Core Code v0.0.1 (macOS arm64, built outside CI)

macOS arm64 only, and built outside CI. Read the next section before installing.

What is NOT here, and why

release.yml produces this normally. It has never succeeded: every run of it has failed, because
this repository's GitHub Actions runners do not start — jobs complete in seconds with zero steps
executed. So this release was produced by running the same release-tools/ pipeline by hand on a
developer Mac.

Consequently:

• No provenance or SBOM attestation. Those bundles are signed by GitHub's OIDC identity inside
  Actions; a machine outside Actions has no such identity and must not forge one. The manifest
  records this as a fact rather than omitting it — "provenance": {"attested": false, "reason": …}
  — so anything reading the manifest sees a refusal, not a plausible-looking digest.
• macOS arm64 only. The Linux, Intel-macOS and Windows targets are not built.
• No PE verification and no curl canary, both of which are Actions-only steps.

What IS intact

team-install.sh's own verification chain runs in full: receipt → manifest bytes → archive bytes →
the binary that actually runs, each checked by SHA-256 and size. The artefacts were produced by the
repository's own release-tools/ chain (legal → sbom → build-info → package → manifest → checksums)
with syft and cargo-about pinned by release-tools/fetch_tool.py, and the binary was built with
cargo auditable so the SBOM binds core-cli to the bytes that shipped.

Three defects fixed to get here

Producing a release end to end has never been done before, so each step had to be made to work:

1. manifest.py build-info raised AttributeError on every invocation (issue #198) — a guard
   belonging to create_release sat in create_build_info, where --receipt does not exist. It was
   not copied there, it was MOVED there: create_release had lost it entirely, so the tool both
   crashed and skipped a real check. Restored to the function whose arguments describe it.
2. A license the allowlist did not accept. fluent-uri pulls borrow-or-share, which is MIT-0.
   The allowlist had MIT but not MIT-0, and MIT-0 is MIT with the attribution clause removed —
   strictly less restrictive. Accepting MIT while refusing MIT-0 does not hold up.
3. The SBOM could not bind core-cli because the binary was built with plain cargo build.
   The pipeline requires cargo auditable build, which embeds the dependency list the scanner reads.

What is in the code

Thirteen slices merged as #210, plus the C-track work in #197 and #201. The largest:

• a workflow run can outlive the turn that started it — WorkflowSupervisor owns runs outside the
  turn's borrow, which is what runtime.rs had recorded as deferred
• a running agent row shows live tokens and tool activity; the emitter for it had never existed
• a partially failed fan-out is now visible on screen AND in the exit code
• a long paste becomes [Pasted text #N +M lines]; an attached image keeps its chip and gains an
  in-line [Image #N] anchor, so its position in the sentence is expressible
• a dropped file path is no longer misparsed as a slash command
• core workflow run can be interrupted