v5.33.0

Added

• An operator can let a Codex that TangleClaw cannot verify launch anyway (#2229). Global Settings has a launch isolation override for the whole install and each project's Settings has its own, both off by default; turning one on needs a signed-in operator. With one on, a launch refused only for its Codex version starts without isolation and may borrow another project's identity. It is recorded as such in the log, the activity log, the launch's answer, Launch readiness and tc sessions isolation, which labels the session NOT ISOLATED (operator's override) and no longer lists it for relaunch: a relaunch can isolate it only on a verified Codex version, and is refused on the same version once the override is cleared. The server's line under tc whoami says the same; tc's own verdict is unchanged. A launch refused for an unverified Codex carries a button to the switch. Limits: the mark ages out with the activity log; tc reads no installed Codex version, so after a verified version is installed it still leaves marked sessions out of its relaunch list and the operator relaunches those too; the button goes after six seconds or when used, and an earlier message's timer can hide it first, still keyboard-focusable (#2339).
• tc tells a session when its launch was not isolated (#2228). tc whoami, tc capabilities and the state step of tc start print a Launch isolation: row. NOT ISOLATED means end the session and launch it again. Limit: tc never reports its own session as isolated; a healthy Codex session reads NOT SHOWN ISOLATED, with the server's record beside it.
• tc check watch now wakes you (#2323). When a watched check finishes, TangleClaw sends the watch's project a switchboard message; if the due time passes with no result it sends an alarm instead. tc check show says what became of each message. Limit: a message can arrive twice when its first send was never confirmed, and says so.
• The merge queue lands pull requests (#2322). Its owner runs tc queue advance: one step a call makes an entry's candidate, then lands it only if the pull request, main, both test checks and every gate still hold. No timer. A landed tree that is not the tested one halts the queue until the Operator clears it. Limit: no real landing has been made yet.
• The server now reads a watched check from GitHub and records its result (#2323). A watch registered with tc check watch reads ready or failed within about a minute of its check ending, and expires 24 hours past its due time. At most 30 watches are read a minute install-wide; past that each is read less often.
• A session can record a watch on a named check and read it back (#2323). tc check watch <pr> --sha <sha> --name <check> --due <minutes>, then tc check list or show. A project's folder must be a GitHub checkout.
• A merge queue can be made, submitted to and read (#2322). The Operator makes one with the command in docs/merge-queue.md and names its owner project; that project's session runs tc queue submit <pr> --head <sha> … and its group tc queue status. A pull request that changes version.json or release.yml is refused: a version bump is still merged by hand.

Changed

• A Codex version refusal says how to keep Codex on a verified version (#2222). It names Codex's check_for_update_on_startup = false setting, which stops the update prompt whose default installs the newest, refused, version (measured on 0.156.1 and 0.157.1). Limit: the launch screen shows the refusal for six seconds only (#2339); the full text is in both guides.
• A Codex session launched on its native channel gets its startup prompt by itself on Codex's default status line (#2059). TangleClaw no longer waits for Ready in the status line: it sends once the session's thread is idle and its pane shows an empty composer, and looks once more just before sending. A launch that is held says what was seen (a Codex prompt by name) or that the pane could not be read. A one-item status line still needs Fire startup prompt. #2059 stays open.
• A Codex engine profile must now declare capabilities.wake.headerPattern and startingPattern (#2187). The bundled profile does. A profile of your own that uses the Codex adapter without them has its trust-free startup fire held as pane_not_ready, naming the two fields, until they are added.
• The first wake of a Codex session after its launch waits five seconds longer (#2059, chunk 1 of 2). When the engine first reports the session idle, the nudge is held one monitor interval so it is not typed onto a screen still being drawn; a sender asking meanwhile sees engine-thread-settling. Later mail is not delayed. This does not yet let a Codex newer than 0.156.1 be woken.
• A Codex 0.156.1 session launched into a new or renamed folder can now get its startup prompt (#2186). The fire goes without a trust entry in Codex's config when the pane shows an empty composer; its row in the Launch readiness panel says trust was not granted. Codex keeps the folder's own .codex/ config and hooks off until you trust it. A folder Codex was told not to trust still blocks, and so does any other Codex version.

Fixed

• A wrap no longer arms auto-merge, or rolls the shared priming file, in a project that works under a coordinator (#2320). If a project's workloadNudge.coordinatorProject names a coordinator, its wrap pull request is opened and left open, saying who merges it, and a pull request it was told to merge is neither pushed to nor enqueued; .tangleclaw/priming/build-session.md is kept as it is, the next-session-prime row reads skipped and names who the project works under, and the drawer's banner says the PR waits to be merged instead of "lands when its checks pass". The same holds when its settings or its merge queue cannot be read. Other projects wrap as before. Lane wraps stay held until one is verified after the deploy.
• The wake no longer types a nudge into Codex's startup dialogs or its opening screen (#2187). On Codex 0.156.1 a session showing the folder-trust or update prompt, or still starting, is held (pane-no-prompt, pane-engine-starting) until its composer is usable. Limits: the opening screens of Codex 0.159.0 and 0.161.0 are not held yet; neither version is verified, so no nudge reaches them. Read live before the merge: Codex and Claude Code at rest and mid-turn, Antigravity at rest; Antigravity's mid-turn was not seen live.
• The wake no longer nudges a Codex session in a folder Codex was told not to trust (#2186). Mail for it is held as engine-folder-untrusted until its operator sets that folder's entry to trusted in Codex's config.toml, or reads the mail by hand. A folder with no entry is nudged as before. An unreadable Codex config does not hold mail.
• A coordinator context that a managed rotation has replaced can no longer submit to or withdraw from the merge queue (#2322). Both calls are refused COORDINATOR_FENCED while the owner's rotation is open and COORDINATOR_EPOCH_MISMATCH from any thread but the bound one; make them through tc. An owner that never rotated sees no change.
• tc queue submit and withdraw no longer report the API unreachable when the server is only slow (#2322). They wait up to 60 seconds; past that the pane is told the request may still be running and to read tc queue status. A withdrawal's reason is checked before any branch is deleted, and a second withdrawal of a queue while one runs is refused QUEUE_CALL_IN_FLIGHT.
• A Codex that cannot answer its version check no longer stalls every launch (#2231). It is asked once, then not again for 60 seconds; launches in that time are refused at once and say when it will be asked again. Replacing the Codex file asks at once. One launch now asks once, not two or three times. Limit: the first ask can still take 5 seconds.

