CCCC 0.4.43

CCCC v0.4.43 Release Notes

CCCC v0.4.43 brings Voice Secretary into one shared service, adds ChatGPT Dots
through native MCP Events, and expands structured control to Pi and five more
official ACP runtimes. Settings, message delivery and session recovery are also
more consistent, with clearer diagnostics when work cannot proceed.

This note covers development starting with
22e500f0,
the first commit after v0.4.42, including subsequent contribution integrations
and fixes.

One Voice Secretary for the Instance

Voice Secretary no longer appears as an Actor in each Group. Configure its
Runtime directly or link a Runtime Profile in Settings → Voice → Voice
Secretary. Documents, transcripts and requests remain in their original
Groups; Secretary and Voice Analyst retain independent runtime configuration.

The first model task starts a resident Secretary conversation. Tasks from all
Groups run sequentially in that conversation, which stays available while idle.
CCCC fixes each task's Group, workspace and destination when accepting it, so
changing the visible Group cannot redirect a running task or its result.

• Prompt is the first and default capture mode. It defaults to dictation
  directly into the composer, without a model task. Enable Polish after
  recording for automatic refinement, or polish typed or dictated text with
  the manual button. Selecting Prompt, Doc or Ask closes the mode menu; the
  checkbox changes only the Prompt preference.
• Doc records into a document. The workspace separates the document library,
  editor and input controls; recording from a viewed document targets that
  document, while the composer shortcut uses the default document.
• Ask retains the question, answer, sources and follow-up together. Pending
  work stays observable when the workspace is hidden. Its composer hint can be
  opened or dismissed without cancelling the task or losing its eventual reply.
• View Secretary opens the shared native terminal or structured execution
  output for instance administrators. Supported native terminals accept keyboard
  and mouse input; queued tasks wait for manual turns to finish. Viewing does
  not launch a model task, and hiding the panel does not stop the conversation.
  Recent tasks are optional history, ordered newest first.

Drafts never send themselves. A late refinement cannot overwrite newer composer
text; a conflicting draft remains available for review. Document updates use a
working copy and a version-checked atomic commit, with a retained candidate on
conflict. Proposed messages to other Actors require user confirmation. Saved
input, failed work and unconfirmed outcomes remain visible rather than being
silently reported as complete. Blocking Runtime approval requests release the
queue with a needs-information result.

The shared conversation is not a confidentiality boundary between Groups.
Task destination checks prevent misrouted results, but do not isolate model
history. Native tools keep their Runtime's permissions; document working copies
are not a filesystem sandbox. Long tasks can delay other Secretary requests.
An idle New session clears the active conversation without deleting saved
work; daemon restart also starts a new conversation on the next task.

Voice Settings and Workspaces Follow the Same Rules

Instance Voice settings now have two feature tabs: Voice Secretary and
Codex Voice. Secretary recognition services, local ASR models and processing
defaults live with its runtime settings. Group Voice settings and enable toggles
are removed.

Microphone and speaker preferences share one browser device editor across both
workflows. Capture mode, recognition language and automatic polishing are
remembered separately for each Group in that browser. Active recordings and
calls retain their starting settings. Browser ASR uses the browser's default
microphone; local and external ASR use the selected device. Browser ASR normalizes
system-language preferences to recognition locales while preserving explicit
regional choices.

The Secretary workspace focuses on documents and questions; switching its view
does not switch the composer's capture mode. Codex Voice keeps Analyst collapsed
by default, distinguishes call readiness from Analyst readiness, and renders
completed structured investigations as Markdown. Settings and nested dialogs
share controls, keyboard focus behavior and return paths across English,
Chinese and Japanese.

Missing configuration, owner startup failures and provider errors stay visible
without blocking plain dictation or discarding saved input. Slow polling no
longer discards every response, older document reads cannot replace accepted
edits, and leaving a view during an action cannot permanently disable its
controls. Progress redaction also covers secrets split across streamed chunks.

Codex Voice remains experimental. Its current call path uses the configured
Codex ChatGPT login and ChatGPT-backed Realtime backend; public OpenAI Realtime
API credits alone do not configure that path. See the
Voice guide.

ChatGPT Dots Uses Native Events

The new ChatGPT Dots runtime receives work through ChatGPT's native
event-triggered task and the shared CCCC MCP plugin. CCCC does not type task
messages into the Dots browser, and its hosted browser login window need not
remain open. The public HTTPS MCP endpoint must remain reachable.

