amicus 0.6.0__tar.gz → 0.7.0__tar.gz

{amicus-0.6.0 → amicus-0.7.0}/.claude-plugin/marketplace.json

@@ -10,8 +10,8 @@
       "source": {
         "source": "url",
         "url": "https://github.com/briandconnelly/amicus.git",
-        "ref": "v0.5.0",
-        "sha": "a54b802993141a6352a0d919ee5a49c68c3f6395"
+        "ref": "v0.6.0",
+        "sha": "539b414b1a597a644e94f0707506137db91069b7"
       },
       "description": "One MCP server for every second-opinion model: consult, review, and delegate with the backend as a parameter."
     }

{amicus-0.6.0 → amicus-0.7.0}/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "amicus",
-  "version": "0.6.0",
+  "version": "0.7.0",
   "description": "One MCP server for every second-opinion model: consult, review, and delegate with the backend as a parameter.",
   "author": { "name": "Brian Connelly", "url": "https://github.com/briandconnelly" },
   "homepage": "https://github.com/briandconnelly/amicus",

{amicus-0.6.0 → amicus-0.7.0}/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "amicus",
-  "version": "0.6.0",
+  "version": "0.7.0",
   "description": "One MCP server for every second-opinion model: consult, review, and delegate with the backend as a parameter.",
   "author": { "name": "Brian Connelly", "url": "https://github.com/briandconnelly" },
   "homepage": "https://github.com/briandconnelly/amicus",

{amicus-0.6.0 → amicus-0.7.0}/.mcp.json

@@ -4,7 +4,7 @@
       "command": "uvx",
       "args": [
         "--from",
-        "git+https://github.com/briandconnelly/amicus.git@v0.6.0",
+        "git+https://github.com/briandconnelly/amicus.git@v0.7.0",
         "amicus-mcp"
       ],
       "env_vars": [

{amicus-0.6.0 → amicus-0.7.0}/CHANGELOG.md

@@ -20,6 +20,119 @@ per-change, as its own lead says.
 
