v0.54.0

Security

• A Producer can no longer make the runtime delete a directory it did not allocate. Runtime-allocated Producer HOMEs move from the system temp directory to a private h/ root in the plugin data directory, each bound to its birth-time identity and its own ownership claim. Retirement renames the identity-matched HOME to a quarantine and removes it with the bound cleanup primitives; a HOME that was moved or replaced is preserved and the role or attempt fails as sandbox-violation (the attempt's archived result itself, so it can never be accepted as clean). Planning failures after allocation now retire the HOME instead of leaking it, Seatbelt denies every write in the HOME root except entries beneath the Producer's own HOME (the HOME pathname itself can be neither moved nor recreated; a Producer moving its own subdirectories out to $TMPDIR is caught only by the identity checks), startup recovery reclaims a HOME only when every recorded owner is proven dead and reports the rest, and a plugin data directory inside the Producer's writable scope is refused (ADR-0001). Every Producer and verification Seatbelt profile now denies the whole plugin state directory after all grants (an inherited-config Producer such as Claude, whose declared ~/.claude grant contains the default plugin data directory, could write archives, decisions and locks), and a launch without Seatbelt is refused when a declared writable root covers the state directory. Runtime scratch directories (candidate and slice Git index directories, the copy-on-write probe, and the confined verification TMPDIR) move out of shared system temp into the same identity-bound allocation and are retired the same way instead of by pathname.

Changed

• CI runs once per change (main pushes and PRs), splits the Windows leg into three shards (~28 → ~14 min), and Dependabot groups updates per ecosystem.
• npx tsc --noEmit now type-checks tests/ under the same strict options as src/.

v0.53.0

Security

• @modelcontextprotocol/sdk 1.30.0 → 1.32.1 (its OAuth client could send credentials to an authorization server chosen by the MCP server), plus lockfile updates for the fast-uri, ip-address, hono, qs, proxy-addr, and source-map-js advisories; npm audit reports 0 vulnerabilities. CodeQL actions 4.37.7 → 4.38.3; @types/node 26.2.0 → 26.6.5; vitest 4.1.11 → 5.0.3.
• Producer-authored bytes can no longer steer Git. Diff-family commands always run with --no-textconv and --no-ext-diff; review diffs read attributes from the trusted base with --attr-source=<base> (Git 2.40+, reported by doctor as git-too-old below that), so a committed .gitattributes cannot hide source as binary; Git calls inside a managed worktree pin GIT_DIR, GIT_COMMON_DIR, and GIT_WORK_TREE, so a rewritten .git pointer is ignored; and truncated Git output is a failure everywhere through one gitChecked/gitSucceeded pair.
• On macOS, project verification runs under Seatbelt with a private scratch TMPDIR, and its evidence records confinement: "macos-seatbelt". The Seatbelt profile denies reads of credential stores under $HOME (.ssh, .aws, .gnupg, .kube, .docker, .netrc, .git-credentials, .config/gh, .config/gcloud, .azure).
• Autonomous acceptance is stricter. It requires every executed verification command to have run under a known OS confinement backend (a missing policy record fails closed, so off macOS every decision needs a person), and a plain delegate candidate that changes verification inputs — tests, test or build configuration, dependency manifests and lockfiles, .gitattributes/.gitignore/.gitmodules — needs a person too. The decision advisory shown to a human is now exactly the autonomous verdict's reasons.
• integrateCandidate refuses an acceptance that names no artifact (a legacy record without candidateManifestHash) with decision-artifact-mismatch instead of falling through.
• Autopilot honors CLAUDE_ARCHITECT_DECISION_AUTHORITY=human: it refuses to start (decision-authority-human), refuses to resume a workflow that still promotes, and the promoter records no autopilot-policy acceptance under it. The acceptance is written only after the exact bytes are staged.
• A spec's environment can no longer override variables the platform sets (HOME, PATH, TMPDIR, …), and every adapter- or spec-supplied value except absolute paths is redacted from output.
• The watchdog keeps the Producer in its process group and escalates SIGTERM to SIGKILL on the whole group when the supervisor dies or the child exits, so grandchildren cannot outlive a run. bootstrap.mjs ignores relative PATH entries when locating Node.
• Dependency inheritance runs cp by absolute path and treats lockfiles over 64 MiB or of different sizes as non-matching.
• delegation-spec.v1.json bounds every array (maxItems), so an oversized spec is rejected at validation.
• Review patches in the review snapshot are sanitized (binary payload omitted, redacted), and Git stderr in pipeline errors is redacted.

