v0.4.2

0.4.2 (2026-07-22)

Features

• 01-30: re-add bootup model question — per-role, fail-closed (ADR §D) (20cf888)
• 01-40-t1: runtime write-guard + R3 lint receiver-provenance fix (ruling-independent half) (f813ab1)
• adr-0006: liveness completeness + fail-closed honest surface (MUST-FIX set) (9123c28)
• adr-0007: moderate-tier LLM operator-proxy (make --expect-pages>0 reachable-green, honestly) (dbc6459)
• architect: restore deliver-until-consumed dispatch invariant (ADR-0009) (4b885cc)
• canon: worker-contract.md — one worker/TRON interface doc + lint L24 (85ea33a)
• canon: worker-contract.md — the worker/TRON interface doc; spawn points at it; reply_line slimmed; lint L24 keeps it in sync (adda829)
• core: restore the worker<->engine messaging layer (the T2-01 wall) (18714ae)
• core: rewrite brick 1 — content-bound landing primitive (kills the confirmed root) (f484501)
• core: rewrite brick 10 — reviewers (cadence PULL) + DONE-REVIEW gate + log-review (6869ae1)
• core: rewrite brick 11 — liveness (silence sweep -> ping -> stalled -> recover) (1bd031d)
• core: rewrite brick 12 — Engine entrypoint + bootup (the whole engine runs bootup->done) (60d5a57)
• core: rewrite brick 13 — classify (the ONE LLM judgment, observe phase) (3f5913f)
• core: rewrite brick 14 — fresh L2 SIM harness (reusable, unbiased) over core.Engine (b69d488)
• core: rewrite brick 15 — L3 launcher wiring + boot-over-REAL-scaffold validation (caught a real bug) (fcbf2e2)
• core: rewrite brick 17 — GAP-A operator-page floor (never a permanent silent drop) (e519c30)
• core: rewrite brick 18 — GAP-E architect-first routing for ALL wall kinds (51770f7)
• core: rewrite brick 19 — GAP-C fleet-outage / canary self-release (32fdaaf)
• core: rewrite brick 2 — DONE-ladder tail (record -> close), first clean close on real git (1183efd)
• core: rewrite brick 3 — full DONE ladder (local->merge->trunk->record->close) (c156275)
• core: rewrite brick 4 — crash-safe tick host (observe->decide->act->persist) (80e492e)
• core: rewrite brick 5 — dispatch (pipeline read + SWITCHBOARD spawn->online->assign) (213cec4)
• core: rewrite brick 6 — multi-block run + dep-gating + clean session-end (32f4292)
• core: rewrite brick 7 — sentry pacing ladder; unify capping (no silent gate hang) (174b1b0)
• core: rewrite brick 8 — parked cases (raise-and-defer) + operator settle + walls (2d1d226)
• core: rewrite brick 9 — architect (forward/reconcile) + reconcile-gate (M-05) (0ea217d)
• core: working-aware pacing (GAP-H) + the LIVE L3 driver (8622c26)
• engine: 01-13 T1/T2/T3 — sender-truth resolution, refusal bounce, liveness parity (tron-14 F1/F2/F4/F8/F9/F10) (8fb3a28)
• engine: 01-16 gate lifecycle under worker purge (D-17-1) (174814e)
• engine: 01-16 gate lifecycle under worker purge (D-17-1) — releaseless purge, workerless gates, empty-trunk regression, wind-down live-lock (86b5af2)
• engine: 01-17 paperwork-landing robustness + wall invariants (tron-22/23/24) (0fd6153)
• engine: 01-17 paperwork-landing robustness + wall invariants (tron-22/23/24) (e8c5470)
• engine: 01-18 addendum — await-resume notify, blocked-list invariant arm, lint fail-loud (T5–T7) (2f8a62c)
• engine: 01-18 addendum — await-resume notify, blocked-list invariant arm, lint.py fail-loud (T5/T6/T7) (320ca22)
• engine: 01-18 addendum 2 — T8 durable inbound-message archive (messages.jsonl) (aa22445)
• engine: 01-18 gate-anchor integrity + walled-worker pacing exemptions (d462ca0)
• engine: 01-18 gate-anchor integrity + walled-worker pacing exemptions (d53c20c)
• engine: A-5 full ladder ratchet — trunk+record hold zone, merged-sha ancestry predicate, gate-contradiction escalation (tron-13 D3) (7ed39bb)
• engine: ADR-0009 — restore deliver-until-consumed architect dispatch (+ ADR-0005..0008 stack) (755d9dc)
• engine: F-1/S-3+R-6 unified paperwork lander — per-role allowlists (paperwork_paths), reviewer landing stage, architect FIFO, session-residue sweep; retires PMT-CLOSE worker-side landing (tron-13 D1) (426f108)
• engine: F-4/R-7 operator re-ping ladder + named resumable safe-park, park visibility on every pull surface (tron-13 D4) (0fa8944)
• engine: S-2-full declarative admission table + lint L22; A-2 structured reports channel (report.sh --tag, zero-LLM gate ladder) (tron-13 D2) (d9e78e8)
• modes: add SCAFFOLD mode — /tron-scaffold stands up a new project (5675452)
• modes: add TRON-ALFREDO — the generalist mode (#153) (8e2572c)
• modes: add tron-app/modes with flynn (ex-super-m) and clu personas (d88672a)
• modes: add TRON-KONDO — tidy an existing project up to canon (#154) (1805396)
• modes: install.sh wires the terminal shortcuts too — one command on a fresh machine (55f212b)
• modes: one-command install — slash commands + terminal shortcuts (178fa67)
• modes: SCAFFOLD mode — /tron-scaffold (8fa1dc5)
• modes: tron-app/modes — FLYNN (advisor) + CLU (supervisor) (013b282)
• one-line installer (curl … | sh) (790b7bb)
• one-line installer (curl … | sh) (e3de844)
• scaffold: add skill-linear-cards — reusable Linear card lifecycle skill (#119) (d84caeb)
• scaffold: TRON setup-repo.sh as SoT (+CI/git-version guards) (#108) (76597ff)
• scoping: as-few-blocks-as-possible rule (<=7 tasks/block) — scaffold architect persona + PMT-SCOPE-REMEDIATION (cf58d21)
• scoping: as-few-blocks-as-possible rule (≤7 tasks/block) (bcf6f83)
• sim: the COURIER — harvest worker turn-output into the engine inbox (0896080)
• wall: contain false walls, answer real ones (block 01-24) (4e3cb72)

