Agent Collab 7.0.0

• Breaking: new run artifacts, state, snapshots, and guard entries use schema 3.0 under the default runs/v3 history. Saved settings stay on schema 2.0 at their existing paths. Explicit run roots are honored exactly; incompatible histories are rejected without migration. Close all active old runs with their original runtime before upgrading because the guard registry filename and lock remain shared.

• Breaking: explicit cancellation is immediate, including after a peer report exists. Remove --force-before-min-wait and the obsolete cancellation timing fields; optional --reason defaults to user_cancelled. Preserve reports and require process quiescence before releasing ownership. Completed runs remain immutable, including interrupted completion recovery. Committed cancellation blocks every completion path; cancellation retries reuse the cleanup proof without probing a possibly reused wrapper process group.

• Remove PATH-based host-CLI wrappers; retain environment depth refusal and helper instructions without claiming a hard recursion boundary.

• Separate host administration, run loading, process ownership, and lifecycle operations. Reuse validated operation inputs, preserve post-wait revalidation and lifecycle write ordering, and share launch-gate ownership, stdin writing, and bounded process reaping. Probe timeouts must be finite and positive.

• Share Claude probe/peer settings, remove duplicate settings and an unreachable effort-family check, and mark the package as requiring local execution in Codex. Model, effort, permissions, and user override choices remain unchanged.

• Standardize malformed lifecycle request diagnostics with exit code 2. Group tests by responsibility and remove exact-prose/source-text assertions while retaining behavioral, artifact, and platform boundaries.

• Classify Codex model and effort failures from provider error events rather than quoted tool or assistant output.

• Add six native Claude behavioral evaluations for explicit and implicit activation, nonactivation, and synthetic finding verification, with deterministic graders and a no-plugin comparison.

• Use portable root plugin.json with OpenAI presentation metadata and retain the native Claude manifest in the shared package.

• Require provider validators and isolated marketplace installation checks in CI, fetch the official skill validator from the installed Codex release, and pin GitHub Actions to maintained commit SHAs.

• Clarify the trust limits of writable helper counters and effort receipts, readable host reports, and outbound cross-session tools. Explicitly prohibit host-report reads and cross-session contact in peer briefs; preserve permission and effort choices. Name both Fable versions in override help and document the older Claude settings-exclusion leak window.

• Restore explicit Fable 5.1 selection guidance, correct workflow navigation, and explain prompt-injection exposure without changing model, effort, or permission defaults.

• Reduce runtime duplication with shared module imports, strict field validation, and provider-result handling. Malformed request fields now produce structured failures, and executable entry points resolve sibling modules with Python safe-path mode enabled.

• Add a resumable start/advance host workflow with explicit next actions, resolved host policy, bounded 60-second guided waits, and successful waiting responses. Keep the normal instructions self-contained within 8 KB and make recovery diagnostics use the guided interface.

• Save readable, revision-bound Markdown evidence separately from compact control output, preserving all original reports while omitting duplicate matrix rows and admission hashes from the reading surface. Review receipts now bind rendered bytes; refresh older drafts through advance before synthesis.

• Count advisory reports within the host helper-report bound and route exhausted budgets to synthesis with the missing advisory visible.

• Breaking: require explicit CLI admission for host reports and revision-bound synthesis, preserve the first admitted host pass, and verify the saved request against its launch-time digest. Close active runs before upgrading; old process artifacts lack the required request digest and admission receipt.

• Keep filtered-file mutation evidence byte-based, support = in filter names, align generated review receipts with their schema, reject deleted admission receipts, and keep doctor diagnostics available when Git root resolution fails.

• Disable Git clean/process filters during snapshots, including initialized nested submodules, and track .git/info/attributes; create missing storage parents privately, reject malformed verdict types cleanly, and quote source text in Markdown review views.

• Fix exact run selection across run roots, normalize explicit Git subdirectories to their worktree root, treat unreaped wrappers as exited, and preserve normalization failures across repeated finish calls.

• Breaking: Linux process identities now require the observing PID namespace. Foreign or unreadable namespaces cannot authorize recovery or cleanup; finish active runs before upgrading. POSIX ps identities use UTC and the C locale, with an explicit format marker so older identities cannot be mistaken for dead processes. Older historical run artifacts are rejected by the new strict contracts.

• Accept compact first-pass, helper, and adjudicator judgments through finish flags. Generate revision-bound synthesis inputs and fill canonical metadata and evidence hashes through complete --synthesis; render pinned evidence with result --format markdown --review.

• Bind registry mutations to exact run instances, reserve lifecycle capacity before admission, and replace startup-wide recovery scans with targeted recovery. Add status --active and recover RUN_ID; result now requires an explicit run.

• Report malformed artifact filenames without a traceback and reject authored judgments disguised as the reserved adjudication placeholder.

• Breaking: allow independent Agent Collab runs in the same worktree, tracking each run in a shared guard registry. Finish active runs before upgrading; older and newer runtimes cannot share an active guard. Recursion controls are no longer a hard worktree-wide boundary.