0.55.0

Added

• Pinned public Gates security and privacy checks, signed local evidence and
  coordinated hooks. Bot delivery no longer requires an Atlas checkout.

• Optional ess_conformance_coverage_v1 evidence admits exact original suite/5
  lineage and complete selected coverage. Its separate opt-in profile requires
  independent task, model, suite, selection, producer and freshness expectations;
  incomplete, empty or unknown coverage cannot satisfy completion requirements.
  Typed input, driver replay, inspection and planning preserve the original bytes.

• Optional paired ess-conformance-report/2 and suite readers preserve exact counts,
  original source bytes and completion time. Evidence is re-admitted before recording
  or restoring it. The opt-in adp-ess-conformance/1 protocol and
  development.ess-conformance-v2 profile require independent task expectations;
  count-stage coverage remains unknown and cannot satisfy complete conformance.

• Planning --from accepts report version 2 with its original suite through
  --suite; evidence inspection exposes exact count values. Invalid pairs refuse
  before storage changes.

Changed

• Concrete model driving, native execution hooks and live evaluation move to
  metaharness aep drive. AEP exposes its neutral CLI library and retains command/operator
  driving, governance, run storage and offline evaluation. Model-backed invocations through
  AEP refuse before allocating a run and name the replacement command.
• Pin Entity Runtime and the documentation build package to verified source revisions.
  Entity Runtime's stricter replay validation refuses imported AEP audit events without
  an emitting kernel definition; persisted AEP state and audit records remain available.
• Direct evidence recording returns a checked result and takes an explicit reading
  instant so malformed or stale source evidence is refused before mutation.
• Source releases retain correctness and artifact checks while documentation publication
  proceeds independently.

Fixed

• Execution hosts can name the runnable resume command in refusal messages, so callers are
  directed to the host that can actually resume the run.

This source release was published without running gates, tests or binary packaging.

AEP 0.54.0

• govern workflow render --format mermaid writes a diagram a Markdown document renders
  itself. The other three formats are assets: a reader needs a viewer, and a repository that wants
  the figure beside its prose commits a binary and has to remember to regenerate it. So a README
  explaining a workflow got a diagram somebody typed, which is true on the day it is typed — the
  org-brain instance had one whose arrows were the order the states were written in rather than the
  transitions, and which carried no guard at all. The Mermaid output carries the guard on each
  arrow, which states are terminal, and the requires of each state as a note, and it is text, so
  the command that wrote it can be run again in a gate.

• govern workflow instruct --map <step-map> also says what runs in each state. A workflow
  declares what may happen and never what does; the step map is the other half, separate because one
  workflow governs instances whose programs differ. Read alone the instructions were honest and not
  actionable — a reader of a state learned the rule it must satisfy and not that a program called
  brain ledger acquire is what satisfies it. With a map each state names its steps in the author's
  order, marked command, llm or operator. A map covering a state with no steps says the driver
  runs nothing there; a map silent about a state says nothing, because those are different facts.
  --map needs --id: one map is written against one workflow, and applying it across a directory
  would render some documents saying what runs and some not, with nothing saying which.

  The step map crosses into aep-render as steps::StepsView, a plain struct the caller builds —
  the seam run::RunView already uses, which is what keeps aep-domain that crate's only
  dependency.

• A refused drive resume names a route that exists. It advised --restart, which no drive verb
  parses, so a reader who followed it got a second refusal — a bare usage error that reads as their
  own mistake rather than the message's. It now names drive run, and a test walks the whole
  command tree to hold every flag the refusal names to a flag some verb accepts.

0.53.0

Added

• aep plan artifact unrelate <id> <relation> <target> takes an edge back. relate had no opposite, so an edge asserted in error was permanent: 9da4f51c#495 found a stale depends_on from phase 1 to phase 0 and left it in the store because there was nothing to type. Both of relate's spellings work — three positionals, or <relation>:<target> split at the first colon — which is the same one spelling for an edge, now in both directions. The flat aep artifact unrelate and the protocol alias reach the same leaf, byte for byte.

  Exactly the edge named goes. The markdown backend's rule has always been that frontmatter is added to and not rewritten, because rewriting it from the contract's view would delete every edge somebody wrote into a document by hand; a removal therefore takes out the one (relation, target) pair on the one artifact and leaves the rest of the relations: list alone.

  An edge that is not there is refused, naming the ones that are, and the refusal writes nothing — not the document, not the journal. The journal gains an unrelated change of its own rather than recording the write as a body replacement, so history reads no longer <relation> <target> and the earlier related entry stays exactly where it was.

