v0.1.6-rc2

v0.1.6-rc2 (re-cut #3)

Release candidate: the RL loop becomes alive — observation, signal, bridge, and supply faces land on the substrate rc1 built, and the harness starts pruning what does not serve the task.

Features

• The decision loop gets its operator faces (#761, #762, #763): observation ingestion into the decision state (component b), distill joins the fixed action vocabulary as a priced act (component A), and the policy's output cardinality — one-or-more, budget-bounded (component π). The o→b→π→a→r chain is now expressible end to end.
• Executor wiring (#776): workspace hooks fire into the learning substrate from the dispatch lane — the W1/W2/W3 faces that let step records actually reach the strategy pools.
• The learning-signal degeneracy breaker (#778): five consecutive identical settlement credits = a dead signal; posterior-moving legs freeze and a signal_degenerate blocker fires (fail-closed, manual recovery). Contract: docs/architecture/rl-signal-contract.md — per-observation evidence mass is capped, counts are never normalized away.
• The learning-decision bridge (#782): starved claims get a claim-level observe_step_credit fallback admission; case posteriors join the prior chain as the fourth source (history → llm_prior → case → store, SHRINK-capped); the breaker counts bridge traffic. Four acceptance metrics measured on the synthetic win-kdf replay (posterior shift, sampled_family rows, rl-posterior-moved, rl-sampler-exit).
• Observation attribution + the policy-state projection (#785, #779/#769): a probe proved Task-spawned tool calls fire workspace hooks but carry the parent session_id — worker identity now rides agent_id/agent_type so step credits attribute to workers; round close projects runs/policy-state.json (schema policy-state/1) with a statusline face and the policy-state-fresh liveness fingerprint.
• Need-driven recall injection (#786, #771): recall is derived from the dispatch question (the WEB_QUERIES/GO_SIGNALS category tables are gone), every item carries a fresh path:L<start>~L<end> section anchor computed at query time, the budget is 3 files / 5 items / 1200 chars, and it is default-OFF behind KUNGLAO_RECALL=1.
• The supply gate (#787, #767): every declared face (plugin mcpServers, agents entries, mcp_probe MANIFEST env rows) must resolve to an in-tree artifact or a pinned installable source — the gate runs red/green in plugin-scan.yml. camoufox-reverse is re-pointed to its true source (WhiteNightShadow/camoufox-reverse-mcp@v1.1.1, MIT); eight de-vaporized surfaces across plugin.json/kunglao-init/README.

Documentation

• The technical doc + the plans (#780): the single-volume architecture/module/backlog/call-graph doc with drawio+mermaid diagrams, the four-arm RL value experiment plan, the closing program plan, and the wiring census — all in docs/architecture/.
• Six spec amendments (#781): the §8.2 as-built-vs-spec mismatches (issues 496/691/753×2/loop-engineering/#764) now carry dated, owner-ruling-cited amendment sections with real file:line pointers; spec_coverage is clean on all six.
• Acceptance docs (#785/#786/#787): per-deliverable acceptance commands, integration points (file:line), boundary schemas, and assembly fingerprints.

Fixes

• Deploy-manifest discipline: the generated deploy-manifest.yaml is now regenerated as the mandatory last step of every surface edit — three CI cycles of "stale manifest" were hunted to a single rule.
• Lint ratchets (#275 family): comment-hygiene, silent-except (0 handlers across touched faces), and formal-code marker baselines are emitted in-PR; policy_state.py landed with a shrunk ledger.
• Actor vocabulary (#879 anchor): policy_state joined LEGACY_ACTORS (a first-attempt regression that silently dropped "priority" was caught in review and fixed).
• Recall defaults (#771): the old default-on injection pins migrated to opt-in fixtures; keywordless questions emit recall_skip instead of noise.

Upgrade notes

• Runtime floor unchanged: Python 3.10+ with uv; uv sync --locked restores the pinned environment.
• PEP 440 ordering (from rc1) still holds: 0.1.5.postN < 0.1.6-rc2 < 0.1.6.
• KUNGLAO_RECALL is default-off; workspaces that relied on always-on injection must arm it explicitly.

Known limitations

• This is a release candidate: pin the exact version when it matters.
• Where worker-step attribution is unavailable, credit lands at CLAIM granularity (the #782 bridge fallback) — learning is coarser by design until the step-attribution face fully matures (#779 follow-ups).
• Deferred to the next cycle: #770 (ledger-driven watchdog), #774 (upgrade transaction), #783 (resident developer hook chain).

