reconc 0.9.8

reconc v0.9.8

Reconc v0.9.8 is a broad hardening release for the repository, action, runtime,
and release boundaries. It keeps every public schema and policy-lock format
stable while making filesystem mutation, retained state, subprocess control,
MCP enforcement, and public reporting substantially more defensive and less
expensive.

Security and privacy

• Filesystem-sensitive operations now bind reads, writes, removals, recovery,
  and ownership changes to validated opened identities. Parent replacement,
  escaping symlinks, unsafe hard links, inode-split locks, and stale path
  observations fail closed across bootstrap, uninstall, update, audit, JSONL,
  command proof, action state, and retention paths.
• Public proofs, CI reports, impact reports, adapter diagnostics, and command
  summaries redact host paths, user identities, quoted sensitive values, and
  unsafe tool data at their output boundaries. Public impact actions no longer
  expose composed absolute paths.
• Strict YAML and JSON admission rejects ambiguous merge semantics, duplicate
  keys, oversized aliases, malformed configurations, and unsafe dynamic
  launcher arguments before trusted structures are created.
• Runtime executables, policy scripts, bootstrap artifacts, receipts, and
  embedded harness packs are rebound to their validated bytes and provenance
  immediately before use or publication.

Durable state and transactions

• Atomic publication reports whether bytes were not published, published with
  uncertain durability, or durably published. Close, sync, validation, and
  cleanup failures can no longer be flattened into success.
• Bootstrap and repository-sync staging, rollback, recovery, and removal retain
  parent handles and exact before/after identities. Interrupted operations
  preserve recoverable state without overwriting foreign or drifted bytes.
• Audit, run, action-ledger, session, and general JSONL storage share bounded,
  cancellable locking and strict mode validation. Rotation and recovery retain
  valid data, prevent lock-inode splits, serialize maintenance safely, and
  preserve terminal reasons and incomplete lifecycle evidence.
• Action reservations, approvals, checkpoints, and pending correlations now
  settle or expire deterministically across cancellation, restart, partial
  failure, and concurrent readers.

Action and MCP enforcement

• Action evaluation owns one end-to-end deadline covering normalization, cache
  lookup, conditions, selectors, globs, inspection, budgets, traces, and final
  publication. Cancellation and deadline expiry win before a decision can be
  cached or returned.
• Tool selectors, budget selectors, namespaced identities, request envelopes,
  progress events, results, and strict audit records receive explicit bounded
  validation. Malformed upstream requests are isolated without corrupting the
  remaining MCP connection.
• Gateway shutdown drains calls and pending approvals in a stable order,
  preserves independent cleanup failures, stops progress admission, and never
  signals an already reaped Unix process group.
• Validated compiled action plans, matcher contexts, and immutable identity
  reads are safely reused; concurrent action-state reads no longer serialize
  behind unrelated read-only work.

Runtime and agent integrations

• Session evidence, pre-decision state, taint resolution, Stop fingerprints,
  completion drift, compaction recovery, and hook liveness remain consistent
  across retries, restarts, terminal transitions, and interrupted persistence.
• Oh My Pi 18.0.11 is covered by the typed project extension with the generic
  session_before_compact/session_compact lifecycle, exact approval events,
  host-controlled extension loading, and one independently shutdown-safe hook
  worker per extension binding.
• Generated adapters fail closed on truncated output, sanitize diagnostics,
  construct MCP envelopes consistently, and retry hook-worker requests without
  duplicating committed effects.
• Kimi managed blocks are parsed structurally, mixed hook configuration keeps
  unrelated ownership intact, and partial wrapper installation is reported as
  partial instead of healthy.
• TUI width is measured in terminal cells, preserving CJK, combining, emoji,
  keycap, flag, variation-selector, and ZWJ clusters without corrupt output.

Performance and bounded work

• Runtime plans cache immutable command expectations and validated action
  programs. Evaluations reuse matcher contexts, short-circuit conditions,
  precompiled inspection programs, source-freshness snapshots, Git state,
  executable verification, and Stop inputs.
• Canonical serialization, lockfile encoding, action traces, session identity,
  glob expansion, and evidence normalization avoid redundant allocations and
  full-input passes.
• Run-log following decodes only validated appended suffixes; artifact and
  executable verification stream bounded inputs; subprocess output uses shared
  retained-prefix capture; impact filesystem snapshots and Grok continuation
  prompts have explicit work and memory ceilings.

Platform and release reliability

• Windows private state applies and validates current-user-only DACLs through
  opened handles, preserves write-through replacement semantics, and verifies
  bootstrap modes through native contracts. The final native Windows suite and
  installer failure paths remain release-blocking.
• Offline hook verification is hermetic, self-host fixtures stay synchronized
  with current runtime contracts, and generated harness assets remain bound to
  the embedded pack.
• CI, release publication, and CodeQL diagnostics preserve complete blocking
  findings under bounded output and avoid leaking hosted-runner paths.

Compatibility

• The product version advances to 0.9.8 without a policy-lock format or
  public JSON-contract change.
• Format-6 locks continue to use the immutable
  reconc-v0.9.7/schemas/v6/policy-lock.schema.json identity. Formats 1 through
  5 and every other registered schema retain their exact published URLs,
  bytes, aliases, and migration behavior.
• Existing policy locks, repository installation receipts, runtime adapters,
  and direct installations require no manual data migration.

Verification

The protected release workflow validates the exact tag with native macOS,
Linux, and Windows tests; root and portable-template race suites; Vet,
Staticcheck, Govulncheck, CodeQL, publication audit, release trust, self-hosting,
the pinned external LangChain MCP proof, five release targets, strict manifests,
checksums, deterministic SBOMs and notices, and GitHub build-provenance
attestations.

Upgrade

Use the existing installation owner after publication:

reconc update
reconc doctor --global

No repository lockfile refresh is required for this release.

reconc 0.9.7

reconc v0.9.7

Reconc v0.9.7 keeps the format-6 policy-lock representation and migration
chain stable while publishing the rule-kind field matrix under a new schema
identity.

Schema and compatibility

• The release publishes Format 6 as
  https://raw.githubusercontent.com/Christopher-Schulze/reconc/reconc-v0.9.7/schemas/v6/policy-lock.schema.json.
• The schema rejects rule fields that are unsupported by the declared rule kind
  before runtime evaluation.
• Existing format-6 locks naming the v0.9.6 schema remain accepted through an
  input-only compatibility alias; refreshing a lock emits the v0.9.7 identity.
• Formats 1 through 5 retain their exact previously published schema URLs and
  migration behavior. No format-version migration is required.
• Unchanged public schema contracts remain byte-identical at their existing
  immutable v0.9.6 identities.

