oacp-cli 0.4.0__tar.gz → 0.4.2__tar.gz

{oacp_cli-0.4.0 → oacp_cli-0.4.2}/.github/workflows/release.yml

@@ -32,7 +32,7 @@ jobs:
       - name: Install Python dependencies
         run: |
           python -m pip install --upgrade pip
-          python -m pip install -e . build pytest ruff
+          python -m pip install -e ".[crypto]" build pytest ruff
 
       - name: Run quality gate
         run: make preflight ARGS="--full"

{oacp_cli-0.4.0 → oacp_cli-0.4.2}/CHANGELOG.md

@@ -5,6 +5,171 @@ All notable changes to this project will be documented in this file.
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [0.4.2] - 2026-08-07
+
+### Added
+
+- Profileless admitted requests now receive a documented **default scope
+  envelope** instead of running unbounded: 25 minutes / 2 files /
+  reply-only, every capability and risk flag false, `risk_tier` mirroring
+  the message's declared priority (else `P2`). `allow_without_task_profile`
+  is thereby an admission-only exemption — the sender needn't author a
+  profile, but the bound always exists, and the post-accept threshold
+  checkpoint is always evaluable. A sender-attached voluntary profile on an
+  exempt type is the documented override path and replaces the default
+  entirely. Every decision names its envelope origin in the new
+  `scope_envelope_source` field (`task_profile` / `default_profileless`),
+  and `scope_envelope: null` on an admitted record is now a schema
+  violation the audit writer refuses to persist. Protocol spec version
+  bumps to 0.4.2.
+- Admitted public-visibility tasks gain an explicit, recorded enforcement
+  branch: `oacp envelope compile --audit <admission-record>` on a
+  `public_visibility: true` task whose record carries a human admission
+  approval deliberately does **not** compile (a compiled public envelope
+  denies the entire approved chain) and instead stamps
+  `envelope_enforcement: none` with the named reason
+  `public_visibility_admission_approved` into the audit record — the
+  degradation is a documented mode with the human as the bound, not a
+  silent absence. The approval record is treated as authorization:
+  `--audit` must resolve inside the receiver's canonical admission audit
+  directory, the record must be an admission-paused record bound to the
+  exact verified message snapshot (`message_sha256`) with a recorded
+  `approved`/`modified` outcome, eligibility and the stamp consume one
+  locked read, and the branch fails closed while any envelope is active
+  for the receiver. Unapproved public tasks and all private tasks are
+  unaffected and keep the fail-closed compile path.
+- `signing.verify_mode: enforce` is now a real mode with a real caller.
+  The autonomy gate invokes verification at message intake, before any
+  evaluation: under enforce, only a `signed-verified` message proceeds —
+  every other outcome (unsigned, INVALID, unknown-kid, revoked,
+  unverifiable) quarantines a mode-600 evidence copy into the receiver's
+  `dead_letter/`, evaluates nothing, and exits `3` with an
+  `intake_rejected` decision object. Rejection is mechanism, not
+  per-receiver diligence; previously the mode silently degraded to warn
+  and nothing on the receive path consumed it. Warn and off behavior are
+  unchanged. The receive-path contract is pinned by a new executable
+  conformance corpus at `tests/conformance/intake/` (four failure classes
+  under each mode, plus a signed-verified positive control).
+- Policy-file signing: `oacp trust sign-policy` signs a receiver's
+  `config.yaml` and `trust/allowed_signers.yaml` with the receiver's own
+  local key, under a distinct JOSE profile (`oacp-policy+yaml` /
+  `urn:oacp:policy:v1`) so message and policy signatures can never be
+  exchanged. Loaders verify at load time: audit records now carry a
+  `policy_auth` block binding `policy_sha256` to an authorized signer; a
+  tampered `config.yaml` fails closed with the new pinned reason code
+  `policy_auth_invalid` before anything — including its own
+  `verify_mode` — reads it, and a tampered `allowed_signers.yaml` makes
+  the trust root unusable (under enforce, everything then rejects).
+  Unsigned policy files remain loadable with the unsigned state recorded
+  (bootstrap: init → key gen → sign-policy).
+- Policy signatures bind their target context — `{project, receiver,
+  kind}` in the protected header — so a signed policy can never be
+  replayed across projects, receivers, or between `config.yaml` and
+  `allowed_signers.yaml`. `sign-policy` also enrolls each target in a
+  machine-local registry (`$OACP_HOME/keys/policy_enrollment.json`):
+  once enrolled, a policy file without a verifiable signature is
+  `invalid`, never `unsigned` — stripping a trailer stops being a
+  downgrade path. Trust mutations (`trust import` / `revoke`)
+  atomically re-sign an enrolled trust root or refuse the write.
+- Single-read snapshot discipline on every receiver read path: the gate,
+  the trust-root load, and all policy consumers (envelope compiler, send
+  helper, trust mutations, inbox lister) verify and parse ONE bounded
+  read of each security-sensitive file, closing the window where a
+  config, message, or pins file could be swapped between its
+  verification and its use. The audit record's `message_sha256` now
+  names the verified snapshot bytes.
+- Every non-gate inbox read path goes through one shared receive
+  boundary (verify one bounded snapshot before parsing it): the `oacp
+  inbox` lister, the `oacp watch` event emitter, the send helper's