Changed

• Plugin renamed claude-architect → architect. Claude Code now reserves plugin names starting with claude-, so claude plugin validate refused the old name. CLAUDE.md moved to .claude/CLAUDE.md, because strict validation rejects it at the plugin root. Install with claude plugin install architect@claude-architect; commands are /architect:delegate, /architect:codex, and /architect:subagent-driven-delegation, and MCP tools are mcp__plugin_architect_runtime__*. The marketplace maps the old name to the new one. The marketplace name, repository, environment variables, Git ref namespace, and .worktrees/claude-architect/ layout are unchanged.
• Protocol 2.0.0 → 3.0.0. autopilotStart no longer accepts pullRequest, and Autopilot specs and workflow states are v2. Callers pinned to 2.0.0 get an explicit protocol version mismatch diagnostic. Run archives are bound to the protocol major, so runs recorded under 2.x are refused as incompatible; decide and integrate them before upgrading.
• Final Branch Report v2: the passing status is ready-for-human-review, matching the terminal state, instead of ready-to-ship. A v1 report is refused on resume with an explicit version diagnostic.
• Autopilot ends at a final-reviewed local branch. It no longer pushes, opens a draft PR, polls required checks, or marks a PR ready; that belongs to the repository's delivery gate (No Mistakes here). Autopilot Spec v2 drops shipping, and Workflow State v2 replaces shipping/ciObservations with branch and drops the pushing, creating-draft-pr, waiting-required-checks, and marking-ready phases; v1 specs and states are refused with explicit version diagnostics. Cleanup keeps the reviewed branch and removes only the worktree and the private base ref.
• Promotion commits carry the user's own Git author and committer, dated now, instead of a fixed runtime identity dated 2000-01-01. Autopilot refuses to start without a configured identity (git-identity-missing).
• One state machine owns an Autopilot workflow: start bootstraps and then runs the same resume path, and startup recovery reports an abandoned cleaning-up workflow as resume (the finalize disposition is gone) instead of finishing it with a second proof of the same crash window. Finish it with autopilotResume.
• Autopilot reads the remote only at create. Revalidation before each promotion and the final review no longer runs ls-remote or re-resolves the remote URL, so a busy upstream main no longer fails a workflow (remote-base-changed and remote-identity-changed are gone), and the workflow runs offline after create. The local base ref still pins the base.
• Managed worktrees live in each repository's main checkout under .worktrees/claude-architect/<id>, a self-ignoring namespace recorded in the plugin data root so recovery finds it; the legacy state-directory location is still swept.
• Every pipeline writer, each fixer included, starts in a fresh worktree at the current candidate; its commits are validated and imported into the shared object store before the worktree is removed. A failed promotion now distinguishes a missing candidate commit (sandbox-violation) from a host failure (environment-defect).
• Optional Jev screen: with CLAUDE_ARCHITECT_JEV=on and TYPESAFE_API_KEY, an otherwise autonomous acceptance is screened by the TypeSafe API over the redacted patch and changed paths. A concern routes the decision to a person; an outage or clear result leaves the deterministic verdict unchanged. It never grants autonomy.
• Minor and nit findings never block the pipeline gate; every undispositioned blocker or major still requires a human.
• Weakened-test detection covers Python, Go, Rust, JVM, .NET, and RSpec path conventions and skip markers.
• Autopilot eligibility is derived directly from the pipeline result, review snapshot, and advisor report, so no self-derived projection is re-checked against itself; a missing candidate is reported as pipeline result has no candidate.
• The final branch review freezes only the refs it needs (task logs/ transcripts excluded), embeds verification once, and is crash-resumable: evidence files are replaceable, the report is immutable, and a report already published for the same artifact is returned on resume.
• Lock contention during promotion reports checkout-busy instead of branch-identity-changed.
• The ls-files output bound is 512 MiB; other Git output stays bounded at 8 MB.
• macOS bound-directory cleanup removes directories in batches of 64 with one lsof per batch (a 2,040-directory tree went from over 120 s to about 26 s).
• A checkout-lease release failure after a finished integration keeps the result and appends ; checkout lock release failed instead of discarding it.
• The slice lifecycle moved out of runPipelineWithLease into SliceRunner (src/pipeline/slice-runner.ts): plan wave, create worktree, launch Producer, freeze, verify, review, compose, release anchor. Run-scoped facts travel as a RunContext value instead of a shared closure, so pipeline-runtime.ts fell from 2464 to ~1540 lines and slice behaviour can be exercised without driving a whole pipeline.
• One implementation of the slice phase. SliceRunner.run superseded the callback-driven runSlicePhase/SlicePhaseDeps pair, which stayed behind as a second routing loop that nothing called but a test suite still exercised — so the suite proved nothing about the code that runs. The superseded loop is deleted and its evidence-isolation and hard-blocker cases now drive the real runner.
• One implementation of the managed-worktree lifecycle. withManagedWorktree lives beside WorktreeManager in src/runtime/worktree-manager.ts, and the pipeline, the slice runner, and candidate verification all borrow through it — so creation serialization and the cleanup-failure disposition cannot drift apart, and verification worktrees gain the git worktree add serialization they previously lacked.
• The slice ref namespace has a single declaration (src/git/ref-namespace.ts). The pipeline wrote refs/claude-architect/slices/ while recovery swept the same literal from its own copy; one declaration makes a silent divergence — refs created but never reclaimed — impossible.
• Unified candidate evaluation into RunDecision (src/runtime/run-decision.ts). readRunDecisionSnapshot loads a run's result, manifest, review snapshot, gate clearance, and decision once and checks their cross-file coherence in one place; evaluate returns a typed RunVerdict — accepted (autonomous), human-required, rejected, incomplete, or invalid — replacing the accept-only rule that was written twice, in mcp/server.ts and mcp/tools.ts. The decide path now reads the archive once: loadArchivedRun carries the snapshot it read, and the provenance resolv...