Fixed

• relate making an edge that had been taken back is no longer a silent replay. The idempotency key was derived from the edge alone, so a store that keeps applied commands — SQLite and Postgres do, markdown does not — recognised the second relate story:x depends_on story:y as the first one being retried and wrote nothing. Unreachable until unrelate existed, and reachable the moment it did. The key now names the attempt as well as the edge, which is what move, body and evidence already did.

0.52.0

Changed

• aep --help offers four words and a preflight instead of twenty-three verbs. The first level of the command line is now govern, plan, drive, observe and doctor — the four area directories crates/ was divided into in 0.51.0, plus the one verb that belongs to no area — so which command do I want? and which crate decides this? have the same answer.

  Every spelling that worked before still works, and prints the same bytes. The older top-level verbs are hidden top-level aliases: identical standard output, identical standard error, identical exit status, and no notice on either stream. Nothing is deprecated and nothing is scheduled for removal; the aliases are hidden from --help because they are compatibility rather than a choice being offered. aep and protocol both carry the whole change, so invariant 10 holds by construction.

  One exception, and it is clap's rather than a gap in this change: a usage error or --help names the path it was invoked by. Usage: protocol validate and Usage: protocol govern validate are two different lines because they are two different invocations — the Usage: line says how this call was spelled, not what the command decided. Everything below it, and every byte of an accepted call, is identical between the two spellings; only that one line is allowed to differ, and it is expected to.

  was	is
  aep validate	aep govern validate
  aep resolve	aep govern resolve
  aep inspect	aep govern inspect
  aep evaluate	aep govern evaluate
  aep explain	aep govern explain
  aep describe	aep govern describe
  aep schema …	aep govern schema …
  aep workflow {render,instruct,flow}	aep govern workflow {render,instruct,flow}
  aep artifact …	aep plan artifact …
  aep serve	aep plan serve
  aep entity …	aep plan entity …
  aep audit	aep plan audit
  aep workspace …	aep plan workspace …
  aep conformance	aep plan conformance
  aep reverse …	aep plan reverse …
  aep drive {run,status,resume,transition}	unchanged — drive is an area and was already the verb
  aep eval {matrix,run}	aep drive eval {matrix,run}
  aep trace …	aep observe trace …
  aep contract …	aep observe contract …
  aep property …	aep observe property …
  aep specification …	aep observe specification …
  aep evidence …	aep observe evidence …
  aep doctor	unchanged — it reports on the installation, not on any area

  eval is the only verb that changed area rather than gaining a prefix, and aep eval matrix still reaches it.

• The driven shell surface admits both spellings. A driven llm step's Bash grant is one simple protocol plan artifact … or protocol observe trace … invocation, by either spelling. The step maps under drivers/development/ now ask for the grouped one, and a surface that matched on the second word would have refused every call it asked for.

• The step maps, the driver prompts, the guides, the CLI reference, README.md, AGENTS.md and this repository's own tests use the grouped spellings. Recorded transcripts, the metaharness.event/1 fixtures, the trace-specification rows judged against them and the eval case text handed to an agent keep the flat spellings, marked # recorded-under-this-name: a predicate matched against a finished run is a claim about that run's bytes.

Fixed

• aep eval run --stream exits with the verdict it prints. The ingest printed not conformant: the run contradicted 2 expectation(s) … (exit 1) — or undecided: … (exit 3) — and exited 0, so a caller reading the status took a contradicted replay as a replayed transcript, which is what the agentplugins gate did on 2026-09-03. The three codes are now aep trace check's own, read off the same record: 0 conformant, 1 contradicted, 3 undecided. A spawn is unchanged and still exits 0 whenever it launched anything: its last line is a ledger over several runs rather than one verdict, and a paid run whose records were written is not a run that failed to happen.
• aep eval run's preflight reports every fault of the child's PATH, not the first. A stale aep in ~/.local/bin (EVAL-RUN-017) masked a missing ess beside it (EVAL-RUN-018), so an operator with both paid two live round trips to learn about the second. Both are found before anything is spawned and refused together, one line each, each naming what to go and fix (AGENTS.md invariant 3).
• trace evidence's provenance.command is documented as the canonical spelling, and guarded. The record names the tool protocol whichever of the two binaries was invoked, which is what invariant 10 requires of an output — a command that followed the caller's binary would make the same check through the two names produce two different documents, and every committed evidence record would diff against a rerun of the command that wrote it. Nothing in the gate said so and nothing tested it; the contract is now stated at the site, on the evidence page, and asserted by running both binaries and comparing the records they write byte for byte.

0.51.0

Changed

• The crates moved under area directories. crates/<area>/<crate>, where the area is one of govern, plan, drive, observe, profile and edge, instead of twenty-two directories flat under crates/. The directory now states what a crate is for and what it may depend on (AGENTS.md § Areas). No crate and no binary was renamed: every [package] name is what it was, aep and protocol remain the two names of the one command, and nothing a consumer pins by name changes. Only paths moved — the workspace member list, the [workspace.dependencies] paths, and the references that named a file by its old path.

