v0.22.2

[0.22.2] - 2026-10-15

Changed

• Pin a3s-code-core and the interactive Code TUI to =9.1.3 at git rev
  2ba6f4fcb269ba5030b206387d2f821eb1d73e79. That revision depends on the
  published a3s-effect 0.2.1, a3s-memory =0.1.5, a3s-search =3.3.0
  and a3s-sandbox =0.2.3, carries no workspace patches, and tracks its
  lockfiles, so the release builds the ACP agent and the pager from the Code
  checkout plus ACL alone.
• On macOS, Core 9.1.3 refuses every native-sandbox shell command before it
  starts (native_process_lifetime_unqualified) until detached descendants
  can be contained. a3s code exec and a3s code report the refusal; there
  is no host fallback. Linux and Windows are unchanged.
• Release preflight requires a3s-code-core on crates.io, because the crate
  job publishes a3s against it.
• code exec reports completion and verification separately (#157). Results
  carry Core's verification summary. A completion-gate refusal is
  code.exec.unverified (exit 3, edits kept) or
  code.exec.verification_failed (exit 1), distinct from code.exec.failed.
• Without a verified native sandbox, code exec hides Bash under every tool
  policy and warns before the run that file edits will end unverified (#153).

Fixed

• code exec exits approval.required only for a confirmation its own denial
  settled. A confirmation that a delegated task's policy already settled no
  longer stops the run; an error still fails closed. The error names tool
  and toolId (#156, #158).
• The Linux artifacts' glibc floor (2.39) is documented, and install.sh
  refuses an older glibc before downloading (#151).