---

中文说明（简体）

v0.1.6-rc2（第三次切版）：RL 回路在本版"活"了过来——观测、信号、桥接、供应链四面落地。

新特性

• 决策环算子面（#761/#762/#763）：观测入决策状态（b）、蒸馏以计价动作身份进入固定动作词表（A）、策略输出基数——一到多、预算约束（π）。o→b→π→a→r 全链可表达。
• 执行面接线（#776）：工作区 hook 从派遣道接入学习基底，步记录真正抵达策略池。
• 学习信号熔断器（#778）：连续 5 个相同结算信用 = 死信号，后验移动腿冻结并发出 signal_degenerate 阻断（fail-closed，人工恢复）；契约见 docs/architecture/rl-signal-contract.md。
• 学习-决策桥（#782）：无步记录的 claim 按 claim 级信用兜底入池；案例后验成为第四先验源（history → llm_prior → case → store，SHRINK 封顶）；熔断器覆盖桥产流量。win-kdf 合成回放四指标实测。
• 观测归因 + 策略状态投影（#785，#779/#769）：探针证实 Task 子代理的工具调用会触发 hook 但归属挂 parent session——worker 身份改由 agent_id/agent_type 携带，步信用归到 worker；轮闭合投影 runs/policy-state.json，statusline 增消费面，新增 policy-state-fresh 活性指纹。
• 需求驱动召回（#786，#771）：召回由 dispatch 问题派生（删除 WEB_QUERIES/GO_SIGNALS 类目表）；每条带查询时新算的 path:L<起>~L<止> 锚点；预算 3 文件/5 条/1200 字符；默认关闭，KUNGLAO_RECALL=1 启用。
• 供应链门（#787，#767）：所有声明面必须解析到仓内工件或钉死的可安装源，plugin-scan.yml 红绿演示；camoufox-reverse 重指向真源 WhiteNightShadow/camoufox-reverse-mcp@v1.1.1（MIT），8 处蒸发表面清除。

文档

• 技术文档 + 计划（#780）：单卷架构/模块/backlog/调用图文档（drawio+mermaid 图）、四臂 RL 价值实验计划、收官计划、接线普查，均在 docs/architecture/。
• 六处 spec 修正案（#781）：§8.2 规格与实现对不上的六处（496/691/753×2/loop-engineering/#764）补齐日期+owner 裁决引文+真实 file:line 指针；spec_coverage 六处清零。
• 验收文档（#785/#786/#787）：每个交付物的验收命令、接入点（file:line）、边界 schema、组装指纹。

修复

• deploy-manifest 纪律：表面编辑后必须最后重生成（连续三个 CI 周期的"manifest 过期"归一为一条规则）。
• lint 棘轮（#275 族）：注释卫生/静默 except（触及面 0 处）/formal-code 标记基线同 PR 发射。
• actor 词表：policy_state 入 LEGACY_ACTORS（首轮静默误删 "priority" 的回归被审查拦下并修复）。
• 召回默认（#771）：旧默认注入钉迁移为 opt-in；无关键词问题发 recall_skip 而非噪声。

升级说明

• 运行时底线不变：Python 3.10+ 与 uv；uv sync --locked 还原锁定环境。
• PEP 440 排序沿用 rc1：0.1.5.postN < 0.1.6-rc2 < 0.1.6。
• KUNGLAO_RECALL 默认关闭；依赖常开注入的工作区需显式启用。

已知限制

• 这是发布候选：在意稳定性的场合请钉死精确版本。
• worker 步归因不可用时，信用按 CLAIM 粒度落账（#782 桥兜底）——学习粒度偏粗，待 #779 后续把步归因补齐。
• 缓发至下周期：#770（账本驱动 watchdog）、#774（升级事务）、#783（常驻开发者 hook 链）。

v0.1.6-rc1

v0.1.6-rc1

Release candidate: feature-complete for v0.1.6 — the learning substrate completes, and the loop's decision state gets its operator faces.

