entrust 0.36.0

Breaking

• Codex reports no longer include codexVersionPinned; codexVersion still identifies the observed server.

Changed

• Conformance generates protocol schemas from the locally installed Codex CLI for each run. CI skips this
  check explicitly; generated schemas and a pinned CLI version are no longer kept in the repository.
• A direct OpenCode delegation covers task-needed data, and the Codex relay carries the user's request,
  selected route and approved scope in its authorization context.

Fixed

• Conformance counts only schema-checked messages in its category totals and reports unchecked responses separately.

Validation

• CLI tests passed 126 cases; relay contract 16, orchestration 13 and skill-page checks 8. Package checks passed
  21 cases and skipped the tag-on-HEAD check because the candidate is not tagged.
• Local conformance passed 108 scenarios with codex-cli 0.167.0-alpha.3.2. The schema check reports unchecked
  keywords and unmapped responses; it does not establish full live-server compatibility.
• GLM Flash reviewed the schema and counter changes before the relay changes. Its local full-suite run hit the
  existing E140 checkout-location failure. A later focused Terra/GLM experiment ran with the working skill and
  a single diff; its first relay command had a wrong path, and no separate auto-review verdict was observed.
• The release live orchestrate gate was skipped at the owner's direction. Claude CLI was signed out; the plugin
  routing eval was not run. Node was 24.15.0 and Claude CLI was 2.1.299.

Known issues

• Open issues E67, E110, E90, E96, E100, E102, E103, E104, E111, E113, E114, E117 and E140 are described in
  ISSUES.md.

entrust 0.35.0

Changed

• For a requested Claude model without a named route, check OpenCode before reporting a gap when native Claude
  and Claude CLI are unavailable. Preserve an explicitly named route and model version.
• OpenCode status accepts --catalogue to list the full enabled model catalogue when a requested model is
  absent from the Desktop picker list. The default status output and JSON schema are unchanged.

Validation

• Four focused OpenCode status cases, five adapter-status cases and thirteen orchestration cases passed.
  Package checks passed 13 cases and skipped the tag-on-HEAD check because the candidate is not tagged.
• A live Haiku call through OpenCode succeeded after the model was found in the catalogue but not the Desktop
  list. Terra checked three other routing decisions against supplied scenarios with the skill loaded explicitly;
  those checks do not establish automatic skill activation.
• Kimi and GLM Flash reviewed the change before the subsequent routing-description and eval updates. Kimi's
  invocation completed with a receipt but exited 6 after two additional-agent requests were declined.
• The Claude plugin routing eval did not run: Claude CLI was signed out. The release's live orchestrate gate
  and the Codex protocol upgrade/check were skipped at the owner's direction. The local Codex CLI was
  0.167.0-alpha.3.2; the driver remains pinned to 0.159.3. Node was 24.15.0 and Claude CLI was 2.1.299.

Known issues

• Open issues E67, E110, E90, E96, E100, E102, E103, E104, E111, E113, E114, E117 and E140 are described in
  ISSUES.md.

entrust 0.34.0

Changed

• OpenCode runs expose owner-backed live status and on-demand transcript pages. New sessions allow skills, while
  resumed sessions retain their existing permission rules. Oversized messages can be read in bounded fragments,
  and observation marks a snapshot incomplete when its input identity changes during the read.
• Workers receive available skills by default; an explicit request not to use them is carried in each affected
  brief. Advisor and effort selection follow the user's choices without automatically selecting maximum effort.

Fixed

• OpenCode EXPECT reports an unknown result when command output may be truncated, instead of treating it as
  complete. Reports and live tool summaries expose the server's truncation flag as true, false or unknown.
• OpenCode continuations retain the selected model variant, and the server owner stops its child when the driver
  disconnects. Diagnostic output omits provider error details while transcripts retain the original messages.
• Large relay output is flushed before exit. Codex workers discover available skills without copying the caller's
  entire configuration, and Claude continuations preserve a known safe mode.

Compatibility

• OpenCode EXPECT now exits 5 with an unknown result when no successful command proves a match and any output
  might be truncated or has an unknown truncation flag. OpenCode's exact (no output) is also ambiguous; a
  match is decisive only if it holds for both an empty string and the literal text.

Validation

• PR #91 CI passed on Ubuntu and macOS: 24 of 26 suites each, with fidelity and orchestrate-live not run and
  individual cases skipped. The OpenCode suite passed 135 cases; an independent review found no actionable issues.
• Live Luna and Kimi probes ran against the preceding snapshot, covering skill use, continuation, large output
  and driver SIGKILL with temporary output limits. They did not exercise the final EXPECT change. Real Codex
  skills-bridge semantics and Claude Skill in SAFE_MODE were not established.

