v0.50.0

v0.50.0 — The Verifiable Loop: contracts, not claims

Until now the loop trusted what an agent said it did. A run ended with
evaluated: false and a prose reminder; acceptance criteria were bare strings
a judge read in good faith; the fat-harness reconstructed success from a
transcript the agent itself wrote. This release closes that gap end to end.
An acceptance criterion can now declare, in machine-checkable terms, what output
counts as done — and the executor, the evaluator, and the verify gate all judge
against that declared contract, grounded in what actually executed rather than
what was reported.

This is the full landing of the 2026-07 roadmap — dead-code clearing, provider
parity, the per-AC success contract, and interview fan-out — plus the first
experience-store metaharness and cross-harness recovery.

The success contract (the spine)

• Structured acceptance criteria (#1551) — an AC becomes an
  AcceptanceCriterionSpec (verify_command / expected_artifacts /
  output_assertion), while every existing bare-string Seed still loads and
  round-trips byte-identically.
• Executor consumes the contract (#1575, #1548) — leaf prompts carry an
  explicit SUCCESS CONTRACT block; the evidence gate requires the declared
  command and artifacts, verified against the runtime transcript.
• Evaluator judges the contract + reward-hacking veto (#1572, #1585) —
  Stage 2 sees the declared contract; a high-confidence gaming signal now vetoes
  approval even after Stage 3 consensus, instead of being written and ignored.
• Verify-by-default (#1548) — the orchestrator-run verify gate, retry, and
  the fat-harness are on by the default path, not opt-in.
• Grounded in authoritative execution (#1592, #1591) — contract-AC
  evaluation and fat-harness evidence matching read the orchestrator's own
  execution record (with path normalization and shell-wrapper unwrapping),
  not a reconstructed transcript. (Release blocker — fixed.)

run → evaluate, guaranteed

• Auto-chain evaluation after run (#1547) — a successful ooo run enqueues
  the formal 3-stage evaluation as a bounded background job on every provider,
  with failure isolation: a hung or failed evaluation never strands the run.

Provider parity — one vocabulary, every dispatch mode

• Sequential subagent contracts across providers (#1543) — copilot / gemini /
  hermes / kiro / goose / pi / gjc now receive the same machine-readable
  fan-out contract that host-driven runtimes already had.
• Transient-retry parity + effort defaults (#1575) — goose and hermes join
  the unified transient-retry core.
• Native context channels (#1583) — copilot instruction dirs, claude --add-dir, and per-run instruction files as first-class context inputs.
• New runtime backends — Grok Build CLI (#1483) and Antigravity CLI (#1482)
  join the roster; a leader-driven external worker pool with native visibility
  (#1496); multi-LLM stage-routing presets in the settings GUI (#1484).

Interview fan-out — use subagents like crazy

• Generic fan-out core + re-entry tool (#1578) — build_fanout_subagents +
  ouroboros_submit_fanout_results revive the synthesis layer so any interview
  step can declare "fan these N prompts out, give me correlated results back".
• Fan-out injection points (#1580) — a per-dimension ambiguity panel,
  multi-persona question candidates, and a closer tri-panel (closer +
  contrarian + gap-hunter), all with deterministic aggregation.
• Advisory re-entry correlation contract (#1586).

Experience-store metaharness (Phase A)

• Provenance gate (#1579) — source-tagged ledger decisions and a
  low-ambiguity gate before a Seed is declared executable.
• Interview trace artifact + experience-store CLI (#1581, #1582) — a
  greppable per-run projection over the EventStore, browsable via
  ooo harness list/show/trace/diff/frontier.
• Cross-harness recovery & review (#1546) — REDISPATCH_ALT_HARNESS, an
  executor ≠ reviewer rule, and an outcome flywheel.
• Session-start context pack (#1544) — run workers are primed with
  deterministic repo facts.

Evolution

• AC-scoped re-execution (#1550) — grounded Wonder plus Reflect AC patches:
  a passed, unchallenged, unregressed AC is kept verbatim and skips
  re-execution.

Reliability & housekeeping

• Closed two JobManager terminal-event races that could strand a job in RUNNING
  forever (#1567, #1576); bounded the trace-export filesystem phase so an
  abandoned write can't block CLI teardown or delay terminal results
  (#1584, #1588, #1589); auto now waits for its run-handoff job instead of
  cancelling it on exit (#1590).
• Adversarial QA probe classes with acting-verification guidance (#1498).
• A provider-tagged web Kanban with a shared events→board projection
  (#1545, #1573).
• Confirmed dead code deleted and byte-identical duplication killed
  (#1540, #1571), plus a wave of pure structural refactors across the
  orchestrator, auto pipeline, and provider layer.