The Actor pane provides the complete setup path: create or reuse the shared
ChatGPT connector, open Dots, copy setup instructions, and check pairing and
subscription separately. One Dot binds to one explicitly selected Actor and
Group per connector; it does not create independent Dots for multiple Actors.

Setup uses a short-lived code to pair the Dot's conversation. Its saved native
handler claims work with {}, using ChatGPT-provided conversation metadata;
there is no permanent claim credential in the handler or attached to every
message. CCCC returns an execution credential for the accepted turn, with exact
reply and completion authority. Subscription credentials stay in the native
subscription configuration. Fresh setup instructions remain available in the
same pane if the ten-minute pairing code expires.

Delivery separates queued work, an accepted event waiting for ChatGPT,
a claimed turn being processed, and a confirmed completion receipt.
An event acknowledgement is not proof that the Dot has started or finished.
Subscription and task-tool diagnostics retain bounded, safe reason codes.
Callbacks support configured HTTPS/SOCKS proxies with hostname restrictions,
and subscriptions are persistent when their expiry is omitted.

Pausing CCCC access blocks new claims and revokes old execution authority,
including pending local-tool calls. It cannot cancel actions already running in
ChatGPT's cloud. Unfinished work requires explicit resolution; reconnecting does
not silently replay an accepted task. A Dot's chat confirmation alone is not
proof that its native event task was saved.

See Dots setup and recovery. Existing ChatGPT Web
Actors continue to use browser delivery and the shared connector; Dots is a
separate event path, not a replacement for that integration.

More Runtimes with Structured Control

Pi joins Actors, Runtime Profiles, Voice Analyst and Voice Secretary through
its official RPC interface. It supports structured progress and results,
cancellation, verified session recovery, and extension questions. Pi requires
1.1.0 or newer from @earendil-works/pi-coding-agent; it has a structured
workspace, not an attached native terminal.

Kimi Code, Auggie, Kiro V3, Hermes and Droid gain optional official ACP
modes across the same surfaces. Native TUI remains their default. The existing
Antigravity, Copilot, Devin and Cursor ACP adapters remain available.

These ACP modes run without a native terminal. Codex, Claude Code, Grok Build,
OpenCode and Kilo retain their existing managed control and same-conversation
native terminals. A TUI-only configuration does not acquire Voice controls
merely by installing the CLI.

Saved mode, command, model and permission changes apply on restart or next
start; Start preserves a healthy running session. Explicit model and mode
choices are reapplied to new and resumed managed sessions. Provider login and
native permissions remain provider-owned; session MCP injection is not a
filesystem sandbox or a guarantee that other configured MCP servers are absent.

Hermes native setup now uses the correct MCP registration flow and verifies its
enabled entry. Its ACP errors identify the failed request with bounded, redacted
details; cancellation retires the process while retaining the exact conversation
for recovery. Kiro V3 uses its native CLI authentication and exposes prompt
admission errors. Pi identities include inherited provider-home settings, so
changing homes cannot silently resume another identity. See the
Runtime guide for prerequisites and per-runtime differences.