Known issues

• Open issues E67, E110, E90, E96, E100, E102, E103, E104, E111, E113, E114, E117 and E140 are described in
  ISSUES.md.
• Cache usage can report a missing read count as zero; one observed Kimi cache miss has no established cause.

entrust 0.33.0

Breaking

• The OpenCode adapter speaks OpenCode's V2 API. V2 servers (measured on 2.1.2/2.1.3) no longer expose the
  V1 routes at all — they answer with the web app's HTML — so the adapter switched wholesale rather than carrying
  a second family, as the 2026-10-08 driver audit prescribed. Sessions, permissions, questions, models, busy
  status, interruption and history all moved: create pins the model, the directory and the permission rules
  ({action, resource, effect}, bash→shell), the prompt body is {id, text} with the input's id echoed as
  the user message, replies link by order instead of parentID, message pages cap at 200, questions are forms
  (answered by field), acknowledgements are 204-only, and health/auth are GET /api/info with the fixed basic
  user opencode and OPENCODE_SERVER_PASSWORD. A report an earlier release recorded as V1 is refused on
  continuation. Live probes re-established what the 2026-10-02 pilot could not: create-time permissions are now
  reported back and natively evaluated, and the owner's OpenRouter models run without a transport override.
• OpenCode's models come from its server, not a saved file. V2 clients no longer keep the V1 TUI's
  model.json, and no server route says which models a user prefers. status.mjs now starts a private server for
  the current directory and lists the models OpenCode Desktop shows in its picker that the catalogue still offers,
  with Desktop's variant for each, or the whole catalogue without Desktop's store; MODEL: inherit selects the
  OpenCode configuration's model and is refused when none is set. The status JSON is schemaVersion 2: models
  and default replace recent. A model is checked by its catalogue id against the run's own directory, so a
  -fast alias and a model a project's configuration declares are found.

Fixed

• The OpenCode driver answers a subagent's permission or question on the subagent's session, attributes a turn only
  the replies that follow its own input, counts an interrupt of an idle session as a stop, refuses a pre-V2 report
  that names no API family, pages through more than fifty subagents, sends each form answer in its field's type
  (an option's label as its value), gives a declined question the refusal's reason, and reads only its own run's
  messages on each poll; its private server's password is always its own. The event stream, which V2 shapes
  differently and which added nothing to the busy status, is gone.
• E139: /entrust:cleanup lists an OpenCode or Claude agent's worktree, by its repository, with the removal that
  is its owner's.

Validation

• Affected suites: OpenCode 102, adapter-status 5, cleanup 64; skills pages: 8 of 8; full offline run-all: 23 of
  25 suites green, with the two live opt-ins (fidelity, orchestrate-live) not run. Live probes against a private
  opencode serve 2.1.2 and the shared 2.1.3 background service: create echoes and natively evaluates the sent
  ruleset (deny, allow, ask), and a permission reject clears its session's pending set
  (research/2026-10-22-opencode-v2-migration/02-review-probes.md). Live workers on OpenRouter GLM flash models ran
  shell commands and answered with receiptOk true, including a continuation, a subagent's write outside the
  roots accepted on the subagent's own session, and a question answered by label and one declined. Not
  established: native enforcement of action names beyond edit, shell and *, and Desktop's store outside
  macOS.
• Measured with Node 24.15.0 and OpenCode 2.1.2/2.1.3. The live orchestrate release gate has not run for this
  candidate; it spends real sessions and a Codex turn.

Known issues

• E67: stopping an approved command outside the Codex sandbox is not established.
• E110: the live gate does not check worker briefs against split ownership or see shell writes.
• E90: swarm batches are limited to fifty units and do not aggregate tokens.
• E96: Claude subagent token figures describe the last call's context.
• E100: worktree coordinator heredocs naming git can be refused.
• E102: the Codex page does not offer the existing background Bash delegation path.
• E103: skill loading in dontAsk mode needs an allow rule for the status probe.
• E104: advisor and refutation effort are stated inconsistently.
• E111: the blanket exclusion of Luna from judgement is not supported by one measured run.
• E113: temporary-directory checks do not verify permissions.
• E114: two lock cases fail inside the Codex sandbox and pass outside it.
• E117: bulk-unit rules are duplicated.
• E140: agent-run D6 uses the checkout as a write target and fails under ~/.codex.

terse 0.7.0

Breaking

• clarity now requires explicit invocation in Codex and Claude Code. Invoke $terse:clarity or
  /terse:clarity when needed; it no longer starts automatically.

Changed

• All four skills use native host instructions for Codex and Claude Code: available model tiers,
  independent critics batched to capacity, and continuation of the same writer. Run creation lives in
  one recipe with local RUN_ROOT and RUN, temporary by default and durable only at the user's supplied
  path; rewrite resolves local SKILL_DIR for its helper. All four skills require explicit invocation,
  with Codex invocation policy alongside Claude's frontmatter, including clarity.
• The genre note for skill pages says how a page cut to fit what a compaction keeps loses no fact: a restated fact
  goes only where its owner states it in the same words at the moment the reader meets it, every event the page
  handles keeps a line on the page, and a rewritten sentence keeps the old one's conditions. Why: the two cuts of
  2026-09-30, of entrust's codex and orchestrate pages, lost facts in each of these ways, and an audit of every
  removed sentence and a fresh reader caught them.
• The genre note for skill pages says what Claude Code keeps of a skill after a compaction: Anthropic documents the
  first 5,000 tokens of each re-attached skill, within 25,000 shared by all of them, and in Claude Code 2.1.280's
  code a token is four characters, so about 20,000 characters of the body survive, without the frontmatter and with
  its paths filled in, the most recent skill first; a skill's first load is never cut. It also lists Anthropic's
  mechanical limits for a skill: the name format, a body under 500 lines, description and when_to_use within
  the listing's 1,536 characters, every reference linked from SKILL.md itself, a table of contents at the top of a
  reference over 100 lines, and forward slashes in paths. Before, it gave only the 5,000 tokens, with nothing to
  measure a page against.
• The skill-page genre note's example ends with the repair: entrust's codex page moved the steps a coordinator
  takes only on an event into the files that own them, linked where each event comes up, and now re-attaches whole
  after a compaction; E77 closed once entrust's orchestrate page fit too. Before, the example said the page was not
  repaired yet.

