v0.3.1

Finish or reconcile running attempts before downgrading to 0.3.0.

• Study-scoped executor container names (#149, product fix): a container name now derives from the study id together with the attempt id, so two studies that repeat one attempt identity on the same executor no longer collide and end unknown with container isolation verification failed. Each stage record stores the name it launched with; a record written before this change carries none and keeps resolving ares-<attemptId>-<stage>[-<pipelineStage>] for inspect, reconcile and absence confirmation. Isolation verification still refuses a foreign or leftover container that carries the new name, and the watchdog, cleanup and adoption paths use the recorded name rather than recomputing one. No record version changes and existing attempts stay readable.

• Reuse request warning (#150, product fix): eligible requests outside a matching investigation run still run fresh and return additive, non-persisted warnings with code outside-investigation, cause and nextStep. CLI/MCP result shapes are otherwise unchanged; no new command or flag is added.

• Task snapshot archive (#148): ares attempt run now creates the task archive with the shared content-only tar rule (COPYFILE_DISABLE=1 tar --no-xattrs, also used for stage logs) and checks every streamed member against the staged task files. An AppleDouble ._* member or any member that differs from the staged files is refused by name, so a macOS controller no longer ships extended-attribute metadata to a Linux executor. The frozen task tree hash is unchanged and pinned by a test.

• Reuse rematerialization r2 preparation (#63 T3): export existing source/fault helpers without changing their implementations, add an arm-neutral fresh/eligible fixture runner and a separate create-once superseding setup receipt. Per-case stage hashes and fault states must equal the original amendment; all frozen inputs, labels, v1/v2 seals and the original Reuse receipt stay unchanged. Phase parent CPU, subprocess unknowns and wall clocks stay distinct. This preparation step contains no measurement; the completed T3 runs are reported separately below. The r2 developer receipt names the original setup seal as superseded before use; invalid r2 receipts refuse instead of falling back. Earlier setup verification may report changed code and never rewrites history.

• Reuse admission (#64, product fix): a candidate stage is no longer reused from a source attempt that is not succeeded. A cancelled or unknown attempt that left its sealed stages intact used to produce a verified hit; it now misses as ineligible-source and the stage runs fresh. A valid digest alone never makes an interrupted or semantically stale source eligible, so the rule only narrows reuse: no stage is added, no stored byte or format changes, and a hit from a succeeded source is unaffected.

• Reuse source rematerialization amendment (#63 T3a): integration-check reports the Reuse arm as integrated-rematerialized-source. A deterministic, code-bound setup rebuilds each case's source stage outputs from that case's own frozen source.workload with the v1 workload arithmetic, at every declared seed, as the producer's own payload bytes, and a separate create-once receipt seals the setup. All ten cases that declare a source are rebuilt: four healthy and six rebuilt healthy and then given their own declared fault, so the fault suites reach the reuse path instead of being refused by the setup. Corruption changes a retained payload after the seal so the sealed manifest hash no longer matches; pruning disposes the rebuilt stages through the retention prune path; an interrupted source is recorded cancelled or unknown after its candidate stages were sealed. The admission check is a fake-runner test per fault and requires the reuse path itself to refuse all three stages with its own reason and admit none. The seal binds the setup modules including the fault-injection code, the corpus index, all twelve input hashes, the per-case workload and stage hashes, inherited thresholds/denominators and the immutable v1 parent; freeze-reuse-rematerialization and verify-reuse-rematerialization verify it and refuse drift. Evaluator labels are never read, so no expected file enters the seal. Outcomes stay null with zero trial executions, and the setup's own cost is recorded separately in the materialization dimensions while every other clock stays unknown.

• Supervision snapshot integration (#63 T2b): pin the closed exported snapshot with source-owned evaluated triples and evaluatedSuppressed. Independent producer-generated unit vectors replace hand-authored snapshots; frozen v1/v2 corpora, labels, receipts and baseline bytes stay unchanged. Absence scoring requires exact rule/task/revision coverage, with gaps and retention overflow remaining insufficient. Intent none requires all three rules; wrong/false proposal burden remains counted from presence, and zero helpful actions reports 0. No treatment trial or runtime hub/model/network call is added by this reader. Its unsealed fixture envelope requires evaluated and evaluatedSuppressed; earlier incomplete envelopes refuse with a restore-from-producer next step.

• Supervision corpus v2 amendment (#63 T2c-B): separate create-once freeze/verify receipt binds the approved v2 protocol/join method, inherited budgets/thresholds/denominators, all input/expected bytes and the immutable v1 parent. Integration-check keeps v1 unsupported and adds twelve format-covered v2 cases with null outcomes and zero runs. The intent join uses action/rule/task/current revision, never producer trigger strings; the 2026-11-10 ruling separates exclusive case outcomes from observed wrong/false proposal burden. Always-wrong proposals consume the false-proposal budget even when missing desired-rule coverage leaves the case insufficient. Absence scoring remains pending source-owned evaluated coverage; no evaluator, treatment, hub or model call is added.

• Execution evaluation (#63 T3/T4): preserve immutable paired Diagnose/Reuse and Supervision v2 shadow receipts and publish the evidence-bound disposition report and closeout. Diagnose is insufficient evidence, Reuse is restricted after failed performance gates, and Supervision is at most retained in shadow mode. Lineage remains read-only utility, eligible reuse stays off by default with explicit operator opt-in, and advisory mode remains off without separate authorization. Human timing and live/native/account benefits are not inferred from synthetic observations.

Install

bun add -g @staix/agent-research@0.3.1

Published with npm OIDC trusted publishing and provenance. The validated tarball and its tag/commit/SHA-256 manifest are attached. SHA-256: dbd850494a51393bd5ce1345a0094041956528a389c283575928211a529068c8.