+  parent-message lookup, and the trust drift report's traffic probe.
+  Under `enforce`, an unverified message surfaces as a held row/event
+  built from filesystem metadata only (no attacker-controlled field is
+  parsed or surfaced), never donates thread identity to replies, and
+  never counts as sender liveness; under `warn` rows and events carry
+  the verification status. A receiver config that fails policy
+  authorization cannot choose a weaker mode — these paths fail closed
+  to enforce. The envelope compiler refuses to compile from a message
+  that is not signed-verified under enforce, and the envelope's
+  `message_sha256` names the verified snapshot. `oacp trust list` and
+  doctor readiness calculations load policy files through the
+  authorized loader; `oacp doctor` reports per-receiver policy-file
+  authorization status.
+
+### Fixed
+
+- Intake conformance tests now skip goldens that pin a
+  signature-evaluation outcome when the optional cryptography dependency
+  is not installed, restoring the suite's graceful degradation without
+  the `[crypto]` extra. The release quality gate installs the extra so
+  the full signing matrix runs before publishing.
+- Agent enumeration now consistently ignores hidden directories under
+  `agents/`, preventing runtime scaffolding such as `.claude/.cc-writes` from
+  appearing as phantom agents in doctor, inbox, profile, and trust workflows.
+- Autonomy-gate negation demotion now recognizes common scope language and
+  carries unambiguous negation headings over their immediately following,
+  bounded block. Blank lines and subsequent headings end that scope, while
+  non-demotable side-effect and content-sensitivity hard stops remain hard.
+- Claude envelope enforcement now allows a reconstructed Edit/Write change
+  confined to the project's own `[project] version` string in
+  `pyproject.toml` under `touches_dependencies: false`, while counting the
+  file and continuing to deny real dependency, mixed, ambiguous, and
+  Bash-side manifest edits.
+- The foreign-session read-only `oacp envelope show` exemption now recognizes
+  argparse-equivalent `--option=value` spellings, unambiguous long-option
+  abbreviations, and help flags without weakening its fail-closed handling of
+  unknown options.
+- Autonomy audit records now resolve `runtime.model` at the writer instead
+  of defaulting to a silent null. The serving model resolves caller-first
+  (an explicit `runtime.model` on the decision), then from the
+  `OACP_RUNTIME_MODEL` environment variable exported by the invoking
+  session, and is normalized at write time: case variants fold to
+  lowercase, and `[context]` suffixes split into the base id plus a
+  separate `model_context` field. `model_source` names the provenance and
+  `model_raw` preserves any input the normalization changed. Records with
+  no signal carry an explicit `model_unknown_reason` — never a silent
+  null — and the requested model (harness configuration) is never used as
+  a fallback. Historical records are not backfilled.
+- The autonomy audit writer now validates `result.completion_kind` against
+  the pinned enum at write time, refusing to persist decisions that carry
+  a caller-composed off-enum kind.
+
+## [0.4.1] - 2026-08-04
+
+### Fixed
+
+- Receiver configs that omit the `autonomy` block, such as signing-only
+  configs, now preserve the same conservative `always_pause` behavior as an
+  absent config file. Doctor reports the config as valid, and the autonomy
+  evaluator records the normal `admission_paused` / `mode_always_pause`
+  fingerprint instead of treating the config as malformed.
+- The Claude envelope hook now splits compound Bash commands only at shell
+  operators outside quoted arguments and command substitutions, so read-only
+  patterns containing literal pipes and backslash-newline continuations no
+  longer produce false escalation while later mutating segments remain gated.
+  Its conservative parser fallback recognizes only a small, redirect-free
+  read-only command set. Every emitted ask or deny reason now starts with the
+  stable `[oacp-envelope]` source tag and includes the active task message id
+  when available, making hook prompts distinguishable from harness prompts.
+- Envelope enforcement is now session-scoped. The compiled envelope
+  records the harness session that compiled it (via a hook-observed
+  session claim consumed by the compiler), and the Claude adapter
+  no-ops for tool calls from any other session — a concurrent
+  interactive session in the same repository no longer inherits a
+  dispatched task's constraints or consumes its `files_touched`
+  budget. Envelopes compiled without a resolvable session (un-hooked
+  runtimes, or callers the harness gave no session id) stay unbound
+  and keep the historical whole-workspace enforcement scope, and
+  same-task recompiles — including a post-re-authorization
+  `--extend` from outside the bound session — inherit the existing
+  binding.
+- The autonomy gate evaluator now persists complete, lock-serialized
+  audit records to the `--audit-dir` destination; previously an
+  evaluation could finish without writing the durable record.
+- `oacp doctor` now reports trust-pin completeness per receiver and
+  gates enforce-mode signing readiness on it: every catalog identity
+  must carry an active pin before a receiver flips to enforce, with
+  gaps broken down per receiver in doctor output.
+
 ## [0.4.0] - 2026-07-17
 