Internal

• Codex 0.161.0 and 0.162.0 stay unlisted, with the reason pinned (#2059). Run signed in, each launched and was held correctly while an answer streamed, but once Codex reported the answer finished TangleClaw typed its mail notice into a pane that had not caught up. Nothing changes for operators; 0.156.1 remains the one version launched natively. #2059 stays open for a revised gate.
• Codex 0.161.0 and 0.162.0 are read by their own screens (#2059). Each version's footer row is declared in the Codex profile from its own captures. The launch gate accepts one status row then that footer; both gates refuse the footer alone, the screen those versions open and resume with. Neither version is listed in verifiedVersions yet, so no session of theirs is launched natively or woken.
• One command writes down what CI and the local complement covered for a commit (#2321). node scripts/ci-evidence.js reads the test check for HEAD, runs the complement, and writes .prawduct/lane-evidence/ci-<sha>.json, or refuses and says why. It changes nothing a gate accepts: the lane rule in docs/lane-ci-evidence.md is a proposal, not in force. It is a wide run.
• The merge queue can read a check as one branch sees it (#2322). New readBranchCheck in lib/merge-queue-github.js counts a test run only when its check suite names the branch asked for, so a run made for another branch at the same commit never stands in. Attribution that cannot be read whole answers unavailable. Nothing calls it yet: an operator sees no change.
• The check reader says which app made a run (#2321). readCheck answers now carry app, and workflowRunId for a GitHub Actions job. A run with no app reads as unavailable. Nothing an operator sees changes: the merge queue and check watches read the same fields as before. Nothing judges the app yet.
• One command runs the tests CI skips on your own machine (#2321). node scripts/ci-complement.js runs the tests test/skip-ledger.json names and fails unless every entry this machine is expected to run passed. What is expected is measured, never typed. It is a wide run and changes nothing a gate accepts. See docs/lane-ci-evidence.md.
• Each test CI is allowed to skip now states what a machine needs to run it (#2321). test/skip-ledger.json entries carry requires, from a closed list in scripts/test-skip-audit.js; CI fails on an entry without a valid one. Adding an environment-gated test now needs it. Nothing measures a host yet. See docs/lane-ci-evidence.md.
• Merge queue candidates are merged on a stage branch (#2322). A candidate is now merged on tc-queue-stage/<id>, which CI does not run on, and its tc-queue/<id> branch is created at the finished merge, so each candidate starts one Tests run and none on main's tip. Nothing makes a candidate yet: no route, tc verb or screen. Never add tc-queue-stage/** to test.yml.
• The two-installs Codex case is now a test (#2230). Tests only; nothing changes for an operator. With two Codex installs and the other one first on a pane's PATH, a project launch, a relaunch and the Project Master each run the install whose version was checked, or refuse.
• The test workflow runs on merge queue candidates (#2322, chunk 3 of 5). A push to a tc-queue/ branch now starts the Tests workflow, so the coming merge queue can test a pull request merged with the current main. Nothing makes such a branch yet: no route, no tc verb, no screen. Removing tc-queue/** from .github/workflows/test.yml would stop every queue landing.
• Merge queue GitHub calls (#2322, chunk 2 of 5). One module now holds every GitHub read and write the coming merge queue makes, limited to tc-queue/ branches and a merge commit pinned to an exact head. Nothing uses it yet: no route, no tc verb, no screen. docs/merge-queue.md lists the calls.
• Whole Codex dialog fixtures, by version (#2187, chunk 1 of 2). Test fixtures only; nothing changes for an operator. Read whole, the wake's pane gate does not refuse Codex 0.156.1's trust and update prompts when the channel answers idle; on 0.159.0 and 0.161.0 it does. The fix is the next chunk.
• Check watch records and reader, schema v65 (#2323, chunk 1 of 3). The store gains two tables for a watch on a named check of an exact commit, and a reader of that check from GitHub. Nothing uses them yet: no route, no tc verb, no timer, no screen. Upgrading adds the empty tables; an older server ignores them.
• Merge queue records, schema v64 (#2322, chunk 1 of 5). The store gains three tables for an Integrator-owned merge queue, and the rules for moving an entry through it. Nothing uses them yet: no route, no tc verb, no screen. Upgrading adds the empty tables; an older server ignores them.
• A downgrade note for v5.32.0's dispatch_note column (#2225). That release's notes gave the upgrade and not the way back: an older TangleClaw opens the store as it is and never reads the column; there is nothing to restore. Said here because a released section is not edited.
• docs/releases/v5.32-status.md now says what is true after the release: v5.32.0 is tagged, published and running on the live install, and every check on the live install has been made (#2272, #2273 and #2268 closed on theirs).