v0.27.0 — startup run-archive pruning

Added

• The MCP server now prunes the run archive once per boot, after crash recovery. Terminal runs older than 14 days, or the oldest terminal runs once the archive exceeds 1 GiB, are reclaimed; active, incomplete, and undecided runs are always retained. A prune failure only logs a redacted diagnostic and never blocks startup.

Changed

• Prune-failure and recovery quarantine diagnostics now share a single bounded redaction helper (boundedRedactedDiagnostic) so filesystem and Git error messages are stripped of repository paths before any runtime log.

Full changelog: https://github.com/Pythoughts-labs/claude-architect/blob/v0.27.0/CHANGELOG.md

v0.23.0

Fixed

• Cleanup convergence when a delegating repository is deleted. Previously a
  vanished repoRoot made canonicalizePath throw: normal-path prune caught it
  and retained the run forever (its bytes never reclaimed, so maxBytes/maxAge
  could not converge), and — more seriously — a repo-gone pending cleanup intent
  made validateRepositoryRoot throw outside the per-record guard in
  replayInterruptedPrunes, aborting the entire crash-recovery pass on every run
  (a permanent block). Both paths now reconcile a repository-absent run without
  Git: prune reclaims the archive directly (no lease, no ref cleanup — the
  candidate and backup refs died with the repository, and no live checkout can
  integrate from a vanished repository), and recovery detects the absent
  repository before validation and completes or rolls back the archive by disk
  state, converging instead of aborting.

v0.22.0

Fixed

• Crash-recovery cleanup journal: close a cross-process race where recovery's
  torn-tail truncation could erase a cleanup intent a concurrent process had just
  appended and fsynced. All journal appends (prune and recovery) and the torn-tail
  repair now hold a new state-dir-scoped cross-process mutex
  (acquireCleanupJournalLock), and recovery reads and repairs the journal as one
  critical section under that mutex. The mutex is a leaf lock — never held while
  acquiring the checkout lease or recovery lock, so ordering stays deadlock-free —
  and is reclaimed like any other lock when its owner dies.

v0.21.0 — sliced delegation

v0.21.0 — sliced delegation

Architect-authored, test-gated vertical slices on the delegation pipeline: each
slice runs fresh/no-context in an isolated worktree gated by its own verification;
a deterministic wayfinder routes advance/repair/halt from objective gate results;
review and the advisor judge the composed candidate over the whole slice branch.
A mid-run halt after at least one slice advances yields a human-acceptable partial
candidate.

MCP wire PROTOCOL_VERSION 1.2.0 -> 1.3.0 (additive: slices, haltedSliceIndex).

Includes the crash-recovery reconciliation of the checkout-lease and quarantine/
in-lock-recheck models, and skips two POSIX-only lock-semantics tests on Windows.

v0.19.0

Deferred-work remediation release. All fixes driven through the delegate MCP lifecycle (Codex GPT-5.6 Sol) and independently verified; CI green on macOS/Linux/Windows.

Security

• Fixer private Git object store: the shared object database is no longer a fixer-writable sandbox root; fixer writes go to a per-run private object directory, and trusted promotion imports exactly the promoted commit's objects (bounded pack-objects), verifying shared-store reachability without alternates before publishing the anchor.
• Copy-on-write dependency clone: aux verification worktrees no longer receive a writable node_modules symlink/junction into the primary checkout (APFS clonefile / Linux reflink; no CoW → fail-closed skipped-cow-unsupported). Windows and non-reflink Linux no longer inherit dependencies into aux worktrees.
• Checkout-lock ABA guard: release deletes the lock file only when it still records the releasing holder's pid + process token.

Fixed

• Run manifests record real reproducibility provenance (committed instruction-file hashes + installed verifier bytes) or fail closed; the silent pending/empty defaults are gone.
• Candidate freezing rejects truncated Git output instead of publishing an incomplete review patch.
• verifyRunManifest treats archived protocolVersion as provenance with same-major compatibility, keeping existing archives reviewable across protocol upgrades.

Changed

• .opencode lane mirrors carry the full operating contract (foreground-only, bounded stall relaunch, worktree isolation, Git-state prohibitions, action-first preamble, failure-classification vocabulary); stall handling normalized to at most one relaunch, two invocations total.
• Lane-contract tests are negation-proof, and the failure-precedence e2e test pins an explicit eleven-classification literal.

See CHANGELOG.md for details.

v0.18.0 — trust hardening (batch 2)

Second trust-hardening release from the post-0.17.0 dogfood scouting pass (Codex GPT-5.6 Sol). Every fix was driven through the delegate/delegatePipeline MCP lifecycle and independently verified; cross-platform CI is green on macOS, Linux, and Windows.

Highlights

• Pipeline trust: fixer commit-provenance validation, final verification routed through the AcceptanceVerifier (archived logs, zero-executed rejection), and OS-confined non-Codex fixers that fail closed without a usable sandbox.
• Protocol 1.1.0: strict-literal protocolVersion, closed schemas, schema-encoded timeout floor, manifest write-validation, provenance-only archived runtimeVersion, SHA-256 (64-hex) OIDs, and per-command expectBaselineFailure.
• Isolation & git hardening: timeout --kill-after process-tree kills, a Codex flag denylist, and runtime git insulated from host/local/worktree config, hooks, fsmonitor, attributes, and content filters.
• Leak & durability: redacted pipeline artifacts and doctor output, and crash-recoverable baseline/verify worktrees.
• Verifier trust: gitlink (160000) rejection, nested-repo forbiddenScope enforcement, broader secret discovery, skip-worktree mutation detection, WSL fail-closed, and probe/routing robustness.

