v0.11.0 - whole-project audit, coverage stage, live pipeline guidance

The biggest release since the pipeline itself: a whole-project audit, a seventh coverage stage that proves the work is actually done, live pipeline guidance in the TUI, and a broad hardening sweep. 66 commits since v0.10.1.

Highlights

• Whole-project audit — ritual audit (with --discover) runs parallel blind lanes across the codebase, then a cross-vendor judge adjudicates every candidate into standard findings that land in the normal triage flow. New knobs: budget_audit_usd and audit_max_lanes; the judge's budget cap scales with the lane count so a big audit doesn't starve mid-run.

• Coverage stage + ritual complete — a new 7th pipeline stage judges your deliverables against the spec's checklist and gates on zero gaps, so "done" means done. ritual complete is a bounded auto-driver that loops (coverage → drive the gaps → re-check) until the feature is complete; ritual complete --check is a scriptable predicate. Budgets and loop bounds live under [complete].

• Pipeline guidance in the TUI — the sidebar now tells you what to do next. Done stages show a stale marker when the spec, plan, or code moved after they ran (tracked via document mtimes and a tree fingerprint persisted at each stage's finish). A » next: strip names the next actionable stage and its top blocker or warning ("62 confirmed finding(s) open", "plan.md missing — run plan first", "check.sh is red"). Press i on any stage for a detail overlay: status, when it finished, the last run's cost/model, exactly why it's stale, what it unlocks, and the suggested action.

• Honest, context-aware which-key — the ? overlay now advertises exactly the keys that work in the current tab and context, with a durable test that fails loudly on drift. g/G/j/k genuinely work on every tab — the History tab finally scrolls — and long sidebar/live-stream text wraps instead of clipping mid-sentence.

• ritual reset-plan (CLI + TUI) — re-plan from the spec while keeping your code, with an exact-branch match so a reset can never touch another feature's findings.

• offline = true is now a real kill-switch — it blocks agent runs before any process spawns (chat and audit refuse identically), not just a preflight skip.

Hardening sweep

• Provenance chain survives parallel runs — an flock around the last-link→meta write plus linkage-order verification, so concurrent runs (e.g. an 8-lane audit) keep the chain intact and verifiable.
• Durable state — writer-unique atomic writes and CLI reload-merge-save, so a background daemon and a foreground command can't clobber each other's stage updates.
• Runner stream/lifecycle robustness — lossy-UTF8 stdout, a stderr sidecar, SIGTERM-aware failure metadata, and incremental tail draining.
• Gates fail closed — a git snapshot error blocks rather than green-lights; dual-review preflights the diff so it can't produce a vacuous green review; code-fix enforces its git guardrail with --disallowedTools and leaves failed attempts in the tree for inspection.
• Branch-slug collisions contained — raw-branch reset matching plus doctor/TUI warnings.

Docs

• GitHub-safe README (no Nerd Font private-use glyphs that render as tofu on github.com), with the audit / coverage / complete workflows, budget knobs, and the offline kill-switch documented.

Install

cargo install --path . --locked      # or: cargo build --release

Full changelog: v0.10.1...v0.11.0