v0.4.6

What's new in v0.4.6

Codex coding runs are no longer stopped by the Codex sandbox (#43).

• The harness Go cache reaches every command Codex runs (#401). v0.4.5 set GOCACHE and GOTMPDIR only in the process environment, and a shell_environment_policy.inherit = "core" setting in the user's Codex config dropped them. Codex coding runs now also pass -c shell_environment_policy.set.GOCACHE=… and GOTMPDIR=…, which Codex applies after its filters.
• A run blocked only by the sandbox goes on to the Lab's checks (#402). New coding outcome environment-blocked: the edits are complete, and only the sandbox denied the harness's own verification.
  • With captured edits, the Molecule goes on to the approved checks, which run outside the sandbox. Without edits, the outcome becomes unknown.
  • The ledger, the gate summary and the PR body quote the denial, so a reviewer sees that the harness didn't verify its own work.
  • --continuation checks-only, recovery and delivery accept it. Scope checks are unchanged.
• The Codex sandbox is probed before coding (#403). A fixed check runs through codex sandbox, with no model call: workspace write, harness cache write, spawn, ps and localhost bind.
  • The result is recorded on the attempt, and the coding instruction names what's denied. The denied list is also set as FORGECELL_SANDBOX_DENIES for the run.
  • If the harness cache isn't writable inside the sandbox, coding doesn't start. If the probe can't run, for example with an older Codex, coding starts as before.

Upgrade note: adapter protocol 11. After installing, run forgecell init --lab DIR --rebind <harness> and approve the proposal.

Known limit: --accept-protected-failures can refuse a by-design failure when a costlier regression check comes first in the plan (#406). The workaround is to amend the plan with its regression checks ordered by cost.

---

Native Forgecell CLI for macOS and Linux (amd64/arm64), with per-artifact SHA-256 files, MIT LICENSE and dependency notices. End users do not need Node, Go or source-repository access.

This is a draft release for review, not automatic publication. The rendered installer pins this exact version and its v-prefixed tag at DanielNetzer/forgecell. Approve public visibility and exact-head Actions results before draft review and approved publication. Verify anonymous install, upgrade and rollback before switching the documented legacy endpoint.

Installer activation smoke-checks the version and preserves Lab data. forgecell rollback restores the previous validated release. Running tickets requires Git, authenticated gh and a configured coding harness.