0.52.0

Changed

• aep --help offers four words and a preflight instead of twenty-three verbs. The first level of the command line is now govern, plan, drive, observe and doctor — the four area directories crates/ was divided into in 0.51.0, plus the one verb that belongs to no area — so which command do I want? and which crate decides this? have the same answer.

  Every spelling that worked before still works, and prints the same bytes. The older top-level verbs are hidden top-level aliases: identical standard output, identical standard error, identical exit status, and no notice on either stream. Nothing is deprecated and nothing is scheduled for removal; the aliases are hidden from --help because they are compatibility rather than a choice being offered. aep and protocol both carry the whole change, so invariant 10 holds by construction.

  One exception, and it is clap's rather than a gap in this change: a usage error or --help names the path it was invoked by. Usage: protocol validate and Usage: protocol govern validate are two different lines because they are two different invocations — the Usage: line says how this call was spelled, not what the command decided. Everything below it, and every byte of an accepted call, is identical between the two spellings; only that one line is allowed to differ, and it is expected to.

  was	is
  aep validate	aep govern validate
  aep resolve	aep govern resolve
  aep inspect	aep govern inspect
  aep evaluate	aep govern evaluate
  aep explain	aep govern explain
  aep describe	aep govern describe
  aep schema …	aep govern schema …
  aep workflow {render,instruct,flow}	aep govern workflow {render,instruct,flow}
  aep artifact …	aep plan artifact …
  aep serve	aep plan serve
  aep entity …	aep plan entity …
  aep audit	aep plan audit
  aep workspace …	aep plan workspace …
  aep conformance	aep plan conformance
  aep reverse …	aep plan reverse …
  aep drive {run,status,resume,transition}	unchanged — drive is an area and was already the verb
  aep eval {matrix,run}	aep drive eval {matrix,run}
  aep trace …	aep observe trace …
  aep contract …	aep observe contract …
  aep property …	aep observe property …
  aep specification …	aep observe specification …
  aep evidence …	aep observe evidence …
  aep doctor	unchanged — it reports on the installation, not on any area

  eval is the only verb that changed area rather than gaining a prefix, and aep eval matrix still reaches it.

• The driven shell surface admits both spellings. A driven llm step's Bash grant is one simple protocol plan artifact … or protocol observe trace … invocation, by either spelling. The step maps under drivers/development/ now ask for the grouped one, and a surface that matched on the second word would have refused every call it asked for.

• The step maps, the driver prompts, the guides, the CLI reference, README.md, AGENTS.md and this repository's own tests use the grouped spellings. Recorded transcripts, the metaharness.event/1 fixtures, the trace-specification rows judged against them and the eval case text handed to an agent keep the flat spellings, marked # recorded-under-this-name: a predicate matched against a finished run is a claim about that run's bytes.

Fixed

• aep eval run --stream exits with the verdict it prints. The ingest printed not conformant: the run contradicted 2 expectation(s) … (exit 1) — or undecided: … (exit 3) — and exited 0, so a caller reading the status took a contradicted replay as a replayed transcript, which is what the agentplugins gate did on 2026-09-03. The three codes are now aep trace check's own, read off the same record: 0 conformant, 1 contradicted, 3 undecided. A spawn is unchanged and still exits 0 whenever it launched anything: its last line is a ledger over several runs rather than one verdict, and a paid run whose records were written is not a run that failed to happen.
• aep eval run's preflight reports every fault of the child's PATH, not the first. A stale aep in ~/.local/bin (EVAL-RUN-017) masked a missing ess beside it (EVAL-RUN-018), so an operator with both paid two live round trips to learn about the second. Both are found before anything is spawned and refused together, one line each, each naming what to go and fix (AGENTS.md invariant 3).
• trace evidence's provenance.command is documented as the canonical spelling, and guarded. The record names the tool protocol whichever of the two binaries was invoked, which is what invariant 10 requires of an output — a command that followed the caller's binary would make the same check through the two names produce two different documents, and every committed evidence record would diff against a rerun of the command that wrote it. Nothing in the gate said so and nothing tested it; the contract is now stated at the site, on the evidence page, and asserted by running both binaries and comparing the records they write byte for byte.