v2.5.0-rc.3 — Re-entry ships with the freeze

What to test

The paths below were fixed against written reproductions, not real use. Drive them as an operator would:

1. Run the continuation START now hands you. In a repo with RDD enabled, run the selectorless preflight STATUS, execute the returned START, grant consent. The reviewing result is now gentle-ai.review-integration.start/v4 and carries next_transition.execute(review.status) with a complete command. Run that command verbatim — expect the bound status/v5 for the same lineage. Try all three scopes: --base-ref … --committed-only, --workspace-overlay, and the plain current-changes projection.
2. Capabilities v2.3. gentle-ai review capabilities --contract gentle-ai.review-integration/v2 must report protocol minor 3 and advertise start/v4 (not start/v3).
3. The provider bundle. From the tagged source: go run ./internal/providercontractbundlecmd verify --archive gentle-ai-review-provider-contract-1.1.0.tar.gz, and inspect the inventory with tar -tzf — it now carries the complete schema set, including transition-execution and the new start-v4 / capabilities-v2.3 pairs.
4. Global mode outside git. gentle-ai review mode enable --scope global from a directory that is not a repository must persist and exit 0.
5. Windows. The full suite now runs on the Windows lane; exercising any review lifecycle on Windows is directly useful.

Consumer note: gentle-pi parity for start/v4 landed in gentle-pi main (Gentleman-Programming/gentle-pi#499). Testing the Pi runtime against this RC requires a Pi build at or after that commit; released Pi builds still decode only start/v3 and will refuse the new envelope by design.

The one change whose argument is verified in tests and unproven in the field is the START continuation itself: it is proven mechanically for the OpenCode runtime by an integration test that executes the emitted command end-to-end, and by one live Claude Code lifecycle. It has not been driven in the field for Pi or Codex against real repositories. Finding a scope or runtime where the emitted continuation does not run verbatim is the most useful thing this candidate can learn.

What rc.2 taught us

rc.2 lasted a day before an operator proved the lifecycle could not be re-entered by following its own instructions: the injected contract ordered every post-START STATUS to carry the exact lineage, revision, and target, while the installed STATUS parser rejected exactly those selectors, and START itself published no runnable follow-up (#3894). The re-entry knowledge lived in prose; the machine refused the prose.

This candidate moves that knowledge into the protocol: the provider now freezes the transaction and hands back the one command that re-enters it. It stays within the same lines as rc.2 — no public Go API widening, fail-closed admission unchanged, and every previously published contract artifact byte-frozen under its digest pin.

START publishes its own re-entry

A reviewing START froze the candidate, selected lenses, and stopped talking. The orchestrator was told, in prose, to reconstruct a revision-bound STATUS the CLI does not parse — a dead end an operator hit on rc.2 within a day.

A negotiated contract-v2 START now returns start/v4: the reviewing created/replayed envelope carries next_transition.execute(review.status) with the operation, the ordered --name=value tokens, a byte-identical selector_arguments echo of the scope selectors, and the lineage/target binding. Capabilities advertise the change as v2.3 (protocol minor 3). The ledger contract's stay-bound step now says what the machine can actually obey: run the returned command verbatim. An integration test drives the OpenCode runtime through the emitted command end-to-end; validation refuses a reviewing v4 envelope without its continuation, and a closed zero-lens envelope with one.

The lifecycle closes what it rejects

A provider-side targeted validator that rejected a correction could leave the attempt half-open, and a terminal escalation left no inspectable evidence of what was refused. Rejected validator attempts now close atomically (#3911), and the earlier rc.2 work on rejection evidence (#3799) holds through that closure.

RDD where git is not

review mode enable --scope global persisted the change and then reported failure when run outside a repository (#3813); it now succeeds honestly (#3899). A genuinely unversioned workspace gets a local Git bootstrap before its first review instead of a refusal (#3885). The TUI gained the global RDD controls (#3766) with copy that matches the advisory policy: gates are informational, delivery stays yours.

Windows is a lane, not an exception

The 19 tests that failed on the newly unblocked Windows lane are fixed and the full suite now runs there (#3891, #1983), with bootstrap-root comparison made path-identity-correct (#3888).

Also in this candidate

SDD settlement types its untracked refusal instead of reporting a generic authority failure (#3882), an apply attempt accounts for the files it creates (#3865), and verify-to-archive routing is guarded by test (#3862). The bench harness gained PTY execution for TUI journeys with correct reader/cleanup joins. The published contract package inventory is complete and asserted exactly (#3905, #3771), and a local build now reports that it has no provenance instead of pretending (#3863).

Install

go install github.com/gentleman-programming/gentle-ai/v2/cmd/gentle-ai@v2.5.0-rc.3

Or the platform binaries below: linux_amd64, linux_arm64, darwin_amd64, darwin_arm64, windows_amd64.exe, plus gentle-ai-review-provider-contract-1.1.0.tar.gz. SHA256SUMS.txt covers all six payload artifacts.