Release v7.101.0

Added

• Browser policy rule: one production tab per session, no parallel polling on production, production read-only unless a permit names the action, staging/local preferred for smoke runs, artifacts and uploads under .ai-work/, a human handoff for sign-in and 2FA, and a required evidence record for UI verification (#861)
• browser-operator agent, the only agent type that receives browser tools, with a headless production-smoke checklist (port-forward, GET-only header-injecting proxy, fresh headless browser) (#861)
• Secrets rule: never run a command whose output contains credentials (pod, deployment and secret JSON/YAML, describe, environment dumps, docker inspect, secret-manager reads, kubeconfig and .env files), use field projections instead, reference secrets by name only, and stop and report a security incident when a value appears in output (#863)
• cratis-guard-secrets hook that blocks credential-printing shell commands in Claude Code, Codex and Pi and names the projected alternative, for example kubectl get pods -o jsonpath=… instead of -o json; set CRATIS_HOOKS_ALLOW_SECRET_READS=1 for a call the user explicitly asked for (#863)
• A secret scan (gitleaks detect --no-git) before archiving or sharing local work records (#863)
• modelTier and reviewIndependence agent frontmatter, checked by corpus verification, so each agent declares a model tier instead of inheriting the session default (#859)

Changed

• Reviewer agents (code-reviewer, security-reviewer, performance-reviewer, screenplay-reviewer, repository-investigation-reviewer) now use the reviewer tier and must run on a different provider than the author; where the harness cannot select one, the review states single-provider, and a provider error yields incomplete with one fallback rather than a failed verdict (#859)
• Corpus agent definitions no longer say they inherit the session model; bind a tier to a concrete model in a project-level agent override (#859)

Fixed

• The Pi quality gate recognises a directory outside any Git repository on a separate volume as "not in a Git repository" instead of reporting that the working tree could not be checked (#868)