delegate-agent-cli 0.29.0__tar.gz → 0.31.0__tar.gz

{delegate_agent_cli-0.29.0 → delegate_agent_cli-0.31.0}/CHANGELOG.md

@@ -5,6 +5,412 @@ All notable changes to this project are documented in this file.
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [0.31.0] - 2026-09-14
+
+### Harness compatibility audit (2026-09-07)
+
+Eleven audits, one per supported harness plus a shared pass, checked Delegate's
+assumptions against each vendor's current release. Every finding that could
+produce a wrong run outcome is fixed below.
+
+#### Per-engine fixes
+- Codex: `--search` and `--ask-for-approval` are declared on the interactive TUI
+  and never reached `codex exec`, so `policy.webSearch` was a no-op and the
+  approval policy was never stated. Both now ride `exec` as `-c
+  web_search="live"` and `-c approval_policy="never"`. Codex usage survives a
+  patch, and a preamble is no longer promoted to an answer after one.
+- Claude: safe and read-only call emit `--permission-prompts none` when
+  discovery has seen the flag, so a prompt is denied rather than hanging. A
+  pinned run judges the served model by Claude's own naming instead of string
+  equality, and `--continuity-mode pinned` refuses an alias that names no family
+  (`best`, `opusplan`, `default`) at preflight.
+- Cursor: `cursor call --read-only` emits `--mode ask`, which Cursor documents as
+  read-only; safe mode deliberately does not, and keeps relying on the isolated
+  workspace copy and the safe-review prefix. Tool events are parsed from the
+  shape Cursor actually emits, and a pinned run accepts the display name Cursor
+  reports in place of the requested selector.
+- Grok: a response is sealed on usage rather than on `end`, so a multi-response
+  stream keeps every part. The effort vocabulary is `low, medium, high, xhigh`;
+  `max` was never accepted.
+- Oh My Pi: work mode pins `--approval-mode yolo` and names its working
+  directory with `--cwd`. An omp selector missing from a fresh account catalog
+  now warns, because omp resolves an unknown id by fuzzy match.
+- Pi and Oh My Pi: the `--thinking` vocabulary is `off, minimal, low, medium,
+  high, xhigh, max`, and omp additionally accepts `auto`.
+- Kimi: the goal summary is kept rather than dropped, pass-through runs pin
+  `--output-format text`, and bwrap binds the selected Kimi home.
+- OpenCode: read-only runs set `OPENCODE_DISABLE_CLAUDE_CODE=1`, and discovery
+  probes with `--pure models --verbose`.
+- Devin: the read-only argv is documented-compatible with 3000.6.14, but that
+  release's read-only behavior is unproven, so the 3000.4.x gate is retained
+  until `DELEGATE_DEVIN_BEHAVIOR_TEST` passes against it.
+
+#### Transports
+- Cursor Agent and Oh My Pi prompts move to stdin, verified live against
+  2026.09.02-c22c1a3 and 18.1.13. That deletes their argv redaction constants,
+  their membership in the 100 KiB argv guard, and the omp flag-like-prompt
+  rejection, and it takes the prompt out of `/proc/<pid>/cmdline`. Kimi is now
+  the only engine on argv transport and the only one whose prompt Delegate
+  redacts.
+
+#### Stream parsing
+- An error event with a `message` or `error.message` now records a `failed`
+  terminal on every harness, and a `result` carrying only `is_error: true` does
+  the same instead of being read as a clean success.
+- A non-JSON stdout line from kimi, opencode, or pi is no longer discarded in
+  silence: it is counted and sampled, bounded and redacted, while the
+  malformed-tool-output protection that stops a raw envelope becoming an answer
+  is unchanged.
+- Event types no parser branch handles are counted, so the next vendor rename
+  is visible rather than silent.
