brew update && brew upgrade agentops · bash <(curl -fsSL https://raw.githubusercontent.com/boshu2/agentops/main/scripts/install.sh) · checksums · verify provenance

AgentOps v3.2.0

Highlights

AgentOps 3.2 makes verification the front door of the product. ao verify reviews a change with a model from a different family than the one that wrote it, binds the verdict to the provenance ledger, and can install that same pre-push ratchet in any repo; ao done closes work only against such a verdict. The reviewer now runs as a standing multi-model service that reports its true state: failover engages only during an outage and labels its verdicts degraded, a byte-identical rebase reuses its existing verdict (REBOUND) instead of paying for a fresh review, and the opt-in strict quorum reports UNAVAILABLE when a second qualified reviewer family is missing. Reviews also leave a record — ao membrane catch/recall/triage stores what reviewers caught, recalls it by domain, and reports whether the same class keeps recurring. The default CLI build slims to the verification and bookkeeping core: ao rpi and the v1 memory commands are removed, the bd/Dolt tracker is retired in favor of br + bv, and the skill catalog drops from 105 to 63. docs/3.2.md has the full narrative.

Upgrade Notes

Installs upgrade in place: brew upgrade agentops, or re-run the install one-liner for your runtime (README §Install). No data migration.
Removed: the ao rpi command (ADR-0009). Use the operating loop (docs/architecture/operating-loop.md) and the /rpi skill; the CLI engine behind them is gone.
Removed: ao recall and ao memory ingest-claude. For session recall, use the open-source cass / cass-memory tools directly.
Removed: the bd/Dolt tracker lane. br (beads_rust) + bv are canonical, the issue ledger is git-JSONL, and the old bd wrappers and docs were swept.
Changed: the default ao build ships the core command set only. The corpus-flywheel and legacy families (harvest, refinery, mind, turn, harness, operator, curate) now require building with -tags "flywheel legacy"; ao --help groups experimental surfaces separately.
Deprecated: ao inject. Skills and docs now point to ao lookup; the old command still ships in 3.2.
New commands: ao verify, ao done, ao provenance show, ao pawl {up,health,route,metrics}, ao wiki, ao plan-pawl decide.

At a Glance

Product Area	Added	Changed	Refactored	Fixed	Deprecated/Removed
Install, Upgrade, and Distribution	1	3	0	1	0
CLI and Operator Commands	6	2	0	1	3
Skills and Workflows	4	4	0	2	1
Codex and Runtime Integrations	3	2	0	2	0
Knowledge Flywheel, Search, and Memory	3	2	0	1	1
Eval, Validation, and Release Gates	7	3	0	3	0
Docs and Onboarding	2	2	0	1	0
Security, Privacy, and Supply Chain	0	0	0	0	0
Contributor/Internal Refactors	0	0	2	1	0

Product Areas

Install, Upgrade, and Distribution

Added: a core-only install tier. The default ao build carries the verification and bookkeeping commands; corpus-flywheel and legacy commands sit behind the flywheel/legacy build tags.
Changed: the pre-push path holds up under load. Installs are worktree-safe with a self-healing hook chainer and a core.bare repair, concurrent local pushes serialize, and an installed fast-forward hook candidate is preserved instead of clobbered.
Changed: ms-reindex ships with a post-merge hook installer, so the skill-search index updates itself after every merge.
Changed: GitHub Actions checkout bumped from v4 to v7 across workflows.
Fixed: workflow install and drift validation scripts guard the .claude/workflows install path against marker and content drift.

CLI and Operator Commands

Added: ao verify, the verification verb. init installs the portable pre-push verdict ratchet and chain verify in any repo, stats reports what verified-done costs from the ledger (dispositions, refute rate, rounds, wall time, degraded share, repeat reviews), receipts renders a proof page, and a per-repo config file comes with --show-config.
Added: ao done closes an issue only with a verdict reference, behind a warn-first close-rate gate. When the local ledger lags, it reads the one on origin/main.
Added: ao pawl manages the standing reviewer service (up/down/health/route/metrics), and ao pawl review runs a one-shot review that works without configuration on a repo it has never seen.
Added: ao provenance show prints the verdict lineage for a commit or issue; ao provenance mine-session mines session logs incrementally.
Added: ao wiki, a port of OpenKB: init/use/add/remove/recompile/lint/status, gold-wiki compilation from .agents/, and a publish step that is verdict-gated and bound to a content digest.
Added: ao plan-pawl decide (deterministic duel decider), ao governor budget (error-budget burn rate), ao scenario evaluate, ao worktree create, ao beads verify-acceptance, ao rehydrate, and ao skills retire.
Changed: session-continuity commands live under ao session and eval commands under ao eval; the quick-start reaches a first verdict in one command.
Changed: --config is fail-closed. The flag names the config file, and nothing silently falls back to the home directory.
Fixed: gate checks accept --scope range and emit non-empty --json failure detail for landing loops.
Removed: the ao rpi command (ADR-0009); the operating loop and skills carry that role.
Removed: ao recall and ao memory ingest-claude; cass / cass-memory own session recall.
Removed: the dead ao cron compatibility shim. turn, harness, operator, harvest, refinery, mind, and curate moved behind the archive build tags.