Fixed

• The Node floor has one copy besides engines, and a test keeps it true (E107). The README keeps
  "Node 22 or newer", the reader's install decision; pages.test.mjs now fails when it differs from
  package.json's engines.node. The rewrite page and the run recipe dropped their copies: the model that runs
  them cannot change the machine's Node, and an older one fails on its own. Before, a change to engines left
  two copies wrong and no test noticed.
• audit, clarity and rethink link directly the files they reached only through rules.md: all three
  writing-rules.md and curse-of-knowledge.md, audit also genres/code-comments.md, clarity
measurements.md, and rethink truth.md, naming its writer as the role that gets the sentence rules. Before, a
  model reached them a second link away and may read a page that far down partially. references/roles.md lists
  its sections under a Contents heading after its opening table, so a preview of its first 100 lines shows where
  every brief is; before, such a preview stopped in brief 2, with eleven of its fourteen sections unseen. The
  repository's evals/skills.test.mjs found both.

Validation

• With Node 24.15.0, the page suite passed 12/12 checks and the repository skill suite passed 8/8
  across 60 pages and 13 skills. The merged manual-invocation PR #86 passed all four CI jobs.
• Live host invocation, automatic-trigger evals and a fresh cross-plugin session were not run for this
  release preparation. Host behavior remains unverified beyond the static policy and page checks.

Known issues

• E141: the plugin and marketplace descriptions still say the assistant may choose clarity, although
  its invocation policy requires the user to invoke it explicitly.

entrust 0.32.0

Changed

• The main proxy runs a full Claude Code session. Claude executes and verifies work with its native tools,
  configured MCP servers, plugins, skills and memory. The host relays messages and final answers through
  prepare, the attached run and finish; tool activity stays in the existing transcript. Chrome integration is
  enabled and bypassPermissions is requested; Claude's own policy determines the observed permission mode.
• A continuation keeps the same Claude session. Failed, refused, never-started and unconfirmed rounds close
  with an explicit outcome. Nothing is replayed automatically; the next user message continues an observed
  session or starts a new one. A live round must finish or be stopped before the mode ends.

Fixed

• A policy denial of an individual proxy tool no longer suppresses a valid final answer. Denials remain in the
  report and status; ordinary workers retain their existing approval semantics.
• A failed proxy round no longer leaves an irreversible resumeUnavailable flag. Recovery uses the observed
  session, and an unknown outcome remains explicitly unknown.

Breaking

• The host-executed proxy protocol is removed: capability catalogues, agent orders, catalogue, begin, bind,
  record, results, the coordinator profile and the ATTACHMENTS header. The transport accepts text messages.
• State from Entrust 0.31 or earlier is refused unchanged. Start a new activation in a new state directory;
  there is no migration or compatibility runtime.

Validation

• Direct proxy: 23 offline scenarios; Claude driver: 36; affected OpenCode suite: 94. Four deliberate regressions
  in denial handling, failed-session recovery, stopping and instruction delivery were detected by the direct suite.
• Live Haiku: the candidate plugin loaded, Bash wrote a marker, Read verified it, the next message retained
  context and session ID, an in-flight command was stopped, and a new message resumed without replay.
  No delayed write appeared over the stopped command's remaining lifetime. This does not establish SIGKILL recovery
  or browser interaction.
• Measured with Node 24.15.0, Claude Code 2.1.299 and codex-cli 0.163.0-alpha.10.2. The Codex protocol remains pinned
  to 0.159.3. The broader live orchestrate, cross-plugin and Codex fidelity release gates have not run for this
  candidate; publication proceeds without those additional gates at the owner's explicit request. The full local offline run reproduced one pre-existing
  agent-run D6 failure on both the candidate and unchanged HEAD when the checkout is inside ~/.codex (E140).

Known issues

• E67: stopping an approved command outside the Codex sandbox is not established.
• E110: the live gate does not check worker briefs against split ownership or see shell writes.
• E90: swarm batches are limited to fifty units and do not aggregate tokens.
• E96: Claude subagent token figures describe the last call's context.
• E100: worktree coordinator heredocs naming git can be refused.
• E102: the Codex page does not offer the existing background Bash delegation path.
• E103: skill loading in dontAsk mode needs an allow rule for the status probe.
• E104: advisor and refutation effort are stated inconsistently.
• E111: the blanket exclusion of Luna from judgement is not supported by one measured run.
• E113: temporary-directory checks do not verify permissions.
• E114: two lock cases fail inside the Codex sandbox and pass outside it.
• E117: bulk-unit rules are duplicated.
• E139: OpenCode and Claude worktrees are absent from the cleanup ledger.
• E140: agent-run D6 uses the checkout as a write target and fails under ~/.codex.

entrust 0.31.0

Added

• entrust:proxy, an explicit-only skill that switches the session to a Claude coordinator after one final
  confirmation. The confirmation names the model and the provider of the route, read from the CLI's route and
  settings rather than guessed from the model, and delegates every right and capability of the session and the
  sending of its working context to that provider. Nothing is launched and no context is sent before the user's
  answer; Cancel leaves the running mode as it was. The consent is saved with its source, session, time, model and
  provider, holds across resumes, restarts and tasks, and is the justification begin prints for a platform check.
  The helper binds the answer to the pending activation and the host session; it cannot tell who wrote it, and the
  skill makes the host the judge of an explicit affirmative.

