v0.1.6

What's Changed

• Run a flow in a git worktree (#166) @adamw

v0.1.5

What's Changed

• Name the role agents so the cost summary answers what planning cost (#165) @adamw
• Tell the user where the run left them (#164) @adamw
• Collapse read-only tool lines; fit lines to their budget (#163) @adamw
• Send reviewers the changed diff sections; widen review scope (#162) @adamw
• Drop review severity; show locations for findings left open (#161) @adamw
• Anti-deference reviewer prompts (#159) @adamw
• Single-pass task review and a capped whole-run final review (#157) @adamw
• Remove the review confidence gate: reviewers report only actionable findings (#156) @adamw
• Add --keep-changes: keep uncommitted files instead of stashing (#155) @adamw

v0.1.4

Highlights

1. Cost and usage tracking overhaul. Cost and turn data moved out of the run manifest into an append-only log (#97), the manifest schema is now typed (#116), cache writes are split from cache reads (#49), a reported cost of zero no longer hides the estimate (#124), and untagged spend shows up in the by-role summary (#142, #153).

2. Hardened read-only reviewer enforcement. Claude's read-only turns use a --tools allowlist instead of plan mode (#89), with git_show/git_file_at served over MCP (#94) and a host-served github_issue tool for NetworkOnly turns (#96). Gemini's tiers are documented as prompt-only (#90), write-capable tool names are rejected in network grants (#119), and any enforcement shortfall is printed as a run caveat (#154).

3. Review-loop diff correctness. The reviewer change set is derived from git rather than parsed from diff text (#75), the diff sent to reviewers is capped with what was left out named explicitly (#81, #87), resumed reviewers get the re-sampled change set too (#72), and how each reviewer was last sent the change set is recorded (#125). Untracked nested git repos and symlinks-to-directories are skipped (#70, #63).

4. Safer git plumbing. The git interface was shrunk (#110), diff-family output is bounded (#114, #118), blank git show results and magic pathspecs are refused (#122), flows are refused in repos with no commits (#132), and changed paths come from git instead of rendered output (#152).

5. Better console output and fixes. Fan-out lines name the agent behind them (#145), the review loop narrates what it's doing (#144), tool headlines stay on one line with issue keys (#151), unresolved findings are printed at the end (#141), a turn's prose renders before its tool calls (#139), and the agent's whole process tree is torn down on turn teardown (#52).