Go 1.27 toolchain and implementation

• The root module and portable harness build with stable Go 1.27. Native macOS
  builds consequently require macOS 13 Ventura or later.
• Strict action-value and lockfile decoding use Go 1.27's stable
  encoding/json/jsontext token API while retaining Reconc's duplicate-key,
  Unicode, depth, cardinality, decimal, trailing-input, and error contracts.
• Canonical action values append into one capacity-hinted output buffer while
  preserving identity-bearing legacy escaping. Targeted in-memory concurrency
  tests use testing/synctest, and MCP shutdown regression coverage queries the
  exact goroutineleak worker stack without treating unrelated goroutines as
  product leaks.

Transaction and filesystem reliability

• Native installers now require GitHub build-provenance verification against
  the fixed repository, release workflow, source tag, hosted-runner identity,
  and candidate bytes. Non-zero candidate installation exits can no longer be
  reported as success, and repository release assets publish create-only.
• Transactional JSONL publication recovers interrupted commits and preserves a
  private on-disk layout for audit evidence.
• Atomic state, lock, bootstrap, and audit publication verifies parent and open
  file identities rather than trusting path names across filesystem races.
• Windows private state persists and verifies protected current-user-only DACLs
  through the supported named-security contract after descriptor identity
  binding. Readonly drift is repaired relative to the bound parent with Go
  1.27 os.Root.Chmod. Unsupported directory-handle
  flushes no longer turn a successful publication into an access denial;
  payload sync remains, replacement paths retain write-through behavior, and
  Go toolchain notices resolve setup-go junction identity before strict license
  reads. A focused native Windows preflight runs immediately after module
  download, before Node/Bun setup and the complete native suite.
• Production file-lock acquisition is bounded, cancellation-aware, and backed
  by a lifecycle-managed same-process gate without changing the authoritative
  cross-process deadline.
• Binary update and rollback temporaries use owner-only Unix permissions or a
  protected current-user-only Windows DACL without changing the executable
  directory. Windows mode tests assert only the representable readonly
  attribute, and identity-race coverage accepts an operating-system refusal to
  replace an opened object as a safe outcome.
• Policy sources and TASK files are read through stable file identities, with
  path components revalidated across multi-read operations.
• Hook workers fail closed on oversized frames, fall back safely, and restart
  after crashes or canceled requests without retaining a failed process.

Compiler and policy-ingest correctness

• One locked policy-source snapshot, discovery context, configuration parse,
  provenance computation, and normalized rule representation now flow through
  compilation without redundant whole-input work.
• Policy-source precedence is canonical and reported truthfully across
  repository instructions, policy files, and generated inputs.
• Glob expansion, inline-policy extraction, parser cardinality, source text,
  and template variables are bounded before materialization or retention.
• Unsupported rule fields and invalid template-variable grammar are rejected at
  their owning boundaries.
• Strict lockfile loading preserves duplicate-key, Unicode, depth, number,
  root-shape, trailing-data, migration, freshness, and digest checks while
  caching validated typed rule and action parts for downstream compilation.

Runtime performance and bounded work

• Runtime path and template matchers plus expected shell invocations are
  precompiled; command evidence and stable evidence-file snapshots are
  normalized or memoized once per evaluation.
• Runtime-plan cache hits revalidate policy-source freshness before reuse.
• Prospective path identities and write-epoch normalization are batched, while
  require-script preparation, evidence matching, package-manager ancestry, and
  action argument sizing avoid repeated work.
• Stop evaluation reuses one bounded lockfile scan and explicit before/after
  source snapshots while retaining mutation detection and fail-closed cache
  eligibility.
• Immutable action plans and action context roots are validated once and reused
  safely within an evaluation.
• Runtime evidence deduplication and inline-policy extraction use bounded linear
  algorithms. Worker response frames use bounded geometric growth instead of
  repeated prefix copies.
• Context-size accounting is bounded and overflow-safe. Harness-pack payload
  limits are enforced before values are retained.
• Release and installer tests bind both Reconc state and the fallback user home
  to temporary roots, preventing verification from changing a real installation
  receipt. Same-version update coverage applies and verifies replacement bytes,
  not only discovery. A bare reconc update returns an exact-version
  installation to the default stable channel, while leaving preview still
  requires explicit intent.
• The downloadable Zsh completion is named reconc.zsh; the release producer
  validates its complete manifest with the same filename contract used by
  existing updater binaries before publication.

Evidence, review, and privacy hardening

• Action deltas distinguish warned from blocked operations, and assurance-file
  reads expose one stable bounded snapshot.
• Extracted rule identifiers are collision-resistant, and proof bundles expose
  only sanitized executable identities; command hashes do not encode raw
  arguments or complete command lines.
• Lockfile diffs deterministically report semantic, provenance, generated,
  unsupported, envelope, source-inventory, and rule-provenance changes,
  including review-relevant generated-only changes.
• Generated harness and publication artifacts remain derived from their
  canonical sources.
• Runtime diagnostics canonically quote untrusted policy identities, and
  evidence-result capacity arithmetic avoids overflowing additions. Fresh
  CodeQL reports no open findings for these paths.

Verification

The release is validated by strict-decoder differential and fuzz coverage,
runtime and worker contract tests, race tests, static analysis, schema and
publication audits, harness-pack verification, self-hosting, release trust,
the pinned external LangChain interoperability proof, vulnerability scans, and
the complete five-target release build. Remote schema and release-asset HTTP
checks run in the protected, tag-bound release workflow.

Upgrade

Use the existing installation owner:

reconc update
reconc doctor --global

Repositories with an existing format-6 lock do not need a migration. Run
reconc refresh . when intentionally rewriting the lock with the v0.9.7
schema identity and review the policy source and lockfile together.

reconc 0.9.6

reconc v0.9.6

Reconc v0.9.6 restores immutable public-schema truth and introduces the first
Go-only Action Plane layer. It compiles strict action authoring into one
canonical format-6 policy lock while making every emitted schema identity,
retained compatibility input, release asset, and publication check derive from
one exact registry.