 ## [Unreleased]
 
+## [0.7.0] - 2026-09-26
+
+Across this release the discovery surface moves `amicus/0.1/schema-43`, what 0.6.0 shipped, to
+`amicus/0.1/schema-50`, and `RESULT_FORMAT` stays 9, so a job result 0.6.0 stored can still be
+delivered. Two entries are labelled **Breaking**: a sync paid call past its deadline returns a
+`timeout` that is never temporary and whose repair names the verb's `_async` twin when
+`AMICUS_JOB_MAX_SECONDS` exceeds the deadline that passed (#245); and a backend a verb never
+accepts fails at the boundary as `invalid_arguments` rather than `feature_unsupported` (#246). A
+new paid call can now be refused with the new code `job_cap_reached` rather than evicting a
+result nobody has fetched, though a result 0.6.0 stored is still evictable (#244), and a stale
+client root is `invalid_workspace_root` rather than `git_unavailable` (#248).
+`docs/MIGRATION.md` ("Upgrading from 0.6.0") says what to do for each. It was checked against
+codex-cli 0.157.0, Kimi Code 2.1.1 and Claude Code 2.1.283.
+
+### Added
+
+- **Surface.** `amicus_job_list` pages (#249, ADR 0042). A page that omits matching jobs
+  carries `has_more: true` and `next_cursor`; pass it as `cursor` with the same filters for
+  the jobs after it, and a cursor whose job has since been consumed still resolves, because
+  it names the anchor's start time and id rather than a position. `truncated` and
+  `truncation_hint` report what they did in 0.6.0, now documented as an alias of `has_more`
+  on this tool. A cursor not in the form the tool returns is `invalid_arguments`. Omitting
+  `limit` still returns every retained match; the description now names the per-workspace
+  cap `AMICUS_JOB_MAX_COUNT`, which server processes sharing a state root can each exceed by
+  one start.
+
+### Changed
+
+- codex-cli 0.157 is a supported version, so `amicus_backends` no longer warns on it. It was
+  checked against 0.156.1 at zero spend: top-level `--help`, `exec --help`, `exec review --help`
+  and `login --help` are identical apart from trailing whitespace. The unknown-feature error, the
+  logged-out `login status` line, and the strict-config, invalid-value and retired-setting
+  rejections are unchanged; the four config keys amicus pins with `-c` are still accepted, and
+  all three features amicus disables on every run are still `stable`. The tool list sent to each
+  bundled model is the same as 0.156.1's with and without those disables, and the served model
+  catalog is unchanged. Of the two features 0.157 turns on by default, `daemon_auto_start` is
+  read only by the interactive TUI and `guardianv2.thread_context` only shapes Guardian approval
+  reviews, so neither is enabled or disabled here. No paid call was part of the check.
+- **Surface.** `amicus_capabilities`' `fingerprint_covers` gains `repair_rules` (#252, ADR
+  0044): each error code's `temporary`, `repair.next_step`, `repair.tool` and lookup
+  `repair.arguments`, as the envelope carries them by default for each in-tree backend, are
+  now part of what the fingerprint guards, so a change to any of them moves `fingerprint`.
+  The repair prose (`alternative`) is not. No error envelope changes.
+- **Surface.** Six minor contract findings of the 2026-09-24 audit (#250). Reads of
+  `amicus://error-envelope`, `amicus://result-meta` and `amicus://params` carry the catalog
+  TTL (`ttlMs: 300000`) where they said `0`; `amicus://capabilities` and the two templates
+  still say `0` (ADR 0041). The `logging` capability is no longer advertised: amicus sends no
+  log message. The two resource templates carry written one-line descriptions, and the models
+  template no longer claims a resource read has no repair carrier. A sync call's progress
+  notifications report elapsed seconds against the deadline as `progress`/`total`, with the
+  backend event count in the message. `amicus_capabilities.tool_details[].stability` is each
+  tool's effective tier rather than `null`, so the two stability surfaces agree. Every tool,
+  resource and template record on the wire no longer carries FastMCP's `_meta.fastmcp` block.
+  Item 1 of the issue, echoing `workspace_root` in `repair.arguments`, was declined under ADR
+  0021.
+- **Surface.** `timeout_seconds` and `detail` carry a one-line summary and an `amicus://params`
+  pointer on every tool that declares them, with the keyed-call and retention elaboration in
+  the resource's `full` text (#247, part), 1,270 bytes of `tools/list`. With the other
+  changes in this release, `tools/list` on the `all` profile is 112,105 bytes (-578 since
+  0.6.0's 112,683, o200k 27,659 tokens). ADR 0043 proposes merging each sync tool
+  with its `_async` twin behind a `wait` flag; that change, and the deprecation of the twins,
+  is not in this release.
+- **Breaking.** A sync paid call that passes its deadline returns `timeout` with `temporary:
+  false`, `retry_after_ms: null` and `repair.next_step: start_new_job` on every backend, where
+  codex and kimi said `temporary: true` / `retry_after_delay` while their own prose said a retry
+  would time out again (#245, ADR 0039). The repair names the verb's `_async` twin in
+  `repair.tool` when `AMICUS_JOB_MAX_SECONDS`, the deadline that twin runs to, exceeds the
+  deadline that passed, and otherwise names no tool; it carries no arguments, since they would
+  echo your inputs. Its text says so and states that any next attempt is a new paid run. Claude's `temporary` and `next_step` are
+  unchanged; it now also names the `_async` tool and shares the new text. A background run (an
+  `_async` job or a keyed sync call) that passes `AMICUS_JOB_MAX_SECONDS` returns `timeout` with
+  no `repair.tool` and prose naming that deadline, since its `_async` twin would hit the same
+  one. Codex's capture-failed timeout, whose repair says to retry the same
+  call once, now says `temporary: true` itself and its repair names no other tool, except on
+  a keyed call, where the same call would replay this error: there it is `temporary: false` and
+  its text first says to retry under a new `idempotency_key`. A keyed sync wait's timeout is
+  unchanged (ADR 0020).
+- **Breaking.** `amicus_delegate`, `amicus_delegate_async` and `amicus_delegate_dry_run`
+  publish `backend` as `codex | kimi`, and `amicus_adversarial_review` and its async twin as
+  `claude`, the sets those verbs accept (#246, ADR 0040). A backend outside the set now fails
+  at the boundary as `invalid_arguments` with `allowed_values`, where it failed after
+  resolution as `feature_unsupported`; that code remains only as a defensive check, returned if
+  the named backend's declared features lack the verb, which no backend a tool's enum accepts
+  does today, and its repair now lists every backend rather than the one that failed.
+  `amicus_capabilities.tool_details[].backends` derives from the same table.
+
+### Fixed
+
+- A new paid call no longer deletes a finished result nobody has fetched (#244). Every paid call
+  records a job, and recording one evicted the oldest finished records past the per-workspace
+  cap (`AMICUS_JOB_MAX_COUNT`, default 50) whether or not their results had ever been read, while
+  the paid tools advertised `destructiveHint: false` in the codex and kimi profile. The cap now
+  evicts only expired records, terminal errors, results amicus has already returned once and
+  records written by an earlier release, which did not track delivery. An unfetched result in
+  another release's result format is kept too, since a server of that release sharing the state
+  root can still deliver it. When only running jobs and unfetched results it must keep remain, a
+  new paid call is refused before anything is spent with the new error code
+  `job_cap_reached`, whose repair lists the workspace's jobs: fetch or consume a result, or
+  cancel a running job, then retry; a result another release wrote is fetched by that release, or
+  expires after `AMICUS_JOB_TTL`. Running jobs now count toward the cap, so a workspace can
+  no longer run more jobs than the cap at once. "Returned once" means amicus handed the result
+  back, from `amicus_job_result`, `amicus_job_consume_result` or the sync call that awaited it,
+  not that the client received it (ADR 0038).
+- **Surface.** A client file root that no longer exists is refused before any work as
+  `invalid_workspace_root` with the new `details.reason` token `root_not_a_directory`, where it
+  was accepted as the workspace and every git-based call then failed as `git_unavailable`,
+  steering the agent to install git (#248). Only handshake-era clients advertise roots. A
+  workspace that vanishes after resolution is now `invalid_workspace_root` too, with the token of
+  its source (`root_not_a_directory`, `not_a_directory`, or `cwd_gone` for the cwd opt-in), from
+  every git wrapper, the delegate preflight and dry run, and a delegate job's worktree setup; a
+  cwd that is a file is handled the same way.
+  The token list in the `workspace_root` contract at `amicus://params` grew by one.
+
 ## [0.6.0] - 2026-09-24
 
 Across this release the discovery surface moves `amicus/0.1/schema-39`, what 0.5.0 shipped, to
@@ -967,7 +1080,8 @@ per-change rather than net, so they also name intermediate states that no releas
 - The tagged publish path to pypi.org has never run. Only the TestPyPI dispatch path has been exercised.
 - Eval scenario S6 in `skills/collaborating-with-amicus/tests/scenarios.md` passed on one run (status: `pass`, validated by that run alone); an M7 follow-up run against the current skill text did not isolate the still-open F3 finding, so F3 remains open. S7 (real-host approval friction) has failed both of its recorded runs (status: `fail`); an M7 zero-spend recheck reached neither a pass nor a fail and is recorded as inconclusive, so it does not move S7's status. See their `status` fields and ADR 0012.
 