+- Run records and snapshots carry `malformedLines`, `malformedSamples`,
+  `unhandledEventTypes`, and `unhandledEventTypesTruncated`. The block appears
+  only when there is something to report, and it survives a retry or auth
+  fallback instead of being reset with the accumulator. A merged usage record
+  keeps grok's `costUsd`.
+- The stall watchdog tracks opencode and grok tool lifecycles. Kimi and Devin,
+  whose stdout is silent by design during tool execution, are exempt from the
+  engine-default detector only when the run carries a finite timeout; an
+  explicit `stallMinutes` is always honored.
+
+#### Structured output
+- One engine-keyed eligibility helper decides whether a schema can be enforced
+  natively. Claude and Codex both require an explicit object root, and Claude
+  additionally requires the serialized argv value to stay under the Linux
+  argument-length limit. An ineligible workflow schema falls back to
+  prompt-and-parse with the reason journaled; a direct `claude --output-schema`
+  fails at preflight with `schema_not_native` instead of forwarding an argv the
+  API will reject.
+- In the structured retry loop, an attempt that fails with no assistant text
+  clears native enforcement for the remaining attempts and embeds the original
+  schema in the correction prompt, including on the resumable path.
+
+#### Deferred, recorded as decisions rather than omissions
+- Devin's 3000.4.x read-only version gate stays until a behavioral probe passes
+  on 3000.6.x; Devin is not installed on the machine that ran the audit.
+- Claude's `ultracode` effort is not added. Discovery overrides the static enum
+  with a warning list that omits the level, so an enum edit alone is unreachable
+  and would need a compatibility exception with its own proof.
+- Usage-limit cooldowns stay Codex-only. Widening the valid-tool set alone
+  changes nothing; the write and check paths are engine-specific.
+- Followup and resume support for grok, droid, opencode, pi, kimi, and devin is
+  verified possible and additive, but each needs a live round trip to prove and
+  none was run.
+- Grok stays on its current stream format, and `validate_schema_subset` still
+  rejects `$defs` and `format`.
+
+### Workflow resume and stale runs (2026-09-14)
+
+Found in the dogfood window after the 0.31.0 candidate was promoted: one
+workflow that lost its supervisor 28 times left 10 children listed as `stale`
+forever, and every resume that reached one of them failed its thunk with
+"already terminal (stale)" instead of relaunching.
+
+- `delegate cancel` seals a `stale` run whose tracked pid is dead as
+  `cancelled`, with `staleReason: dead_pid` on the record and a warning that
+  nothing was signalled, instead of refusing it with `run_already_terminal`.
+  A `stale` run with no pid at all is still refused: under the registry lock
+  that can be a launch that has not published its pid yet. A dead leader
+  whose recorded process group still has members is refused with
+  `run_group_alive`, naming the group, because a dead pid is not proof the
+  run's work stopped and the group id may already belong to someone else.
+- `workflow run --resume` and `workflow approve` seal the prior attempt's
+  in-flight children before the new supervisor starts, the same way `workflow
+  kill` does, and journal `attempt_superseded` with the lost supervisor's pid,
+  its last status, and the sealed children. The replay then relaunches the
+  agent instead of tripping over the orphan. The seal runs after gate
+  validation and never on `--dry-run`, which launches no replacement.