Bug Fixes

• 01-27: prove fleet-wide outage self-release + escalate stuck close (F-4) (fa56056)
• 01-40-t1: close 4 hostile-review bypasses in the runtime guard + R3 lint (279c6db)
• 01-40-t1: close R3 lint's binding-shape blindness — deny at the mention (572ee9c)
• 01-40-t1: close second-review bypasses — symlink/hardlink src, glob-spec inode alias, chmod/chown, container-mutation taint (7261f3a)
• 01-40-t1: make CI actually run the proof steps + rebuild R3 lint as a class guard (efd9ded)
• 01-40-t1: rebuild R3 lint on flow-insensitive taint UNION (4th rebuild) (aeb6360)
• 01-40-t1: rebuild R3 lint's write-mechanism detection structurally (b40a554)
• 01-40-t1: STOP THE CLASS — deny-by-default runtime guard; close .update() container-taint gap (6197b9b)
• 01-40-t1: THIRD hostile review — generalize container-mutation taint from an enumerated method-name set to arg-taints-receiver (34c1f98)
• 01-40-t1: vendor the real scaffold fixture instead of a cross-org checkout (d93b1f7)
• adr-0006: address Sonnet peer-review before push (R2e→warning, docstring, R1c cap) (c0f2053)
• adr-0007 §7: a SIM passes only if the app is built to the fullest — abandoned block = REJECT (1c20822)
• ADR-0010: kill phantom-wall class at the mint (origin+target invariants) (44c6919)
• ADR-0010: kill the phantom-wall class at the mint (2 invariants) (936ac30)
• architect: idle backstop for a no-op reconcile (T2-12 silent wedge) (12b62a3)
• architect: phantom classify.unclassified triage auto-resolves, never wedges (f968701)
• canon: 01-13 T6 — record order is a NEW order, never a repeat; contract defines a repeat as the same step re-asked (tron-14 F5) (459d67c)
• casestate: don't evict a worker whose own gate is still in-flight (a3159e9)
• ci: full clone for the A/B differential + stub the claude runtime (afc27ed)
• ci: install pyyaml before running the engine test suite (36479b5)
• classify: a tag-less branch declaration is never sent to the judge (T2-16 phantom-wall REJECT root-fix) (3f949c5)
• classify: architect's own unclassified narration never self-triages (a3ca7ee)
• core: forward-wall #4 — architect reconcile can complete (unblocks 01-03) (c27f7d4)
• core: rewrite brick 16 — systematic knobs seam (schema-nested + fail-loud), close fidelity gap (0159357)
• core: T2-01 forward-wall batch — identity, gate.local, two-phase online, prose wall (9fe7946)
• engine: 01-13 T4/T7 — retire_stale_dir (spawn hygiene, crash-resume preserved) + main-worktree exclusion by position (tron-14 F7/F11) (d3af0aa)
• engine: 01-14 merge-order integrity + wall hold (tron-15 D-15-1..4) (1372c8f)
• engine: 01-14 T1-T4 — merge-order integrity + wall hold (tron-15 D-15-1..4) (4c61016)
• engine: 01-14 T2 review gap — a wall-case abandon releases the held worker (fd8f7d8)
• engine: 01-15 close integrity — held-sender verbs, gate lifecycle, hold symmetry (tron-16 D-16-1/D-16-2 + residues) (3d2a0bd)
• engine: 01-15 T1-T6 — close integrity (tron-16 D-16-1/D-16-2 + residues) (33edf42)
• engine: close F-3 — ref-agnostic block invariant + engine-observed validation signal (block 01-25) (2f1446c)
• engine: cut the never-observed worker-retract verb (block 01-29) (d75e43b)
• engine: paperwork case ids stay inside land.sh's safe-token alphabet (b21c361)
• engine: paperwork case ids stay land.sh-landable (token-safe) (697cd8b)
• engine: preserve unlanded paperwork FIFO at the release chokepoint; ratchet accepted-residual note (tron-13 delta review) (c6c4537)
• engine: reactive-layer consolidation — one pacing helper, named escalations (block 01-26) (38d3953)
• engine: record-stage landing — mint arm + truth-ref-keyed record check (91fd20f)
• engine: record-stage landing — mint arm + truth-ref-keyed record check (ADR-0002 D2 completeness) (32c3a57)
• engine: tron-07 campaign — wall set W1–W8 + co-signed hardening (two consecutive clean E2E runs) (#92) (cdf1d6c)