Added

• A typed per-artifact registry for all current and legacy JSON Schema
  contracts, including immutable default URLs, local and release paths,
  introduction tags, SHA-256 digests, enterprise mirror paths, supported
  formats, state, and input-only aliases.
• Independent offline Draft 2020-12 compilation for every registered schema,
  representative validation for every current and legacy artifact, and
  end-to-end validation of every legacy policy-lock migration.
• Release-time online verification that every published canonical schema URL
  returns HTTP 200 without redirects and is byte-identical to the registered
  local file.
• Strict actions.tools, actions.rules, and actions.defaults authoring with
  typed selectors, effects, phases, conditions, decisions, failure/cache policy,
  provenance, deterministic normalization, and frozen resource bounds.
• reconc why action for redacted explanation of canonical action policy,
  defaults, provenance, selectors, and legacy lowering.
• Strict actions.ledger authoring with required, best-effort, or disabled
  recording, bounded selected fields, and declaration, exact, or keyed tool
  identity.
• A separate private format-1 Action Ledger with nine payload-free lifecycle
  events, domain-separated selected-field identities, atomic multi-process
  append, bounded rotation, crash recovery, archive continuity, and detached
  chain-head verification.
• reconc action log tail|stats|verify|export for deterministic verified
  lifecycle inspection and privacy-bounded minimized Impact Lab export. Missing
  state is read-only empty; corruption fails; export omissions and replay gaps
  remain explicit; output is private and create-only.
• reconc mcp gateway as a Go-only, tools-only stdio enforcement boundary
  around one operator-selected downstream MCP server. Routed calls receive
  strict tool-contract validation, policy and executable identity resampling,
  cumulative budgets, signed one-time approvals, required lifecycle recording,
  inspected progress and results, bounded stderr diagnostics, and owned child
  process-tree shutdown.
• Current MCP 2026-07-28 and legacy 2025-11-25 tool-call interoperability
  through the pinned official Go MCP SDK v1.7.0, including signed current
  input-required and legacy form-elicitation approvals, with direct/native tool
  bypasses and unsupported capabilities kept explicit.

Changed

• Current policy authoring uses v4, repository-sync plan/report and
  custom-runtime manifests use v2. Restored legacy inputs remain readable; a legacy
  custom-runtime route must still budget enough bytes for the current canonical
  response metadata, while v2 makes the safe 512-byte minimum explicit.
• Current Action Ledger events use schema v2 for gateway approval and delivery
  semantics; the published v1 schema remains byte-identical and registered as
  a legacy contract.
• Release copying, verification, checksums, manifest, SBOM, provenance, project
  license, and exact third-party notices consume their canonical inventories
  instead of maintaining parallel release lists.
• Custom-runtime manifest v2 requires a response budget large enough to hold
  the canonical neutral-response metadata introduced by release-pinned schema
  identities.
• Policy-lock format 6 stores one canonical actions plan. Legacy mcp
  authoring lowers into it, existing host MCP consumers derive their
  compatibility view from it, and no parallel runtime mcp plan remains.
• The Go-only MCP gateway is now presented as the primary LangChain boundary,
  and release publication is blocked by the pinned official LangChain client
  interoperability test.

Fixed

• Native Windows state validation accepts Windows-normalized multi-ACE DACLs
  only when their complete effective and inherited access remains owner-only
  and full. Action-ledger live files, archives, locks, journals, and recovery
  backups now enforce that same private DACL contract instead of relying on
  POSIX mode checks. Concurrent active-session publication keeps every pointer read
  and replacement under the same lock, and release publication waits for the
  exact tag to pass native Windows tests, binary smoke, and installer gates.
• Private Action Ledger lock creation now secures and verifies a same-directory
  candidate before atomically publishing the final lock path. Concurrent
  creators converge on that one protected file, transient directory-snapshot
  changes are retried within a strict bound, and existing permission, ACL,
  symlink, special-file, or identity drift still fails without repair.
• Private project-directory initialization now serializes creation and Windows
  DACL publication under the retention lock, so concurrent first-use processes
  cannot observe a partially secured directory while existing unsafe state
  still fails without repair.
• Action Ledger lock acquisition remains context-cancellable and strictly
  bounded while allowing valid serialized writers enough time to complete
  under observed native Windows contention.
• Schema files no longer claim mutable, missing-tag, or unreachable canonical
  locations. Historical identities remain explicit compatibility aliases and
  are never emitted as verified publication URLs.
• Semantic additions are no longer retroactively attributed to v1 policy,
  repository-sync, or custom-runtime contracts.
• Policy-lock v2 and v3 use truthful immutable identities, while the legacy v4
  file remains byte-identical to its v0.9.4 tag.
• RFC 0001 consistently identifies policy-lock format 6, and the RFC index now
  states the immutable schema-evolution rule enforced by the registry.
• Action globs and regexes are precompiled, strict URL/path/CIDR operands are
  canonicalized once, source precedence matches its declared contract, and all
  action-plan views are defensive copies.
• Action-ledger rotation now journals backup preparation before any primary
  mutation, rejects permission drift without repair, preserves existing generic
  JSONL modes, and enforces exact approval, budget, and terminal ordering.
• Action-ledger denial evidence now matches persisted budget state: it binds the
  live reservation, released capacity, and denied-count-only consumption.
• Action-ledger selected-field identities now bind repository and declaration
  identity, strict phase/source ownership, and explicit unavailable-identity
  completeness. Rotation refuses to prune active calls, and verification keeps
  evaluated state separate from completeness.
• Native-width JSON Pointer indexes, 32-bit budget windows, publication Git
  blob reads, and merged policy capacities now enforce explicit allocation and
  conversion bounds.

Compatibility

• Current policy locks use format 6 and the immutable v0.9.6
  schemas/v6/policy-lock.schema.json identity.
• Supported legacy schema aliases and policy-lock formats 1 through 5 continue
  to migrate offline. Unknown URLs, crossed URL/format pairs, and future
  versions fail closed.
• Legacy top-level mcp authoring remains accepted during this compatibility
  window and preserves existing host behavior after canonical lowering.
• Core runtime behavior makes no schema-network request. Online retrieval is a
  release-publication gate only.

