Skip to content

agent harness v0.11.0

Choose a tag to compare

View all tags
@github-actions github-actions released this 28 Oct 18:40
· 15 commits to main since this release
Immutable release. Only release title and notes can be modified.
v0.11.0
eba2ad6
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

v0.11.0

Release notes for v0.11.0. This document describes the release contents and the gates that must be satisfied before publication.
The package is @judgment-pack/harness. A completed release is expected to publish
its attested npm tarball and checksums and create the matching Go module tag
go/v0.11.0 on the release commit for module
github.com/Judgment-Pack/judgment-pack-agent/go. The package version and lockfile identify v0.11.0. Publish only after the release procedure
verifies the package, checksums, attestations and matching Go module tag.

Release scope

v0.11.0 contains versioned checkpoint/event/policy readers, task-aware plans,
repeated-tool controls, per-turn routing, optional usage budgets, retained history,
feedback and archive/capture APIs, and tool-taxonomy and dialect-authoring surfaces.
Release publication remains subject to the prerequisites below. The host migration details are in the host upgrade guide.

Archive1 is the retained-history archive shape introduced in v0.11.0; it has no
compatibility promise for unpublished archive prototypes. Imported archives are detached,
read-only display data and cannot resume or execute a run. v0.11.0 does not supply a
persistent host store or scheduler. ADR-0025's unattended-run build items
#223–#230 are assigned to v0.12.0 and are not claimed here.

Host review before pinning

Upgrade readers before writing feature-bearing records. Feature-free checkpoint,
event and report outputs retain their existing formats; opt-in features may write
checkpoint 3, event 2, policy 2 or report 2 as described in the guide. Review the
storage ownership, archive read-only constraints and explicit per-feature defaults
before enabling a capability.

A durable root-author native invocation with an accepted Plan and conversational
controls (AllowConversation in Go, allowConversation in TypeScript) retains
checkpoint 3 / event 2 claim evidence before the provider call; see
host preparation for the exact pause, release and
continuation requirements.

Release prerequisites

  • #171 dialect authoring — Spec companion published at draft maturity; Agent source interop verified.
    The TypeScript and Go factories select the published Spec distribution
    v0.3.0-rc.2,
    source bcac15b7537ce21879201b5e5dfe795496225121, schema
    sha256:0cb49f238c78391cb163a65474cc9af962df2bb1024a55c5310c2b784b2f0557
    and corpus
    sha256:17b16ff7a9b74fe4cc81eb6f6129a6aabdd9834621d9e756aa2d4c1a3f245863.
    This is the retained-column/1 companion at draft maturity with explicit trusted
    base opt-in; the historical Draft RFC0029 checkpoint identity remains inspectable,
    but cannot authorize a new proposal or grant execution authority. The 48 TypeScript/Go calls against the published Runtime v0.39.0-alpha.2 release
    passed and verify source interoperability; they do not establish a published Agent
    artifact pairing. Runtime source 57c854abb9ace8a91013a75ab688bd70d063797c is
    immutable (release);
    the publication evidence is recorded in PR338.
    Runner v0.26.0-alpha.2
    is published and immutable at source 85cbcfc83e589904fa165e908f6fd0e08f71fe9c.
    Its exact-source main CI passed all jobs in one attempt, PR 184 review recorded no
    findings, and its release workflow and published asset/attestation verification
    succeeded. The published Runner and source worker passed the retained-column
    lifecycle fixtures for Core 0.2.0-draft and 0.3.0, including fresh signed fixture
    acquisition, restart, exact record/custody preservation, exports 2–5 and bound offline
    re-execution; 11 backward-consumer calls also passed against unchanged
    historical fixtures. This is synthetic fixture and compatibility evidence, not a
    real Desk/history/grant/stdout, live-provider or positive-policy claim. See the
    dialect authoring design for the contract.
    Final Agent artifact pairing, integrated CI, independent review and release gates
    remain required. No migration rewrites historical records.
  • Taxonomy producer artifacts. Gateway v0.22.0-alpha.1 and Runtime
    v0.39.0-alpha.1 publish the #324/#329 producer metadata under the scoped alpha
    decision. The producer pair has bounded verification; this does not establish final
    Agent integrated CI/review or final artifact pairing.
  • Routing. Routing is implemented and bounded focused acceptance passed. Integrated
    CI, review and final release evidence are required. Keep routing off by default; no
    evidence-based recommendation to enable auto is claimed.
  • Runtime action approval. Runtime v0.39.0-alpha.1 is immutable and verified. Its
    bounded consumer evidence does not prove final Agent integrated CI/review or
    published support for the additional #171 retained-column contract.
  • Go HTML dependency fixes. Upgrade golang.org/x/net to v0.62.0 for
    GO-2026-6860 (quadratic text
    coalescing) and GO-2026-6866
    (raw-text rendering across foreign ancestor namespaces). Compatible transitive
    updates retain the Go 1.26.0 minimum.
  • Go dependency disclosure. GO-2026-5781
    (PDF) and GO-2026-5932 (OpenPGP)
    remain unresolved in the Go module graph. For the final v0.11.0 source, the native
    Linux/amd64, CGO-enabled, default-build-tags assessment on Go 1.26.10 found no
    affected imports in the package/test/generator closure and no affected symbols in
    govulncheck. These findings remain; this is not a code fix, withdrawal or safety
    claim. An explicit maintainer exception covers Agent v0.11.0 and go/v0.11.0 only
    and expires 2026-11-07 00:00 UTC
    (approval).
    Dependency-path replacement is deferred. Other configurations and future releases
    are not covered. Reassess if source, dependencies, configuration or advisory evidence
    changes, and when the exception expires. Separately record the exact release commit,
    npm audit coverage/result, Python dependency assessment, and current primary evidence;
    the offline fixture check is not a live advisory assessment.
  • Capture/export. Optional transcript-v1 capture metadata and projection are
    implemented and paired focused-verified. Integrated CI, review and final release
    evidence are required;
    this does not claim live-provider comparison or whole-issue acceptance.
  • Scoped runner image exception. The maintainer approval
    permits GitHub ImageVersions 20261023.163.3 and 20261026.180.1 for v0.11.0 only,
    expiring 2026-11-07 00:00:00 UTC. Both actual producer and verifier must satisfy
    the exact approved ubuntu26/Linux/X64/os_release tuple; configured tools and all
    other admission gates remain exact. Raw identities and exception usage are
    reported. This accepts unknown host library/kernel/preinstalled-tool differences;
    it is not equivalence proof, a product behavior change or live validation.
    New validated main evidence and independent review are required.
  • Release validation. Before publication, record the exact release commit and dirty
    diff, full required check summary, exact-head CI, full mutation coverage, independent
    review and final artifact/attestation verification. A version edit alone does not
    satisfy these gates.

Live answer comparison

No live answer-quality, token-saving or monetary-cost result is claimed. For Agent
v0.11.0 only, the maintainer deferred #169 and the dependent live routed/unrouted
comparison on 2026-10-26 (scope decision,
issue comment).
The issue remains open and unscheduled. Desk may test the published release and
report bugs; the deferral applies only to Agent v0.11.0. It does not waive other
release gates. No Desk comparison requirement is asserted here.

References

Before tagging, record validation and advisory dispositions for the exact release
commit, confirm the Go module tag, and verify published artifacts and attestations.
Implementation and focused checks alone do not satisfy the release gates.

Assets 5
Loading