 ### Added
@@ -537,6 +702,8 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 - Checkout step in github-release workflow job (#19)
 - Pre-release audit fixes: SHA-pinned actions, dangling doc refs (#15, #16)
 
+[0.4.2]: https://github.com/kiloloop/oacp/compare/v0.4.1...v0.4.2
+[0.4.1]: https://github.com/kiloloop/oacp/compare/v0.4.0...v0.4.1
 [0.4.0]: https://github.com/kiloloop/oacp/compare/v0.3.5...v0.4.0
 [0.3.5]: https://github.com/kiloloop/oacp/compare/v0.3.4...v0.3.5
 [0.3.4]: https://github.com/kiloloop/oacp/compare/v0.3.3...v0.3.4

{oacp_cli-0.4.0 → oacp_cli-0.4.2}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: oacp-cli
-Version: 0.4.0
+Version: 0.4.2
 Summary: Open Agent Coordination Protocol CLI for file-based multi-agent workflows
 Project-URL: Homepage, https://github.com/kiloloop/oacp
 Project-URL: Repository, https://github.com/kiloloop/oacp

{oacp_cli-0.4.0 → oacp_cli-0.4.2}/docs/guides/doctor.md

@@ -35,6 +35,10 @@ Checks the project directory structure under `$OACP_HOME/projects/<name>/`.
 - **workspace.json** — must exist and contain valid JSON
 - **agents/ directory** — must exist; reports the number of registered agents
 
+Agent discovery ignores hidden directories directly under `agents/`. Tooling
+scaffolding such as `agents/.claude/.cc-writes/` is therefore not counted or
+checked as a phantom agent if a runtime creates it in that location.
+
 ### 3. Inbox Health
 
 Scans each agent's `inbox/` directory for pending messages and staleness.

{oacp_cli-0.4.0 → oacp_cli-0.4.2}/docs/guides/runtime_capability_matrix.md

@@ -1,12 +1,12 @@
 # Cross-Runtime Parity Matrix
 
-**Date**: 2026-06-26
+**Date**: 2026-08-03
 
 This is a capability comparison across the currently profiled agent runtimes (Claude Code, Codex, Gemini), compiled from each runtime's self-report and current runtime changelogs. Cursor support is scaffold-only until Cursor-owned onboarding lands, so Cursor is intentionally excluded from this comparison table; see `docs/protocol/runtime_capabilities.md` for its conservative scaffold defaults.
 
-Claude was last checked against Claude Code `v2.1.170` with Claude Fable 5 (`claude-fable-5`, serving model verified in-session on the 1M-context variant). Fable 5 (released 2026-06-09, first Mythos-class model) is included at no extra cost on Pro/Max/Team/Enterprise plans Jun 9–22, 2026, with usage credits required after; Opus 4.8 remains available and serves as Fable 5's safeguard-fallback model.
+Claude was last checked against Claude Code `v2.1.220` (verified in-session 2026-08-03 via `claude --version`) with Claude Fable 5 (`claude-fable-5`, serving model verified in-session on the 1M-context variant). Fable 5 (released 2026-06-09, first Mythos-class model) is now included in Max and Team Premium plan usage as part of the shared weekly limit pool (the launch-window free-inclusion/credit period has ended); the API rate is $10/$50 per MTok. Claude Opus 5 (`claude-opus-5`, released 2026-07-24) is the current Opus tier at $5/$25 per MTok with the same 1M context; Opus 4.8 remains available at the same price and remains the safeguard-fallback target for Fable 5's classifier fallbacks (unchanged by the Opus 5 release).
 