What's Changed

• Print the enforcement shortfall as a run caveat, not a step (#154) @adamw
• Name the cost summary's role-less bucket (no role) (#153) @adamw
• Keep tool headlines on one line and show issue keys (#151) @adamw
• Ask git which paths a commit changed, instead of reading it off the render (#152) @adamw
• Give an empty diff sample its own LastSent case; drop RosterEntry's type parameter (#149) @adamw
• Match each backend's structured-output prompt to its wire (#148) @adamw
• Silence the launcher's dependency-download wall (#147) @adamw
• Share one unit per count group; name every role's model in the header (#146) @adamw
• Name the agent behind fan-out lines; tidy tool headlines (#145) @adamw
• Say what the review loop is doing in its output lines (#144) @adamw
• Fix docs claims about --verbose and the tool-result glyph (#143) @adamw
• Show untagged spend in the cost summary's By role section (#142) @adamw
• Print the findings a review loop leaves unresolved (#141) @adamw
• Show reviewers the task description and the user's request (#140) @adamw
• Render a turn's prose before the tool calls it announces (#139) @adamw
• Remove a failed stage's new files in failure teardown (#138) @adamw
• Make the reviewer picker unable to answer "none apply" (#137) @adamw
• Pin codex's default model so its turns are priced (#136) @adamw
• Give each enforcement fact one home; document NetworkOnly grants (#135) @adamw
• Pin the read-only wire form and resumed restriction flags on every backend (#133) @adamw
• Make the turn-entry gate a template method on AgentBackend (#131) @adamw
• Bundle claude's per-turn MCP servers into one list (#127) @adamw
• Make the autonomous auto-deny reason approval-mode aware (#123) @adamw
• Reject write-capable tool names in claude.withNetworkTools (#119) @adamw
• Derive each backend's argv flags and enforcement cell from one match (#115) @adamw
• Align opencode's read-only tier with the documented grants (#111) @adamw
• Rename diff to uncommittedDiff, drop ensureClean's unused Boolean (#134) @adamw
• Refuse a flow in a repository with no commits (#132) @adamw
• Merge forceAdd and commitStaged into forceCommitOnly (#130) @adamw
• Dedupe the best-effort git read probes (#126) @adamw
• Refuse a blank git show, reject magic pathspecs, unflag branch names (#122) @adamw
• Bound the branch diff reaching the PR summariser (#118) @adamw
• Bound the diff family's output and probe branch emptiness by exit code (#114) @adamw
• Shrink the git interface: drop dead and redundant operations (#110) @adamw
• Deduplicate review-test fixtures and clean up comments (#129) @adamw
• Record how a reviewer was last sent the change set (#125) @adamw
• Report failing format commands (#121) @adamw
• Replace initialDiff with a ReviewDiff enum, and frame the diff per source (#117) @adamw
• Fold the review loop's gate rejects in one place (#113) @adamw
• Stop reporting fixed findings as ignored (#109) @adamw
• Extract SessionPicker's shared row resolution (#128) @adamw
• Don't let a reported cost of zero hide the estimate (#124) @adamw
• Mark a partial cost total, and narrow the cost-pipeline contracts (#120) @adamw
• Type the manifest schema: enums, Instants, disjoint usage axes (#116) @adamw
• Carry the session name on SessionCommitted (#112) @adamw
• Emit Unobserved debit for usage-less claude error frames (#108) @adamw
• Fix the agent-isolation findings (#107) @adamw
• Review-loop fixes: state, diff sampling, fixer contract (#105) @adamw
• Fix the cost pipeline (#106) @adamw
• Fix the MCP output cap, the unbounded git_show read, rev validation, and two stripMargin sites (#104) @adamw
• Three prose fixes after the read-only repair (#103) @adamw
• Fix the manifest write gate, and stop manifest-less runs evicting continuable ones (#102) @adamw
• Record the manifest's carve-out from the 0.x versioning rule (#99) @adamw
• Cover pruning across a run's two files (#98) @adamw
• Move cost and turns out of the manifest into an append-only log (#97) @adamw
• Widen the readability reviewer's comment check (#101) @adamw
• Give NetworkOnly claude turns a host-served github_issue tool (#96) @adamw
• Drop the run manifest's version gate (#95) @adamw
• Give read-only claude turns git_show and git_file_at over MCP (#94) @adamw
• Gemini's read-only tiers are prompt-only, not hard (#90) @adamw
• Give claude read-only turns a --tools allowlist, not plan mode (#89) @adamw
• ADR 0021 §8: correct the codec claim, which implementation disproved (#100) @adamw
• Record why the per-round snapshot sketch does not work (#93) @adamw
• ADR 0021 §8: split the run manifest from the cost record (#92) @adamw
• Stop the trailer rendering a change as "+0 -0" (#91) @adamw
• Record the answer to R1's NetworkOnly question (#88) @adamw
• Say how much diff the reviewer got, not the threshold (#87) @adamw
• Keep the developer's git config out of test fixtures (#86) @adamw
• Stop stripMargin eating a | line in the reviewer-picker prompt (#85) @adamw
• Research: the reviewer and planner tool surface after claude loses Bash (#84) @adamw
• Plan mode is not a capability gate: correct the scaladocs that say it is (#83) @adamw
• Research: can an OS-level filesystem sandbox make reviewers actually read-only? (#80) @adamw
• Keep the read-only tier; plan the claude repair (#78) @adamw
• Keep a path with a tab in the change set, and tighten the diff cap (#82) @adamw
• Cap the diff sent to reviewers, and name what was left out (#81) @adamw
• Send the fixer's declines to the re-review prompt, and the diff's base commit to the initial one (#79) @adamw
• Record a turn's session and API-call count in the manifest (#77) @adamw
• Reject writes after closeStdin in the piped-process fake, and fix what that exposed (#74) @adamw
• Record T2.4: inline the review diff, don't hand reviewers coordinates (#73) @adamw
• Send the re-sampled change set to resumed reviewers too (#72) @adamw
• Derive the reviewer change set from git, not from diff text (#75) @adamw
• T1.4 findings: one CLI process per durable session — NO-GO (#69) @adamw
• Measure the fixed per-session preamble and attribute it (T6.2) (#68) @adamw
• Research: should the re-review prompt carry more payload? (T2.5) (#65) @adamw
• Simplify the comments added by the loop-cost-ceiling change (#76) @adamw
• Cut the review loop's iteration ceiling; attribute retried turns (#71) @adamw
• Skip untracked nested git repositories in the review diff (#70) @adamw
• Warm the lint gate's summariser session within a review loop (#67) @adamw
• Stop stripMargin mangling wizard input in the authoring prompts (#66) @adamw
• Report agent work that outlives a turn, via an environment cookie (#62) @adamw
• Review the change set since the stage began, not since HEAD (#59) @adamw
• Skip untracked symlinks-to-directories in the review diff (#63) @adamw
• Stop stripMargin mangling interpolated content in prompts (#54) @adamw
• Keep file-gated reviewers on an empty diff; narrow the reviewer set across rounds (#48) @adamw
• Unbreak master: align the manifest cost schema with the split cache axes (#64) @adamw
• Record cost, tokens and per-turn prompt size in the run manifest (#61) @adamw
• Send claude's haiku alias fully qualified, so claude:haiku runs Haiku (#58) @adamw
• Write claude's MCP config under .orca/cache so a leftover can't be committed (#57) @adamw
• Tear down the agent's whole process tree on turn teardown (#52) @adamw
• Split cache writes from cache reads in cost accounting (#49) @adamw
• Tell write-capable agents that background work is abandoned at the turn boundary (#47) @adamw
• Bump os-lib to 0.11.8 (#55) @adamw
• Ignore Cargo.lock in the runnable example seeds (#51) @adamw
• Load the sbt build from a linked git worktree (#50) @adamw
• Bound the diff sent to the commit-message model (#46) @adamw
• Explain agent failures instead of swallowing them (#45) @adamw
• Detect branch conflicts when starting a new orca run (#44) @adamw

