v0.9.0

Added

• isolation: auto is the new default (#156). The isolation: convention header now defaults to auto: at a ticket's work-start the engine asks once whether more than one ticket will be worked at once on this machine this session, and if so resolves the mode by repo shape (a plain repo to worktree, a submodule superrepo to clone), otherwise it works in the current checkout exactly like none. The autonomous run never asks (sequential work, no concurrency). An explicit none / worktree / clone is honoured as-is. A submodule-bearing repo escalates worktree to clone (a superproject worktree cannot safely carry submodule state), and a clone with submodules is provisioned recursively at the superproject's recorded commits. Documented in both READMEs, /docs, and the teamwork / configuration references.
• /trailhead:prune verb (verb badge now 22). A new verb that prunes a map's closed and orphan native sub-issue edges to reclaim slots under GitHub's 100-per-map cap (references are kept; only the structural edge is dropped). The child-to-map edge add is now cap-aware: at the cap the engine surfaces it and offers /trailhead:prune rather than silently dropping the edge, and the dashboard flags a map that is near cap or at cap · prunable. The prune gh mechanics are single-sourced and 404-tolerant (an already-detached edge is not an error). Projected on Codex as a discoverability skill.
• body-guard hook (guardrail #7) (#152). A new guardrail that hard-blocks a gh issue edit / gh pr edit / gh api write that would overwrite an issue or PR body with an empty or whitespace-only value, the backstop for the fail-safe body-rewrite rule. It recognises the -b / -F / --body / --body-file forms, gh api quoted and @file empty-body shapes, and expands a leading ~ in body-file paths. The guardrail count is now seven across both READMEs and /docs. Registered on both Claude and Codex.
• Brief the ticket and confirm scope before the work engine runs. work and quick now give a short, result-oriented summary of what resolving the ticket will do and ask whether to change anything before dispatching to the type engine. A change consistent with the ticket is folded in; a divergent request is surfaced as a mismatch and offered as work-as-is versus a separate new ticket (opened only if the user chooses it). Under an autonomous run this is a process confirm gate that proceeds without stopping.
• Eager sub-issue edge drop at close (#151). When a ticket is closed as trailhead:out-of-scope or trailhead:superseded, its native sub-issue edge is now dropped at close to reclaim a slot immediately (references intact), instead of waiting for a later prune.

Changed / Fixed

• No agent-side action may be sequenced after /clear (#159, #160). The handoff and capture specs now forbid sequencing after /clear an action the agent must perform that depends on context /clear will erase; the fix is to do the agent action before the handoff, or convert the next step into a user-runnable command. The constraint now governs every line after /clear, not just commands (#159). The greenfield "pending codebase offer" was an attenuated instance: it is now posed and resolved before the /clear-first block is rendered rather than placed inside it (#160).
• Next-step guidance anchors on /trailhead:work over /trailhead:quick (#158, #149). The whiteboard / map-complete handoff branches, the bare-/trailhead empty-frontier move-list, the whiteboard render, and the capture and chart close blocks now anchor on /trailhead:work <n> and offer /trailhead:quick <n> only alongside as the no-split alternative, never in its place.
• gh-subcommand hook detection hardened. The shared gh-subcommand library is now installed on every host, and flag detection handles two-token and unknown flags without desyncing the keyword scan (an unknown boolean gh flag can no longer hide a write).
• Injection scanner false positives reduced. The issue-injection scanner narrows its matched objects to cut prose false positives and tolerates padded imperative-override phrases.
• Miscellaneous. The post-commit self-check reads commit paths with core.quotepath=false so a non-ASCII filename compares plainly; the hookless update check rewrites its cache atomically; gh -F command substitutions are quoted in the cookbook; and the ticket-language directive is asserted single-sourced by a test.