Features

• The learning substrate completes (#581, #582, #597, #601, #609, #610): epistemic probe features (entropy band, constant density, packer verdict) join the state signature so opening bets are per-instance; the refutation fold raises verify density where red-team refutations cluster, with monotone decay; verify-act absorb-at-kill settlement with writer binding; the discovery trigger recalibrates to the measured budget shape (K=2 plus a loop-stall arm) with a hard-wall corpus to match; four audit-driven hardening fixes (proven-waiver authority, the register wipe wall, censored-timeout credit aligned to the failure floor, environment-belief reconciliation with quota-storm backoff).
• The decision state faces (#584, #585, #586): per-fact uncertainty and next-probe fields with a hypothesis view; timeline v2 (the structured progress face), global_plan rendered from it, the ICD-203 note conventions, the evidence and result DAGs, promotion write-back (register and facts stay consistent), and milestone-progress readouts (stage coverage, progress depth, the stall funnel).
• Operator experience (#606, #611, #612, #613): the README states the positioning (an act-level RL controller around Claude Code, how the online RL works, tool-routing learning, self-improvement evidence) with broadcast-grade animated visuals (posterior curves, progress curves, q-cell heatmaps, training curves, ReAct triplet traces) and bilingual success case studies from real run artifacts.

Behavior changes

• Consolidation (#561, #578, #590, #591, #580): the atomic-write family, the lint scan/emit protocol, registry maps for the eval drivers, scripts_bootstrap; the repo-walk test invariants exclude sibling worktrees and deployed scaffolds.
• CI (#605, #607): docs-only PRs take a fast path (the heavy legs noop, the required-check chain untouched); a bounded connectivity gate absorbs runner egress blips before checkout.
• Version identity: this cycle ships as 0.1.6-rc1; v0.1.6 is the last Claude Code-native release line — v0.2 migrates the runtime to the PI Agent base.

Fixes

• Adversarial memory (#582) and the prediction ledger (#575) land with their decay and log-lift guards.
• #275 batch-3 endgame holds across the consolidation (zero silent handlers, the empty ledger endgame, the marker inventory).
• kunglao_upgrade version parsing handles PEP 440 rc suffixes (0.1.6-rc1 orders before 0.1.6, after 0.1.5.postN) — the upgrade ladder previously crashed on the suffix.
• The v0.1.6 fix campaign folds in (#646, waves 2-4; supersedes #639-#643, #645): the dispatch-gate family hardening (#615, #617, #619-#627: verifier exemption, undo-anchor rollback with the approval-point reopen, the delivery-verified gate, no-fabrication intent handling, rank and strategy rows) plus the PQ-link mint path (#618: mint stamps answers_question; ws_yaml gains the append face); the heartbeat continuity dead zone closed (#616: tick-row provenance manual|cron, the count-bounded 6-tick window with the age arm retired, loop_registered preserved across resets) with the autonomy batch (#630-#638: compact-continuity stash + delivery, stale-feedback invocation, stamp re-emit, rank-face warn, live round-credit settlement, the cadence advisor and the slot monitor, durable-loop removal); the RLVR live seams wired (#647: cross-task strategy-store bank, case-settlement posteriors for the ranker, compose settled-ledger fallback, episode tiers) with fact provenance landing end to end (#648: creator stamps, the failure-analysis seeder); the exploration arm policy pinned at the 3/5/8/16 ladder (#649 — floor 3, default 5, active ceiling 8, library ceiling 16; temperature is not a lever, per the owner ruling); test-infra fixtures aligned (#644).

Upgrade notes

• Runtime floor unchanged: Python 3.10+ with uv; uv sync --locked restores the pinned environment.
• kunglao_upgrade no longer crashes on PEP 440 rc-suffixed versions; an rc orders before the final (0.1.6-rc1 < 0.1.6) and after the post releases (0.1.5.postN < 0.1.6-rc1).

Known limitations

• This is a release candidate: the shipped surface may still change before v0.1.6 final — pin the exact version when it matters.
• Gate 4 (test effectiveness) attests the recorded mutation baseline (devkit/mutation-baseline.json) against commit ancestry; if follow-up work squash-merges onto dev, the gate will — by design — demand a baseline re-record there.
• The self-hosted CI runner's egress to github.com was observed intermittently flaky this cycle; the release-check connectivity gate absorbs the blips, but integration-leg timing can vary.

---

Re-cut 2026-10-11: this tag re-cuts under one version (the #655
head-hash identity distinguishes the batches). The re-cut folds the
post-cut wave into the release: Gate 4 reads the recorded mutation
baseline (#663), the verify-stage hybrid ruling — re-run receipts +
the landing gate (#653), the fact-certification gate (#651), the
batch-repair card wave 2 (#654), and the shadow experience substrate
(#667). The first cut's content (changelog below) is unchanged.

v0.1.5.post2

v0.1.5.post2

The strategy-learning release: the loop's economy — sampling, planning, obstacles, remedies — moves from recorded to running.