-Codex was last checked against app update `26.616`, CLI `0.142.3`, the local desktop app `26.623.31921`, OpenAI's GPT-5.5 launch note from 2026-04-23, and the June 2026 Codex/API entries for Sites, Amazon Bedrock, Remote, and Record & Replay.
+Codex was last checked against app update `26.727`, stable CLI `0.146.0`, GPT-5.6, and the OpenAI Codex/API changelog entries through 2026-07-30. Runtime availability remains configuration-dependent: standard multi-agent support and memories are stable, while multi-agent V2, token budgets, current-time reminders, and remote Code Mode may still require explicit enablement or experimental configuration.
 
 ---
 
@@ -15,18 +15,19 @@ Codex was last checked against app update `26.616`, CLI `0.142.3`, the local des
 | Capability             | Claude (Claude Code CLI)                                                   | Codex (Desktop App)                                                                            | Gemini                                                                |
 | ---------------------- | -------------------------------------------------------------------------- | ---------------------------------------------------------------------------------------------- | --------------------------------------------------------------------- |
 | Spawn background tasks | Yes — Task tool + Bash `run_in_background`                                 | Yes — shell background processes                                                               | Yes — `run_command` async mode                                        |
-| Spawn subagents        | Yes — typed agents (Explore, Plan, general-purpose, code-reviewer, etc.)   | Yes — native multi-agent lifecycle with runtime metadata and follow-up defaults                | Partial — `browser_subagent` only                                     |
-| Parallel agent teams   | Yes — TeamCreate, task lists, SendMessage, broadcast                       | Partial — parallel spawned agents are supported, but there is no team/task-list primitive      | No — parallel tool calls but no independent agent instances           |
+| Spawn subagents        | Yes — typed agents (Explore, Plan, general-purpose, code-reviewer, etc.)   | Yes — stable native multi-agent lifecycle with runtime metadata and follow-up controls         | Partial — `browser_subagent` only                                     |
+| Parallel agent teams   | Yes — TeamCreate, task lists, SendMessage, broadcast                       | Partial — parallel delegation is supported; opt-in multi-agent V2 adds configurable models, reasoning, concurrency, and roles, but there is no shared team/task-list primitive | No — parallel tool calls but no independent agent instances           |
 | MCP tools              | Yes — extensible via MCP servers                                           | Yes — MCP/plugin support with `/mcp verbose`, per-server environment targeting, read-only MCP parallelism, scriptable plugin inventory, and default tool-search exposure where supported | Yes — MCP server support                                              |
 | Web search             | Yes — native WebSearch tool                                                | Yes — web search/fetch tools; hosted web tools are expanding in code-mode flows                | Yes — native `search_web` tool                                        |
-| Browser interaction    | Partial — WebFetch (read-only, HTML→markdown)                              | Partial — in-app browser and Chrome extension can inspect local/public and approved browser contexts, with faster asset extraction and read-only JS structured-data extraction; not full browser automation | Yes — full browser control (click, type, navigate, screenshot, video) |
+| Browser interaction    | Partial — WebFetch (read-only, HTML→markdown)                              | Configuration-dependent — Browser and Chrome plugins can navigate, click, type, inspect, and capture approved contexts; history search remains separately permissioned | Yes — full browser control (click, type, navigate, screenshot, video) |
 | File system access     | Sandboxed — configurable read/write allowlists                             | Policy-dependent per session; named permission profiles can include deny-read rules and managed requirements | Full — unrestricted                                                   |
-| Git operations         | Yes — via Bash (may need sandbox configuration)                            | Yes — native                                                                                   | Yes — via shell                                                       |
+| Multi-folder projects  | Manual workspace composition                                               | Yes — the primary folder controls new chats, Git, and automatic instruction/skill/config discovery; secondary folders provide file access | Manual workspace composition                                          |
+| Git operations         | Yes — via Bash (may need sandbox configuration)                            | Yes — native; in a multi-folder project, operations are rooted in the primary folder           | Yes — via shell                                                       |
 | GitHub CLI (gh)        | Yes — via Bash (may need sandbox configuration)                            | Yes — authenticated                                                                            | Yes — native                                                          |
-| Session memory         | Strong — auto-loaded MEMORY.md + optional MCP memory                       | Partial — app memories where available plus OACP file memory; app memories are not protocol SSOT | Partial — Knowledge Items (not directly writable), conversation logs  |
-| Interactive mode       | Yes — CLI chat with permissions, plan mode                                 | Yes — desktop app and CLI/TUI, including Plan Mode, Goal mode, side conversations, archive/unarchive/delete flows, and token-budget-aware long-running work | Yes — chat with task UI, artifacts                                    |
-| Context window         | ~1M with Fable 5 or Opus 4.8 (auto-compaction extends indefinitely)        | Model-dependent; GPT-5.5 in Codex is documented at 400K, with no auto-compaction guarantee      | ~1M tokens                                                            |
-| Cost model             | Token-based, visible in statusline; Fable 5 API rate is $10/$50 per MTok (2× Opus 4.8's $5/$25) | Not surfaced per session; GPT-5.5 Fast mode trades 2.5x cost for 1.5x token generation speed, and newer CLI builds add explicit token budgets for bounded work | Token-based                                                           |
+| Session memory         | Strong — auto-loaded MEMORY.md + optional MCP memory                       | Partial — stable generated app memories plus OACP file memory; app memories are not protocol SSOT | Partial — Knowledge Items (not directly writable), conversation logs  |
+| Interactive mode       | Yes — CLI chat with permissions, plan mode                                 | Yes — desktop app and CLI/TUI, including Plan and Goal modes, named and pinned sessions, side-chat switching, forks, and archive/unarchive/delete flows | Yes — chat with task UI, artifacts                                    |
+| Context window         | ~1M across the current lineup (Fable 5, Opus 5, Opus 4.8); auto-compaction extends indefinitely | Model-dependent; GPT-5.6 Sol, Terra, and Luna are documented at 272K                           | ~1M tokens                                                            |
+| Cost model             | Token-based, visible in statusline; Fable 5 API rate is $10/$50 per MTok (2× the $5/$25 shared by Opus 5 and Opus 4.8) | ChatGPT sessions do not surface per-session cost; API Fast mode for Sol trades 2× price for up to 2.5× speed, while Terra and Luna target lower-cost work | Token-based                                                           |
 | Sandbox restrictions   | Yes — configurable allowlists                                              | Session-dependent; supports deny-read policies, isolated `codex exec`, named permission profiles, managed requirements, and explicit approval policies | None — full system access                                             |
 