+- The workflow supervisor handles `SIGTERM` and `SIGHUP` by requesting the
+  same cooperative cancellation the stall watchdog uses. The signal handler
+  itself only records; a wakeup-pipe relay thread journals
+  `supervisor_signalled` and sets the cancel event in ordinary thread context,
+  so the handler never takes a lock. Admission closes, in-flight children are
+  cancelled, retry worktrees are released, and the supervisor exits through
+  its normal cleanup with `status: failed`, `signal`, `watchdogReason:
+  signal:<NAME>` (a genuine watchdog reason that started the shutdown is
+  kept, and its error text is not replaced by the signal's), and the
+  `cancelled` list on `status.json`. Before any terminal status is chosen or
+  published the supervisor drains the relay, so a signal already delivered
+  to the process is on the record consumers read as final; one that lands
+  after the last child completed is recorded on the `succeeded` status as
+  `signalAfterCompletion`. Each drain is answered only by its own marker,
+  and a drain the relay did not acknowledge in time is published as
+  `signalDrainIncomplete: true` on the terminal status instead of as a
+  settled record, which `workflow wait` and `workflow watch` repeat in every
+  output mode; the workflow lock is released only once the relay can no
+  longer write (the supervisor fences it at exit, waiting without bound
+  in-process and, as the detached supervisor process, ending itself
+  unconditionally while it still holds the lock rather than letting a writer
+  outlive ownership; every exit from the lock context, exceptional or not,
+  fences the relay and hands the lock to a delivery in flight, which closes
+  it when it completes; arming the relay rolls back handlers, wakeup fd, and
+  descriptors when it fails before the reader thread exists, and the read
+  end is owned by whichever of the reader and the rollback claims it first). A repeated signal is recorded, not re-raised. `workflow kill` notes which
+  children were already terminal before it signals and completes its
+  `cancelled` report from the whole group afterwards (`observedIn: registry`
+  on entries it did not cancel itself), so a supervisor sealed by the kill's
+  own SIGTERM, a child admitted just before cancellation closed, or a
+  supervisor cut short by the SIGKILL escalation still yield a full list; the
+  `killed` status drops only the diagnostics the signal itself produced. A signal used to end the supervisor with the lock released,
+  `status.json` still `running`, and no record of why.
+- A `--continuity-mode pinned` run that completes without any harness model
+  observation carries a `pinned_continuity_unverified` warning naming the
+  harness, on tracked runs and on ungrouped `call` payloads alike. Claude and Oh My Pi were observed reporting the served model in
+  the dogfood window; Codex and Grok streams carry no model field, so on those
+  engines a pinned run is pinned in name only and now says so.
+- `delegate models` marks a configured binary that does not resolve from the
+  Delegate process (`binaryMissing: true`, `(missing)` in text) instead of
+  printing the configured path as if it were installed. The check is the
+  launch check: `shutil.which` on the configured value, no `~` expansion.
+
+### CI and runtime hardening (2026-09-07)
+
+- Pinned runtime snapshots and workflow attempt directories are published while
+  still writable and sealed to `0o500` only after the rename. macOS `rename(2)`
+  refuses to move a directory that lacks owner write permission, which made
+  every pin-store test fail on the macOS CI runner while Linux passed. A stale
+  temporary snapshot that cannot be removed now raises a typed
+  `runtime_snapshot_collision` error, and the writable pre-pass walks the tree
+  through directory descriptors so a swapped symlink cannot redirect the chmod.
+- Test process guards read `ps -ww` and pin `COLUMNS=80`; narrow runner
+  terminals truncated the argument column and left children unreaped.
+- `trackedStreamMaxBytes` is a per-engine config value: 16 MiB by default and
+  64 MiB for Pi and Oh My Pi. The limit is resolved at request build and
+  pinned into the run context and manifest, so a config edit does not change
+  an already-launched run. Limit errors name the engine and which limit fired.
+- Harness discovery fingerprints an explicitly configured wrapper whose
+  basename is not another harness's binary name (an `estate-pi` style wrapper
+  now discovers), while still refusing ambiguous basenames and any basename
+  that names a different harness.
+- Harness event capture no longer duplicates the final assistant text when a
+  completion event repeats the last streamed chunk.
+
+### Added
+- `describe` provides a compact command index; `describe --full` expands the
+  command/config catalog. Help is generated from the same command specifications
+  used to validate supported global options.
+- `workflow resume` aliases `workflow run --resume`; focused reject help,
+  workflow typo suggestions, and additive error recovery fields reduce guesswork.
+  `workflow watch --jsonl` streams events without retaining the full response.