Features

• Replayable Thompson sampling. The rank sampler seeds from the posterior state and round: the same state reproduces the same ranking, a new round re-rolls it, and every seed's components are on the event record.
• Plans carry their own epistemics. Steps can declare if-fails branches; unknowns mint epistemic claims priced by situational ΔH; facts declare their assumptions; refutation propagates along semantic edges, so a dynamic-registration counterexample can retire the static conclusion it contradicts.
• Obstacles have a ladder. When an attack path exhausts, the loop walks a 3-rung target/attack-surface ladder and mints each alternative as a sibling claim back into the pool; promotion attempts count with a 3-strike dead-letter queue.
• A stalled loop unblocks itself. A STALLED verdict now routes to the decomposition operator, minting the mechanical claim that breaks the flatline — instead of printing advice.
• Oversized plans get split. The granularity gate refuses plans above 8 steps or spanning domains, and fans them out into dependent sub-claims before execution.

Behavior changes

• Oracle admission split: reproduction and replay-evidence are decided separately at intake; generation-language phrasings pin reproduction; replay questions reroute to input-contract claims.
• Event envelopes are complete by construction: duration / arm / epoch / hypothesis fields populate at emit with a tick stamp; an explicit null now requires a stated reason.
• Settlement moves posteriors: ΔH is computed and visible after every settlement.
• Zero-output cycles leave a record: no_delta fingerprinting is wired into post_check and the production gate list.
• progress.txt is a complete timeline, derived from the ledger — no hand-maintained narrative.
• No silent failures: every fail-open handler leaves one rate-limited WARN trace; the repo-wide silent-except ledger ships empty and is lint-gated.

Upgrade notes

• Run /kunglao-agent:upgrade <workspace> on workspaces older than 0.1.5.post2 — the frame refresh and stamp carry automatically; claims, facts, and evidence are never touched (byte drift refuses with RC=4).
• No new HARD toolchain requirements in this release.
• Naming: the tag is v0.1.5.post2 (PEP 440 post-release); plugin manifests carry the semver face 0.1.5.

Known limitations

• web and macos targets run a deliberately light toolchain probe at init; heavier capability checks happen when the target actually needs them, not upfront.

v0.1.5.post1

The Patch1 release — ten field-run fixes on the v0.1.5 line, plus the adversarial-review remediation batch, the macOS memory-probe fix, and CodeQL hardening.

New capabilities

• Lane routing — task_spec.yaml declares its analysis lane (malware | algorithm | protocol | web | data | app). Algorithm-RE tasks initialize without a binary sample; protocol/web/data/app ship scaffolded stubs; a workspace that declares nothing is ASKED for its lane (no default). The malware lane is byte-for-byte unchanged.
• Statusline v2, deployed by init — a fresh workspace gets live loop state from the first minute: value sparkline, entropy badge, health dots, active claim, and the Thompson rank face (R:<claim> <score> with stale/broken-emit states visible on screen).
• Android probe surface — init probes apkid (recommendation only), the JVM, and runs the APK memory gate, recording the verdict as an environment fact that formally gates jadx dispatch. On macOS the gate now measures REAL available memory (Mach counters) — the budget is dynamic again, and a failed probe is visible instead of silently flooring.
• Unified uv operations — every user-scope operation dispatches through uv run --project <skill_root>; the Phase-0 environment probe follows the same path with --locked, so lock-faithful installs pass and a probe never rewrites your uv.lock.
• One decompiler face — IDA XOR Ghidra XOR ida-pro-vm MCP: a single decompiler check reports the winning supply and the skipped siblings, instead of parallel contradictory items.
• State-layered diagnosis — tool failures are diagnosed at the layer where they failed (installed → registered → connects → capable → input), with decision_lint blocking installs that already-gathered facts forbid.
• Evidence classes — algorithm-recovery claims can no longer reach PROVEN on string-triage evidence alone; the refusal names evidence-class.

Upgrade notes

• Existing workspaces: run the upgrade — uv run --project <skill_root> python <skill_root>/scripts/kunglao_upgrade.py <ws>. Any behind workspace now gets the frame/stamp carry automatically (the upgrade planner gained a universal terminal carry; releases no longer hand-write boilerplate migration entries).
• Legacy task_specs without a lane keep their current behavior — no action needed.
• Version naming: this release is version 0.1.5.post1 (PEP 440); the Claude plugin manifests carry the semver form 0.1.5-post1 of the same release (the plugin scanner requires strict semver).