 ---
@@ -41,8 +42,8 @@ Codex was last checked against app update `26.616`, CLI `0.142.3`, the local des
 | Plan mode                        | Claude, Codex | Claude has structured explore → plan → approve → implement; Codex CLI can move from planning into fresh-context implementation |
 | Auto-compaction                  | Claude        | Context auto-compresses, enabling unlimited session length                   |
 | Cross-session semantic search    | Claude        | MCP-based searchable memory (optional)                                       |
-| Browser automation (full)        | Gemini        | Click, type, navigate, screenshot, WebP video recording                      |
-| GPT-5.5 model availability       | Codex         | Available in Codex for Plus, Pro, Business, Enterprise, Edu, and Go plans with a 400K context window |
+| Browser automation              | Codex, Gemini | Codex Browser/Chrome plugins can click, type, navigate, inspect, and capture approved contexts; Gemini also supports WebP video recording |
+| GPT-5.6 model family            | Codex         | Sol, Terra, and Luna provide task-tier choices with a documented 272K context window |
 | Image generation                 | Codex, Gemini | Codex CLI image generation is enabled by default; Gemini has native `generate_image` |
 | URL content reading (no browser) | Gemini        | `read_url_content` fetches HTML→markdown or PDF directly                     |
 | Code outline navigation          | Gemini        | `view_file_outline`, `view_code_item` for structured exploration             |
@@ -53,12 +54,14 @@ Codex was last checked against app update `26.616`, CLI `0.142.3`, the local des
 | Remote host control              | Codex         | Mobile or desktop remote control can run work on connected Mac or Windows hosts with host-local files, credentials, plugins, skills, and config |
 | App-level artifact review        | Codex         | Sidebar preview for generated PDFs, spreadsheets, documents, and presentations |
 | App-level PR review              | Codex         | PR sidebar can inspect changed files, review comments, and follow-up fixes   |
-| App-server automation            | Codex         | JSON-RPC app-server, SDK, schema generation, thread APIs, and websocket/Unix-socket transports for custom clients |
+| Multi-folder projects            | Codex         | One project can span repositories; the primary folder owns Git and automatic instruction, skill, and config discovery, while secondary folders are file-access-only |
+| Session organization             | Codex         | CLI/TUI supports named and pinned sessions, side-chat switching, archive/unarchive, deletion, and temporary or persisted forks |
+| App-server automation            | Codex         | JSON-RPC app-server, SDK, schema generation, thread APIs, and authenticated WebSocket/Unix-socket/stdio transports; remote Code Mode remains experimental |
 | Hosted site deployment           | Codex         | Sites preview can create, deploy, inspect, and manage hosted websites or internal tools through the Codex app |
-| Plugin marketplace inventory     | Codex         | Plugin directory plus `codex plugin list --json` for installed plugin inventory and marketplace-aware diagnostics |
+| Plugin marketplace inventory     | Codex         | Agent Plugin manifests, workspace publishing, additional marketplaces, and `codex plugin list --json`; availability and trust remain configuration-dependent |
 | Goal mode                        | Codex         | Stable long-running objective mode with dedicated state; candidate for OACP wait/review-loop experiments |
 | Record & Replay                  | Codex         | Mac desktop workflows can be recorded and converted into reusable skills; candidate for private skill capture after privacy review |
-| Current-time reminders           | Codex         | CLI can remind agents of current time/date context; useful for protocol work with relative dates and scheduled waits |
+| Current-time reminders           | Codex         | Announced CLI surface for relative-date work; feature availability must be checked before workflow dependence |
 