-[Unreleased]: https://github.com/briandconnelly/amicus/compare/v0.6.0...HEAD
+[Unreleased]: https://github.com/briandconnelly/amicus/compare/v0.7.0...HEAD
+[0.7.0]: https://github.com/briandconnelly/amicus/compare/v0.6.0...v0.7.0
 [0.6.0]: https://github.com/briandconnelly/amicus/compare/v0.5.0...v0.6.0
 [0.5.0]: https://github.com/briandconnelly/amicus/compare/v0.4.0...v0.5.0
 [0.4.0]: https://github.com/briandconnelly/amicus/compare/v0.3.0...v0.4.0

{amicus-0.6.0 → amicus-0.7.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: amicus
-Version: 0.6.0
+Version: 0.7.0
 Summary: One MCP server for every second-opinion model: consult, review, and delegate with the backend as a parameter
 Project-URL: Homepage, https://github.com/briandconnelly/amicus
 Project-URL: Repository, https://github.com/briandconnelly/amicus
@@ -73,7 +73,7 @@ The plugins launch the server from a published release tag, pinned in
   "mcpServers": {
     "amicus": {
       "command": "uvx",
-      "args": ["--from", "git+https://github.com/briandconnelly/amicus.git@v0.6.0", "amicus-mcp"]
+      "args": ["--from", "git+https://github.com/briandconnelly/amicus.git@v0.7.0", "amicus-mcp"]
     }
   }
 }
@@ -139,8 +139,11 @@ dedicated adversarial-review verb is scoped to Claude. To ask Codex or Kimi for
 review, use `consult` or `review_changes` and supply the stance yourself; the dedicated verb adds
 a fixed critic stance and the `target` and `evidence` inputs.
 
-Asking a backend for something it does not support returns a `feature_unsupported` error naming
-the backend and the feature, rather than failing obscurely.
+Asking a tool for a backend outside its `backend` enum, in-tree or not, is rejected before any
+spend as an `invalid_arguments` error whose `details.allowed_values` lists the backends that tool
+accepts (the enum is that set). `feature_unsupported` is only a defensive check: it is returned
+if the named backend's declared features lack the verb, which no backend a tool's enum accepts
+does today.
 
 ## Safety
 
@@ -155,7 +158,10 @@ the backend and the feature, rather than failing obscurely.
 - **A paid call's whole answer stays on disk** in the job record under `AMICUS_STATE_DIR`,
   whatever `detail` delivered it and after only best-effort secret redaction, until it expires
   (`AMICUS_JOB_TTL`, default 24h; an expired record is removed on a later job call, not by a
-  daemon), the per-workspace cap evicts it or `amicus_job_consume_result` removes it. It can
+  daemon), `amicus_job_consume_result` removes it or, once amicus has returned it, the
+  per-workspace cap evicts it. The cap never evicts a result nobody has fetched that was
+  recorded since delivery tracking (#244), whichever release recorded it. When only running jobs
+  and such results remain, a new paid call is refused with `job_cap_reached` instead ([ADR 0038](docs/adr/0038-the-job-cap-never-evicts-an-unreturned-result.md)). It can
   quote what you sent. Your inputs themselves are never written there ([ADR 0035](docs/adr/0035-a-backend-answer-is-kept-on-the-job-record.md)).
 - **Kimi keeps its own copy.** The kimi CLI writes its own session files (observed under
   `~/.kimi-code/sessions`), which can hold the whole prompt and any answer produced. amicus found
@@ -181,13 +187,14 @@ the new ones.
 
 ## Status and known limits
 
-0.6.0 is the current release. The discovery surface moved from `amicus/0.1/schema-39` to
-`amicus/0.1/schema-43`, and `RESULT_FORMAT` did not move, so a job result 0.5.0 stored can still be
-read. Two changes ask something of a caller: `amicus_job_consume_result` now deletes a failed,
-cancelled or timed-out job's record and reports `state_changed` where it reported `not_done`, and
-an answer the output capture cut is `answer_unavailable` rather than a shorter or earlier answer.
-One change asks something of an operator: a `CODEX_HOME` that is not an absolute path is now
-refused. [`docs/MIGRATION.md`](docs/MIGRATION.md#upgrading-from-050) explains how to upgrade, and
+0.7.0 is the current release. The discovery surface moved from `amicus/0.1/schema-43` to
+`amicus/0.1/schema-50`, and `RESULT_FORMAT` did not move, so a job result 0.6.0 stored can still be
+read. Two changes ask something of a caller: a sync call past its deadline returns a `timeout`
+that is never temporary and whose repair names the verb's `_async` twin when
+`AMICUS_JOB_MAX_SECONDS` exceeds the deadline that passed, and a backend a verb never accepts
+fails as `invalid_arguments` rather than `feature_unsupported`. A new paid call can also be
+refused as `job_cap_reached` rather than evicting a result nobody has fetched.
+[`docs/MIGRATION.md`](docs/MIGRATION.md#upgrading-from-060) explains how to upgrade, and
 [`CHANGELOG.md`](CHANGELOG.md) lists every user-visible change.
 
 One known limit: a third-party backend distribution can load through the `amicus.backends`

{amicus-0.6.0 → amicus-0.7.0}/README.md

@@ -44,7 +44,7 @@ The plugins launch the server from a published release tag, pinned in
   "mcpServers": {
     "amicus": {
       "command": "uvx",
-      "args": ["--from", "git+https://github.com/briandconnelly/amicus.git@v0.6.0", "amicus-mcp"]
+      "args": ["--from", "git+https://github.com/briandconnelly/amicus.git@v0.7.0", "amicus-mcp"]
     }
   }
 }
@@ -110,8 +110,11 @@ dedicated adversarial-review verb is scoped to Claude. To ask Codex or Kimi for
 review, use `consult` or `review_changes` and supply the stance yourself; the dedicated verb adds
 a fixed critic stance and the `target` and `evidence` inputs.
 
-Asking a backend for something it does not support returns a `feature_unsupported` error naming
-the backend and the feature, rather than failing obscurely.
+Asking a tool for a backend outside its `backend` enum, in-tree or not, is rejected before any
+spend as an `invalid_arguments` error whose `details.allowed_values` lists the backends that tool
+accepts (the enum is that set). `feature_unsupported` is only a defensive check: it is returned
+if the named backend's declared features lack the verb, which no backend a tool's enum accepts
+does today.
 
