v1.2.0

An advisory-channel minor release. It adds diff --application, which compares
the agent wiring of OpenAI Agents SDK and Google ADK applications between two
Git refs, read from source with no manifest, saved baseline or declarations,
and supplies no release verdict or merge permission. The host comparison gains
three readers — hook script bytes, coding-agent launches inside CI workflows,
and a hook's or MCP server's launch detail — names the changed inputs it does
not read, and closes three fail-open comparisons.

Measured, as each entry records: on a pinned corpus of 48 application pull
requests, a scope derived from the change establishes the same 296 rows the
repository root does (#875); on 134 open SDK/ADK pull requests, naming what a
tool reaches left rows, statuses and exit codes unchanged, and 9 of 96 row
sides name an outbound call (#872); a root-scope comparison of
TencentCloud/CubeSandbox went from 412 s to 46 s with identical rows (#686).
The limits are worth stating plainly: diff --application reads OpenAI Agents
SDK and Google ADK source wiring only and compares what it observes, not what
runs; every construction, import or call it cannot follow is a named gap or
limit; and a tool's reach is read statically, claiming read only when every
outbound call was followed and every one reads.

The full reviewed prose is in
docs/changelog/1.2.0.md. This section is the
release note; that file is the record.

Migration notes: read every Migration Note: 1.2.0 entry in
STABILITY.md before upgrading from 1.1.0. Schema versions
move: runtime contract 40 → 41, verifier 0.20 → 0.21, capability diff
0.3 → 0.4, and host-grants inventory, baseline and drift 0.6 → 0.7.
diff --application publishes application_comparison_schema_version 0.2,
its first published version.

Highlights

• diff --application compares agent wiring from source, for OpenAI
  Agents SDK and Google ADK, between exact base and head refs, with scoped
  coverage gaps and explicit uncertain candidates. Without --scope, the scope
  is derived from the change. (#871, #875)
• It follows a tool where it is bound: from another module, through a
  package re-export, from an ADK local factory or a tools list built in the
  agent's function. An agent it cannot read is a named gap, never "no change".
  (#864, #865, #876)
• A row names what the bound tool reaches: the endpoint, the request
  fields, the credential it sends by variable name, and which arguments the
  model chooses, with effect evidence from the engine's own assessment. (#872)
• A host comparison names the changed inputs it does not read, so a
  zero-row result is not read as covering them. (#821)
• New host readers: hook script bytes (#702), coding-agent launches in CI
  workflows (#823), and a hook's matcher, command and timeout and an MCP
  server's launch arguments (#819).
• Three fail-open comparisons closed: a narrowing in one settings file no
  longer hides a grant in another (#858); a plugin hook the project settings
  enable is no longer passed (#809); a plugin directory that cannot be compared
  no longer hides the rest (#808).

Application comparison without prior setup

• Add diff --application for OpenAI Agents SDK and Google ADK source-observed per-agent wiring between exact base and head refs; it needs no manifest, saved baseline or declarations and supplies no release verdict or merge permission. (#871)
• diff --application without --scope derives the scope from the change instead of comparing the repository root, and reports how it chose. (#875)
• diff --application no longer reads another library's Agent or function_tool as the OpenAI Agents SDK's, and no longer reports an agent it stopped observing as removed. (#871 follow-up)
• diff --application no longer reports compared with no changes while an agent it could not see gained a tool: an unread construction is a named gap. (#876)
• diff --application no longer refuses a repository over a link or submodule its application reader never opens, and reads a Google ADK agent imported from the package root. (#871 follow-up, measured for #868)
• diff --application rows name what a bound tool reaches: the endpoint, the request fields, the credential it sends and which arguments the model chooses. (#872, part of #868)
• Follow a tool an agent binds from another module in the repository. (#864)
• Read a Google ADK tool a local factory builds, and a tools list built in the agent's function. (#865)
• Read a materialized Git tree's blobs through a few git cat-file --batch processes: a root-scope diff --application of TencentCloud/CubeSandbox went from 412 s to 46 s with identical rows. (#686)

Host comparison and the Action

• Compare exact repository script bytes for supported Claude Code and Codex hook executable references: a script-only edit produces an attributable hook row. (#702)
• A host comparison names the changed inputs it does not read, so a zero-row result is not read as covering them. (#821; slice 2 of #812)
• A hook row names what changed in the hook, and an MCP row names a change to the server's launch arguments. (#819, slice 2 of #795)
• Read how a coding agent is launched inside a CI workflow: a documented agent action's permission inputs, the flags of a plain claude -p or codex exec, and each actions/checkout ref. (#823)
• A plugin directory that cannot be compared no longer hides the host changes outside it. (#808)
• check and verify no longer pass a change to a Claude Code plugin's hook that the repository's project settings enable. (#809)
• Fix a fail-open comparison where a narrowing in settings.json suppressed the expansion signal for the same rule newly allowed in settings.local.json. (#858)
• An unrelated permission rule for another tool no longer splits a decided replacement into separate review changes. (#858)
• Correct false widening markers on hook and MCP edits, disabled plugins, more restrictive permission modes and enabled sandboxes; an edit whose direction is not established says so. (#820)
• A Claude Code setting that disables prompts or approves project MCP servers carries one rating on every surface that names it. (#827)
• Rate documented arbitrary-code Bash launcher prefixes with trailing wildcards as critical/admin, so widening a rule cannot lower its rating; check no longer reports respelling a Bash rule as a new grant. (#824)
• A changed Claude Code git push prefix allow names the documented command forms the narrower deny prefixes in the same source do not cover. (#829)
• Note a literal, unconditional inline PreToolUse allow on a broad Claude Code hook matcher. (#826)
• Add factual mutable-source notes to supported MCP launcher changes, including pinned-to-mutable transitions. (#825)
• Add conditional review guidance for supported Claude Code shell-permission changes. (#839)
• An unchanged instruction file or plugin manifest reached through an in-tree link no longer refuses the whole host comparison. (#822)
• Skill frontmatter metadata no longer refuses the entire host comparison. (#848)
• verify --preview in a repository with a shipgate.yaml no longer sends the caller to a human for missing evidence. (#807)
• Workflow comparison values label their aggregate access, so it is not mistaken for an individual token scope. (#859)
• Host-only verifier headlines and control.reason label their raw count as rows. (#857)
• Host-only Action summaries no longer invent an empty scan status or zero scan severity counts. (#854)
• The PR-comment fallback renders correctly in the job summary after a 403 or 404. (#856)
• Version-based Action installs log the installed engine content digest. (#855)
• Move the published-release pins, examples and adoption prompts to v1.1.0 (contract 40) now that it was published. (#778)