Changed

• OpenCode status lists three saved recent models instead of two. A model family the user names is found when it
  is among the three most recent references, so switching between three families no longer reports one as unresolved.
  MODEL: inherit still runs the first recent model.

• The main proxy's coordinator acts only through the host. Claude runs it with no tool, MCP server or
  installed or custom customization of its own (--tools "", --safe-mode, --strict-mcp-config); platform built-in
  plugins and admin policy that safe mode keeps are accepted only by the provenance init reports (path: builtin,
  source: <name>@builtin), not by name; an init that names anything else, a
  call of its own, no init at all or another model than the confirmed one fails the round without dispatch and keeps
  the coordinator. A round is admitted at prepare and again in the driver right before the coordinator starts, so
  an end, a switch, another host session or another route sends nothing from a round not yet admitted (admission under the state lock is the round's durable start; one already admitted finishes, keeps its report and publishes no orders of an ended mode). Orders publish unbegun; begin claims one
  right before the host executes it, and an end revokes those not begun. A switch saves the new consent first, ends
  only this host session's replaced mode, and finishes on a repeated confirm after a crash. Images in native results
  reach the coordinator as image blocks. A catalogue keeps every runtime capability and its native schema: arguments
  are checked only against a schema whose every keyword the reader enforces, and enum compares JSON values without
  regard to member order. A failed round closes, so the next prepare continues the same coordinator, and a large
  catalogue is sent once and then as changes.

Fixed

• A relay the host interrupted without a signal no longer leaves its external run to finish unseen, and a relay's
  hand-back can be checked. On the Codex host measured on 2026-10-18, the native interrupt of a Luna relay delivered no
  signal: a plain 20-second command ran to its end with no Entrust in it, and a click on the card was not observed. When a
  proxy's task ends interrupted, --stop --report-file is the explicit bridge: it signals the driver once, after its whole
  command line equals the one the keeper spawned (recorded in spawn.json), and prints the nine lines with
  stopped=stop. Without it the keeper cuts a run whose proxy was last seen attached or returning with RUNNING= and
  has not called again 180 s later, as a Stop would (partial report, RECEIPT= reading stopped=relay-lost): up to
  750 s from the interrupt, since the interrupted call keeps pulsing until its 570 s return. A request waiting on a
  decision, a run handed back and a run nobody attached stay uncut. lifecycle.jsonl journals each attach, return,
  hand-back, stop and each signal a --run received with whether it attempted to forward it (an attempt, not a
  delivery). --handback compares a relay's hand-copied message with the launcher's own lines (three relays dropped
  the final REPORT=): exact, truncated, differs or running, with the canonical lines framed; no copy is
  promised lossless. The claude and opencode entry points name the Luna medium relay under Codex, and the shared
  page forbids a coordinator's own --run. A hand-made signal remains the recovery for a run no command reaches. A
  --stop that comes after the driver is spawned and before it announces itself waits up to 10 s for the announcement instead of refusing, and --handback tells a driver that is starting, a report
  nothing was launched for (a call's own sandbox refusal included, reproducible only in the same sandbox) and a driver
  that died with no exit marker from a run that is going. A live pid counts as the run's driver only when its owner and
  whole command line are the spawned ones, so a reused pid no longer hides a terminal report as running; a claim file
  with no driver, or a process whose identity cannot be read, is unknown with a note, not starting; and another
  report path in a run's directory is refused.
• An OpenCode driver stopped before its prompt is admitted ends in a terminal aborted report. Its Stop handler was
  installed after the private server started, the model was looked up and the session was made, so a Stop that the
  launcher forwarded on the pid line, which comes first, killed the driver by default and left only the starting claim
  (measured 2026-10-18, exit 143, no cancellation). The handler is now installed before the pid line. Until this
  invocation has submitted its prompt, a Stop records its reason and cancels the server startup in flight, and the next
  startup boundary ends the run with exit 3, turnStatus: aborted, partial: true, receiptOk: false, nothing
  submitted and the private server closed. The report keeps what is known: the observed model stays null before any
  model response, a session ID is kept if one is already known (a resumed or created session) and is null otherwise, and
  the requested model is kept when the prompt named one and stays null while an inherited selection is unresolved.
  cancellation.observed: idle there means only that this invocation submitted nothing (promptSubmitted: false); it
  does not say a prior session or another invocation's child is idle, and a prior busy child is never aborted.