Upgrade

After the immutable release is published:

reconc update
reconc doctor --global

Exact native install on macOS or Linux:

curl -fsSL https://raw.githubusercontent.com/Christopher-Schulze/reconc/reconc-v0.9.6/install.sh \
  | sh -s -- --version 0.9.6
export PATH="$HOME/.local/bin:$PATH"
reconc doctor --global

Formats 1 through 5 migrate in memory. Run reconc refresh . when you
intentionally want the repository to persist the current format-6 lock and its
canonical action plan; review and commit policy source and lock together.

reconc 0.9.5

reconc v0.9.5

Reconc v0.9.5 is a compatibility-preserving correctness and release-trust
release. It closes the cache, hook-observation, hostile-input, and false-green
gaps found by auditing the post-v0.9.4 source and its published claims. It does
not introduce a policy or schema migration.

Added

• Bounded, source-free Oh My Pi user_python observations. Hook liveness and
  hook status expose a saturating count, latest timestamp,
  repository-relative working directory, code byte size, and context-exclusion
  flag without storing Python source.
• A shared bounded subprocess-output boundary for production helpers, with
  boundary-specific limits and explicit overflow failure.
• Exact parity tests tying command metadata, custom-runtime reservations,
  documented hook kinds, portable workflow-audit routes, and scaffold cache
  inputs to their canonical registries.

Improved

• Stop report reuse now binds every reachable policy-declared input with the
  same evaluator path semantics and supported content, mode, time, and platform
  identity used by the decision. Applicable native assurance always evaluates
  rather than relying on an incomplete fixed input set.
• Completion captures the exact evaluator inputs, dynamic evidence and
  freshness targets, staged command proofs, temporal freshness, and native
  assurance authority before and after evaluation.
• File-backed audit, run-state, bootstrap, release, SBOM, provenance, and
  retention readers validate bounded complete snapshots and reject links,
  special files, identity changes, and partial over-budget input.
• TASK claim and promotion utilities publish transactionally and refuse
  clobbering or moving targets. Legacy pruning applies safe defaults and cannot
  erase evidence under an empty policy.
• The harness pack includes the complete audited portable safety and parity
  suite, and the formatting gate covers non-ignored new Go files before they
  are added to Git.

Fixed

• Oversized files, over-budget directories, escaping or nested symlinks,
  special files, and unstable policy inputs can no longer preserve a reusable
  Stop fingerprint through an approximate identity.
• Direct or symlinked FIFO inputs no longer block Stop caching or hook status
  on macOS.
• OMP user_python metadata is persisted instead of being validated and then
  discarded, and every invoked OMP route is covered by the executable contract.
• Release trust now builds the real shipped release target. Generated assets,
  copied assets, target-derived binaries, the manifest, checksums, and verifier
  share canonical inventories, so missing, extra, stale, and drifted output
  fail for the asserted reason.
• Codex guidance consistently states native SessionEnd cleanup, and route
  enumeration can no longer drift silently between the registry, CLI,
  documentation, custom runtimes, and portable audit.
• Captured Git, worker, Grok, offline-hook, publication, SBOM, and TASK-helper
  output can no longer grow memory without a boundary or expose partial success
  after overflow.

Upgrade

For an existing direct installation:

reconc update
reconc doctor --global

Exact native install on macOS or Linux:

curl -fsSL https://raw.githubusercontent.com/Christopher-Schulze/reconc/reconc-v0.9.5/install.sh \
  | sh -s -- --version 0.9.5
export PATH="$HOME/.local/bin:$PATH"
reconc doctor --global

Exact native install on Windows x64:

$installer = Join-Path $env:TEMP "reconc-install.ps1"
Invoke-WebRequest https://raw.githubusercontent.com/Christopher-Schulze/reconc/reconc-v0.9.5/install.ps1 -OutFile $installer
& $installer -Version 0.9.5
Remove-Item $installer
$env:Path = "$env:LOCALAPPDATA\Programs\Reconc\bin;$env:Path"
reconc doctor --global

A global CLI update does not rewrite repository-owned files. Repositories that
use Oh My Pi must refresh the owned extension to receive the new redacted
Python observation route:

reconc hook install omp . --json
reconc hook status . --json

Compatibility And Limits

• Policy locks remain format 4. The v0.9.4
  schemas/v4/policy-lock.schema.json URL remains the immutable canonical
  identity; the compatible v1 artifact and older policy-lock schema identities
  remain on their original tags.
• No policy can decide arbitrary Python source. OMP user_python is
  observation-only; user_bash remains the blocking boundary for shell
  commands the user types.
• Direct installers remain available for macOS amd64/arm64, Linux amd64/arm64,
  and Windows amd64. Windows arm64 is not shipped.
• Static configuration and offline contract fixtures are not live proof that a
  particular host delivered a route. Use reconc hook status . --json for
  runtime claims.
• Reconc remains a deterministic repository control layer, not an operating
  system sandbox against a hostile same-user process.

reconc 0.9.4

reconc v0.9.4

Reconc v0.9.4 moves the policy lockfile to format version 4 and closes the
host-integration gaps found by verifying every supported runtime against its
own published configuration surface. Format 1, 2, and 3 lockfiles migrate
automatically on read, so no repository action is required.

Added

• cache_inputs on require_script rules and on require_script checks inside
  composite rules. A gate declares the literal repository-relative files its
  script reads, and Stop report reuse binds exactly those files. A gate that
  declares nothing is never reused and runs on every Stop.
• MCP policy on Claude Code and Codex. Both hosts publish MCP calls as
  mcp__<server>__<tool> on their generic tool events and accept a matcher for
  that namespace, so exact MCP selectors, unclassified: deny, and MCP write
  evidence now work there as they already did on Cursor.
• Native SessionEnd routing for Codex and native Notification routing for
  Claude Code. Both events are part of those hosts' configuration surfaces and
  were previously reported as unsupported.
• Windows executable-shadow reporting across PATHEXT in the global diagnostic.

Improved

• The MCP platform vocabulary, the two live JSON schemas, hook status, and
  doctor --deep derive from one ordered source, so a supported host cannot be
  accepted by one surface and dropped by another.
• hook status and doctor --deep report strict unclassified MCP deny as
  available on every host that has a discriminator, instead of naming Cursor
  alone.
• Codex SessionEnd declares the three-second timeout that host accepts rather
  than a value it clamps and warns about.
• The Pi contract fixture records package version 0.84.1 and its exact source
  revision. That revision widened the blocking tool result with terminate, a
  hint the host honors only under batch unanimity; Reconc has no policy mode
  that ends a session, so the adapter keeps returning {block, reason}.
• Host coverage is stated rather than implied: Claude Code accepts 31 hook
  events and Reconc binds the 15 that carry a decision or attributable
  evidence; GitHub Copilot names fourteen and Reconc binds twelve.