Quality

The train went through a three-agent adversarial review before release: evidence re-runs (6/6 confirmed), gate-integrity audit, and a correctness hunt whose ten reproduced findings were all fixed before the cut (#225). Code scanning is clean of the long-standing high alerts (workflow permissions, URL substring checks, tag-filter regex).

v0.1.5

What this release is about

v0.1.5 makes the loop honest at both ends. It can no longer start work without asking you what you want, and it can no longer claim success without mechanical proof. In between, every score update, reward movement and case settlement became auditable — and the whole environment setup, knowledge base and CI were rebuilt around you never having to do the agent's setup work.

New capabilities

• Init asks before it builds. Every init now interviews you for the analysis goal (recorded verbatim), a checkable success criterion, and how the result should be verified (reproduction / replay evidence / static / manual). Answers are written into the task contract; without them there are no oracle files and the analysis loop refuses to start — no more runs on guessed goals. Upgrade interviews existing workspaces too.
• Claims need proof. Reproduction claims require controlled-variable replay evidence; non-equivalent or missing evidence fails closed. Convergence requires the declared oracle coverage — the run can't dodge its own primary questions.
• The environment sets itself up. The toolchain gate now probes and resolves: it finds IDA (Spotlight, .app bundles, brew, known directories), falls back to Ghidra, registers missing MCP servers itself, configures the rooted device over adb (debug flag, frida/gserver), installs uv if missing, and only asks you to choose when genuinely nothing is installable — never to do work the agent can do.
• Settlements are forensic. Every case records how it was won or lost; a rolling win-rate curve and a unified algorithm event log (rank feeds, posterior updates, observations) make the agent's beliefs and rewards auditable end to end.
• Statusline v2: sparkline, entropy badge, health dots and the current-task chip, deployed per-project.

Improvements

• References tree rebuilt: three-level re-library, mapping-driven generators, generated two-tier indexes, noise removed (relib_audit enforces integrity).
• scripts/ consolidated: six clusters merged, nine orphans removed, shared libs extracted, tool installation unified under one registry (unidbg included).
• Knowledge distillation: IDA-scripting methodology, debuggability enablement ladder, the 26-lesson Android-RE course, anti-bot/unidbg queue, and task-writing as a checkable oracle.
• CI: four parallel release legs (all must be green), xdist acceleration, subprocess elimination — and the recall subsystem now answers in-process against a memoized index.

If you are upgrading from 0.1.4

• The 0.1.4 → 0.1.5 migration runs automatically on upgrade: it re-merges CLAUDE.md from the new template and refreshes the template stamp.
• On the next upgrade or init, the agent will ask you for the goal, success criterion and verification method of your workspace — this is intended, and answers are stored in task_spec.yaml.
• If your machine has the learning-output-style / explanatory-output-style plugins installed, init warns that their session-start injections are neutralized inside kunglao workspaces (the workspace contract requires the agent to implement everything itself).

Known limitations

• Replay evidence is not yet bound to a medium (#199): a replay "pass" produced inside a simulator the agent controls counts only as hypothesis-grade support; device-medium binding lands in v0.1.6.

Milestone: 31 issues closed. Full per-issue detail in CHANGELOG.md.

v0.1.4

kunglao-agent v0.1.4 — UX & Bugfix

Highlights

• Worker lifecycle: WAIT/UNWAIT real spin-poll with signal re-arm + self-kill (#902)
• Adversarial loop with teeth: challenge ledger, 5-round cap, stalemate arbitration, worker rebuttal right (#909)
• CLAUDE.md employee handbook: type-conditional rendering (VM/MCP/env slots), Roles/Layout/Quick-start sections, cultivate-not-append governance (#919/#920)
• Identity: repositioned from single-domain tool to a reverse-engineering expert across the full task spectrum (#919)
• Quality: ruff rule upgrade with legacy ratchet (#914), test-governance batch 1 (#915), compat zombie purge (#916), rho_verifier F821 fix reviving cockpit persistence (#913)
• Platform: T0 capability probes (#697), per-channel event log (#699), workspace single-source (#865)
• License: AGPL-3.0 + commercial dual-license
• CI: official uv installer (PEP 668 compatible), release-check hardening

Verification: 5300+ tests green; every PR landed through CI-gated release-check.