Breaking

• main-proxy.mjs init is replaced by propose and confirm; a request outside the proxy skill no longer activates
  a coordinator, and the claude and opencode pages answer one with the proxy command. OpenCode and Codex coordinators
  are not offered: no profile of theirs acts only through the host yet. A mode saved by init keeps its read-run
  coordinator and is never given a consent.

• A confirmed mode's orders start as published and need begin before bind or record.

• The entrust:proxy skill is not the agent type of that name that 0.30.0 renamed to entrust:relay.

• An external OpenCode run has no wall clock unless its caller declares one, as Codex and Claude. The 30-minute default
  cut healthy runs that were still working (--timeout 0 was also read as an instant limit). --timeout now defaults to 0
  (none), --idle-timeout keeps its 600 s (0 disables) and a session the server reports busy, or an event of this run's
  own sessions, is still progress. Both clocks stand still while a request waits for its decision, from when the driver observes
  it open until it observes the decision, the deadline or its own refusal (a group rejection decides its siblings only
  when this run owns every member), so the native call that follows is work, and silence restarts in full from there. A
  definite native response to the reply, a 4xx included, counts as progress (liveness, not proof the answer was applied);
  a 5xx or transport failure does not. The three numbers take whole values only (no fraction, sign, exponent or blank),
  and a published terminal or cut report carries limits. The volume bound, stops, partial results and
  RESUME are unchanged.

• An external Claude run has no wall clock unless its caller declares one, as a Codex agent since 184bc339.
  The 30-minute default cut healthy runs that were still working. --timeout now defaults to 0 (none) and takes 0;
  --idle-timeout (default 900 s, 0 disables) cuts a run whose stream writes no event of the run for that long.
  The run is started with --include-partial-messages, so a message being written, a subagent's event or a running
  tool's progress heartbeat counts as life, while only whole events count as calls or evidence; a line that is no
  such event does not. Both clocks
  stand still while a request waits for its decision, and silence starts again in full once the last one is
  answered; work keeps its time. The volume bound, stops and RESUME of a cut run are unchanged; the report adds
  limits, cancellation.kind (signal, wall, idle, volume or rights) and longestSilenceMs. Claude Code writes that
  heartbeat every 30 s for a tool in the main conversation and none for a tool inside a subagent, and how long a
  healthy run stays quiet is not measured yet, so 900 s is Codex's default rather than a proven one;
  longestSilenceMs is how each run measures it.

entrust 0.30.1

Fixed

• Main proxy delivers terminal worker replies without collect. Delegate and continue outcomes publish the
  bound reply's full content and SHA-256 beside the native result. Spawn bindings accept one terminal update;
  missing or unreadable replies report delivery_error, and terminal outcomes remain immutable. Unbound launch
  refusals and errors remain recordable without inventing reply delivery; completion requires a binding.

Measurements and conditional checks

• Measured with Node v24.15.0, codex-cli 0.162.0-alpha.17.2, and Claude Code 2.1.299.
• Offline regression: the two-delegate no-collect case fails on 0.30.0 and passes on the fix. Results and the next coordinator prompt retain complete valid UTF-8 Unicode/quotes/CRLF replies longer than 64 KiB, SHA-256 over the raw file bytes, and verbatim native outcomes. Spawn reads, terminal delivery errors, continuation, immutable publication, and existing collect behavior are covered.
• Affected offline suites: main-proxy 18 passed; claude 29 passed and 1 opt-in live skip; orchestrate 11 passed; fragments 2 passed; package 13 passed and 1 release-tag skip; skill-page checks 8/8; git diff --check passed. The release-tag check must run after tagging.
• The opt-in live Claude case was not run because it spends a Haiku run that is not authorized.
• Live orchestrate gate not run: it needs Sonnet, Fable, and a Codex turn on Astra, which are not authorized.
• Codex schema regeneration and the live fidelity gate not run: the Codex driver behavior is untouched (only VERSION changes); CLI migration is outside this release's scope.
• Installed acceptance, run after publishing: Codex's plugin manager updated the existing install to 0.30.1 (all 77 files equal the tag). A native Luna proxy using only the installed helper ran Claude Opus as coordinator, which delegated to native Luna and Sol (low) without collect; both complete replies (one over 500 KB) and their raw-byte sha256 reached Opus through the helper's results, with no reply text or hash in the host's bind/record inputs. Object and raw-string invokes and a follow-up message passed, ending with no pending, unknown or rejected requests. Test-harness deviations: one round was sent before the first final answer, and the first catalogue had a wrong input kind for an unused tool. Physical restoration of the parent Claude session is not proven.