---

What's Changed

• feat(orchestrator): leader-driven external worker pool + native-visibility opt-in by @Q00 in #1496
• fix(auto): keep recovery text out of seed contracts by @Q00 in #1534
• feat(orchestrator): add Antigravity CLI (agy) runtime backend by @project820 in #1482
• feat(orchestrator): add Grok Build CLI (grok) runtime backend by @project820 in #1483
• feat(config): add multi-LLM stage-routing presets to the settings GUI by @project820 in #1484
• chore(deps): bump the python-minor-patch group with 7 updates by @dependabot[bot] in #1528
• chore(deps): bump actions/setup-python from 6 to 6.2.0 by @dependabot[bot] in #1527
• chore(deps): bump actions/checkout from 6.0.3 to 7.0.0 by @dependabot[bot] in #1526
• fix(#1530): error_max_turns(1) still reproduces on 0.43.3 by @ouroboros-agent[bot] in #1531
• fix: split plugin auto handoff and claimed leases by @ASak1104 in #1529
• fix(#1501): evolve_step: 'NoneType' object is not iterable via plugin MCP server (works in-process) by @ouroboros-agent[bot] in #1502
• fix(#1535): fix(plugin): commands/ shims duplicate skills/ entries in Claude Code skill listing by @ouroboros-agent[bot] in #1536
• feat(qa): adversarial probe classes + acting-verification guidance (ouroboros-native) by @Q00 in #1498
• fix(#1537): salvage phantom tool calls under the sealed no-tools envelope by @Q00 in #1541
• fix(orchestrator): register runtime-only backends in RuntimeHandle contract by @project820 in #1539
• fix(mcp): pair the injected sealed interview adapter with the tool-less prompt by @Q00 in #1542
• chore: delete confirmed dead code by @Q00 in #1540
• feat: emit sequential subagent contracts across providers by @Q00 in #1543
• feat: auto-chain evaluation after run by @Q00 in #1547
• refactor(orchestrator): extract evidence helpers by @Q00 in #1549
• feat(evolution): AC-scoped re-execution — grounded Wonder + Reflect AC patches by @Q00 in #1550
• refactor(backends): centralize factory dispatch registry by @Q00 in #1552
• fix(test): loosen CI-flaky wall-clock deadline in run-evaluate chaining test by @Q00 in #1565
• refactor(auto): split pipeline run phases by @Q00 in #1554
• refactor(auto): split interview round driver by @Q00 in #1557
• refactor(providers): share runtime stream helpers by @Q00 in #1558
• refactor(retry): centralize transient error matching by @Q00 in #1559
• fix(core): honor worktree_cleanup policy and add ooo cleanup for auto-session residue by @brandonwie in #1561
• chore(deps): bump actions/setup-python from 6.2.0 to 6.3.0 by @dependabot[bot] in #1563
• refactor(orchestrator): split capability graph modules by @Q00 in #1553
• refactor(orchestrator): extract AC runtime handle manager by @Q00 in #1555
• feat(core): add structured acceptance criteria by @Q00 in #1551
• refactor(orchestrator): extract execution event emitter by @Q00 in #1556
• feat(orchestrator): verify-by-default — AC success contracts, orchestrator-run verify gate, retry, fat-harness ON by @Q00 in #1548
• chore(deps): bump the python-minor-patch group with 8 updates by @dependabot[bot] in #1564
• feat(dashboard): merge provider-tagged web Kanban + delete dead TUI layers by @Q00 in #1545
• feat(orchestrator): cross-harness recovery & review — REDISPATCH_ALT_HARNESS, executor≠reviewer, outcome flywheel by @Q00 in #1546
• fix(#1566): JobManager._run_job can strand a job in RUNNING forever if the terminal-event append raises by @ouroboros-agent[bot] in #1567
• feat(orchestrator): session-start context pack — prime run workers with deterministic repo facts by @Q00 in #1544
• feat(evaluation): judge against declared AC contract + reward-hacking veto by @Q00 in #1572
• feat(orchestrator): V5 — transient-retry parity (goose/hermes) + effort defaults + leaf success-contract block by @Q00 in #1575
• refactor(dashboard): share the events→board projection between web kanban and TUI (D2) by @Q00 in #1573
• refactor(mcp): split AuthoringHandlers.handle into per-action methods by @Q00 in #1574
• refactor(providers): kill byte-identical duplication — JSONL parse + strip keys by @Q00 in #1571
• refactor(orchestrator): extract AtomicPromptBuilder + LeafDispatcher from _execute_atomic_ac by @Q00 in #1577
• feat(mcp): generic interview fan-out core + ouroboros_submit_fanout_results re-entry tool by @Q00 in #1578
• fix(mcp): close the remaining JobManager terminal-event race (zombie job without terminal state) by @Q00 in #1576
• feat(auto): A1 provenance gate — source-tagged ledger decisions + low-ambiguity gate before executable seed by @Q00 in #1579
• feat(interview): fan-out injection points — ambiguity panel, question candidates, closer tri-panel by @Q00 in #1580
• feat(auto): A2 interview trace artifact — greppable per-run projection over EventStore + ledger by @Q00 in #1581
• feat(cli): A3 experience-store CLI — ooo harness list/show/trace/diff/frontier over A2 traces by @Q00 in #1582
• feat(providers): C4 native context channels — copilot instructions dir, claude --add-dir, per-run instruction files by @Q00 in #1583
• fix(auto): bound the finalize trace export so a hung store cannot delay terminal results (#1581 follow-up) by @Q00 in #1584
• fix(evaluation): apply reward-hacking veto after Stage 3 consensus approval (#1572 follow-up) by @Q00 in #1585
• fix(mcp): advisory fan-out re-entry — correlation contract + registry state dir (#1578 follow-up) by @Q00 in #1586
• fix(cli): validate harness run_id before filesystem resolution — close path traversal (#1582 follow-up) by @Q00 in #1587
• fix(auto): bound the trace export filesystem phase too — off-loop writes so the deadline holds (#1584 follow-up) by @Q00 in #1588
• fix(auto): run the trace-export filesystem tail on a daemon thread so abandoned writes cannot block CLI teardown (#1584 follow-up 2) by @Q00 in #1589
• fix(cli): auto waits for its run-handoff job instead of cancelling it on exit by @Q00 in #1590
• fix(orchestrator): normalize paths and unwrap shell wrappers in fat-harness evidence matching (release blocker) by @Q00 in #1591
• fix(cli): ooo seed/interview commands + auto run-wait trusts durable execution terminal by @Q00 in #1593
• fix(orchestrator): ground contract-AC evaluation in authoritative execution, not transcript reconstruction by @Q00 in #1592

New Contributors

• @project820 made their first contribution in #1482
• @brandonwie made their first contribution in #1561

Full Changelog: v0.44.0...v0.50.0