Skills and Workflows

Added: a durable 15-skill core partition (spine: true in frontmatter, held by a behavioral gate) that separates the proven product loop from experimental skills.
Added: the ms skill (meta_skill search and load doctrine: consume over MCP, write via CLI), surfaced in session bootstrap and folded into the discovery, plan, and skill-builder decision points.
Added: the plan-pawl duel in planning: /discovery gains --duel/--no-duel/--duel-rounds, pre-mortem gains the duel checklist, and fanout-class plans face a cross-family acceptance gate before any issue is written.
Added: behavior-first-planning and pre-land-refuters skills; dual-pane-atm absorbs the mixed-model duel; account-rotation unifies host-routed account switching.
Changed: the skill catalog consolidated from 105 to 63 — one prune folded 39 sources into 21 targets, a second pass folded six more into their canonical owners — and ao skills retire makes a retirement deterministic through the dispositions ledger.
Changed: six corpus-flywheel skills plus evolve, autodev, and acfs moved to a new experimental tier, and demoted skills no longer carry Codex twins.
Changed: thirteen substrate skills folded down to five via the dispositions ledger.
Changed: all 50 trigger-marker offenders were cleared, a new skill.triggers gate holds the line, and folded-skill redirects are gate-checked for validity.
Fixed: retired bd tracker vocabulary swept to br across the skill corpus and workflows, with a regression gate.
Fixed: skill code fences avoid start-of-line # comments, which the ms normalizer garbles.
Removed: the standalone caam skill (folded into account-rotation) and the other retired slugs recorded in the dispositions ledger.

Codex and Runtime Integrations

Added: task-packet and run-receipt JSON Schemas enforced at runtime. Dispatch validates the packet, executes required_commands, and records the results in the receipt.
Added: dispatch security hardening. Packet-injected auth environment variables are rejected, and dispatch paths are bounded to the working directory and allowed_paths roots.
Added: a Codex image health doctor with per-check timeouts and slow-check reporting.
Changed: Codex twins are generated self-contained from source, ending the hand-mirroring, with a pointer-exemption mechanism, a byte-verify drift gate, and content-divergence gates that now cover SKILL.md bodies and references.
Changed: twin regeneration is scoped to the core skill set, which cut routine regeneration work by about 70%.
Fixed: one shared fail-closed codex-exec runner library now carries the stall and echo defenses for every non-review caller.
Fixed: rebase auto-merge damage in generated Codex manifests is repaired and guarded against.

Knowledge Flywheel, Search, and Memory

Added: review memory. ao membrane catch records what a review panel caught at the verdict chokepoint, ao membrane recall retrieves those catches by domain (--include-catches injects them into prompts), and ao membrane triage reports recurrence on two axes.
Added: the escape loop is proven end-to-end on the shipped binary. A review that wrongly passed compiles into a draft constraint, activating the constraint enforces it at the gate, the derived check loads by domain and cites the original miss, and learned constraints travel to CI and clean clones.
Added: real token accounting. Token counts were hardcoded zeros; they are now captured per issue, ao yield tokens parses Claude and Codex transcripts (deduplicated by response id, erroring on transcripts without usage data), and ao governor budget adds an error budget with a two-sided noise band.
Changed: retrieval gained a gold layer. ao lookup --gold reads the gold wiki compiled from .agents/, --pointers bounds retrieval, and a cold-start exploration floor keeps low-traffic knowledge reachable.
Changed: gold findings are ranked by utility with token-match relevance weighting, so natural-language queries actually surface them.
Fixed: provenance ledger appends serialize under a cross-process lock, so concurrent landings can no longer fork the chain.
Removed: the unproven memory-moat machinery, per the ADR-0004 honesty ruling. The verification layer is untouched.

