Agent Collab 7.0.0

• Breaking: new run artifacts, state, snapshots, and guard entries use schema 3.0 under the default runs/v3 history. Saved settings stay on schema 2.0 at their existing paths. Explicit run roots are honored exactly; incompatible histories are rejected without migration. Close all active old runs with their original runtime before upgrading because the guard registry filename and lock remain shared.

• Breaking: explicit cancellation is immediate, including after a peer report exists. Remove --force-before-min-wait and the obsolete cancellation timing fields; optional --reason defaults to user_cancelled. Preserve reports and require process quiescence before releasing ownership. Completed runs remain immutable, including interrupted completion recovery. Committed cancellation blocks every completion path; cancellation retries reuse the cleanup proof without probing a possibly reused wrapper process group.

• Remove PATH-based host-CLI wrappers; retain environment depth refusal and helper instructions without claiming a hard recursion boundary.

• Separate host administration, run loading, process ownership, and lifecycle operations. Reuse validated operation inputs, preserve post-wait revalidation and lifecycle write ordering, and share launch-gate ownership, stdin writing, and bounded process reaping. Probe timeouts must be finite and positive.

• Share Claude probe/peer settings, remove duplicate settings and an unreachable effort-family check, and mark the package as requiring local execution in Codex. Model, effort, permissions, and user override choices remain unchanged.

• Standardize malformed lifecycle request diagnostics with exit code 2. Group tests by responsibility and remove exact-prose/source-text assertions while retaining behavioral, artifact, and platform boundaries.

• Classify Codex model and effort failures from provider error events rather than quoted tool or assistant output.

• Add six native Claude behavioral evaluations for explicit and implicit activation, nonactivation, and synthetic finding verification, with deterministic graders and a no-plugin comparison.

• Use portable root plugin.json with OpenAI presentation metadata and retain the native Claude manifest in the shared package.

• Require provider validators and isolated marketplace installation checks in CI, fetch the official skill validator from the installed Codex release, and pin GitHub Actions to maintained commit SHAs.

• Clarify the trust limits of writable helper counters and effort receipts, readable host reports, and outbound cross-session tools. Explicitly prohibit host-report reads and cross-session contact in peer briefs; preserve permission and effort choices. Name both Fable versions in override help and document the older Claude settings-exclusion leak window.

• Restore explicit Fable 5.1 selection guidance, correct workflow navigation, and explain prompt-injection exposure without changing model, effort, or permission defaults.

• Reduce runtime duplication with shared module imports, strict field validation, and provider-result handling. Malformed request fields now produce structured failures, and executable entry points resolve sibling modules with Python safe-path mode enabled.

• Add a resumable start/advance host workflow with explicit next actions, resolved host policy, bounded 60-second guided waits, and successful waiting responses. Keep the normal instructions self-contained within 8 KB and make recovery diagnostics use the guided interface.

• Save readable, revision-bound Markdown evidence separately from compact control output, preserving all original reports while omitting duplicate matrix rows and admission hashes from the reading surface. Review receipts now bind rendered bytes; refresh older drafts through advance before synthesis.

• Count advisory reports within the host helper-report bound and route exhausted budgets to synthesis with the missing advisory visible.

• Breaking: require explicit CLI admission for host reports and revision-bound synthesis, preserve the first admitted host pass, and verify the saved request against its launch-time digest. Close active runs before upgrading; old process artifacts lack the required request digest and admission receipt.

• Keep filtered-file mutation evidence byte-based, support = in filter names, align generated review receipts with their schema, reject deleted admission receipts, and keep doctor diagnostics available when Git root resolution fails.

• Disable Git clean/process filters during snapshots, including initialized nested submodules, and track .git/info/attributes; create missing storage parents privately, reject malformed verdict types cleanly, and quote source text in Markdown review views.

• Fix exact run selection across run roots, normalize explicit Git subdirectories to their worktree root, treat unreaped wrappers as exited, and preserve normalization failures across repeated finish calls.

• Breaking: Linux process identities now require the observing PID namespace. Foreign or unreadable namespaces cannot authorize recovery or cleanup; finish active runs before upgrading. POSIX ps identities use UTC and the C locale, with an explicit format marker so older identities cannot be mistaken for dead processes. Older historical run artifacts are rejected by the new strict contracts.

• Accept compact first-pass, helper, and adjudicator judgments through finish flags. Generate revision-bound synthesis inputs and fill canonical metadata and evidence hashes through complete --synthesis; render pinned evidence with result --format markdown --review.