+- Workflow pins use immutable per-attempt operational settings with effective
+  values, origins, and digests, and bind the selected profile and credential
+  namespaces.
+
+### Fixed
+- `delegate doctor` warns when `codex.profile` names an overlay file that does
+  not exist. Codex reads the setting as `$CODEX_HOME/<name>.config.toml` and
+  accepts a missing file silently, so a stale profile cost every run its overlay
+  without a word.
+- A recognized option name typed after the prompt warns that it is being treated
+  as prompt text.
+- A terminal reason is redacted before it reaches the run record.
+- Persistent-worktree launches preserve requested continuity and process-group
+  termination grace through the shared request-to-run mapping.
+- Doctor distinguishes executing, installed, and last-promoted artifacts and
+  verifies the outer launcher chain instead of equating matching version strings.
+- PI/OMP failed, aborted, and exhausted turns no longer become successful merely
+  because the process exits zero. Later retry/compaction recovery remains supported.
+- Noisy OMP thinking deltas use bounded diagnostic sampling with explicit capture
+  receipts. Useful output, individual records, and total ingress retain finite caps.
+- Safe Codex runs can write their designated scratch directory without granting
+  source or metadata write access. Unsupported native permission configuration
+  fails closed rather than falling back to broader workspace permissions.
+- Workflow replay reads the journal once; watch tails new bytes and handles
+  interrupted final records. Approval/resume handles draining supervisors and
+  rolls back approval when launch publication fails.
+- Attempt publication atomically refuses an existing destination, including empty
+  directories. Conflicting worktree identity retains files instead of guessing a
+  removal target, and limited run listings avoid probing logs for excluded rows.
+
+### Changed
+- The auto-injected skill-review preamble is behind
+  `tracking.skillReviewPreamble.enabled`, default `false`. Call, slash
+  pass-through, and `--pass-through` prompts never receive it either way.
+- Workspace mail setup is on by default; global `--no-mail` or
+  `mail.enabled: false` opts out without suppressing `--notify`. Push remains
+  opt-in.
+- Mail storage failures warn and disable launch-time mail instead of refusing
+  the run; unreachable isolated mailboxes record manifest-only warnings.
+- The wrapped work prompt gains 303 UTF-8 bytes, which count toward the argv
+  size guard; `--no-mail` avoids that overhead near the boundary.
+- Droid uses the same `--model <alias-or-model>` grammar as other engines. The
+  positional model-alias form is retired.
+- Droid custom-model selectors use Factory's documented
+  `custom:<Display-Name>-<index>` form. The previous id-based selectors no longer
+  resolve: re-read `delegate models droid` and update any `droid.models` alias
+  that pinned one.
+- Workflow resume requires current-format pins, attempt configuration and
+  version-2 structural keys. Legacy formats are refused before child launch;
+  start a new workflow instead of migrating old state. Gate approvals require
+  the matching result hash.
+- Run progress, finalization and cancellation share one bounded mutable record.
+  Snapshot output is computed from that record; new runs do not maintain a
+  second mutable `snapshot.json`. Keep old and new runtime writers in separate
+  workspace registries during development or cutover.
+- Routine progress updates recover only their own pending finalization record.
+  Inspection remains lock-free and can observe a valid pending completion.
+  Automatic retention is throttled and is not on the cancellation path.
+- Nested workflows share runtime state without replaying the journal again.
+  New-agent and followup execution share locked replay and lifecycle decisions,
+  including concurrent rejection and interrupted-result recovery.
+- Worktree maintenance shares safety predicates while retaining command-specific
+  policies, retirement ignore-globs, and fresh checks before destructive changes.
+- CLI and input JSON normalize into one launch builder for tracked and call
+  modes, retaining input-specific validation and workflow-session checks.
+  Invalid JSON instruction modes return usage errors; Droid raw model IDs no
+  longer become spurious worktree-planning aliases.
+- Shared metadata projections, typed isolation plans and retirement inputs, and
+  a read-only record module reduce duplicated policy and circular imports.