Known issues

• E67. A command run after an approval, outside the sandbox, is not established to end when its agent is stopped
• E110. E59's fix dropped the live gate's check of worker briefs against the split's owners, and a shell write of the shared file is invisible to it
• E90. The swarm, the bulk row's batch route, is called an experiment, holds fifty units at most, and reports no tokens
• E96. The harness's token figure for a Claude subagent is its last call's context, and the plan's comparables are built on it
• E100. A coordinator session inside a worktree has the launcher's heredoc calls refused when their text names git
• E102. A Codex agent can run as one background Bash task, as the swarm runs fifty, but the codex page offers only the Haiku proxy, for a reason the claude page contradicts
• E103. In dontAsk mode the codex page, and the advisor page that loads it first, do not load, because the Codex status line it runs needs an allow rule the page cannot give
• E104. A role's effort over the default is stated twice, in codex's parity reference and its model table, and the two differ on refutation
• E111. The pages keep Luna out of judgement, and on one run Luna at high effort was the strongest dissenting critic (research)
• E113. Each level of the temporary directory chain is checked once, after it is made, and never for its mode
• E114. Two cases of the lock suite fail inside Codex's sandbox and pass outside it on the same tree
• E117. The bulk row's unit, derived count and pilot are written twice, on orchestrate's plan reference and on the swarm page
• E139. An OpenCode or Claude worktree is in no ledger, and cleanup does not list it

entrust 0.30.0

Changed

• Main proxy state mutations are serialized and batches publish once. Status reconciles lost stdout;
  catalogue generation and string-input invoke support raw native tools. Collect requires a terminal status,
  and explicit worker defaults must still be runtime-advertised.
• Claude can coordinate main proxy sessions. A runtime capability catalogue governs invoke and explicit
  worker model/effort selection; main-proxy.mjs preserves messages, complete outcomes and report lineage.
  Claude submits a root-combinator-free schema copy and validates the original contract locally, with schema
  hashes and invocation timestamps in its report.
• Entrust OpenCode sessions read outside the working directory without path prompts. RIGHTS scopes writes,
  not reads. Bash also runs without prompts and is not limited by the session's file or network tool scopes.
• External worker names and relays have clearer contracts. Names use model family, stable id and role, and a
  supported native follow-up reuses its relay task. OpenCode diff reviews receive their patch inside the brief,
  so the worker does not need the worktree's shared Git metadata.

Breaking

• The per-worker agent type is now entrust:relay; rename entrust:proxy in saved Workflow scripts and prompts.
• Main proxy delegate orders require a catalogue-listed worker model and effort, supplied explicitly or by an
  explicit mode default; neither is inherited.
• Custom Claude OUTPUT_SCHEMA files must use the local validator's supported subset and an explicit root
  object type. An unsupported schema fails preflight (exit 2) before launch.
• Claude reports set outputSchemaOk only after validation against the original schema. A complete, otherwise
  successful structured answer that fails the original schema exits 13.

Release baseline

The retained Unreleased bullets on OpenCode reads/Bash and worker naming/relay follow-ups landed in e6a2bd05 (#79), already on main before this release branch. git log entrust@0.29.0..e6a2bd05 --oneline also lists 46b37b17 (#78), a ledger update. The full release baseline is entrust@0.29.0; these bullets are not new changes in e6a2bd0..HEAD.

Measurements

Measured with Node v24.15.0, codex-cli 0.162.0-alpha.17.2 and Claude Code 2.1.299.

Conditional checks

• Run on source: live main-proxy acceptance, native Luna proxy → Claude Opus → native Sol/Luna, object and raw-string invoke, and follow-up. Evidence: /private/tmp/entrust-claude-opus-proxy-01a13ab1-20261014/live-final/l3-live.reply.md (three attributed, schema-valid coordinator rounds, zero pending/unknown requests).
• Passed: fresh candidate session, Claude Code 2.1.299 headless on Opus with --plugin-dir at candidate 085d4ba. The only loaded entrust copy was 0.30.0 (builtin plugins were also present); entrust:relay was present and entrust:proxy absent. «Давай используем прокси на claude opus» loaded entrust:claude, not opencode, and selected the mode without requiring a task first. Evidence: /private/tmp/entrust-claude-opus-proxy-01a13ab1-20261014/release/session/l6-session-3.reply.md. An earlier --max-turns 4 run ended on the turn limit before a final reply; the successful run used --max-turns 15. The later commit changes compatibility wording only.
• Not run: cross-plugin terse brief. plugins/terse/plugin/references/roles.md:9 reserves external-model adapters for an explicitly requested external run. A search of plugins/terse/plugin finds no entrust:proxy/relay or Entrust agent launch path; unrelated third-party agents/ research references do exist. A real brief through the relay would spend its pinned Haiku model, which was not authorized for this release.
• Not run: live orchestrate gate; Sonnet, Fable and a Codex turn on Astra were not authorized for this release.
• Not run: Codex protocol schema regeneration and live fidelity gate. codex-cli 0.162.0-alpha.17.2 differs from PINNED_CODEX 0.159.3; this release changes only the Codex driver's VERSION, not its protocol behavior. Protocol migration is out of scope.
• Not run: live routing plugin eval, because it spends Claude Code plugin-eval sessions not authorized for this release. An offline routing fixture was added.

Limitations

• 240 runtime capabilities were catalogued and forwarded generically; only read-only exec_command and functions.exec samples were invoked live.
• Physical restoration of the Claude parent session is not proven; the reports prove linkage only.
• The known agent-run D6 failure under this ~/.codex path is pre-existing; that suite is not part of this local run.

