0.6.0 Governor

The controller no longer carries the work. The pipeline is two axes of script-driven state with a dispatched subagent at every step that needs judgment, a critique gate on every authoring phase, and a fail-closed path for unattended runs.

Five new scripts, one new skill, 17 prompt templates. 9,633 lines across 52 files.

⚠️ If you installed an earlier v0.6.0

The first three v0.6.0 tags shipped exec-store-check using an associative array (declare -A), which is bash 4.0+ only. The scripts use #!/usr/bin/env bash, so on a stock macOS — and on any machine where bash resolves to the system 3.2 — the script died on that line and every check after it silently never ran. Re-install from this tag if you are on macOS.

Three structural defects this closes

Only 2 of 11 phases could reject a bad deliverable. plan-regression and review dispatched independent critics; design and verification had no artifact gate at all, and architecture and spec ran adversarial self-critiques whose own skills refused the word critic — correctly, since one agent grading its own work is not review.

Upstream drift was structurally undetectable. No reviewer prompt in executor-review ever opened the architecture store, so an implementation satisfying every R-nn and every C-nn while violating the ARCH passed every gate in the system. Adapters importing each other, an ORM row crossing into policy, a seam renamed from its IFCE — there was no seat at which anything could see it. Two seats catch it now: the code component's catalog makes the architecture, IFCE and design stores required inputs, and the final reviewer takes them the same way.

The pump's "never authors" rule had no mechanism behind it. AUTHOR-<phase> was a registered role that nothing ever dispatched. The decision table now says to dispatch it, and the phase-axis loop is written out.

The critique gate

executor-critique generalises the plan-regression contract to all nine authoring components. Each phase's artifacts are audited as a set — the defects worth finding live between documents — and the phase cannot be marked passed until that audit is clean or the human has waived it in writing.

The gate is a script, and it is harder than the stage it generalises from:

• verdict: PASS beside a non-zero high/medium is refused, not believed
• the three-round cap is enforced by the script — audit 04 exits 2
• a waiver needs both a note in the row and an initiative ruling naming the artifact
• an empty clearance is not a cleared one

Adding a component is a registry row and a catalog section, not a script. plans proves it: it resolves to the pre-existing plan-regression/ home and reads the same summary.md — one gate, two front doors, not two gates that can disagree.

Unattended runs

exec-gate INIT PHASE --auto clears a gate only when the initiative's autonomous.md permits it, and every ambiguity resolves to deny — no policy file, enabled: false, an unlisted phase, a mode spelled wrong. A typo in a table cell must not become an unattended phase gate. Pick-class phases still require a scored verdict on disk, because a script can count files but cannot choose between designs.

An auto-pass records as **auto-passed**, visibly distinct from a human passed, and a human who disagrees overturns it with one command.

Cross-platform correctness

Four defects that behaved differently across environments while failing silently — each found by running on the environment it actually breaks on, never by reasoning about it:

• bash 3.2 — declare -A in exec-store-check is bash 4.0+, and #!/usr/bin/env bash resolves to the stock macOS 3.2. Under set -e the script died there, so every check after it never ran. The only bash 4+ construct in the codebase; replaced with a newline-delimited set.
• Worker liveness — BSD's date -j -f ignores the date it was handed and returns roughly now; GNU's -d parses it. The same dispatch row read alive on macOS and dead hours later on Ubuntu. A false DEAD verdict burns a revive rung and replaces an agent still holding its context.
• validate-skills — the box-drawing check used a multibyte bracket expression. mawk is byte-oriented, so an em-dash in prose matched. The validator passed on macOS and failed on every Linux runner.
• exec-store-check timestamps — BSD's date -j -f needs -u; the offset cancelled in its current call sites, so nothing was broken today, but it was a trap for the next caller.

script-smoke now runs on an [ubuntu-latest, macos-latest] matrix, and the suite prints a toolchain banner so a CI log carries the environment it ran against. A Linux-only job catches these only when the author is on Linux; a macOS-only one never would have.

Every dispatch prompt now covers its edge cases

A prompt is the only definition of what a subagent does, so an undefined state is an unreviewed behaviour. Measured before: one prompt in seventeen had preconditions, none had a refusal channel, none handled a file left behind by an aborted prior run. All seventeen now define their preconditions, edge cases, refusal path, and output-file collisions.

Two bugs worth calling out. component-reauditor-prompt.md hardcoded R01/R02 while claiming R02+, so an R03 dispatch would have written R03's findings into R02's file — the loop would have reported progress it never made. And design-critic-prompt.md required a ranking while stating "you do not pick the winner", pre-empting the human's choice with an unreviewable judgment.

Upgrade notes

This release rewrote main's history to sign every commit. If you cloned before, run git fetch && git reset --hard origin/main — the old commits are gone from every branch.

All commits on main carry verified signatures, as does the v0.6.0 tag.

Verification

123 regression tests, validate-skills, prompt-injection lint, and shellcheck -S warning — all clean on bash 3.2, bash 5, macOS and ubuntu 24.04.