• engine: trunk validation — trusted verdict, no false wall (block 01-28) (1132d56)
• engine: W10 — branch declarations are modifiers hoisted to ingest (any verb, slot-merge data-over-prose, FIFO dedup); lander names surviving refs; residue sweep enumerates worktrees (2dc0e26)
• engine: W11 — the block-branch registry is owner-only (A-1 sender-first completes at the last text-trusting write) (9f6fcb2)
• engine: W12 — a missing branch at the gate gets named and prescribed the one-message remedy, never a blind re-validation order (2e5d8d9)
• engine: W9 — trunk truth reads the pinned committed tree via atomic snapshot, never the working tree (tron-13 attempt-1 wall) (271327b)
• escalation: revalidate a landing worker.wall against trunk before paging (ADR-0008, T2-18 REJECT root fix) (3791693)
• gate: engine owns the local (no-remote) trunk merge (a93fcb4)
• gate: engine owns the local (no-remote) trunk merge (b955a2e)
• landing: content-bind grant case-ids every stage, never cache a stale id (T2-17 REJECT root-fix) (806c34e)
• licence: stop hiding the bpmn.io watermark (#144) (9da474b)
• licence: stop the version stamp overlapping the bpmn.io watermark (#145) (fab4584)
• modes: close the review findings on the scaffold procedure (f2bb90c)
• modes: install.sh robustness + scaffold log dir + stale refs (10a0210)
• modes: install.sh robustness, scaffold log dir, stale refs (c6e7090)
• modes: scaffold appends CLAUDE.md to the app .gitignore (94e066c)
• R1: triage lifecycle engine-state-driven + source-directional (ADR-0005) (5c35cee)
• R3: session-end + acceptance gate on open escalations (ADR-0005) (8dfb807)
• R5: record gate conforms to frozen skill §6 bundled close-out (ADR-0005) (a0c184b)
• review: address Sonnet code-review findings on R3/R5 (ADR-0005) (e543d92)
• router,reviewers: tie reconcile + review completion to engine state, not LLM prose (e6d845d)
• router: a worker.wall FROM the architect is narration, never a self-triage (5041827)
• router: never build-ASSIGN a reviewer (T2-10 reviewer wall) (9f01c72)
• runner: deterministic online handshake (supersede turn-forwarding) (a52481e)
• runner: deterministic worker->engine return path (online handshake) (f94e70c)
• scaffold: point flynn-local template at tron-app/modes/flynn (b56c6e4)
• scaffold: point flynn-local template at tron-app/modes/flynn, not the old canon path (da92241)
• scaffold: protect-branches.sh must require checks, not zero of them (#151) (96be836)
• scaffold: worker-owned landing + orchestrator-agnostic project artifacts (audit F1-F8) (b7c2b45)
• scaffold: worker-owned landing + orchestrator-agnostic project artifacts (audit F1-F8) (ba99a80)
• security: vendor bpmn-js, add CSP, fix annot-btn contrast (U-TRN-7) (#143) (0f95e8d)
• sim+engine: honest live-SIM seed + 8 root fixes for real-LLM E2E (9635613)
• sim: orphan check keys ownership off /proc/<pid>/cwd (peer-review false-neg) (7b384a0)
• sim: scope live-driver orphan check to owned fleet (kill monitor false-REJECT) (8ee9f6a)
• sim: seed live SIM from scaffold_ref (unbuilt) + HEAD meta, not answer key (571d9ad)
• teardown: hard-kill a released-but-alive runner by OS truth, not the state flag (T2-19 REJECT root fix) (4e64179)
• test: drop two more SHAs the history rewrite killed (b9dd131)
• test: pin 01-26 A/B differential to parent SHA 2f1446c (trunk-red hotfix) (8b3ed3d)
• test: resolve 01-26's parent from the log instead of a pinned SHA (05fcb47)
• test: unpin the 01-26 A/B SHA — trunk is red (02f2322)
• TRON logo to latest DS colors (orange mark, ink wordmark) (fd1ce79)
• TRON logo to latest DS colors (orange mark, ink wordmark) (c8a9276)
• trunk: record gate accepts the skill-prescribed Completed date (96000b5)
• ui: move the version stamp to the bottom-left corner (#146) (34c4234)