• Three crates are named after the protocol. adp-domain is now aep-profile-development, aop-domain is aep-profile-operations, and protocol-cli — which built the aep command under the retired command's name — is aep-cli. The two profile crates are vocabulary over aep/1, not sibling products, and their old three-letter names said otherwise. The binaries are unchanged: aep and protocol are still the two names of the one command, built by the renamed crate, and still byte-equivalent (AGENTS.md invariant 10). The protocol ids are unchanged: adp/1, aop/1 and the workflow id adp/default are wire ids, not crate names. cargo install --path crates/edge/protocol-cli becomes cargo install --path crates/edge/aep-cli, and cargo build -p protocol-cli becomes cargo build -p aep-cli.

• This repository names the renamed agent plugins. agentplugins@a2077d2 renamed them by product and verb, and every reference here follows:

  was	is
  plugin aep-planning	plugin aep-plan
  plugin adp	plugin aep-drive
  plugin ess-schema	plugin ess-specify, whose skill is specify
  aep-planning:{planning,story-migration}	aep-plan:{planning,story-migration}
  aep-planning:{decomposer,plan-reviewer,reverse-engineer,plan-critic-*}	aep-plan:…
  adp:{drive,wave}, adp:{implementor,adversary,story-scoper}	aep-drive:…
  ess-schema:ess-schema	ess-specify:specify

  The wire ids are not plugin names and do not change: adp/1, aop/1 and the workflow id adp/default are what they were.

• EVAL-RUN-018 fires on either spelling of the ESS plugin. The ess-on-PATH preflight was keyed on ess-schema: alone, so a case whose subject.skills named the renamed ess-specify:specify sailed past it and a labelled live run would spawn and pay on a runner with no ess — its step drafted by hand and never validated. Both prefixes are accepted, for one release, so a case written or recorded under either name still refuses; the refusal names both.

• The recordings keep their recorded ids, and say so. A committed transcript is evidence and is not rewritten, so every expectation row and task statement judged against one keeps the id the run was actually offered, marked # recorded-under-this-name: conformance/trace/expectations.{trace,driven-step}.trace.yaml, conformance/eval/{decomposer,plan-reviewer}-charter/{case.yaml,expectations.trace.yaml}, crates/observe/trace-spec/tests/{adapter.rs,event_stream.rs} and src/check.rs. One more coordinate is kept deliberately old: beyond10x/agentplugins@aep-planning@0.4.0 in crates/edge/aep-cli/tests/eval_run.rs is a released pin, and that release really is named that.

• The console blocks in Check a transcript are regenerated from the commands above them, and a test now holds them there: the page quoted a transcript digest, a spec digest and a row count from a run predating three changes to the tree, while telling the reader it was quoting what the command printed. Its declared expectation count follows the specification's own forty-three.

• A conformance/eval case may declare subject.skills. The corpus reader denied it as an unknown field, so the one block aep eval run's EVAL-RUN-018 preflight keys on could not be written in a case at all; the block is accepted and closed, so a typo inside it is still refused. A live artifact's scope: is now also checked for an area-qualified path naming a crate this tree does not have, not only for a pre-move spelling.

0.50.0

Added

• A lifecycle for executable-system-specification. draft → validated → conforming, with superseded and archived beside them. conforming costs one ess_conformance record, so a specification is conforming because a suite ran and its report says so, never because somebody moved it there.
• model_digest on a specification artifact, written by aep artifact set --model-digest. It ties a conformance report to the exact model the suite ran against. Only a kind ArtifactKind::carries_model_digest names may carry one; on any other kind the key is refused by name rather than kept as text a reader would take for a guarantee.
• cargo xtask release checks that the tag's commit is on origin/main — a sixth step beside the five it already ran. See Fixed.

Fixed

• A model digest survives the round trip through an instance. aep artifact set --model-digest printed model_digest set (revision 2) and left the document at revision 1 with no digest: instance_of did not carry the field, so the value was applied to a document and dropped on the way back out to the store. Anyone who ran the command against 0.48.0 has a specification with no digest on it and was told otherwise.
• A release could be tagged on a branch that never reached main. Every check cargo xtask release ran was computed from HEAD, so a tag on a feature branch satisfied all five and reported the release complete. 0.48.0 was cut that way, and 0.49.0 was then cut from a main that had never seen it — the newer version shipping without the lifecycle the older one added. 0.50.0 carries both, and the new check refuses the shape that caused it.
• Rewrite the Design principles stale-approval example around the fields AEP actually checks: the review's subject identifies the design, while reviewed_version identifies the version Ada saw.