Fixed

• Rooted-path decisions no longer depend on the operating system that evaluates
  them. filepath.IsAbs treats a POSIX root as relative on Windows, so a
  declared cache input or a git ref naming /etc/passwd was refused on Unix and
  resolved against the repository on Windows. One helper now rejects every
  rooting convention at once, and the policy-file and script resolvers use it.
• require_script containment is enforced on the resolved parent directory, so
  an intermediate directory symlink can no longer move execution outside the
  repository while every path segment stays a plain name.
• kill_timeout_sec values that overflowed the raw conversion no longer wrap
  into a negative wait delay that disabled SIGKILL escalation.
• forbid_command no longer misses escaped or quoted executables such as \rm.
• Oversize hook output keeps the real reason and appends the byte-budget notice
  instead of replacing the diagnostic.
• Composite require_script checks validate their cache_inputs like top-level
  rules do.

Upgrade

For an existing direct installation:

reconc update
reconc doctor --global

Exact native install on macOS or Linux:

curl -fsSL https://raw.githubusercontent.com/Christopher-Schulze/reconc/reconc-v0.9.4/install.sh \
  | sh -s -- --version 0.9.4
export PATH="$HOME/.local/bin:$PATH"
reconc doctor --global

Exact native install on Windows x64:

$installer = Join-Path $env:TEMP "reconc-install.ps1"
Invoke-WebRequest https://raw.githubusercontent.com/Christopher-Schulze/reconc/reconc-v0.9.4/install.ps1 -OutFile $installer
& $installer -Version 0.9.4
Remove-Item $installer
$env:Path = "$env:LOCALAPPDATA\Programs\Reconc\bin;$env:Path"
reconc doctor --global

A global CLI update does not rewrite repository-owned files. Repositories that
installed Claude Code or Codex hooks before this release keep working, and their
installed artifacts report as stale until they are reinstalled:

reconc hook status . --json
reconc hook install claude-code . --json
reconc hook install codex . --json

Compatibility And Limits

• Format 4 is published as the v0.9.4 schemas/v4/policy-lock.schema.json
  identity. The v0.9.1 schema URLs remain the immutable canonical identities for
  the compatible v1 artifact schemas and for the v1, v2, and v3 policy-lock
  schemas.
• cache_inputs accepts literal repository-relative files and directories.
  Globs, template variables, escaping paths, and duplicates are refused at
  compile time, because binding them would require a directory walk on the Stop
  path.
• Direct installers remain available for macOS amd64/arm64, Linux amd64/arm64,
  and Windows amd64. Windows arm64 is not shipped.
• MCP enforcement before execution requires a host that can tell an MCP call
  apart from a built-in tool: a dedicated MCP event on Cursor, the mcp__
  namespace on Claude Code and Codex. OpenCode, Kilo, OMP, Pi, and ZCode enforce
  configured identities but report strict unclassified deny as unavailable.
• Static configuration and offline contract fixtures are not live proof that a
  particular host binary delivered a hook. Use reconc hook status . --json for
  runtime claims.
• Reconc remains a deterministic repository control layer, not an operating
  system sandbox against a hostile same-user process.

reconc 0.9.3

reconc v0.9.3

Reconc v0.9.3 is a compatibility-preserving quality release. It completes the
native ZCode runtime surface, tightens malformed-input handling and strict
outcome coverage, and brings the public documentation and release metadata to
one consistent current state. It does not introduce a policy or schema
migration.

Added

• Native ZCode support through project-local .zcode/config.json integration.
  The generated adapter wires all seven documented events through the
  process-executor transport: SessionStart, UserPromptSubmit, PreToolUse,
  PermissionRequest, PostToolUse, PostToolUseFailure, and Stop.
• Regression coverage for duplicate JSON keys, trailing values, non-object
  payloads, invalid JSON Pointers, oversized host payloads, MCP envelopes,
  strict Stop outcomes, passive events, and lockfile mode integrity.
• Current-state migration and installation guidance for the v0.9.3 source and
  release line, including explicit ZCode hook installation and restart
  behavior.

Improved

• Runtime documentation, command references, generated agent guidance, the
  README, issue template, self-hosting diagnostics, installer examples, and
  release metadata now agree on v0.9.3 and the thirteen supported coding-agent
  runtimes.
• Test-depth reporting remains measurement-only review evidence and never blocks
  a build or release on a numeric result.
• Release provenance fixtures and versioned recovery-path tests now exercise the
  v0.9.3 source line instead of stale v0.9.2 examples.

Fixed

• Windows Bun hook timeouts now terminate the complete wrapper process tree,
  preventing detached shell descendants from poisoning the next hook event.
• Draft release reconciliation now addresses the release by its immutable
  GitHub release ID, so draft assets can be replaced and verified before
  publication instead of failing on the tag-only API view.
• Removed stale current-release references that could direct users to the
  superseded v0.9.2 installer while leaving historical v0.9.2 migration and
  release notes intact.

Upgrade

For an existing direct installation:

reconc update
reconc doctor --global

Exact native install on macOS or Linux:

curl -fsSL https://raw.githubusercontent.com/Christopher-Schulze/reconc/reconc-v0.9.3/install.sh \
  | sh -s -- --version 0.9.3
export PATH="$HOME/.local/bin:$PATH"
reconc doctor --global

Exact native install on Windows x64:

$installer = Join-Path $env:TEMP "reconc-install.ps1"
Invoke-WebRequest https://raw.githubusercontent.com/Christopher-Schulze/reconc/reconc-v0.9.3/install.ps1 -OutFile $installer
& $installer -Version 0.9.3
Remove-Item $installer
$env:Path = "$env:LOCALAPPDATA\Programs\Reconc\bin;$env:Path"
reconc doctor --global

A global CLI update does not rewrite repository-owned files. Install the ZCode
adapter explicitly where needed and restart ZCode so it snapshots the updated
configuration:

reconc hook install zcode . --json
reconc hook status . --json

Compatibility And Limits

• The v0.9.1 schema URLs remain the immutable canonical identities for the
  compatible v1 artifact schemas and v3 policy-lock schema.
• Direct installers remain available for macOS amd64/arm64, Linux amd64/arm64,
  and Windows amd64. Windows arm64 is not shipped.
• ZCode pre-tool, permission, and synchronous Stop routes can block when the
  host provides the required decision boundary. Host timeouts remain
  ZCode-owned fail-open behavior, and Stop continuation is capped by ZCode at
  three consecutive blocks.
• Static configuration and offline contract fixtures are not live proof that a
  particular ZCode binary delivered a hook. Use reconc hook status . --json
  and bounded host verification for runtime claims.
• Reconc remains a deterministic repository control layer, not an operating
  system sandbox against a hostile same-user process.

reconc 0.9.2

reconc v0.9.2

Reconc v0.9.2 is a compatibility-preserving patch release that hardens the
public CLI, repository-owned transactions, agent integrations, and release
truth built on v0.9.1. It does not introduce a policy or schema migration.