Reliable Delivery, Recovery and Shared State

• Mail reaches idle managed Actors promptly. Existing disable switches
  remain effective, and busy or unknown states keep their ordinary delay. Mail
  consumption still requires an explicit Inbox read.
• Local cross-Group replies return to their origin. Thread references and
  reply obligations remain consistent in both Groups. Invalid attachments
  are rejected before recording a reply, and idempotent retries cannot change
  the accepted destination or parent.
• Files and images travel between local Groups. Web uploads and MCP
  cccc_file_send support a local destination, with up to 100 MiB of attachments
  per cross-group message. Verified files are placed in the destination's own
  blob store before either ledger entry is recorded. Invalid scopes and
  unusable existing blobs fail before recording; partial-delivery retries retain
  the accepted content and complete the missing copy once.
• IM controls agree with the Web. Per-chat relay modes cover all traffic,
  user-facing messages, or explicitly user-addressed messages. Telegram sends
  are bounded and preserve reply threading; skipped or throttled sends no
  longer masquerade as recovery from a delivery failure.
• Actor failures remain inspectable. Restored starts, process exits and
  managed turn outcomes retain safe diagnostics. Historical failure replay
  cannot replace newer daemon-owned Actor state, while matching stop and
  cancellation events still retire streaming output.
• Claude's autonomous turns stay connected. Scheduled or peer input can
  start a turn without a preceding controlled prompt. CCCC tracks that work;
  competing delivery ownership is reported as ambiguous instead of leaving an
  unrelated message pending indefinitely.
• Saved conversations survive failed resume. Codex, Grok, OpenCode and
  Kilo join Claude's explicit recovery behavior. Failed verification pauses
  automatic startup; Start/Restart retries the selected conversation and
  New session starts fresh without deleting provider history. An unrelated
  old receipt cannot restart a healthy ACP session.
• Large valid protocol output stays usable. Codex accepts bounded large
  frames, including resume previews; OpenCode and Kilo retain lifecycle events
  with inline image results up to the encoded-line limit. Malformed or oversized
  streams still fail explicitly.
• Linux Group retirement cleans attributed processes. Cleanup revalidates
  CCCC-home and process identity, including children that escaped the original
  process group, without relying on broad process-name matching.
• Context relationships and permissions stay intact. Task IDs are not
  reused after deletion or failed writes. Legacy ID collisions preserve valid
  canonical dependencies and parents; ambiguous recovery is reported. Subtree
  deletion and scope administration check ownership before mutation.
• Profiles and automation keep their authority. Existing Profiles without
  stored scope/owner fields use the established defaults when read or edited.
  Copying private environment values checks source and target independently.
  Cron validation handles POSIX Sunday ranges and bounded weekday steps; partial
  automation failures retain notices already written.

Everyday UI and Documentation

Settings pages share labelled rows, compact layouts and save actions. The Group
header, sidebar and terminal columns use space more predictably, while chat
history loading preserves scroll position. Mobile Presentation has clearer
document navigation, slot selection and shared Standard/Enhanced preview
controls. Modals follow the visual viewport, terminal resize requests are
coalesced, and composer slash commands and attachment chips are more consistent.

Relative CLI project paths resolve
from the invoking terminal. Realtime reconnect feedback uses the actual
transport state and retry countdown, and coordination briefs preserve complete
constraints or provide an explicit full-context lookup. English, Chinese and
Japanese CLI quick starts now
agree on startup, Group selection and the fact that Inbox reads consume Mail.
Worktree guidance explains cleanup for long-lived Actors without adding an
automatic Git cleanup service.

Upgrade Notes

1. Upgrade CCCC, restart it using your usual method, and refresh the Web UI.
   Saving Runtime settings alone preserves the current execution surface.
2. Configure the global Secretary explicitly. Startup retires obsolete
   per-Group secretary Actors through the normal lifecycle, retaining documents
   and transcripts; their old execution path and three MCP tools are removed.
   Old Actor inputs are not automatically replayed. When saved unclaimed input
   exists, choose whether to process it or hold it when configuring the Runtime.
   Leftover per-Group enable flags no longer block recording.
   Custom integrations must stop using cccc_voice_secretary_document,
   cccc_voice_secretary_composer and cccc_voice_secretary_request; the new
   task tool is scoped to the global Secretary's accepted work.
3. For Dots, reuse the shared plugin and refresh its tools/events after
   upgrading. Older native tasks that saved a claim credential or expected to
   read subscription configuration must be updated with the current setup
   instructions and credential-free handler. CCCC cannot rewrite a task already
   saved in ChatGPT. Keep a working pairing; do not reset it merely to upgrade.
   Very old Actor-specific ChatGPT connectors still follow the
   v0.4.41 migration.
4. Install and authenticate the required official Runtime before selecting its
   ACP or RPC adapter. Installation detection alone does not prove login or
   task readiness. Review unconfirmed work before retrying or replacing a
   conversation; an uncertain submission is not safe to assume unexecuted.

Validation Scope

Release preparation checks the Rust workspace, Web tests and static checks,
repository contracts, documentation, and an isolated packaged Linux/WSL smoke
test. The local release binary and its served Web assets are checked together.
Synthetic protocol fixtures exercise routing, cancellation, recovery and
authority boundaries without consuming provider credits.

This is not a claim of complete live acceptance across every provider, account,
browser or operating system. Native Windows/macOS release builds remain part
of release CI. Real microphones, ASR services, Realtime audio and cloud Dots
tasks depend on the provider and user environment. Existing successful live
tests do not eliminate those differences.

Thanks to chriscoveries, waterbang, zixuniaowu, and everyone who contributed code,
reported failures and tested the evolving workflows.

Full source comparison