 ## Safety
 
@@ -126,7 +129,10 @@ the backend and the feature, rather than failing obscurely.
 - **A paid call's whole answer stays on disk** in the job record under `AMICUS_STATE_DIR`,
   whatever `detail` delivered it and after only best-effort secret redaction, until it expires
   (`AMICUS_JOB_TTL`, default 24h; an expired record is removed on a later job call, not by a
-  daemon), the per-workspace cap evicts it or `amicus_job_consume_result` removes it. It can
+  daemon), `amicus_job_consume_result` removes it or, once amicus has returned it, the
+  per-workspace cap evicts it. The cap never evicts a result nobody has fetched that was
+  recorded since delivery tracking (#244), whichever release recorded it. When only running jobs
+  and such results remain, a new paid call is refused with `job_cap_reached` instead ([ADR 0038](docs/adr/0038-the-job-cap-never-evicts-an-unreturned-result.md)). It can
   quote what you sent. Your inputs themselves are never written there ([ADR 0035](docs/adr/0035-a-backend-answer-is-kept-on-the-job-record.md)).
 - **Kimi keeps its own copy.** The kimi CLI writes its own session files (observed under
   `~/.kimi-code/sessions`), which can hold the whole prompt and any answer produced. amicus found
@@ -152,13 +158,14 @@ the new ones.
 
 ## Status and known limits
 
-0.6.0 is the current release. The discovery surface moved from `amicus/0.1/schema-39` to
-`amicus/0.1/schema-43`, and `RESULT_FORMAT` did not move, so a job result 0.5.0 stored can still be
-read. Two changes ask something of a caller: `amicus_job_consume_result` now deletes a failed,
-cancelled or timed-out job's record and reports `state_changed` where it reported `not_done`, and
-an answer the output capture cut is `answer_unavailable` rather than a shorter or earlier answer.
-One change asks something of an operator: a `CODEX_HOME` that is not an absolute path is now
-refused. [`docs/MIGRATION.md`](docs/MIGRATION.md#upgrading-from-050) explains how to upgrade, and
+0.7.0 is the current release. The discovery surface moved from `amicus/0.1/schema-43` to
+`amicus/0.1/schema-50`, and `RESULT_FORMAT` did not move, so a job result 0.6.0 stored can still be
+read. Two changes ask something of a caller: a sync call past its deadline returns a `timeout`
+that is never temporary and whose repair names the verb's `_async` twin when
+`AMICUS_JOB_MAX_SECONDS` exceeds the deadline that passed, and a backend a verb never accepts
+fails as `invalid_arguments` rather than `feature_unsupported`. A new paid call can also be
+refused as `job_cap_reached` rather than evicting a result nobody has fetched.
+[`docs/MIGRATION.md`](docs/MIGRATION.md#upgrading-from-060) explains how to upgrade, and
 [`CHANGELOG.md`](CHANGELOG.md) lists every user-visible change.
 
 One known limit: a third-party backend distribution can load through the `amicus.backends`

{amicus-0.6.0 → amicus-0.7.0}/commands/amicus/jobs.md

@@ -29,7 +29,11 @@ Request: $ARGUMENTS
 - Recover a lost `job_id`, or see what is in flight: `amicus_job_list`, filterable by
   `backend`, `status`, or `task_id`.
 
-Job records expire after `AMICUS_JOB_TTL` (default 24h) and a per-workspace cap
-evicts the oldest terminal records, so read results promptly rather than leaving
-them to expire. Treat a fetched result the same way you would treat the tool it came
+Job records expire after `AMICUS_JOB_TTL` (default 24h), so read results promptly
+rather than leaving them to expire. A per-workspace cap evicts the oldest terminal
+records but never a result amicus has tracked and not yet returned (records written
+before delivery tracking are evictable); when unfetched results and running jobs fill
+it, a new paid call is refused with `job_cap_reached` until you fetch, consume or cancel
+one, or, for a result another amicus release wrote, until that release fetches it or it
+expires. Treat a fetched result the same way you would treat the tool it came
 from: verify findings and diffs against the actual code before acting on them.

{amicus-0.6.0 → amicus-0.7.0}/docs/MIGRATION.md

@@ -124,7 +124,7 @@ Most amicus tools take `backend` as a required parameter (no default); pick `"co
 | `claude_job_cancel` | `amicus_job_cancel(...)` |
 | `claude_job_list` | `amicus_job_list(...)` |
 
-`claude-in-codex` had no `claude_delegate`: Claude is review-only in amicus too, so `amicus_delegate` and `amicus_delegate_async` reject `backend="claude"` with `feature_unsupported`.
+`claude-in-codex` had no `claude_delegate`: Claude is review-only in amicus too, so `amicus_delegate` and `amicus_delegate_async` reject `backend="claude"` at the boundary as `invalid_arguments` with `details.allowed_values`, because each tool's `backend` enum is the set it accepts, and any backend outside it, in-tree or not, is `invalid_arguments`; `feature_unsupported` is only a defensive check, returned if the named backend's declared features lack the verb, which no backend a tool's enum accepts does today.
 `amicus_adversarial_review(_async)` is the only pair that rejects `backend="codex"` and `backend="kimi"`, because only Claude declares the `adversarial_review` capability.
 
 ## Behavior deltas
@@ -193,6 +193,33 @@ A `null` there means no loaded plugin declares one.
 The `amicus://backends/{backend}` resource is always the full entry.
 `amicus_capabilities(detail="contracts")` is removed: pass `include_tool_details=false` for the same rowless payload, and `detail` now selects only how much each `tool_details` row carries (`summary` is `name`, `cost`, `stability`, `backends`; `full` adds the rest, including `error_codes`).
 