Added

• Native Oh My Pi support through a project-owned .omp/extensions/reconc.ts
  extension with awaited pre-tool and main-session Stop enforcement, complete
  tool outcomes, lifecycle events, compaction, shutdown, and bounded
  continuation handling.
• Native Pi Coding Agent support through a trust-aware project-owned
  .pi/extensions/reconc.ts extension with blocking tool and user-shell
  boundaries, lifecycle and result observation, compaction, shutdown, and
  bounded settled-state continuation requests.
• Kimi Code CLI support through an explicit user-global 16-event TOML hook
  integration. The managed block preserves unrelated configuration, discovers
  an explicitly configured Reconc repository from the invocation directory,
  and otherwise no-ops.
• Registry-derived Cursor CLI surface events and exact live-route reporting,
  including the official agent executable and the cursor-agent
  compatibility alias.
• reconc sources for body-free effective source provenance.
• Nested reconc help paths backed by the same authoritative command metadata
  used for dispatch, completions, the man page, and command documentation.
• Checksum-bound reconc repo sync resolve strategies and
  reconc repo sync recover for reviewed drift and interrupted transactions.
• Durable, fail-closed TASK transaction recovery with exact before-image,
  destination, journal, and mode validation.

Improved

• OMP and Pi now participate in hook generation, installation, removal, status,
  doctor, bootstrap, scaffold sync, host probes, portable harnesses, MCP policy,
  release inventory, and the canonical CLI and documentation surfaces.
• Generated adapter transports enforce bounded combined output and timeout
  contracts across OpenCode, Kilo Code, OMP, and Pi without sequential-drain
  deadlocks or platform-dependent process races.
• Offline update selection reads regular release metadata through one bounded
  path, verifies the exact manifest bytes it decoded, and rejects oversized
  checksum metadata.
• TASK archive cache Git commands now use the classified 15-second audit runner
  instead of unbounded subprocesses.
• Repository sync now plans from one hermetic Git snapshot, binds the complete
  plan to its digest and preconditions, writes a durable before/after journal
  before mutation, and verifies the full result under the repository lock.
• Repository sync resolution publishes an ownership receipt, requires a fresh
  plan, and never treats receipt or journal deletion as remediation.
• Cursor integration separates documented surface events, artifact loading,
  exact-route observation, negative enforcement proof, and unsupported host
  behavior instead of promoting static configuration into live proof.
• Kimi Code installation is deliberately excluded from init, bootstrap, and
  repository scaffold sync because the host configuration is user-global.
• CLI operands, help, completion, man-page, and documentation contracts now
  derive from one command catalog and reject ambiguous or extra operands.
• Policy compilation, migrations, source ingestion, audit JSONL, lock diffs,
  templates, retention, and release discovery use stricter bounds and
  deterministic identities.
• Semantic-version ordering handles arbitrarily large numeric prerelease
  identifiers without integer overflow and uses POSIX C collation in the
  native installer.

Fixed

• Stabilized the Windows Bun transport contract while preserving simultaneous
  stdout and stderr backpressure coverage, and made the hanging-process timeout
  regression deterministic without orphaning a child process.
• Completed the documented host and adapter timeout inventory for Cursor and
  OMP so the public runtime contract matches the registry and generated assets.
• Removed the non-production reconc demo surface and its private fixture
  engine. The project video remains the demonstration path.
• Removed misleading legacy and quality command surfaces that duplicated
  canonical commands or implied guarantees they did not provide.
• TASK mutations now publish all related files as one no-clobber transaction,
  retain exact file modes, reject symlink and destination drift, and recover
  only from a valid strict journal.
• Repository sync no longer evaluates a moving worktree between policy,
  ownership, and publication checks.
• Cursor postToolUseFailure is failure evidence only, while
  afterShellExecution remains passive because the host supplies no
  authoritative exit status.
• Kimi Code crashes, timeouts, non-2 failures, and post-tool payloads without
  an authoritative exit status can no longer be represented as enforced
  success.
• Release inventory, schema-lock integrity, safe names, case-aware path
  identity, and retained audit data reject malformed, ambiguous, or
  unbounded inputs instead of normalizing them into a pass.
• The exhaustive publication audit retains a hard deadline but now has enough
  headroom for race-instrumented and resource-constrained CI while scanning
  every tracked file and post-boundary history blob.
• Windows tests and transactions now model native file-mode, home-directory,
  executable-lock, and non-directory path semantics without weakening the
  corresponding POSIX ownership and permission checks.
• Async continuation tests preserve their accelerated timeout contract while
  allowing realistic Windows process-start latency and identify every expected
  failure route instead of accepting an aggregate diagnostic count.

Upgrade

For an existing direct installation:

reconc update
reconc doctor --global

Exact native install on macOS or Linux:

curl -fsSL https://raw.githubusercontent.com/Christopher-Schulze/reconc/reconc-v0.9.2/install.sh \
  | sh -s -- --version 0.9.2
export PATH="$HOME/.local/bin:$PATH"
reconc doctor --global

Exact native install on Windows x64:

$installer = Join-Path $env:TEMP "reconc-install.ps1"
Invoke-WebRequest https://raw.githubusercontent.com/Christopher-Schulze/reconc/reconc-v0.9.2/install.ps1 -OutFile $installer
& $installer -Version 0.9.2
Remove-Item $installer
$env:Path = "$env:LOCALAPPDATA\Programs\Reconc\bin;$env:Path"
reconc doctor --global

A global CLI update does not rewrite repository-owned files. Review and apply
repository changes explicitly with reconc repo sync plan, reconc repo sync apply, and reconc repo sync verify. Reinstall a specific agent hook only
when that repository should receive its updated generated adapter.