 ---
 
@@ -80,9 +83,9 @@ Scope: skills shipped in [`kiloloop/oacp-skills`](https://github.com/kiloloop/oa
 
 | Dimension       | Claude                                                                 | Codex                                                                   | Gemini                                                               |
 | --------------- | ---------------------------------------------------------------------- | ----------------------------------------------------------------------- | -------------------------------------------------------------------- |
-| Best at         | Orchestration, multi-agent teams, persistent memory, plan-then-execute | Terminal-native execution, GPT-5.5 agentic coding, fast iterative patching, plan-to-implementation handoff, app-assisted PR/artifact review, app-server automation, protocol discipline | Web research, browser automation, visual verification, large context |
+| Best at         | Orchestration, multi-agent teams, persistent memory, plan-then-execute | Terminal-native execution, GPT-5.6 agentic coding, fast iterative patching, native delegation, plan-to-implementation handoff, app-assisted review, app-server automation, protocol discipline | Web research, browser automation, visual verification, large context |
 | Ideal task type | Team coordination, complex multi-file refactors, long-running sessions | Shell-heavy workflows, long-horizon coding, targeted file edits, deterministic scripts, PR follow-up, artifact review, CLI planning passes, plugin/app-server automation prototypes | External research, UI testing, document review, MCP integrations     |
-| Cost profile    | Flexible (haiku subagents for cheap tasks, opus for complex, Fable 5 at 2× Opus API rates for the hardest work) | Per-session cost not visible; GPT-5.5 is described as more token-efficient than GPT-5.4 for Codex tasks | Token-based, web search has additional costs                         |
+| Cost profile    | Flexible (haiku subagents for cheap tasks, opus for complex, Fable 5 at 2× Opus API rates for the hardest work) | Per-session ChatGPT cost not visible; Sol, Terra, and Luna provide quality/speed/cost tiers, with API Fast mode available for Sol | Token-based, web search has additional costs                         |
 
 ---
 
@@ -90,17 +93,17 @@ Scope: skills shipped in [`kiloloop/oacp-skills`](https://github.com/kiloloop/oa
 
 | Limitation                    | Claude                        | Codex                                                          | Gemini                 |
 | ----------------------------- | ----------------------------- | -------------------------------------------------------------- | ---------------------- |
-| No subagents                  | —                             | Yes                                                            | Partial (browser only) |
-| No browser automation         | Yes (read-only)               | Partial (in-app browser and Chrome extension are useful for review/verification, but not a general full-browser automation substitute) | —                      |
+| No subagents                  | —                             | —                                                              | Partial (browser only) |
+| No browser automation         | Yes (read-only)               | Configuration-dependent — Browser/Chrome plugins and an approved context are required | —                      |
 | No image generation           | Yes                           | —                                                              | —                      |
 | No persistent writable memory | —                             | Partial (app memories are not a replacement for OACP durable memory) | Yes                    |
 | Sandbox friction              | Yes (configurable)            | Session-dependent                                              | —                      |
-| No team primitive             | —                             | Yes                                                            | Yes                    |
-| Context limits                | Auto-compaction mitigates     | Model-dependent; GPT-5.5 in Codex is 400K, but there is no documented auto-compaction behavior | Large but finite       |
+| No team primitive             | —                             | Partial — native parallel delegation exists, but not a shared task-list/broadcast primitive | Yes                    |
+| Context limits                | Auto-compaction mitigates     | GPT-5.6 Sol, Terra, and Luna are 272K; compaction behavior is runtime-dependent | Large but finite       |
 | No terminal stdin             | Yes                           | —                                                              | —                      |
 | Cost not surfaced             | —                             | Yes                                                            | —                      |
 | Permanent session delete      | —                             | `codex delete` is available; use archive/unarchive for routine cleanup and reserve delete for explicit destructive cleanup | —                      |
-| Serving model can change mid-session | Yes (Fable 5 only — cyber/bio-chem/distillation classifiers fall back to Opus 4.8; default and non-configurable in Claude interfaces incl. Claude Code, with a session event emitted; <5% of sessions — system card §1.5) | — | — |
+| Serving model can change mid-session | Yes (Fable 5 only — cyber/bio-chem/distillation classifiers fall back to Opus 4.8, a target unchanged by the Opus 5 release; enabled by default and user-configurable in Claude interfaces — off-toggle in Settings > Capabilities, or Config > MODEL & OUTPUT in Claude Code, after which a flagged request pauses instead of switching; a session event is emitted on switch; <5% of sessions) | — | — |
 