+## Upgrading from 0.6.0
+
+The changes below are the ones a caller using amicus 0.6.0 may have to handle before running 0.7.0.
+`CHANGELOG.md`'s 0.7.0 section lists every user-visible change since 0.6.0, including the ones that require no migration.
+A job result stored by 0.6.0 is still readable: `RESULT_FORMAT` did not move.
+
+**A sync `timeout` is never temporary, and its repair names the `_async` twin (#245).**
+On codex and kimi the envelope said `temporary: true` with `retry_after_delay`; it now says `temporary: false` with `start_new_job` and `repair.tool` set to the verb's `_async` tool.
+Claude's `temporary` and `next_step` are unchanged; it now also names the `_async` tool and shares the new text.
+The `_async` tool runs to `AMICUS_JOB_MAX_SECONDS`, not `timeout_seconds`, so it is named only when `AMICUS_JOB_MAX_SECONDS` exceeds the deadline that passed; otherwise `repair.tool` is absent and the text says to narrow the task or have the operator raise `AMICUS_JOB_MAX_SECONDS`.
+A background run (an `_async` job or a keyed sync call) that passes `AMICUS_JOB_MAX_SECONDS` returns `timeout` with no `repair.tool` and prose naming that deadline.
+A caller that retried the same sync call on `temporary: true` should start the `_async` twin named in `repair.tool`, when there is one, with its original arguments instead; the retry is a new paid run.
+
+**A backend a verb never accepts is rejected at the boundary (#246).**
+`amicus_delegate` with `claude`, or `amicus_adversarial_review` with `codex` or `kimi`, now fails as `invalid_arguments` with `details.allowed_values`, where it failed as `feature_unsupported`.
+A caller that branched on `feature_unsupported` for those picks should read the tool's `backend` enum, which is now the accepted set.
+
+**A new paid call can be refused as `job_cap_reached` (#244).**
+0.6.0 made room under the per-workspace cap (`AMICUS_JOB_MAX_COUNT`, default 50) by evicting the oldest finished records, including results nobody had fetched.
+0.7.0 evicts only expired records, terminal errors, results it has already returned once and records an earlier release wrote, counts running jobs toward the cap, and refuses a new paid call before anything is spent when only running jobs and unfetched results remain.
+A result 0.6.0 stored carries no delivery record, so 0.7.0 still evicts it at the cap like any other earlier-release record: fetch any 0.6.0 result you still need before the upgraded server starts another paid call in that workspace.
+A caller that starts many jobs without fetching their results should fetch or consume them, or cancel a running job, and then retry; the error's repair lists the workspace's jobs.
+
+**A stale client root is refused as `invalid_workspace_root`, reason `root_not_a_directory` (#248).**
+A handshake-era client whose advertised first root no longer exists used to get `git_unavailable` from the first git-based call; it now gets the workspace refusal, with no repair, before any work.
+Fix the root the client advertises, or pass `workspace_root`.
+
 ## Upgrading from 0.5.0
 
 The changes below are the ones a caller or operator using amicus 0.5.0 may have to handle before running 0.6.0.

{amicus-0.6.0 → amicus-0.7.0}/docs/adr/0003-workspace-resolution.md

@@ -17,3 +17,4 @@ The server cwd is used only under `AMICUS_ALLOW_CWD_WORKSPACE=1`, and then the r
 - Sessionless (2026-07-28) clients must pass `workspace_root`; the parameter description says so.
 - M1 implements the resolver (orchestration/workspace.py) and the handshake-era roots probe; a sessionless client without workspace_root receives invalid_workspace_root with zero spend.
 - The server cwd is read only on the branch that would use it (issue #170): an explicit or client root never consults it, so a cwd deleted under the running server cannot fail a call that named its workspace, and when that branch is reached and the cwd is gone the call fails as invalid_workspace_root rather than a retryable internal_error.
+- A client root is checked with `is_dir()` like an explicit path (issue #248): a root the client still advertises after the directory is gone is refused as invalid_workspace_root with reason `root_not_a_directory`, first-root selection stands, and a workspace that vanishes after resolution is reported with the token of its source (`root_not_a_directory`, `not_a_directory` or `cwd_gone`) rather than as a missing git executable, from the git wrappers, the delegate preflight and dry run, and a delegate job's worktree setup.

{amicus-0.6.0 → amicus-0.7.0}/docs/adr/0010-m4-claude-port-decisions.md

@@ -22,6 +22,7 @@ The maintainer approved decisions 1–4 in the M4 planning session.
 - The zero-exit envelope is an outcome inspection: `ClaudeBackend.inspect_outcome` returns `invalid_json` for a non-JSON zero-exit stdout, classifies an `is_error`/non-success envelope through the same classifier the process-failure path uses, and returns `claude_permission_error` for denials with no answer.
 - `finalize` returns the workspace hook warning as `ExecResult.warnings`, and `orchestration.finalize.apply_exec` copies backend warnings onto `meta.security_warnings` (a loop change every backend may use).
 - Timeout is the first `repair_overrides` entry (`start_new_job`, not temporary); the classifier marks the failure `retryable=False` too.
+  Superseded by [ADR 0039](0039-a-deadline-timeout-is-never-temporary.md): the rule is now amicus-wide and the override is gone.
 - Pre-spend refusals in `validate_request`: effort outside the enumerated levels, `config_mode`/`access` outside the vocabulary, budget outside 0.01–5.00, `bare` without `ANTHROPIC_API_KEY` (`api_key_missing`), any `extra_args`, and the shared `instructions_append` rules for consult and review only.
 - `backend_options.max_budget_usd` is bounded 0.01–5.00 on the wire (the sibling's ceiling) and refused pre-spend outside it; the sibling's configured/effective budget meta is not carried.
 - Names: `AMICUS_CLAUDE_{BIN,CONFIG_MODE,ACCESS,MODEL,REASONING_EFFORT,MAX_BUDGET_USD,SUPPORTED_MAJORS}` with `CLAUDE_IN_CODEX_` twins for all but `BIN`; defaults inherit, toolless, xhigh, 1.00, {2}; no extra-args variable.

{amicus-0.6.0 → amicus-0.7.0}/docs/adr/0018-the-catalog-carries-a-ttl-and-resource-reads-do-not.md

@@ -2,6 +2,8 @@
 
 **Status:** Accepted (2026-09-09)
 
+The `resources/read` clause is superseded by [ADR 0041](0041-static-resource-reads-carry-the-catalog-ttl.md); the rest stands.
+
 Supersedes the cache-hint clause of [ADR 0006](0006-fingerprint-and-surface-digest.md); the rest of that record stands.
 