Compatibility And Limits

• The v0.9.1 schema URLs remain the immutable canonical identities for the
  compatible v1 artifact schemas and v3 policy-lock schema.
• Direct installers remain available for macOS amd64/arm64, Linux amd64/arm64,
  and Windows amd64. Windows arm64 is not shipped.
• Kimi Code hooks are user-global and opt-in. Static configuration is not live
  enforcement proof, host timeouts fail open, and post-tool output has no
  authoritative exit status.
• OMP project extensions are discovered from .omp/extensions; its awaited
  pre-tool and main-session Stop boundaries fail closed, while shutdown is
  observational. OMP tool events expose no authoritative MCP server identity.
• Pi project extensions load from .pi/extensions only after the project is
  trusted. Pi has no permission event, MCP discriminator, synchronous Stop
  event, post-user-shell event, or continuation delivery acknowledgement;
  settled continuation is therefore reported as inferred rather than enforced.
• Cursor surfaces do not promise identical hook delivery. workspaceOpen
  proves artifact loading only, and Cursor exposes no generic tool hook for
  AskQuestion.
• Reconc remains a deterministic repository control layer, not an
  operating-system sandbox against a hostile same-user process.
• Direct POSIX, direct Windows, and source installation are the only supported
  distribution channels in this release.

reconc 0.9.1

reconc v0.9.1

v0.9.1 is the Windows direct-installer reliability patch for the v0.9 CLI
line. It preserves the v0.9.0 policy, repository, ownership, schema, and
embedded harness-pack contracts.

Fixed

• The native PowerShell installer now handles a real HTTPS Content-Length
  header as the numeric value PowerShell exposes instead of calling nullable
  members that are unavailable on that value.
• Missing headers remain accepted, while negative or over-limit values fail
  before writing a destination.
• The streamed 2 MiB metadata and 256 MiB binary caps, checksum validation,
  GitHub provenance verification, downgrade protection, and atomic
  binary-plus-receipt publication remain enforced.
• Native Windows CI now exercises the numeric, missing, over-limit, and
  negative header paths. The post-publication live-release job verifies the
  complete tagged installer over HTTPS.

Install

Exact native install on macOS or Linux:

curl -fsSL https://raw.githubusercontent.com/Christopher-Schulze/reconc/reconc-v0.9.1/install.sh \
  | sh -s -- --version 0.9.1
export PATH="$HOME/.local/bin:$PATH"
reconc doctor --global

Exact native install on Windows x64:

$installer = Join-Path $env:TEMP "reconc-install.ps1"
Invoke-WebRequest https://raw.githubusercontent.com/Christopher-Schulze/reconc/reconc-v0.9.1/install.ps1 -OutFile $installer
& $installer -Version 0.9.1
Remove-Item $installer
$env:Path = "$env:LOCALAPPDATA\Programs\Reconc\bin;$env:Path"
reconc doctor --global

Upgrade

Rerun the immutable v0.9.1 native installer or use the existing source-owned
update path. Then run reconc doctor --global. No repository receipt, policy
lock, hook, schema, or harness-pack migration is required for this patch.

Supported Platforms

Platform	Direct installer
macOS amd64	yes
macOS arm64	yes
Linux amd64	yes
Linux arm64	yes
Windows amd64	yes
Windows arm64	no

reconc 0.9.0

reconc v0.9.0

v0.9.0 turns the standalone toolkit into one globally installed,
ownership-aware CLI with transactional repository ownership and upgrade.

Highlights

• reconc init . is the canonical non-interactive onboarding command. It
  inspects, selects, plans, applies, receipts, and verifies one create-only
  transaction. reconc bootstrap . remains a compatibility alias.
• reconc doctor --global reports the real installation owner, channel,
  binary identity, PATH shadows, receipt health, checksum, target, and
  provenance without mutation.
• reconc update check|apply supports stable, preview, and exact versions for
  direct installs and requires explicit downgrade intent.
• reconc uninstall removes only verified installation-owned global state.
  Repository policy, hooks, TASKs, docs, and evidence remain separate.
• reconc repo sync plan|apply|verify upgrades repository-owned Reconc files
  from the portable receipt. Plans are digest-bound, stale-state checked,
  drift-blocking, rollback-capable, and offline.
• The binary embeds the immutable advanced@1.0.0 public harness pack.
  Initialization and sync no longer depend on a copied source checkout.
• Direct installers support stable, preview, and exact selection, preserve the
  selected channel in the receipt, bound downloads, verify checksums and
  release provenance, reject silent downgrades, and never edit shell profiles.

Install

Exact native install on macOS or Linux:

curl -fsSL https://raw.githubusercontent.com/Christopher-Schulze/reconc/reconc-v0.9.0/install.sh \
  | sh -s -- --version 0.9.0
export PATH="$HOME/.local/bin:$PATH"
reconc doctor --global

Exact native install on Windows x64:

$installer = Join-Path $env:TEMP "reconc-install.ps1"
Invoke-WebRequest https://raw.githubusercontent.com/Christopher-Schulze/reconc/reconc-v0.9.0/install.ps1 -OutFile $installer
& $installer -Version 0.9.0
Remove-Item $installer
$env:Path = "$env:LOCALAPPDATA\Programs\Reconc\bin;$env:Path"
reconc doctor --global

Upgrade From v0.8.8

1. Use the exact v0.9.0 native installer for direct installations or a
   path-qualified v0.9.0 install-cli for source builds.
2. Run reconc doctor --global. Resolve any PATH shadow before repository
   mutation.
3. Plan the repository upgrade with
   reconc repo sync plan . --output /tmp/reconc-v0.9-sync.json.
4. Review every action, then apply the exact emitted digest with
   reconc repo sync apply --plan /tmp/reconc-v0.9-sync.json --digest SHA256.
5. Run reconc repo sync verify ., reconc status ., and
   reconc hook status . --json.

Legacy private bootstrap receipts are accepted only as bounded migration
evidence. They do not grant ownership of user-edited policy, instructions,
docs, TASKs, or unrelated files. Drift and orphaned legacy paths stop before
mutation and receive explicit review actions.