• Bind registry mutations to exact run instances, reserve lifecycle capacity before admission, and replace startup-wide recovery scans with targeted recovery. Add status --active and recover RUN_ID; result now requires an explicit run.

• Report malformed artifact filenames without a traceback and reject authored judgments disguised as the reserved adjudication placeholder.

• Breaking: allow independent Agent Collab runs in the same worktree, tracking each run in a shared guard registry. Finish active runs before upgrading; older and newer runtimes cannot share an active guard. Recursion controls are no longer a hard worktree-wide boundary.

Agent Collab v6.0.1

• License the project under MIT and include the license, package README, and SVG listing/composer icons in the synchronized dual-host package.
• Disable Codex message boards for peers so inherited remote-board configuration cannot inject cross-session messages into an ephemeral independent review. Ordinary local-helper messaging remains available.
• Name the required fork_turns="none" argument for independent Codex helpers and distinguish that instruction from Claude fork controls. Clarify retained hooks/MCP, Skill-triggered subagents, and explicit Fable 5.1 selection.
• Fix Linux Codex safe-mode preflight for npm installations by asking Codex to initialize its read-only sandbox instead of guessing bundled Bubblewrap paths.
• Pin Codex's canonical memory-use and memory-generation controls so an inherited provider feature alias cannot restore automatic saved-memory context or memory tools.
• Correct the public-directory publication guidance to distinguish OpenAI's icon requirement from Anthropic's published checklist.
• Shorten the skill entry point and move conditional launch, platform, and failure details into a dedicated reference while preserving the peer-first workflow and closure requirements.
• Select optional helpers by context separation and independent verification; keep tightly coupled work in the main loop. Assign launch choices to the spawner and explicitly forbid helpers from delegating again.
• Correct generated Codex prompts and documentation to distinguish V1 configured depth from V2 instructional depth, hidden spawn override fields from runtime rejection, and Claude model-list narrowing from exact-model checks.

Agent Collab v6.0.0

6.0.0 — 2026-10-22

• Breaking: require Python 3.11 or newer. Python 3.10 reached end of life on 2026-10-01, and doctor now flags it. CI tests the oldest supported release, 3.11, and the latest stable, 3.15.
• Breaking: accept only ASCII decimal numbers for AGENT_COLLAB_TIMEOUT_SECONDS and every numeric command-line flag, as integer settings already required; Unicode digits, underscores, and exponents are rejected.
• start refuses a Git repository when git is not on PATH instead of moving the worktree guard out of the repository, where it would not exclude a run started with Git available.
• Pin Codex agents.max_depth=1 for models on multi-agent V1, which still expose per-spawn model and effort overrides, and drop the legacy features.memory_tool alias; features.memories=false already disables memory.
• Raise Claude hook timeouts from 5 to 30 seconds, so a slow interpreter start on Windows or macOS neither blocks a legitimate Agent call nor loses Stop effort evidence.
• Name the actual deadline in timeout results instead of AGENT_COLLAB_TIMEOUT_SECONDS.
• Write skill commands with literal placeholders instead of shell variables, so they also run in PowerShell, where $host is reserved.
• Move CI to actions/checkout@v7 and actions/setup-python@v7, which run on Node.js 24, and require the latest stable release of every selected dependency in AGENTS.md.
• Correct the documentation against the implementation and current Claude Code and Codex documentation: the isolated workspace's fresh /tmp, minimal /dev, and which sockets stay reachable; credential paths; the startup gates' scope; macOS Codex safe mode; multi-agent V1 overrides; the effective Codex ultra effort; mods as a spawn channel outside the Agent counter; Claude Code's refusal of bypassPermissions as root; WinGet updates; and the workflow and agent-team environment pins.

Agent Collab v4.0.0

4.0.0 — 2026-10-21

• Add a Linux system-package setup script for disposable workspaces, with a read-only dependency check and Debian/Ubuntu and Fedora installation paths.
• Breaking: default full-capability peer runs on Linux to a disposable copy-on-write repository and HOME workspace. Preflight FUSE OverlayFS and bubblewrap before run creation; fail closed if unavailable. Permit temporary validation writes and discard them after the run. Fresh macOS settings default to direct mode with bounded persisted snapshots, which detect included changes but do not prevent them; explicit settings remain authoritative. Durable delegated peer edits require direct mode. Isolated runs use a lightweight boundary receipt instead of hashing large ignored trees. Add strict workspace_mode settings and request fields; existing v2 settings must be recreated.
• Keep large workspace baselines below the artifact reader limit by streaming Git index and patch digests and retaining bounded path samples with complete manifest digests; report when changed paths fall outside the sample.