v0.44.0

Security

• Autonomous acceptance now requires a durable pipeline-gate clearance record
  bound to the archived candidate commit. Plain delegation and missing,
  malformed, human-required, or commit-mismatched evidence fail closed to human
  elicitation.

Changed

• The verified SDD wrapper now distinguishes the architect-owned branch home
  from runtime-owned attempt worktrees and lets a repository-defined delivery
  gate supersede Superpowers' generic direct merge/push finish. This repository's
  agent policy routes Superpowers SDD through verified delegation, hands manual
  SDD branches to No Mistakes only after explicit authorization, and prevents
  stacking that gate with Claude Architect Autopilot.
• Manual delegation now labels its read-only spec validation and its single
  execution dispatch as two MCP calls but one execution run. It distinguishes
  plain delegation's one implementation attempt (after its separate edit-lane
  environment probe) from a pipeline's multiple fresh implementation, review,
  and repair Producers, and forbids a second dispatch
  while the original execution call is pending.

Fixed

• Windows removal and validation reliability: identity-revalidating filesystem
  helper calls (directory open, ACL validation, delete disposition) retry
  bounded transient sharing violations — such as antivirus scans of freshly
  written files — instead of failing an entire cleanup transaction on the first
  denial; the bound-cleanup child now names its failing clause with redacted
  code-only diagnostics; and the checkout-lock wait deadline is calibrated for
  Windows process-spawn latency so designed serialization no longer reports
  spurious checkout-locked contention. Every path handed to the native
  filesystem helper is now \\?\-namespaced, so identity-bound removal and
  validation work on worktree paths past MAX_PATH instead of failing with
  ERROR_PATH_NOT_FOUND.
• Startup recovery now sweeps proven orphaned registered worktrees regardless
  of their names while preserving unproven directories and worktrees claimed by
  live, ambiguous, or independently owned runs and workflows. Removal uses
  bigint inode plus birth-time identity, inode-bound quarantine traversal,
  parent-directory durability syncs, and a durable staged transaction for only
  the exact Git registration under the checkout lease. Removal manifests replay
  before stale-run inspection, registration paths are compared canonically, and
  Autopilot stale registrations and run worktrees whose physical directories
  vanished use the same recoverable removal owner instead of raw recursive
  deletion. Unresolved removal manifests pause run/workflow cleanup; transient
  Git failures, malformed or conflicting ownership entries, symlinked metadata
  roots, and forged quarantine names fail closed. Creation publishes a bound
  intent before git worktree add, so an immediate crash or managed-root
  substitution can recover the hidden physical inode and exact registration.
  On POSIX upgrades, recovery
  safely tightens legacy runtime state/worktree directories from group/world-
  readable modes to 0700 after binding and rechecking their filesystem identity.
  Group/world-writable, wrong-owner, or substituted roots remain blocked; operators
  must restore the runtime-data owner and remove group/world write bits before restart.
  Newline/Unicode and
  case-equivalent Windows paths remain intact, and bounded redacted sweep issues
  are visible at MCP startup. Packaged x64/arm64 native helpers now validate
  Windows ACLs, flush directory metadata, and delete identity-matched handles;
  trusted runtime cleanup no longer depends on PowerShell. Cleanup-backend
  prerequisites are checked before Git creates a worktree and fail with an
  actionable classification.
• Final-review head-bound phases now retain one real checkout lease through
  materialization cleanup and every concluding head, tree, and branch-identity
  revalidation on both success and failure paths.
• Producer preflight now propagates managed worktree cleanup failures instead
  of recursively deleting the checkout and potentially stranding its Git
  registration. When probing, cancellation, or bounded probe-file reading also
  fails, the ordered aggregate retains that primary outcome before cleanup.
• Startup recovery now preserves a non-terminal run whose recorded owner
  process is verified alive even when its checkout lock entry has vanished,
  classifying owners through the shared lock-owner status rule instead of
  terminating them.
• MCP startup's mutation-recovery gate only resolves the caller's repository
  when a preserved sweep issue could belong to it, so ambiguity recorded for an
  unrelated repository no longer blocks another repository's mutating tools.
• Checkout locks now require the repository's Git common directory on every
  platform instead of falling back to the canonical checkout path.
• Workflow branch-registration reads no longer swallow filesystem errors:
  an absent record still reads as unregistered, while permission and I/O
  failures propagate as failures instead of masquerading as absent ownership.