Known issues

• E67. A command run after an approval, outside the sandbox, is not established to end when its agent is stopped
• E110. E59's fix dropped the live gate's check of worker briefs against the split's owners, and a shell write of the shared file is invisible to it
• E90. The swarm, the bulk row's batch route, is called an experiment, holds fifty units at most, and reports no tokens
• E96. The harness's token figure for a Claude subagent is its last call's context, and the plan's comparables are built on it
• E100. A coordinator session inside a worktree has the launcher's heredoc calls refused when their text names git
• E102. A Codex agent can run as one background Bash task, as the swarm runs fifty, but the codex page offers only the Haiku proxy, for a reason the claude page contradicts
• E103. In dontAsk mode the codex page, and the advisor page that loads it first, do not load, because the Codex status line it runs needs an allow rule the page cannot give
• E104. A role's effort over the default is stated twice, in codex's parity reference and its model table, and the two differ on refutation
• E111. The pages keep Luna out of judgement, and on one run Luna at high effort was the strongest dissenting critic (research)
• E113. Each level of the temporary directory chain is checked once, after it is made, and never for its mode
• E114. Two cases of the lock suite fail inside Codex's sandbox and pass outside it on the same tree
• E117. The bulk row's unit, derived count and pilot are written twice, on orchestrate's plan reference and on the swarm page
• E139. An OpenCode or Claude worktree is in no ledger, and cleanup does not list it

Local checks

All targeted suites exited 0, on tracked files:

package: all 13 passed, 1 skipped: an entrust@ tag on HEAD is the version the tree claims
fragments: all 2 passed
main-proxy: all 14 passed
claude: all 29 passed, 1 skipped: live, opt-in: the real claude on Haiku through the launcher, an approval accepted
agent-contract: all 15 passed
gate-checks: all 24 passed
orchestrate: all 11 passed
opencode: all 85 passed
skills: 60 pages read, 12 skills; 8 of 8 passed

The full matrix is reserved for PR CI.

Stage C recheck

After the compatibility wording commit, package, claude and fragments each exited 0:

package: all 13 passed, 1 skipped: an entrust@ tag on HEAD is the version the tree claims
claude: all 29 passed, 1 skipped: live, opt-in: the real claude on Haiku through the launcher, an approval accepted
fragments: all 2 passed

git diff --check passed and git status --short was empty at 6669b8d.