Eval, Validation, and Release Gates

Added: REBOUND verdicts. A byte-identical rebase re-authorizes through patch-id, lineage, and a green gate rather than a second full review; the portable push-gate and CI both honor it, and a keep-ref lets CI re-verify a reviewed commit that history later orphaned.
Added: an opt-in strict two-family cold quorum that will not fall back — it reports UNAVAILABLE until a second strict-eligible family exists — plus an outage-only cold failover chain whose verdicts carry an explicit degraded label.
Added: an evidence-quality floor for CONFIRMED verdicts (a concrete finding or attestation plus a genuine-run marker) and a live-smoke mode that puts runtime evidence in the review packet.
Added: the verification-membrane eval measures false-done catch rate against deterministic oracles with cross-family verifiers, alongside real false-done trap tasks, escape-harvest tooling, and a local-MLX eval reviewer that matched codex on 100% of eval tasks (the production gate stays on frontier cross-family models).
Added: scenario A/B gained environment-level arm isolation (macOS sandbox-exec), deterministic answer-key grading, a ceiling pre-screen, and absolute task-success judging; ineligible scorecards are rejected outright.
Added: new deterministic gates — the full race suite on every push to main, provenance hash-chain verification, live-doc CLI-snippet resolution, skill references checked across all docs, an unproven-claims lexicon over live docs, a script-preamble ratchet, an ADR-registry check, pinned fail-closed golangci-lint, and a shell-portability gate.
Added: a hardened landing pipeline — a single-writer land lane with a branch submit queue, a deterministic land wrapper, a staged-scope pre-commit guard against cross-lane contamination, and per-item consumed markers in the next-work queue.
Changed: the ship path routes to the Go release authority (ao gate check), and a report-only CI backstop re-verifies tip verdicts.
Changed: review timeouts scale with diff size, and #trivial waivers verify the diff really is provenance-only.
Changed: the standing reviewer service is the default review route, with warm panes across three model families, capability-adaptive routing, self-healing respawn and reroute, and p50/p95 latency plus agreement metrics.
Fixed: the review pipeline records each pane's actual verdict rather than fabricating REFUTED from a timeout, collects every verdict rather than stopping at the first REFUTED, and uses delivery-based sends now that the unreliable engagement gate is gone.
Fixed: cold codex reviews are echo-safe and explain themselves when a backgrounded process is reaped, and a hijack guard refuses to bind a verdict if the worktree HEAD moved mid-review.
Fixed: a macOS portability sweep across the bats suites and release scripts (BSD wc/stat/find/sed differences); the full suite passes on both platforms.

Docs and Onboarding

Added: docs/3.2.md, the release narrative, plus a quick-start that lands a first verdict in one command.
Added: a loop-map doc indexing the five loop framings, and §6 conformance-pattern documentation for workflow authors.
Changed: the root agent docs were reconciled to executable truth, with source-of-truth precedence stated inline and stale tracker and hook-era wording swept.
Changed: README claims now cite evidence docs, and unproven-claim language is mechanically banned from live docs by a gate.
Fixed: a doc-lifecycle sweep deleted byte-duplicate files, renumbered a duplicate ADR, repaired broken architecture links, and removed a career-page leak.
Docs: corrected the ms CLI search documentation — upstream hybrid search is BM25-only, so the docs no longer describe a semantic mode that does not exist.

Security, Privacy, and Supply Chain

Security: tar extraction gained explicit containment — absolute paths rejected, a canonical path-inside assertion, and typed rejections.
Security: a fail-closed pre-push guard scans the full tree for private artifacts, and ao corpus scan detects deny-listed and PII content before it ships.
Security: working-directory-relative script execution routes through a trust chokepoint, and Codex dispatch rejects packet-injected auth environment variables.
Security: the provenance ledger is tamper-evident. Hash-chain verification runs as a local gate before every push, and appends serialize under a cross-process lock.
Security: JSONL storage helpers moved to a loud-failure buffer policy with fsync-safe atomic writes, including a parent-directory fsync after rename.

Contributor/Internal Refactors

Refactored: the retired rpi orchestration engine was dismantled. Its live helpers moved to internal/worktree, internal/runtimecmd, and internal/rpi; the dead engine surfaces were deleted.
Refactored: atomic file writes converge on storage.AtomicWriteFile; the quest, llmwiki, doctor, and wiki writers all delegate to it.
Fixed: test-isolation hardening across cli/cmd/ao — cobra flag and writer state restored via t.Cleanup, tmux socket isolation, deterministic process-group tests, and a trustworthy cmd/ao test floor with the gate blind spot that had shipped it red now closed.

