v0.0.32 — design-review convergence

Ironclad v0.0.32

Design reviews now converge. This release rebuilds the design-review lifecycle end to end: reviewers
return structured findings tracked in a durable ledger, blocking findings close only on evidence from
an independent verifier, and deterministic pre-checks run before any paid review round. A simplicity
budget, convergence loop control with checkpoints, governed operator recovery, and strong-author
routing machinery complete the picture — plus a large set of reliability fixes found in live testing.

Added

• Design reviews now converge: structured, typed findings reconcile into one durable ledger per design; approval requires no active blocking finding.
• Evidence-based closure: a blocking finding closes only when an independent verifier (different agent and model) confirms the fix; fail-closed until a third identity is configured.
• Deterministic pre-checks before paid review (schema, placeholders, concurrency, traceability, complexity budget) with versioned, expiring, audited waivers.
• Simplicity budget: non-standard primitives must be justified at authoring time; a cheap deterministic advisory pass flags complexity before review.
• Loop control with checkpoints: convergence stops when nothing blocks, detects stalls and oscillation, and rolls back to the best checkpoint on exhaustion.
• Governed recovery: /recovery commands let operators override eligible medium/low findings with cooldowns, expiry, and an immutable audit trail.
• Strong-author routing validation harness (offline replay, hash-pinned suite, independent audit sidecar); machinery only, no quantitative routing claim.
• Strong-coder scope and design authoring by default (inline-mode opt-out), with an engine-enforced implementation-spine decision before any scope is recorded.
• Design-to-scope conformance declarations required before review; scopes must declare elicitation defaults, concrete standards, and reasoned requirement-altering assumptions.
• Durable provenance and verification: author/prompt stamps, a per-turn write manifest, artifact verification at run end, and design validation on write.
• Maintainer-only scripted drive of the front-half lifecycle, durably marked as fabricated.

Changed

• Built-in OPUS agent defaults to Claude Opus 5; the review cost envelope accumulates across escalations.
• Coder launches go through one typed lane; Kimi Code 0.29.1 compatibility and a legacy-CLI guard; reviser/author jobs launch read-only.
• Ink: copying wrapped text stays complete across line boundaries; /approve scope renders readable itemized rows.
• README and test report no longer publish platform-dependent suite counts.

Fixed

• Live-testing reliability fixes for the new review lifecycle: pre-check retries no longer drop findings, finished author jobs settle, blocked/exhausted states tell the truth and the next step.
• Front-half automation: project switches deliberately disarm it, support tasks no longer stop it, cancellation recovers cleanly.
• One authoritative design lineage (a replacement proposal cancels the old running review); escalated review remediates terminal findings before paying for re-review.
• Review/reviser failures carry stable machine-readable causes across restarts; task-board rows are bounded and injection-safe.
• Reviser output is validated before persistence under a dedicated size limit; reviewer findings re-enter prompts fenced as untrusted content.
• Review round counting and cost accounting are monotonic and survive degraded runs.
• Vault reconciliation and the lineage graph now include review artifacts; autopilot names the agent that ran; spine reasoning is no longer silently truncated.
• Pre-release public-export audit fixes and an explicit security gate listing for /session and /turns.