+- Unit tests use owning modules while CLI contracts retain entrypoint coverage.
+  Acceptance selects the pinned Ruff toolchain. Pytest uses private temporary
+  state and ownership-checked process cleanup; runner parity retains complete
+  logs and cancellation regressions.
+
+### Fixed
+- Claude `--output-schema` is accepted in tracked `safe`/`work` modes, not only
+  `call`, and is passed natively as `--json-schema`, recorded in the manifest,
+  and inherited on resume. Unblocks structured Claude review lanes such as
+  deslop's `--runner delegate --lane claude`.
+- Workflow `schema=` validation now matches Claude's schema preflight: empty or
+  duplicate `enum` values (JSON equality, integers beyond 2**53 and non-string
+  object keys refused), repeated `required` or `type` entries are rejected
+  before launch, and runtime enum membership uses the same JSON equality.
+  Claude workflow children receive every supported schema natively.
+- Worktree retirement no longer treats the shared `.beads/` and
+  `.papercuts.jsonl` ledgers as lane work, so a run that filed a papercut or
+  closed a bead can retire its worktree instead of stranding it. Configurable
+  via `worktrees.retirementIgnoreGlobs`.
+- `worktree prune` (and the auto-prune that runs at completion) no longer
+  selects a worktree whose owning Run is still alive, reporting `run_active`,
+  `run_not_terminal`, or `process_group_alive` instead. `--force` overrides.
+- `workflow run --dry-run` can no longer hang indefinitely on a script that
+  waits for a human gate: scripts now receive a `dry_run` global, dry-run item
+  threads are disposable, and `workflows.dryRunTimeoutSeconds` (default 300)
+  bounds the run with a `dry_run_timeout` error.
+
+### Added
+- `delegate doctor` (read-only, `delegate.doctor.v1`) reports the live runtime
+  digest against the last promotion stamp and warns when the installed runtime
+  changed without a promotion, when the installed launcher drifted, and which
+  workflow supervisors are still pinned to older runtimes. `delegate promote
+  --actor WHO --source TEXT [--runtime-digest HEX]` writes the stamp
+  (`~/.delegate/last-promotion.json`) under a lock, reading the live digest
+  inside it.
+- Structured-output retries now resume in place when the harness supports it,
+  retaining a safe temporary workspace across attempts and reaping it from
+  durable child snapshots on timeout, kill, crash, or supervisor resume.
+
+- `delegate workflow run --notify room:<name>|channel:<name>` rings a detached
+  supervisor's owner when it pauses at a checkpoint, fails, succeeds, or times
+  an agent out. The target survives resume and dry-run, and a notification that
+  cannot be delivered is recorded as a `notify_degraded` journal event without
+  changing the workflow's outcome.
+
+### Fixed
+- `agent_timeout` and `agent_structured_retry` journal rows carry the task key
+  and label, so which lane died no longer has to be inferred by cross-referencing
+  `agent_started` timestamps.
+- A persistent-worktree run warns at completion when its base is N commits behind
+  the source branch — the child never saw work that landed after it was
+  dispatched.
+- Parse-time option errors name `delegate dry-run`, which already validated an
+  invocation without launching it. The hint appears only for launch-shaped
+  commands, never when the caller has already typed `dry-run`, and a correction
+  for a dry-run stays a dry-run instead of handing back a live launch.
+- `workflow approve` now accumulates approvals (`approvedKeys` in `approval.json`) instead of overwriting the single `gateKey`, so a resume that replays an earlier approved gate no longer re-pauses the run there.
+- Workflow `agent(schema=...)` on Codex no longer dies before launch when the
+  schema has optional fields or a typed `additionalProperties` map: native
+  `--output-schema` is used only for strict-compatible schemas, everything else
+  falls back to the prompt-and-parse path the other engines use.