 ---
 
@@ -110,10 +113,10 @@ These are the highest-impact gaps where one runtime's limitation blocks effectiv
 
 | Gap                         | Affected Runtime(s)                | Impact                                                             | Proposed Fix                                                                   |
 | --------------------------- | ---------------------------------- | ------------------------------------------------------------------ | ------------------------------------------------------------------------------ |
-| No team orchestration       | Codex, Gemini                      | Cannot run parallel agent teams                                    | Agent cards — let runtimes discover and delegate to capable peers              |
+| No shared team/task-list primitive | Codex, Gemini                | Codex can delegate in parallel but lacks Claude-style shared task lists and broadcast; Gemini lacks independent general agents | Agent cards — let runtimes discover and delegate to capable peers |
 | Memory asymmetry            | Codex (partial), Gemini (KIs only) | Cross-session context degrades without MEMORY.md equivalent        | Standardize memory protocol; each runtime implements its own persistence layer |
 | Sandbox blocks git/gh       | Claude                             | Every git/gh call needs sandbox configuration                      | Configure sandbox allowlists or disable sandbox for specific commands          |
-| Full browser automation gap | Claude, Codex                      | Claude is read-only; Codex has stronger browser review and Chrome-extension support but not full autonomous browser automation | Delegate full browser tasks to Gemini; use Codex browser/Chrome workflows for local, public, or approved signed-in page review |
+| Full browser automation gap | Claude; Codex without Browser/Chrome plugins | Claude is read-only; Codex browser control depends on installed plugins and an approved browser context | Delegate to a browser-capable runtime or enable the scoped Codex browser surface after privacy review |
 | Reviewer cost               | All (especially Claude)            | High cost for single PR review with polling pattern                | Stateless reviewer rounds — one round per invocation                           |
 | Public skill coverage       | Gemini                             | `kiloloop/oacp-skills` ships `claude/` and `codex/` variants for all 5 public skills; no `gemini/` variants — Gemini users must rely on convention-based adoption | Add `gemini/` variants to each public skill, or document the convention-based pattern as a first-class install path |
 
@@ -124,7 +127,7 @@ These are the highest-impact gaps where one runtime's limitation blocks effectiv
 | Dimension                    | Claude                           | Codex                                      | Gemini                                        |
 | ---------------------------- | -------------------------------- | ------------------------------------------ | --------------------------------------------- |
 | Max parallel tool calls      | ~10+                             | Yes (parallel independent calls)           | ~10 (practical)                               |
-| Side conversations           | No                               | Yes (`/side` in CLI/TUI)                   | No                                            |
+| Side conversations           | No                               | Yes — named/pinned sessions and side-chat switching in CLI/TUI | No                                            |
 | Hooks system                 | Yes (pre/post tool call hooks)   | Yes (stable hooks and extension lifecycle hooks; plugin-bundled hooks are configuration-dependent) | No                                            |
 | Automation scheduling        | Yes (`CronCreate`, `ScheduleWakeup`, `/loop`, `/schedule` skills) | Yes (desktop app thread automations, Goal mode, and app-server/SDK automation surfaces) | No                                            |
 | Notebook editing             | Yes (NotebookEdit tool)          | No                                         | No                                            |
@@ -138,7 +141,8 @@ These are the highest-impact gaps where one runtime's limitation blocks effectiv
 | Workflow file format         | SKILL.md with YAML frontmatter   | SKILL.md with YAML frontmatter             | Markdown with YAML frontmatter                |
 | Policy visibility at runtime | Partial (sandbox config visible) | Yes (session policy, approval policy, sandbox, and named permission profiles) | Yes (`SafeToAutoRun` flags)                   |
 | Long-running shell sessions  | Bash tool (no stdin)             | Yes (PTY + stdin; multiple terminals in app) | Yes (`send_command_input`)                    |
-| App-server / SDK             | No                               | Yes (JSON-RPC app-server, Python SDK, archive/thread APIs, schema generation, remote execution improvements, and multi-agent continuation surfaces) | No                                            |
+| App-server / SDK             | No                               | Yes (JSON-RPC app-server, Python SDK, thread/fork APIs, authenticated WebSocket/Unix/stdio transports, and experimental remote Code Mode) | No                                            |
+| Multi-folder projects        | No native primary-folder model   | Yes (primary folder owns Git and automatic instruction/config discovery; secondary folders are file-access-only) | No native primary-folder model                |
 | Hosted site deployment       | No                               | Yes (Sites preview, app-only/cloud-hosted with separate secret management) | No                                            |
 | Desktop workflow capture     | No                               | Yes (Record & Replay on Mac; privacy-sensitive and best treated as private-skill capture until reviewed) | No                                            |
 
