v0.24.0

---

version: 0.24.0
date: 2026-06-10
headline: "Minor — the helped rate gets a kernel-owned denominator, and SELF_MODIFY gains an operator-armed override window."
themes: ["helped", "override", "release", "hook-stats", "hygiene", "docs"]
highlights:

• "dos helped now reports of-N-adjudicated, read from a kernel-owned observation log"
• "dos override: an operator-armed, expiring SELF_MODIFY override window with status/disarm"
• "Release gate now adjudicates the committed bytes, plus a TestPyPI rehearsal before the PyPI hold"
• "Hook stats: intervention-rate headline; delegate handoffs leave the denominator"
• "Toolathlon durable replay data restored; gitignore negation hygiene pinned by test"

---

TL;DR — Two new operator surfaces land: dos helped gains an honest
denominator (every hook adjudication is now logged by the kernel itself, so the
"caught for you" rate is out of N observed calls, not an anecdote), and
dos override gives the operator a deliberate, expiring window to make T1
kernel edits without disabling the guard. Release tooling hardens around the
issue-#7 scars, and the public tree's scratch-dir handling gets audited and
pinned.

helped — the denominator is kernel-owned (docs/297)

• New kernel leaf hook_observation.py — every hook verb appends one
  observation record per adjudication, so the rollup has a denominator the
  agent never authors.
  • Why: "DOS helped you N times" is only honest as "N of M adjudicated."
  • How: src/dos/hook_observation.py; folded by src/dos/help_summary.py;
    surfaced as dos helped's of-N-adjudicated rate (src/dos/cli.py).
• Delegate handoffs leave the stats denominator — a Go-hook call that
  delegates to Python is not double-counted.
  • How: go/internal/hook/stats.go (docs/297 P4).

override — the operator-armed SELF_MODIFY window (docs/296)

• An arm-file the operator writes by hand opens a bounded override window;
  the PreToolUse hook honors it as PEP disposition, never as verdict evidence.
  • Why: T1 kernel edits previously required the out-of-repo playbook; the
    deny had no legitimate, auditable bypass.
  • How: src/dos/override_facts.py (arm-file read, expiry),
    src/dos/pretool_sensor.py (disposition), dos override status|disarm +
    a dos doctor row (src/dos/cli.py). Arming stays a by-hand act.

release — adjudicate the commit, rehearse the publish (docs/295)

• scripts/release_dry_run.py runs the release-killer witness against the
  committed bytes in a detached worktree + scratch venv — a sibling's unstaged
  hunk can no longer skew the verdict.
• publish.yml now rehearses on TestPyPI + install-smokes the artifact
  before pausing at the pypi approval hold.
• scripts/release_context.py preflights workflow parseability and the
  trunk-CI verdict on HEAD, so a doomed release is refused before any tag.

hook-stats — the intervention-rate headline

• dos-stats leads with what percent of tool calls the kernel touched;
  bundled plugin binaries rebuilt for the new fold
  (go/internal/hook/stats.go, claude-plugin/bin/).

hygiene — the public tree's scratch handling, audited

• Restored the toolathlon durable replay data (replay_all_rows.csv,
  replay_all.json, schema.md) — trailing inline comments on their
  .gitignore negations had silently untracked them, so the public seed
  shipped without them.
• Un-fused the root benchmark/_cc_* pattern from comment prose that had
  made it match nothing since the v0.22.0 seed.
• tests/test_gitignore_hygiene.py pins both failure classes: no pattern
  line carries an internal space, and every literal negation actually
  re-includes its path per git check-ignore.

Also in this tag

• Issue workflow goes mechanical: drafted issue bodies pipe through the leak
  scanner; the dispatch/replan skills capture out-of-scope findings as issues.
• README audience gradient (docs/292 P5–P7): terms defined before use, one
  install default, the build journal split out of the docs index.
• Trae mapped as the advisory-only host with no hook seam (docs/294); plans
  296/297 recorded.