entrust 0.29.0

Changed

• A proxy relays one run and decides nothing, on every host, and a fresh one runs each call of the launcher.
  Three pages gave the proxy three contracts: the shared call page's relay that never reads the result, the
  operational proxy that decides covered requests and reads the report, and the shipped agent that hands every
  request back. In Codex the proxy was the deciding one, kept one attached call and polled; on 2026-10-09 three
  Luna proxies started a second watcher on one driver, accepted a clipped request and left --why empty on 26
  accepts, and a read-only check took close to three hours. In Claude Code two Haiku proxies of three, sent the
  same block after a decision, answered from their earlier turn and ran nothing. Now every host runs the same
  block in a fresh small agent for each --run (the first, the one after a decision, a continuation's first),
  names it after the external agent on every host, and the coordinator decides every request; the operational
  proxy page is the main proxy mode's alone.
• A read agent checks with its file tools, and its inputs sit inside its directory. Orchestrate told the
  coordinator to give every worker capture-check.mjs, a shell command, while an OpenCode read agent asks for
  every shell command and a Claude one for any command outside Claude Code's read-only set; on 2026-10-09 read
  agents briefed that way asked 11 times (Claude, Sonnet) and 43 times (OpenCode, GLM) in one read-only task,
  each question a stop for the coordinator. The script now goes to native workers and Codex agents; the shared
  call page tells the coordinator to brief an OpenCode or Claude read agent in reads and searches, and to put an
  OpenCode read agent's inputs inside its directory, since for one file outside it the agent asked for the whole
  directory. Both drivers now tell a read agent that its read, grep and glob tools need no approval, and the
  coordinator runs a check that needs a command before the launch and puts the result, the commit included, in
  the task. On 2026-10-10 the same task asked once, from 111 calls of read, grep and glob and none of the shell.
• Four rules a coordinator had to guess are on the pages. Read against one task on two hosts, the pages left
  these to what a Claude coordinator already knew or a Codex one did not: whether a subagent can launch agents
  (the Claude adapter said it can; a cloud session's subagent had no Agent tool), whether a pre-approved team lifts
  the usage stop (a Codex coordinator read it so and ran past three times the pilot), which text the completeness
  critic must have read (in both hosts a shorter message went out than the one it read), and whose TMPDIR an
  external agent's checks write to (orchestrate promised each agent its own; only the Codex driver makes one).
  Each now says what holds.
• A refused accept of an OpenCode or Claude request names the frame it was printed in. --decide --accept
  compared a typed request's body but told the caller to copy the lines between COMMAND<< and COMMAND>>,
  which such a request does not print; on 2026-10-09 a proxy that restated an OpenCode permission's command
  alone was sent looking for them twice. It now names REQUEST_BODY<< and REQUEST_BODY>> for a typed request.
• The usage stop compares usage per unit. It compared an agent's total with the pilot's median per agent, so an
  agent carrying more units than a pilot agent crossed it by size alone: on 2026-10-10 a Codex coordinator's pilot
  agent read one ledger entry for 376,319 tokens, was continued for the other twelve for 2,470,884, six and a half
  times the pilot and about half of it per entry, and the audit of that run reported the stop as missed.
  The line is now three times the pilot's median per unit, counted in tokens from the agent's report, since a
  second audit could not tell whether "usage" meant tokens or the catalog cost an OpenCode report also carries.
• In Codex, a proxy runs the launcher outside the sandbox. The proxy's block was written for Claude Code's Bash
  tool and said nothing of a sandbox; the driver starts the agent's CLI, which writes its state under the home
  directory and reaches its provider, and Codex's sandbox allows neither by default. On 2026-10-10 a Codex proxy
  given the block alone handed back an OpenCode server that had exited before its run began, where the day before
  proxies that asked for escalated permissions had started theirs. The shared call page now gives a Codex proxy a
  step 1 that asks for them, with a justification naming the agent, and the launcher refuses a --run or a launch
  made under Codex's macOS sandbox, which marks its commands CODEX_SANDBOX=seatbelt, before it starts anything:
  its ERROR= says to run the same command again with escalated permissions, and the agent's directory stays
  fresh for that call. The suites' own launches drop the mark.
• In Codex, a proxy waits for the run to end before it hands back. Codex's shell tool comes back while a long
  command runs, with a session id and no exit code, and the block's step 2 sent such an empty result on as it was.
  On 2026-10-10 four of the first five Codex proxies that ran handed back nothing, or step 4's "report delivered"
  line, while their agent went on working, and the coordinator read the report and the driver's processes itself.
  A Codex proxy's step 2 now reads the command's session again with write_stdin until an exit code comes, and
  its step 4 is left out, since its final message is its hand-back.
• The proxy's command goes as written, with no variables before it. Orchestrate told the coordinator to pass
  its temporary context on "worker commands", and on 2026-10-10 a Codex coordinator put TMPDIR,
  ENTRUST_STATE_DIR and ENTRUST_TEMP_CONTEXT, over 400 characters, before every proxy's --run; one brief
  mistyped the launcher's path and its proxy was stopped. --run starts the driver in the working directory and
  with the state directory --new recorded, which a new case in the launcher's suite checks from another directory
  and another TMPDIR, and the pages now say the launcher's calls take none of it.
• An approved plan is the permission to send an agent's provider its files, and in Codex the coordinator's
  launcher calls run in the sandbox. Codex's automatic reviewer of escalated commands read a --new that sends
  the project's files to OpenRouter as a transfer the user had not approved, though the brief the user pasted said
  they had: on 2026-10-10 it refused the launch twice, and the run waited 15 minutes for the user's chat answer;
  earlier that day the same refusal ended with the coordinator doing the task with the host's own model. Telling
  the coordinator to get that approval in the chat first then held a later run 21 minutes on a pasted brief that
  carried it, while that run's --plan, --new and --decide worked without escalation and never reached the
  reviewer. Orchestrate now says that an approved plan, or a request naming the adapter or the model, is that
  permission and no other is asked, runs those three calls unescalated, and turns to the user only when the
  reviewer refuses an escalated one.
• After a passing pilot, the rest runs side by side. The plan said only to expand when the pilot's rule passes,
  and on 2026-10-10 a Codex coordinator continued its one GLM agent over the twelve remaining ledger entries in
  three batches of four, one after another (6.1, 5.0 and 2.9 minutes), under a bound of six alive. The plan now
  gives the remaining independent units to agents that run side by side within the bound, unless usage rather
  than time is the limit.
• An OpenCode server that ends before it serves says why. The driver read the server's output only for its
  address and reported "exited before announcing its local URL" alone; on 2026-10-10 a Codex rerun of the
  orchestrate task stopped there half a second after the server started, and its report held no exit code and
  none of the server's words. The error now carries the exit code or signal and the last lines the server printed.

Validation

• Locally, in a Linux container running as root on Node 22, the suites this release touches pass: agent-run 62,
  agent-contract 15, opencode 84, claude 26 with its live case skipped, orchestrate 11, lint-draft 13,
  capture-check 17, status 10, fragments, conformance, and package with its tag check skipped;
  scripts/skills.test.mjs passes 8 of 8 and terse's pages 12 of 12. The protocol, lock and cli suites fail in
  that container as they do on the tree before this release, and pass in CI. CI's four jobs run on the release PR,
  and a red run stops the release.
• On the owner's machine, a Codex coordinator ran one read-only task on this branch three times: OpenCode GLM 5.3
  agents through OpenRouter checking the 13 entries of ISSUES.md, each run relayed by a Luna proxy. At 35cfa6b
  four of eleven proxies handed back before their run ended. At b13a374 four proxies handed back with no failure
  and the first agent ran 5 minutes after the start rather than 22, but the verdicts counted an address that merely
  existed. At d36a2c0 the verdicts matched, entry for entry, a reference made independently on the same commit;
  four proxies, one permission request, and one escalated command of the coordinator's against 94 in the run
  before, once the owner's instructions put the sandbox first.
• Not run: the live orchestrate gate, the live fidelity gate and the cross-plugin terse brief; the preparing
  machine has no Codex CLI.

Known issues

• Open ledger entries remain E67, E90, E96, E100, E102–E104, E110, E111, E113, E114, E117 and E139; see
  ISSUES.md. The d36a2c0 audit found that ten of them cite text that has since moved, which the
  ledger has not caught up with.

Release environment

• Release preparation used Node.js v22.22.0 an...