Skip to content

v0.17.0 — Trust-hardening

Choose a tag to compare

View all tags
@elkaix elkaix released this 17 Jul 13:18
v0.17.0
dde252a

Trust-hardening release from a six-agent dogfood scouting pass (Codex GPT-5.6 Sol). Every fix was driven through the delegate/delegatePipeline MCP lifecycle and independently verified; cross-platform CI (macOS/Linux/Windows) is green.

Fixed

  • Candidate promotion — a delegatePipeline fix round that changes bytes now promotes the fixer's final tree into a canonical single-parent candidate (re-frozen artifact, re-pointed anchor, re-archived result/manifest via a bounded promotion that fails closed after a decision). Review/decision/integration previously operated on the pre-fix tree and silently dropped the reviewed fix.
  • Writable-root validation — linked-worktree .git/commondir pointers are validated (plain-file, realpath containment under the common gitdir's worktrees/, plain objects dir); a tampered pointer makes the fixer fail closed with sandbox-violation instead of crashing or running unconfined.
  • Dependency inheritance — compares the full recognized lockfile set (not just the first) and refuses to inherit on any divergence; the recorded dependencyLink is surfaced in acceptance evidence.
  • Baseline verification — threads cancellation (cancelled ≠ environment-defect), detects command-induced worktree mutations, and reserves environment-defect for a completed report with a failed command (operational errors propagate).
  • Checkout lock — acquired before repository preconditions and baseline verification (released on every path); a verification cwd that is absolute or escapes the checkout is rejected as invalid-specification up front.
  • Pipeline gate — requires a clean final review before decision-ready; a fix applied on the final round without re-review now requires a human decision.

Known limitations

Fixer private object-store isolation and read-only dependency mounting (full prevention of writes to the shared object DB / primary node_modules) are deferred as a dedicated write-confinement change.

No external schema/protocol change (PROTOCOL_VERSION stays 1.0.0); RUNTIME_VERSION advances to 0.17.0.

Assets 2
Loading