v0.1.3

What's Changed

• Support GitHub URLs in issue/PR flows alongside short pointers (#43) @adamw
• Push progress-log removal in teardown to keep PRs clean (#42) @adamw
• Format token counts compactly in cost summary (#40) @adamw
• Fix review loop silently discarding sub-threshold findings (#38) @adamw

v0.1.2

What's Changed

• Pass --head explicitly to gh pr create (#37) @adamw
• Make pi sessions durable and resumable (#35) @adamw
• Authoring: compile the flow via the sandbox lint gate (#34) @adamw

v0.1.1

What's Changed

• Trim flows and README to user-relevant content (#33) @adamw
• Add review.sc: a review-only flow (#32) @adamw
• CI: compile the built-in flows against a locally published build (#31) @adamw
• Remove epic.sc; move its docs pass into implement-enhanced.sc (#30) @adamw
• Drop sbt hardcodes from issue-pr-bugfix.sc; state both issue flows' outcomes (#29) @adamw

v0.1.0

What's Changed

• Orca Shell (ADR 0021) (#27) @adamw

v0.0.17

What's Changed

• Docs: comment-conciseness rule + README readability pass (#26) @adamw
• Trim verbose comments across the codebase (#25) @adamw
• Settings-configured role agents: planningAgent, codingAgent, reviewAgent (ADR 0020) (#24) @adamw

v0.0.16

What's Changed

• Per-project stack settings with agent-based auto-discovery (ADR 0019) (#23) @adamw

v0.0.15

What's Changed

• Stage-bound runtime, capability split with capture checking, and the complexity-review overhaul (#22) @adamw