v0.27.0 — startup run-archive pruning

Added

• The MCP server now prunes the run archive once per boot, after crash recovery. Terminal runs older than 14 days, or the oldest terminal runs once the archive exceeds 1 GiB, are reclaimed; active, incomplete, and undecided runs are always retained. A prune failure only logs a redacted diagnostic and never blocks startup.

Changed

• Prune-failure and recovery quarantine diagnostics now share a single bounded redaction helper (boundedRedactedDiagnostic) so filesystem and Git error messages are stripped of repository paths before any runtime log.

Full changelog: https://github.com/Pythoughts-labs/claude-architect/blob/v0.27.0/CHANGELOG.md

v0.23.0

Fixed

• Cleanup convergence when a delegating repository is deleted. Previously a
  vanished repoRoot made canonicalizePath throw: normal-path prune caught it
  and retained the run forever (its bytes never reclaimed, so maxBytes/maxAge
  could not converge), and — more seriously — a repo-gone pending cleanup intent
  made validateRepositoryRoot throw outside the per-record guard in
  replayInterruptedPrunes, aborting the entire crash-recovery pass on every run
  (a permanent block). Both paths now reconcile a repository-absent run without
  Git: prune reclaims the archive directly (no lease, no ref cleanup — the
  candidate and backup refs died with the repository, and no live checkout can
  integrate from a vanished repository), and recovery detects the absent
  repository before validation and completes or rolls back the archive by disk
  state, converging instead of aborting.

v0.22.0

Fixed

• Crash-recovery cleanup journal: close a cross-process race where recovery's
  torn-tail truncation could erase a cleanup intent a concurrent process had just
  appended and fsynced. All journal appends (prune and recovery) and the torn-tail
  repair now hold a new state-dir-scoped cross-process mutex
  (acquireCleanupJournalLock), and recovery reads and repairs the journal as one
  critical section under that mutex. The mutex is a leaf lock — never held while
  acquiring the checkout lease or recovery lock, so ordering stays deadlock-free —
  and is reclaimed like any other lock when its owner dies.

v0.21.0 — sliced delegation

v0.21.0 — sliced delegation

Architect-authored, test-gated vertical slices on the delegation pipeline: each
slice runs fresh/no-context in an isolated worktree gated by its own verification;
a deterministic wayfinder routes advance/repair/halt from objective gate results;
review and the advisor judge the composed candidate over the whole slice branch.
A mid-run halt after at least one slice advances yields a human-acceptable partial
candidate.

MCP wire PROTOCOL_VERSION 1.2.0 -> 1.3.0 (additive: slices, haltedSliceIndex).

Includes the crash-recovery reconciliation of the checkout-lease and quarantine/
in-lock-recheck models, and skips two POSIX-only lock-semantics tests on Windows.

v0.19.0

Deferred-work remediation release. All fixes driven through the delegate MCP lifecycle (Codex GPT-5.6 Sol) and independently verified; CI green on macOS/Linux/Windows.

