
 [Architecture](docs/architecture/architecture.md#boundary-invariants).
@@ -200,8 +215,8 @@ Examples:
 - `docs/github-governance`
 
 Maintainer branches are local-only. A temporary release candidate uses the
-compact version spelling with no dots: `v043` for release tag `v0.4.3`. Never
-create or push a branch named `v0.4.3`; dotted `vX.Y.Z` names belong exclusively
+compact version spelling with no dots: `v046` for release tag `v0.4.6`. Never
+create or push a branch named `v0.4.6`; dotted `vX.Y.Z` names belong exclusively
 to immutable release tags. The compact branch is local scaffolding and is
 deleted after its reviewed commit reaches `main` and the release succeeds.
 
@@ -234,7 +249,7 @@ verification and teardown safely. After a PR is merged or a release is tagged:
    `refs/heads/main`; every additional head is a cleanup failure.
 
 For a release, first verify `refs/tags/vX.Y.Z^{commit}` equals the reviewed
-commit on `main`, then close the compact candidate branch such as `v043`.
+commit on `main`, then close the compact candidate branch such as `v046`.
 Published tags are never deleted, moved, or recreated during cleanup.
 
 ## Commits
@@ -309,6 +324,6 @@ To propose a skill:
    `clio-coder skills list`.
 5. Open a PR. A maintainer reviews against the rubric, sets `audit: pass`,
    approves the catalog version, then regenerates and checks the catalog with
-   `npm run skills:pin` and `npm run skills:check`.
+   `pnpm run skills:pin` and `pnpm run skills:check`.
 
 Full catalog conventions and install options: [skills/README.md](skills/README.md).

package/NOTICE

@@ -8,6 +8,22 @@ Illinois Institute of Technology.
 Licensed under the Apache License, Version 2.0. See the LICENSE file
 distributed with this work for the full license text.
 
+--------------------------------------------------------------------
+Technology acknowledgements
+
+Clio Coder builds on Earendil Works' Pi framework and, for optional Claude
+workers, Anthropic's Claude Agent SDK. Its runtime and development tools
+include Node.js, TypeScript, node-pty, Tree-sitter, Ollama's JavaScript
+client, esbuild, tsup, and Biome. The source GUI uses React, Deno, Vite,
+and community libraries for Markdown, diagrams, syntax highlighting,
+sanitization, images, and fonts.
+
+We thank these projects and their maintainers. Exact dependencies and
+versions are recorded in the package manifests and pnpm-lock.yaml;
+third-party components retain their upstream copyrights and licenses.
+README.md also acknowledges the optional inference and tool integrations
+that operators can connect to Clio.
+
 --------------------------------------------------------------------
 Pinned external tools