See CHANGELOG.md for the full list and known limitations (deferred reproducibility-provenance and write-confinement redesigns).

v0.17.0 — Trust-hardening

Trust-hardening release from a six-agent dogfood scouting pass (Codex GPT-5.6 Sol). Every fix was driven through the delegate/delegatePipeline MCP lifecycle and independently verified; cross-platform CI (macOS/Linux/Windows) is green.

Fixed

• Candidate promotion — a delegatePipeline fix round that changes bytes now promotes the fixer's final tree into a canonical single-parent candidate (re-frozen artifact, re-pointed anchor, re-archived result/manifest via a bounded promotion that fails closed after a decision). Review/decision/integration previously operated on the pre-fix tree and silently dropped the reviewed fix.
• Writable-root validation — linked-worktree .git/commondir pointers are validated (plain-file, realpath containment under the common gitdir's worktrees/, plain objects dir); a tampered pointer makes the fixer fail closed with sandbox-violation instead of crashing or running unconfined.
• Dependency inheritance — compares the full recognized lockfile set (not just the first) and refuses to inherit on any divergence; the recorded dependencyLink is surfaced in acceptance evidence.
• Baseline verification — threads cancellation (cancelled ≠ environment-defect), detects command-induced worktree mutations, and reserves environment-defect for a completed report with a failed command (operational errors propagate).
• Checkout lock — acquired before repository preconditions and baseline verification (released on every path); a verification cwd that is absolute or escapes the checkout is rejected as invalid-specification up front.
• Pipeline gate — requires a clean final review before decision-ready; a fix applied on the final round without re-review now requires a human decision.

Known limitations

Fixer private object-store isolation and read-only dependency mounting (full prevention of writes to the shared object DB / primary node_modules) are deferred as a dedicated write-confinement change.

No external schema/protocol change (PROTOCOL_VERSION stays 1.0.0); RUNTIME_VERSION advances to 0.17.0.

Claude Architect v0.16.0

Hardening release from a full-day dogfooding session that surfaced eleven delegation-lane and runtime defects; every fix in this release was itself implemented through delegatePipeline.

Added

• Pre-dispatch verification baseline — every spec verification command runs against clean HEAD in a disposable worktree before producers are probed; unexpected failures stop the attempt with the new environment-defect classification. expectBaselineFailure: true opts intentional bug-reproducer specs out; read-only specs skip with explicit evidence. The baseline verifier is dependency-injectable.
• Clean-room dependency inheritance — verification/baseline worktrees symlink node_modules from the primary checkout when the lockfile is byte-identical (dependencyLink evidence), so npx tsc/vitest gates no longer fail falsely.
• Fixer commit capability — fix-round producers receive the linked worktree's private gitdir and shared object database as sandbox writable roots; git commit inside the sandbox now succeeds instead of every fix round ending blocked on a denied index.lock.
• Action-first edit prompts — CODEX_EDIT_ACTION_PREAMBLE on all non-read-only codex prompts; distilled constraints required in spec context.
• Edit timeout floor — RUNTIME_MIN_EDIT_TIMEOUT_MS (10 min) rejected-not-clamped; isolated codex runner defaults to a 600s cap (degrading gracefully without coreutils).
• Codex lane failure classification — FAILURE CLASSIFICATION: sandbox-attributable | real | mixed | unresolved | not-applicable with per-gate basis; a gate is real only when the wrapper's outside-sandbox rerun also fails.
• Delegate skill: Verification preflight and Coordinator duties sections.

Fixed

• Lanes ending their turn "waiting" on a background monitor: one foreground blocking Bash call (explicit timeout: 600000 tool parameter), exactly two valid turn endings, PID-rejoin loops with 10-minute stall detection.
• Parallel-lane data loss: unconditional per-lane worktree isolation, tree-wide git-state mutations forbidden on shared checkouts (propagated into producer prompts), disposable-worktree pre-existence checks, overlap-serialization with central integration, per-run private mktemp -d spec dirs.
• Producers never create commits; sandbox .git/index.lock denials are expected confinement, classified sandbox-attributable.
• Verification ordering: lint/format before the final type-check, non-mutating check mode, coverage of all touched typed files including new tests.
• The lane-contract test pins all of the above across both hosts.

Full details in CHANGELOG.md.

Claude Architect v0.6.0

Changed

• Rebranded the project, plugin, runtime namespace, documentation, and visual assets as Claude Architect.
• Added publication-ready Claude Code marketplace metadata and a plugin rename map for Claude Code 2.1.193 and later.
• Existing installations under the previous identity should add the renamed marketplace and reinstall the plugin or OpenCode assets.

Install

claude plugin marketplace add Pythoughts-labs/claude-architect
claude plugin install claude-architect@claude-architect