+- `parse_json_tolerant` now returns the last JSON value that validates against
+  the schema instead of decoding from the first `{`/`[` in the text, so a
+  markdown completion report with decoy brackets (`[T1]`, `{run, exit, note}`)
+  no longer burns structured-output retries.
+- Workflow child failures report the child's JSON `error`/`message`/`runId`
+  instead of only stderr (which was often just the persona preface).
+- `workflow run --resume` treats a key whose retries were exhausted as
+  retryable: a finished child run is adopted, otherwise the agent re-runs,
+  instead of replaying the cached failure straight back into the same gate.
+
+- The workflow journal no longer sorts event keys: a structured result's key
+  order is part of the data (scripts embed prior results via `repr()` in later
+  prompts, which the agent cache key hashes), so a sorted replay missed every
+  downstream key after a resume and re-ran the whole wave.
+
+### Added
+
+- Workflow schema subset: `additionalProperties` may be a schema, typing a map
+  with unknown keys.
+
+## [0.30.0] - 2026-08-22
+
+### Added
+
+- Added an opt-in bubblewrap safe backend for eligible Linux safe runs. Set
+  `isolation.safeBackend` to `"bwrap"` or use `DELEGATE_SAFE_BACKEND` to run
+  zero-copy against the real workspace, bound read-only inside a bubblewrap
+  boundary with gitignore-parity masks. The workspace `.delegate/` registry is
+  hidden except for the current run's writable scratch, and `$HOME` is a private
+  tmpfs where only the selected engine's config home is made writable by
+  default. `isolation.bwrapBinds` adds explicit `{path, mode}` host paths. Each
+  run preflights its final mount plan and launches with the exact probed binary.
+  The backend fails closed when bubblewrap is unavailable, an untracked symlink
+  could expose a host path, parity needs more than 2000 masks, a submodule is
+  initialized, a writable bind covers or sits inside the workspace, or
+  `--pass-through` is requested. Linked Git worktrees are supported. See the
+  [security model](docs/security-model.md#zero-copy-safe-isolation-linux-isolationsafebackend-bwrap)
+  and [configuration guide](docs/configuration.md#isolationsafebackend-and-isolationbwrapbinds-linux).
+- Added `--notify room:<name>|channel:<name>` for one metadata-only completion
+  line through the optional `post` CLI. A missing, refused, or timed-out send
+  degrades to a manifest record without changing the run result. Notifications
+  also fire for child launch failures and persistent-worktree setup failures,
+  and the option works with `resume`; `call` and `--pass-through` reject it.
+- Cursor dry-run and terminal JSON now include a stable `accountFingerprint`
+  derived from `cursor-agent status --format json`. Raw account fields and
+  tokens are never emitted or persisted; unauthenticated or malformed status
+  output omits the fingerprint so consumers can fail closed.
+
+### Changed
+
+- The dev extra now ships `pytest` and `pytest-xdist`; `scripts/test-parity.sh`
+  checks that the parallel accelerator and the unittest gate agree on executed
+  and skipped counts.
+- Bundled Grok declarations move to Grok 4.6: `grok-4.6` is the Grok CLI
+  default, and Cursor entries use the canonical `cursor-grok-*` IDs with the
+  full `cursor-grok-4.6` effort ladder (cursor-agent no longer accepts the
+  legacy `grok-4.5-fast-*` style).
+- Devin runs use the current noninteractive workspace-trust flow.
+- Release hygiene: CI also runs the suite on macOS (Python 3.12), the
+  repository has one canonical pull-request template, and the sdist ships
+  `scripts/test-parity.sh`.
+
+### Fixed
+
+- `workflow run --resume` turns a completed workflow dry-run into live
+  execution under the same workflow ID. Simulated agent and budget events stay
+  in the journal for audit but never satisfy replay or consume live budget.
+  (Listed under 0.29.1 in earlier drafts; it landed after that tag.)
+- Workflow child runs keep their identity (workflow ID and child name)
+  through registration, journal events, and snapshots, including children
+  launched in isolated worktrees.