 ## Context

amicus-0.7.0/docs/adr/0038-the-job-cap-never-evicts-an-unreturned-result.md

@@ -0,0 +1,52 @@
+# ADR 0038: the job cap never evicts an unreturned result
+
+**Status:** Accepted (2026-09-24)
+
+## Context
+
+Every paid call, sync or async, is recorded as a job, and the job store keeps at most `AMICUS_JOB_MAX_COUNT` records per workspace (50 by default).
+Until this decision, recording a new job evicted the oldest terminal records past that cap, whether or not anyone had fetched their results (#244).
+A new paid call could therefore delete a finished, paid-for result the caller had not read yet, and a later `amicus_job_result` returned `job_not_found`, which looks the same as a mistyped id.
+
+In the codex and kimi profile the paid tools also advertise `destructiveHint: false`, and `amicus_capabilities.annotations_reading` justified that without naming eviction.
+ADR 0001 annotates for the worst enabled backend; it never said a paid call may remove state a caller still needs.
+
+The issue offered two ways out: make the hint true in fact, or flip every paid tool to `destructiveHint: true`.
+Flipping the hint would have kept the loss and only disclosed it, and would have raised a host approval prompt on every paid call in a profile whose backends write nothing outside a throwaway worktree.
+
+## Decision
+
+**The cap evicts only what nobody still needs from amicus.**
+It may remove an expired record, a terminal error (`failed`, `cancelled`, `timeout`), a `done` result amicus has already returned once, and a record written before delivery tracking existed.
+It never removes a running job, or a tracked `done` result that has not been returned, whatever its result format.
+
+**A full cap refuses the new call before anything is spent.**
+The check runs before the worker spawns: it reaps expired records, evicts what it may oldest first, and raises `JobCapReached` when the workspace still holds `AMICUS_JOB_MAX_COUNT` records.
+The tool returns `job_cap_reached`, temporary with no `retry_after_ms`, because the room comes from the caller's own next step rather than from time: fetch or consume a result, or cancel a running job.
+Its repair lists the workspace's jobs with `amicus_job_list`, and says that a result another release wrote, which this server reports as `job_result_incompatible` and a consume keeps, is fetched by a server of that release or expires after `AMICUS_JOB_TTL`.
+Running jobs count toward the cap, so within one server process the cap bounds how many records a workspace holds, where running jobs used to overshoot it; across processes it is bounded as the last decision below says.
+A refused keyed call leaves its idempotency key unreserved, so the same key works once there is room.
+
+**"Returned once" is recorded by the server, not acknowledged by the client.**
+A record carries `delivered_epoch`, `null` until amicus validates its stored result and hands it back, from `amicus_job_result`, `amicus_job_consume_result` or the sync tool that awaited it.
+A status read, a list, a keyed wait that timed out, and a stored result that failed validation never stamp it.
+A sync response lost in transport after the stamp is therefore evictable, as it was before; the prose says "returned", never "received".
+A record without the key predates this decision and is evicted as before, so an upgrade cannot fill a workspace with protected records until their TTL runs out.
+
+**Servers of different releases can share a state root.**
+The store never reads a record's result format, because the release that wrote a result can still deliver it from a server sharing the root, whether it is older or newer than the one enforcing the cap.
+This is the rule `amicus_job_consume_result` already follows: it keeps a result it cannot read rather than delete one another release could deliver (#126).
+The cost is that unfetched results in a format no running server reads hold their slots until `AMICUS_JOB_TTL` expires them.
+A release from before this decision still evicts by age alone, and the records it writes carry no delivery stamp, so they are evicted as before; that is unchanged, and it ends when the old server is upgraded.
+
+**The store alone enforces it, under the process lock.**
+`_LOCK` is process-local, so server processes sharing a state root can each pass the check at once and overshoot the cap by one start per process.
+An overshoot deletes nothing, which is the property the annotation needs.
+
+## Consequences
+
+`destructiveHint: false` on the paid tools in the codex and kimi profile now holds for the job store: a paid call never deletes a tracked result amicus has not yet returned.
+`annotations_reading`, the paid tools' retention sentence, the `amicus_job_*` retention sentence and the server instructions say so.
+`job_cap_reached` is a new amicus-local error code, so `FINGERPRINT` moves.
+`RESULT_FORMAT` does not: the code is refused before a job record exists, so no stored `result.json` can carry it.
+An agent that starts many jobs and never fetches them now meets a refusal where it used to lose results silently.