Compatibility And Breaking Boundaries

• The old positional installer version remains accepted, but stable is now the
  default channel when no selector is supplied.
• Exact downgrades now require --allow-downgrade on POSIX,
  -AllowDowngrade on PowerShell, or the equivalent CLI update flag.
• A direct or source install becomes globally owned only after the installed
  binary is the exact bare reconc PATH identity. An off-PATH binary is not
  falsely receipted.
• init --force is rejected. Managed-block acceptance remains explicit and
  whole-file drift is never overwritten.

Release Trust

The release contains five native binaries, both native installers,
Bash/Zsh/Fish completions, the generated man page, all public schemas, the
advanced harness pack, deterministic SPDX 2.3 and CycloneDX 1.6 SBOMs,
release-manifest.json, and SHA256SUMS.

Every checksummed artifact is tied to the protected tag by GitHub build
provenance. The release workflow stays manual-only and draft-first, verifies
the complete inventory before publication, and rejects stale generated
surfaces.

Supported Platforms

Platform	Direct installer
macOS amd64	yes
macOS arm64	yes
Linux amd64	yes
Linux arm64	yes
Windows amd64	yes
Windows arm64	no

Known Limits

• Windows arm64 has no native v0.9 artifact and is rejected explicitly.
• Generated shell hook wrappers and shell policy scripts on Windows require
  sh; Git for Windows provides the supported path.
• GitHub attestation verification is optional when gh is absent unless
  RECONC_REQUIRE_ATTESTATION=1 is set.
• Reconc is not an operating-system sandbox. A hostile same-user process still
  requires an external sandbox and protected remote CI.
• There is no background updater, daemon, telemetry, shell-profile mutation,
  implicit privilege elevation, or mutable-main installer path.

reconc 0.8.8

reconc v0.8.8

v0.8.8 is the final v0.8.x patch baseline before the separately planned
v0.9.0 CLI productization. It publishes the complete standalone line since
v0.8.7: lossless bounded-evidence continuity, explicit taint recovery,
reachable lockfile repair, a stable user CLI installation contract, stronger
cross-platform behavior, and materially higher test coverage.

Evidence continuity and termination

• Long agent sessions now seal complete raw evidence into bounded,
  SHA-256-linked segments instead of truncating the evidence window. Every
  policy, claim, CI, Stop, and completion consumer verifies and replays the
  complete chain plus live evidence.
• Full-chain replay deduplicates evidence in linear time and validates
  multi-segment links, so rotation stays operational under sustained command
  load without turning summaries into synthetic proof.
• Evidence that cannot fit an empty segment, segment exhaustion, storage
  failure, or chain corruption creates a durable project-scoped taint with the
  exact field and limit cause. Successor sessions inherit it, material actions
  remain blocked, and no certified policy or completion pass is possible.
• With repository run disabled, a tainted session may terminate only as
  explicitly uncertified. Run-enabled Stop remains blocked. Recovery requires
  reconc hook evidence-status followed by token-bound
  reconc hook evidence-resolve with an operator reason.
• Session-state readers and the shared active-session pointer now use explicit
  cross-process serialization, including native Windows sharing semantics and
  one-way lock ordering.

Policy and workflow recovery

• Stale-lockfile blocks admit only a fully parsed reconc refresh or
  reconc compile invocation while all other gated work remains blocked.
  Compound commands, pipes, dynamic executables, and unrelated chained work
  cannot inherit the repair exemption.
• Shell-analysis failures now report the exact bounded cause and concrete
  remediation instead of one generic refusal.
• Repository cleanliness scans use a dedicated classified timeout, and
  publication root identity uses the operating system's canonical filesystem
  identity instead of case-sensitive string equality.
• Portable workflow audits distinguish unreferenced TASK details from arbitrary
  Markdown in reserved TASK directories and keep remediation explicit.

Stable user CLI and bootstrap

• reconc install-cli atomically installs the exact running executable into
  the stable user command location, rejects unsafe targets, verifies the
  installed checksum and executable mode, and proves bare reconc resolves to
  that build.
• Mutating compatibility and transactional bootstrap establish the same user
  CLI contract before repository writes. Bootstrap verification checks it
  again, and both native installers emit exact PATH remediation when the
  installed command is missing or shadowed.
• Run-control guidance now uses the canonical repository-root form
  reconc run on|status|off, so users and agents no longer need versioned or
  repository-local binary paths for routine operation.

Coverage and portability

• Whole-module coverage is now enforced for both Go modules. The release
  baseline measures 84.4824% for the standalone module and 85.0377% for the
  portable template, with permanent non-regression floors of 84% and 85%.
• Strict behavioral tests add positive, negative, malformed, boundary,
  concurrency, rollback, parser, CLI, bootstrap, runtime, audit, and
  publication coverage without exclusions or denominator tricks.
• Windows-native regressions cover user-CLI cleanup, PATH guidance, TASK
  reference normalization, concurrent session state, and installer behavior.
  Canonical-path and template tests remain platform-neutral on macOS, Linux,
  and Windows.

Install

macOS or Linux:

curl -fsSL https://raw.githubusercontent.com/Christopher-Schulze/reconc/reconc-v0.8.8/install.sh \
  | sh -s -- 0.8.8
export PATH="$HOME/.local/bin:$PATH"
reconc demo

Windows x64:

$installer = Join-Path $env:TEMP "reconc-install.ps1"
Invoke-WebRequest https://raw.githubusercontent.com/Christopher-Schulze/reconc/reconc-v0.8.8/install.ps1 -OutFile $installer
& $installer 0.8.8
Remove-Item $installer
$env:Path = "$env:LOCALAPPDATA\Programs\Reconc\bin;$env:Path"
reconc demo

Set RECONC_REQUIRE_ATTESTATION=1 to require gh attestation verify. Core
repository control remains one offline Go binary with no Node, Bun, model,
daemon, Docker, or runtime network dependency.

Release artifacts

The release uploads SHA256SUMS plus exactly twenty checksum-bound artifacts:

• reconc-0.8.8-darwin-amd64
• reconc-0.8.8-darwin-arm64
• reconc-0.8.8-linux-amd64
• reconc-0.8.8-linux-arm64
• reconc-0.8.8-windows-amd64.exe
• install.sh and install.ps1
• Bash, Zsh, and Fish completions plus the generated man page
• six immutable v1 schemas plus the current v2 policy-lock schema
• deterministic SPDX 2.3 and CycloneDX 1.6 SBOMs

Every manifest-listed artifact is checksum-verified before upload and covered
by the release workflow's GitHub build-provenance attestation.