Note on 0.48.0

0.48.0 is a published tag whose commit is not on main. Its content — the lifecycle and model_digest above — reaches the released line here, with the round-trip defect fixed. Nothing needs 0.48.0; the tag is left in place rather than deleted.

0.49.0

Fixed

• The git identity is read where the run happened, not where the runner was typed. 0.47.0 read user.name at this process's working directory. A git identity is per repository: the runner's own checkout can carry a bot override while the fixture the session committed in carries the operator's real name, and reading only the first scrubbed the bot and left the person — silently, because a redaction that removed something looks exactly like one that removed the right thing. Both callers now read every directory that could hold one: eval run its own --cwd, and trace redact the transcript's directory, each beside the process's own.
• A one-word git user.name is no longer taken on trust. $USER is a login name the system constrains; user.name is free text, and in a container it is routinely root, CI or Bot. Replacing one of those everywhere would rewrite root cause to <user> cause and digest the result into a manifest — corrupting a stream to hide a name that identifies nobody. A single token is removed only from eight characters up; an address or anything with a space always is.
• An operator named user no longer breaks idempotence. < and > are both outside [A-Za-z0-9_], so the <user> placeholder was a word-bounded match for the name user and a second pass produced <<user>> — on exactly the second pass trace redact exists to perform.

Changed

• Redaction is its own module. Operator, redacted and replace_word moved out of eval.rs into redaction.rs, beside money.rs and for the same reason: one value read once and applied at two unrelated boundaries. trace.rs called into eval.rs for it while eval.rs already called into trace.rs for load_spec, so two verb families whose module docs both say they share no state with the rest of the binary had a cycle between them.

AEP 0.48.0

This tag is not on main. It was cut on a feature branch that was never merged, so 0.49.0 — released after it, from main — does not contain anything below. Everything here reaches the released line in 0.50.0, together with a fix for a defect this release shipped: aep artifact set --model-digest reported success and wrote nothing. Use 0.50.0 or later. The tag is left in place rather than deleted.

---

Added

• A lifecycle for executable-system-specification. The kind existed and had no ladder, which
  the engine reads as every status is legal and so is every move — the one kind whose purpose is
  to be held to a generated suite was the one kind nothing held to anything. It now walks
  draft -> validated -> conforming -> superseded -> archived, and conforming costs one
  ess_conformance record so it cannot be asserted into.
• model_digest on a planning artifact, written by aep artifact set --model-digest <hex>.
  ess-conformance already bound a run to the specification revision — a report counts only where
  its spec_digest is the digest the specification records — and the field it reads had nowhere to
  be written, so the requirement failed closed for every adopter and conforming was unreachable.
  Accepted only on a kind that carries a compiled model; refused on any other, by the CLI and by
  the frontmatter validator both, because a write the validator then rejects leaves a document the
  store cannot read.

0.47.0

Fixed

• --redact now removes the operator's git identity too. It read $HOME, $USER and $LOGNAME, which is not what a stream carries when a recorded run commits inside its own fixture: git log prints an author, and that is a person's real name and their address. The golden-path recording of 2026-09-03 went to disk redacted and still carried the operator's name four times — twice as a commit author, twice as an argument the agent had read out of git config and typed back. user.name and user.email are now read the way the child would read them, and a machine with no git, or a directory that is not a repository, has nothing to remove and is left alone.

Added

• protocol trace redact --transcript <path> [--out <path>] applies that same removal to a stream already on disk. It is idempotent, which is the point of having it: a stream an older --redact wrote is missing only what that build did not know to remove. It does not re-digest anything — a manifest's transcript_digest names the bytes its run wrote, and a verb that rewrote both would leave a manifest attesting a file nobody can check against the run.

0.46.0

Fixed

• A run whose session wrote two terminal records is no longer charged twice. aep eval run totalled total_cost_usd, usage and duration_ms over every session.ended in a stream. That is right across the sessions of a driven run, where each states its own spend, and wrong within one session: --max-budget-usd stops a session after it has written its result, so the stream carries a second terminal record saying error_max_budget_usd, and both restate the same running counters. A golden-path recording on 2026-09-03 reported cost_micro_usd: 30002816 for a session that spent $15.00140784, and the manifest's cost row read a $15 run as a $30 one against its $15 cap. The fold is now per session — the largest figure any of that session's terminal records stated, summed across sessions. The largest and not the last, because the stopping record restates the cost and zeroes its usage.

Changed

• Reworked the Design principles guide into a failure-first, runnable walkthrough that maps the passkey example to AEP's validation, evidence, capability, approval, command, driver, ESS adapter, and compatibility boundaries.