Security

• Fixer private Git object store: the shared object database is no longer a fixer-writable sandbox root; fixer writes go to a per-run private object directory, and trusted promotion imports exactly the promoted commit's objects (bounded pack-objects), verifying shared-store reachability without alternates before publishing the anchor.
• Copy-on-write dependency clone: aux verification worktrees no longer receive a writable node_modules symlink/junction into the primary checkout (APFS clonefile / Linux reflink; no CoW → fail-closed skipped-cow-unsupported). Windows and non-reflink Linux no longer inherit dependencies into aux worktrees.
• Checkout-lock ABA guard: release deletes the lock file only when it still records the releasing holder's pid + process token.

Fixed

• Run manifests record real reproducibility provenance (committed instruction-file hashes + installed verifier bytes) or fail closed; the silent pending/empty defaults are gone.
• Candidate freezing rejects truncated Git output instead of publishing an incomplete review patch.
• verifyRunManifest treats archived protocolVersion as provenance with same-major compatibility, keeping existing archives reviewable across protocol upgrades.

Changed

• .opencode lane mirrors carry the full operating contract (foreground-only, bounded stall relaunch, worktree isolation, Git-state prohibitions, action-first preamble, failure-classification vocabulary); stall handling normalized to at most one relaunch, two invocations total.
• Lane-contract tests are negation-proof, and the failure-precedence e2e test pins an explicit eleven-classification literal.

See CHANGELOG.md for details.

v0.18.0 — trust hardening (batch 2)

Second trust-hardening release from the post-0.17.0 dogfood scouting pass (Codex GPT-5.6 Sol). Every fix was driven through the delegate/delegatePipeline MCP lifecycle and independently verified; cross-platform CI is green on macOS, Linux, and Windows.

Highlights

• Pipeline trust: fixer commit-provenance validation, final verification routed through the AcceptanceVerifier (archived logs, zero-executed rejection), and OS-confined non-Codex fixers that fail closed without a usable sandbox.
• Protocol 1.1.0: strict-literal protocolVersion, closed schemas, schema-encoded timeout floor, manifest write-validation, provenance-only archived runtimeVersion, SHA-256 (64-hex) OIDs, and per-command expectBaselineFailure.
• Isolation & git hardening: timeout --kill-after process-tree kills, a Codex flag denylist, and runtime git insulated from host/local/worktree config, hooks, fsmonitor, attributes, and content filters.
• Leak & durability: redacted pipeline artifacts and doctor output, and crash-recoverable baseline/verify worktrees.
• Verifier trust: gitlink (160000) rejection, nested-repo forbiddenScope enforcement, broader secret discovery, skip-worktree mutation detection, WSL fail-closed, and probe/routing robustness.

See CHANGELOG.md for the full list and known limitations (deferred reproducibility-provenance and write-confinement redesigns).

v0.17.0 — Trust-hardening

Trust-hardening release from a six-agent dogfood scouting pass (Codex GPT-5.6 Sol). Every fix was driven through the delegate/delegatePipeline MCP lifecycle and independently verified; cross-platform CI (macOS/Linux/Windows) is green.

Fixed

• Candidate promotion — a delegatePipeline fix round that changes bytes now promotes the fixer's final tree into a canonical single-parent candidate (re-frozen artifact, re-pointed anchor, re-archived result/manifest via a bounded promotion that fails closed after a decision). Review/decision/integration previously operated on the pre-fix tree and silently dropped the reviewed fix.
• Writable-root validation — linked-worktree .git/commondir pointers are validated (plain-file, realpath containment under the common gitdir's worktrees/, plain objects dir); a tampered pointer makes the fixer fail closed with sandbox-violation instead of crashing or running unconfined.
• Dependency inheritance — compares the full recognized lockfile set (not just the first) and refuses to inherit on any divergence; the recorded dependencyLink is surfaced in acceptance evidence.
• Baseline verification — threads cancellation (cancelled ≠ environment-defect), detects command-induced worktree mutations, and reserves environment-defect for a completed report with a failed command (operational errors propagate).
• Checkout lock — acquired before repository preconditions and baseline verification (released on every path); a verification cwd that is absolute or escapes the checkout is rejected as invalid-specification up front.
• Pipeline gate — requires a clean final review before decision-ready; a fix applied on the final round without re-review now requires a human decision.

Known limitations

Fixer private object-store isolation and read-only dependency mounting (full prevention of writes to the shared object DB / primary node_modules) are deferred as a dedicated write-confinement change.

No external schema/protocol change (PROTOCOL_VERSION stays 1.0.0); RUNTIME_VERSION advances to 0.17.0.