@@ -146,10 +150,11 @@ These are the highest-impact gaps where one runtime's limitation blocks effectiv
 
 ## 8. Source Notes
 
-- GPT-5.5 Codex availability, 400K context, Fast mode, token-efficiency, and API timing come from OpenAI's 2026-04-23 release note: <https://openai.com/index/introducing-gpt-5-5/>.
-- Codex app/CLI capability changes through app `26.616`, CLI `0.142.3`, and the local desktop app `26.623.31921` come from OpenAI's Codex changelog and local Codex runtime checks: <https://developers.openai.com/codex/changelog>.
+- GPT-5.6 model availability, the corrected 272K context window, stable memories and multi-agent support, session organization, Agent Plugins, multi-folder behavior, browser/Chrome changes, and app-server transports come from OpenAI's Codex changelog: <https://developers.openai.com/codex/changelog>.
+- Codex app/CLI capability changes are reviewed through app `26.727` and stable CLI `0.146.0`; workstation-specific alpha versions are intentionally kept out of this public matrix.
+- GPT-5.6 API model and pricing changes through 2026-07-30 come from the OpenAI API changelog: <https://developers.openai.com/api/docs/changelog>.
 - Sites, Amazon Bedrock, Remote, Record & Replay, app-server, plugin, and permissions details come from the official Codex docs under <https://developers.openai.com/codex/>.
-- Claude Fable 5 release date, pricing, and plan-inclusion window come from Anthropic's 2026-06-09 announcement: <https://www.anthropic.com/news/claude-fable-5-mythos-5>. Safeguard-fallback behavior comes from the Fable 5 / Mythos 5 system card §1.5 ("Novel safeguards"): client apps and Claude interfaces auto-fall back to Opus 4.8 (default and non-configurable in interfaces, session event emitted), while the Messages API blocks by default with a structured refusal category and offers opt-in server-side fallback. The serving model in the header was verified in-session by the Claude runtime.
+- Claude Fable 5 release date and pricing come from Anthropic's 2026-06-09 announcement: <https://www.anthropic.com/news/claude-fable-5-mythos-5>; the current plan-inclusion posture (Max/Team Premium shared weekly pool, launch promo ended) reflects Anthropic's plan policy as of 2026-07-20. Claude Opus 5 model ID, pricing ($5/$25 per MTok), 1M context, and its release as the current Opus tier were re-verified 2026-08-03 against Anthropic's model documentation (models overview + migration guide at <https://platform.claude.com/docs/en/about-claude/models/overview.md>): Opus 5 is a drop-in at Opus 4.8's pricing, and Opus 4.8 stays available. Present-day interface fallback behavior comes from Anthropic's Help Center article "Why Claude switched models in your conversation with Fable 5" (2026-07-01, verified 2026-08-04): automatic switching to Opus 4.8 is enabled by default and user-configurable — Settings > Capabilities in the apps, Config > MODEL & OUTPUT in Claude Code ("Switch models when a message is flagged" toggle); with it off, a flagged request pauses the conversation. The Fable 5 / Mythos 5 system card §1.5 ("Novel safeguards") remains the source for the safeguard design, the observed fallback-rate/session-event facts, and the API posture: the Messages API blocks by default with a structured refusal category and offers opt-in server-side fallback — whose category-routed default likewise targets Opus 4.8 for cyber-class refusals, so the fallback target is unchanged post-Opus-5. The serving model (claude-fable-5) and Claude Code version (v2.1.220) in the header were verified in-session by the Claude runtime on 2026-08-03.
 
 ---