+- Safe mode never places its scratch copy inside the source workspace. When
+  the system temp directory is the source (for example `delegate ... safe` run
+  from `/tmp`), the copy goes to `$XDG_CACHE_HOME/delegate/safe-workspaces`
+  or `~/.cache/delegate/safe-workspaces`; a source that contains every
+  candidate is refused with `safe_workspace_source_too_broad`. Previously the
+  copy recursed into its own output until `ENAMETOOLONG`.
+- Safe-mode copies skip directories the caller cannot read (other users'
+  `/tmp/systemd-private-*`, for example) with a bounded warning, and any
+  residual copy failure is reported as `safe_workspace_copy_failed` instead of
+  a traceback.
+
+## [0.29.1] - 2026-08-11
+
+### Changed
+
+- The PyPI artifact handoff now uses the official Node 24 upload and download
+  actions, removing the deprecation warnings emitted during the 0.29.0 publish.
+
 ## [0.29.0] - 2026-08-11
 
 ### Added
@@ -981,6 +1387,10 @@ Usage-audit fix wave: 82 sessions and 1,241 delegate invocations from one week o
 
 - Releases before 0.1.3 predate this changelog.
 
+[Unreleased]: https://github.com/treygoff24/delegate-agent/compare/v0.31.0...HEAD
+[0.31.0]: https://github.com/treygoff24/delegate-agent/compare/v0.29.1...v0.31.0
+[0.30.0]: https://github.com/treygoff24/delegate-agent/compare/v0.29.1...v0.30.0
+[0.29.1]: https://github.com/treygoff24/delegate-agent/compare/v0.29.0...v0.29.1
 [0.29.0]: https://github.com/treygoff24/delegate-agent/compare/v0.28.0...v0.29.0
 [0.28.0]: https://github.com/treygoff24/delegate-agent/compare/v0.27.0...v0.28.0
 [0.27.0]: https://github.com/treygoff24/delegate-agent/compare/v0.26.0...v0.27.0

{delegate_agent_cli-0.29.0 → delegate_agent_cli-0.31.0}/CONTRIBUTING.md

@@ -9,14 +9,14 @@ python3 -m venv .venv
 . .venv/bin/activate
 python3 -m pip install -e ".[dev]"
 python3 bin/delegate.py --json describe
-python3 -m unittest discover -s tests -t .
+python3 -m pytest -q
 ```
 
 Use `python3 bin/delegate.py` from this repository when validating development changes. Do not overwrite an installed `delegate` shim, `~/.delegate/config.json`, or any live runtime unless an operator explicitly asks for promotion.
 
 ## Supported platforms
 
-Required CI currently runs on Linux for Python 3.11, 3.12, 3.13, and 3.14. Contributions for macOS or Windows compatibility are welcome, but do not claim support for a platform until tests cover it.
+Required CI runs the suite on Linux for Python 3.11, 3.12, 3.13, and 3.14, and on macOS for Python 3.12. The bubblewrap safe backend is Linux-only and its live tests skip elsewhere. Contributions for Windows compatibility are welcome, but do not claim support for a platform until tests cover it.
 
 ## Development guidelines
 
@@ -35,7 +35,7 @@ Run the narrowest useful checks for your change, then the full suite before prop
 ```bash
 python3 -m compileall -q src tests bin
 git diff --check
-python3 -m unittest discover -s tests -t .
+python3 -m pytest -q
 ruff check .
 ruff format --check .
 ```

{delegate_agent_cli-0.29.0 → delegate_agent_cli-0.31.0}/MANIFEST.in

@@ -6,6 +6,7 @@ include SECURITY.md
 include config.example.json
 include bin/delegate.py
 include bin/delegate-profile-shim
+include scripts/test-parity.sh
 include docs/agent-setup.md
 include docs/cli-reference.md
 include docs/configuration.md