amicus-0.7.0/docs/adr/0039-a-deadline-timeout-is-never-temporary.md

@@ -0,0 +1,51 @@
+# ADR 0039: a deadline timeout is never temporary
+
+**Status:** Accepted (2026-09-24)
+
+Amends [ADR 0010](0010-m4-claude-port-decisions.md), whose Claude-only timeout override this makes the rule for every backend.
+
+## Context
+
+When a sync paid call on codex or kimi passed its deadline, the `timeout` envelope said `temporary: true` with `next_step: "retry_after_delay"`, while its own prose said the same synchronous call would likely time out again (#245).
+`temporary` means the identical call may succeed later; here the identical call is a sync call that spends again and hits the same deadline.
+Claude's plugin already overrode the rule to `temporary: false`, `next_step: "start_new_job"`, because a Claude timeout may already have been charged.
+So one condition had two contracts, chosen by `backend`, and an agent that branched on the machine field rather than the prose burned quota in a loop.
+
+## Decision
+
+**The `timeout` rule is amicus-wide: `temporary: false`, `next_step: "start_new_job"`, one prose text.**
+It lives in `amicus.errors._LOCAL_RULES`, above the SDK default; Claude's `repair_overrides` entry and its classifier's own `RepairHint` are gone, and the classifier keeps `retryable: false` and its detail about a possibly charged run.
+A plugin cannot override it: `repair_table` re-applies it after a plugin's `local_codes` and `repair_overrides`, so only a single failure's own `retryable` or repair, applied in `render_failure`, changes that failure's envelope.
+The prose states the spend, names the four `_async` twins, and gates polling on `status` as the `job_running` repair does.
+
+**On a sync run, the repair names the verb's `_async` twin, when its deadline is longer, and carries no arguments.**
+`repair.tool` is set where the verb is known: the sync await in `jobs.lifecycle` and `errors.render_failure`, which now takes the run's `kind` and whether it is a background run.
+The twin runs to `AMICUS_JOB_MAX_SECONDS` (60 to 7200 seconds) rather than `timeout_seconds` (10 to 600), so it can have the shorter deadline; it is named only when `AMICUS_JOB_MAX_SECONDS` exceeds the deadline that passed.
+The sync await compares the job store's `max_seconds` with its wait, and `render_failure` compares `RunSpec.job_max_seconds`, set from the server's settings for every run, with `timeout_seconds`.
+Otherwise no tool is named, and the prose says that when it names none the job deadline is no longer than the one that passed, so narrow the task or have the operator raise `AMICUS_JOB_MAX_SECONDS`.
+`RunSpec.job_max_seconds` is not a prompt input and stays out of the idempotency identity, like `background`; a record that lacks it loads as `None`, and then the twin is named as before.
+The arguments would echo prompt inputs (rule 18), and ADR 0021 already accepts a repair that names a tool without arguments when the correction is not unique; the prose says the arguments are the caller's own.
+
+**A backend-classified CLI timeout is the same condition.**
+On an unkeyed sync call the worker applies the caller's `timeout_seconds` to the backend subprocess, so there the classifier's `timeout` is the one that fires in practice, and it takes the same rule.
+Codex's capture-failed timeout is the one exception: its hint says to retry the same call once, so it sets `retryable: true` itself, and on that one repair no `_async` tool is named, because its hint prescribes retrying the same call.
+On a keyed call that exception does not hold, because the same call under the same key replays this stored error rather than running again (ADR 0020).
+So `RunSpec.keyed` records whether the call passed an `idempotency_key`, and `render_failure` makes a keyed run's temporary timeout `temporary: false` and leads its prose with `KEYED_REPLAY_NOTE`, which says any retry needs a new key.
+`RunSpec.keyed` is not a prompt input, stays out of the idempotency identity like `background`, and loads as `False` from a record that lacks it.
+
+**A background run's timeout names no tool.**
+A background run, an `_async` job or a keyed sync call, gives the backend subprocess `AMICUS_JOB_MAX_SECONDS` (default 1800s) rather than the caller's wait, so its `_async` twin is the run that already timed out.
+Its `timeout` keeps `temporary: false` and `next_step: "start_new_job"`, names no `repair.tool`, and carries its own prose, which names that deadline, says the same call, sync or `_async`, will likely time out again and that any next attempt is a new paid run, and suggests narrowing the task or having the operator raise `AMICUS_JOB_MAX_SECONDS`.
+`RunSpec.background` carries the fact to `render_failure`; it is not a prompt input, it stays out of the idempotency identity so a keyed record written before it existed still replays, and a record that lacks it loads as `False`.
+The same condition on a background run can instead surface as `job_timeout`, depending on when the job is polled: the job store's deadline starts when the job is recorded, before the subprocess's own, and a poll past it reaps the job.
+That is a separate code, which this ADR leaves unchanged.
+
+**A keyed sync wait's timeout stays temporary.**
+ADR 0020 already made it so whatever the backend's rule said; the run continues and the repair polls it.
+
+## Consequences
+
+- `error.temporary` on `timeout` changes from `true` to `false` for codex and kimi, and `retry_after_ms` is always null: **Breaking** in the CHANGELOG sense, since a value a caller read has changed meaning.
+- The codex and kimi result differentials record the deviation from the siblings' `temporary: true`.
+- `FINGERPRINT` moves (with #246, to `schema-45`); `RESULT_FORMAT` stays 9.
+- The design spec's "timeout is not retryable for Claude" now reads "never temporary".

amicus-0.7.0/docs/adr/0040-the-backend-enum-is-the-set-the-verb-accepts.md

@@ -0,0 +1,32 @@
+# ADR 0040: the backend enum is the set the verb accepts
+
+**Status:** Accepted (2026-09-24)
+
+## Context
+
+Five tools published a `backend` enum of `codex | kimi | claude` while always rejecting one or two of them: delegate and its async and dry-run forms accept codex and kimi, and adversarial review and its async form accept claude (#246).
+Only description prose carried the restriction; a schema-driven caller, or a client that generates bindings from `inputSchema`, had no signal, and the wrong pick failed after resolution as `feature_unsupported` with a repair that looked up the backend that had just failed.
+`[3.strict-types]` puts a fixed value set in the enum, and the server already knew the true sets in `amicus_capabilities.tool_details[].backends`.
+
+## Decision
+
+**Each paid verb's tools publish the enum of the backends that verb accepts.**
+`schemas.codes.VERB_BACKENDS` is the table; `DelegateBackendParam` and `AdversarialBackendParam` are the narrowed `Literal`s, and `TOOL_DETAILS[...]["backends"]` derives from the same table, with a test holding the published enums equal to it.
+The narrowing is in the Pydantic type, so the published enum, the boundary validation and `invalid_arguments.allowed_values` change together.
+A one-value enum, adversarial review's `claude`, is published as `enum: ["claude"]` rather than JSON Schema `const`, so the published set and `invalid_arguments.allowed_values` read the same way on every tool.
+
+**The enum narrows per verb, not per profile.**
+A per-profile enum would make the profiles differ in more than annotations, which the manifest's byte-difference control pins, and the tool set is the same in every profile by design.
+Every tool no enabled backend can serve stays listed.
+The adversarial review description says so (its call is `backend_unavailable` unless `claude` is enabled); the delegate descriptions, already long, do not.
+
+**`feature_unsupported` repairs to the unfiltered `amicus_backends` call.**
+The code is now only a defensive check: it is returned if the named backend's declared features lack the verb, which no backend a tool's enum accepts does today.
+A third-party backend cannot reach it either, because `config._profile` drops an id outside `BACKEND_IDS`, each tool's `backend` `Literal` rejects one, and the registry refuses an entry point that claims an in-tree id (`reserved_id`); such a call is `invalid_arguments`.
+ADR 0021 forbids a repair whose `arguments` are not a complete call, and a correction that carries a prompt input cannot be echoed, so the repair lists every candidate rather than naming one.
+
+## Consequences
+
+- `amicus_delegate(backend="claude")` and its async and dry-run forms, and `amicus_adversarial_review(backend="codex"|"kimi")` and its async form, now fail at the boundary as `invalid_arguments` with `allowed_values`, where they failed after resolution as `feature_unsupported`: **Breaking**, since the code a caller read for that call changed.
+- `amicus_models` and `amicus_backends` keep the whole set: they answer for any known backend.
+- `FINGERPRINT` moves (with #245, to `schema-45`); `tools/list` grows by 134 bytes on every profile (`all`: 112683 to 112817), most of it the adversarial review description's clause that the tool stays listed in every profile: 27 bytes from the delegate tools dropping `claude` from their enum and rewording its description, and 107 bytes from the adversarial review tools narrowing to `claude` alone and gaining that description clause.

amicus-0.7.0/docs/adr/0041-static-resource-reads-carry-the-catalog-ttl.md

@@ -0,0 +1,26 @@
+# ADR 0041: static resource reads carry the catalog TTL
+
+**Status:** Accepted (2026-09-25)
+
+Amends [ADR 0018](0018-the-catalog-carries-a-ttl-and-resource-reads-do-not.md): its "resources/read carries no hint at all" clause is superseded; the rest stands.
+
+## Context
+
+ADR 0018 left `resources/read` unhinted because the SDK chooses a hint per method and two template reads report live install, auth and model-catalog state.
+`amicus://error-envelope`, `amicus://result-meta` and `amicus://params` change only when the fingerprint moves, yet every read of them said `ttlMs: 0` while `resources/list` said `300000` (#250 item 2, `[8.cacheable-results]`).
+The SDK applies a method hint only to the fields a handler did not set, so a hint can be stamped per URI on the read result; FastMCP 4.0.5 offers no per-resource hint of its own.
+
+## Decision
+
+**The three static bodies carry `CATALOG_CACHE_TTL_MS` on their read results, per URI.**
+`server._install_static_read_ttl` re-registers the low-level `resources/read` handler with a wrapper that stamps the TTL and scope on those three URIs and passes every other result through.
+`resources/read` stays out of the method hint map, so `amicus://capabilities`, which embeds the live env report and `surface_digest`, and the two templates keep `ttlMs: 0`.
+
+**The set is written out.**
+`STATIC_READ_TTL_URIS` names the three; a test holds it equal to the manifest's static URIs, and the stdio test asserts the TTL on each of them and its absence on the capabilities and template reads.
+
+## Consequences
+
+- `modern_result_envelopes` moves for the three reads, so `FINGERPRINT` moves (with the rest of #250).
+- A host that honours `ttlMs` re-reads the three bodies at most every five minutes; a fingerprint move within that window is visible on `amicus_capabilities`, which is not cached.
+- The same handler re-registration is how `_meta.fastmcp` is stripped from the three list results (`_install_meta_strip`), because FastMCP adds that key after every transform and middleware has run.

amicus-0.7.0/docs/adr/0042-amicus-job-list-pages-by-an-opaque-cursor.md

@@ -0,0 +1,26 @@
+# ADR 0042: amicus_job_list pages by an opaque cursor
+
+**Status:** Accepted (2026-09-25)
+
+## Context
+
+`amicus_job_list` could not page: omitting `limit` returned every retained match, and setting it truncated to the newest N with `truncated: true` and no way to reach an older job except fetching them all (#249, `[8.house-pagination]`).
+The 2026-09-07 review judged house pagination unnecessary because no tool returned an unbounded list; the list is held to the per-workspace cap `AMICUS_JOB_MAX_COUNT`, which an operator may raise to 1,000, and which server processes sharing a state root can each exceed by one start, because the lock that enforces it is process-local (`JobStore._make_room`).
+
+## Decision
+
+**A page that omits matching jobs carries `has_more: true` and `next_cursor`, and `cursor` returns the jobs after it under the same filters.**
+`has_more` and `next_cursor` are a house pagination convention in the tool's own result, not protocol fields (`[8.house-pagination]`).
+`truncated` and `truncation_hint` keep their 0.6.0 values as a compatibility alias of `has_more` on this tool, and their descriptions say so: under `[8.truncation]` `truncated` should mean rows paging can never return, and no job the listing omits is beyond reach, so a caller should read `has_more`; changing what `truncated` reports would instead tell a 0.6.0 caller it holds every job.
+The cursor is the last returned row's `started_epoch` and `job_id`, joined by a colon; the listing sorts by that pair, newest first, so a page after an anchor is every row that sorts below it, and an anchor that was consumed or evicted between pages still resolves.
+The text is opaque to callers, and only this tool mints it, but only its form is checked: a cursor that is not a finite epoch, a colon and a 32-hex job id is `invalid_arguments` on `cursor` with a repair naming the tool, and a well-formed one is used as an anchor whether or not the tool issued it.
+Signing the cursor would add a server secret to protect nothing: a forged anchor can only select a page of the caller's own workspace listing, which the same call without `cursor` already returns.
+
+**"Omit `limit` for all" stays the default.**
+The list is held to the per-workspace cap, so a bounded default page would change a documented default for little protection; the description now names the cap and its per-process overshoot.
+
+## Consequences
+
+- `JobListResult` gains `has_more` and `next_cursor`, the tool gains `cursor`, and the listing's sort gains a tiebreak, so `FINGERPRINT` moves; `RESULT_FORMAT` stays 9, since a job list is never stored.
+- The `truncation_hint` names the cursor rather than "omit `limit`".
+- `amicus_capabilities.tool_details` lists `cursor` among the tool's optional parameters.