Known Issues

The full-tier local gate (ao gate check --full) is green at the tree level: 105 of 108 checks pass on the release tip, and the three failures are local to the primary development machine (an attached-worktree pile-up, a stale local citation backlog, and local corpus defrag staleness). All three pass on a fresh clone. The tree-level failures found during release prep — Go lint, skill heal, and the flywheel proof with its roll-up gate — were fixed in this release, and the push-path gate set is green.
The Gemini/AGY install one-liner fails right now. scripts/install-agy.sh runs images/gemini/verify.sh as a hard gate, and that bundle predates the skill consolidation (44 bundled skills against a hardcoded 65-slug list that names retired skills), so the installer aborts before agy plugin install. Workaround: pin the last good bundle with install-agy.sh --ref v3.1.0. The Claude (marketplace) and Codex (curl) paths install from the live tree and pass the 45-check install smoke. images/claude/verify.sh has the same staleness in its manifest. A bundle refresh is queued for the first 3.2.x patch.
One historical commit on main (5b064b2) carries a wrong author email from a lane that predated the identity fix. The effect is cosmetic — GitHub misattributes that single commit — and we accepted it rather than rewriting released history.
A cold cross-family review cannot verdict a diff whose git show output exceeds roughly 65KB, which mostly means deletion-heavy commits. The warm service handles larger diffs; for the rest, split the removal into smaller commits.
The strict two-family cold quorum reports UNAVAILABLE until a second reviewer family qualifies for strict mode; Gemini remains benched for strict validation.

Full changelog

AgentOps 3.2 is the verification-keystone minor: the cross-family review loop became the product's front door. ao verify is the canonical verb over the pawl engine (with init making the pre-push verdict ratchet portable to any repo, stats pricing the cost of verified-done, and receipts rendering the proof), ao done makes bead closes verdict-referenced, and the reviewer hardened into a standing multi-model service with honest degradation — outage-only failover, REBOUND re-authorization for byte-identical rebases, and an opt-in strict two-family quorum that reports honest-UNAVAILABLE rather than fake redundancy. The membrane gained memory (ao membrane catch/recall/triage) and its escape→derived-check loop is proven end-to-end on the shipped binary, including constraint travel to CI. Around that core the CLI shed the cathedral: the default build is the verification + bookkeeping spine (corpus-flywheel and legacy families behind -tags "flywheel legacy", ADR-0012), the ao rpi surface and v1 memory experiment are removed, the bd/Dolt tracker is retired for br+bv, and the skill catalog consolidated 105→63. See docs/3.2.md for the release narrative.

Added

ao verify — the verification front door (age-wedge-all-in-dyr0, age-rk3r): ao verify reviews a change and binds the verdict to the provenance ledger; ao verify init installs the portable pre-push verdict ratchet + chain verify in any repo; ao verify stats reports dispositions, refute rate, rounds, duration, degraded share, and re-review waste from the ledger; ao verify receipts renders the proof page from the embedded bundle; per-repo config file + --show-config.
ao done — verdict-referenced bead close with a warn-first close-rate gate, falling back to the origin/main ledger when the local one lags (age-wedge-all-in-dyr0.4, age-lw4c); ao provenance show (per-SHA/bead verdict lineage) and ao provenance mine-session.
Standing pawl service (age-standing-pawl-service-ml8): ao pawl up/down/health/route/metrics with warm tri-model panes (Claude + Codex + AGY), capability-adaptive routing, self-healing respawn/reroute, p50/p95 + agreement SLOs; ao pawl review runs zero-config on a stranger's repo (age-a9iv).
Verdict-integrity layers (age-rk3r): REBOUND patch-id verdicts authorize byte-identical rebases without a re-review (honored by the portable push-gate and CI with Go-side lineage+proof re-validation, plus a keep-ref so CI can re-verify an orphaned reviewed commit); opt-in strict two-family cold quorum that refuses to degrade (honest-UNAVAILABLE); outage-only cold reviewer failover chain with explicit degraded labels; evidence-quality floor for CONFIRMED; live-smoke verify mode; provenance v1.1 verdict-edge enrichment (reviewer_family, degraded, rounds, duration_s, evidence_path).
Membrane memory (age-zpj5, age-membrane-memory-arch-tz2s): ao membrane catch records panel catches (class key + affected paths), ao membrane recall --include-catches retrieves them by domain into prompts, ao membrane triage reports honest two-axis recurrence; the escape→derived-check loop is proven end-to-end on the shipped binary (scripts/em-loop-donetest.sh) with learned constraints traveling to CI and clean clones.
ao wiki — the OpenKB port (age-port-openkb-into-agentops-go-5qw): init/use/add/remove/recompile/lint/status, gold-wiki compilation from .agents/ with sanitize+mine, and verdict-gated publish bound to a content digest; retrieval integration via ao lookup --gold and --pointers bounded retrieval with a cold-start ε-exploration floor.
Plan-pawl duel (age-plan-pawl-9yib): ao plan-pawl decide deterministic duel decider; /discovery gains --duel/--no-duel/--duel-rounds; pre-mortem gains the duel checklist; ApprovalEdge records two judge panes.
Real token accounting + governor: per-bead token capture kills the hardcoded zeros, ao yield tokens parses Claude and Codex transcripts (deduped by response id, loud on absent usage), and ao governor budget adds an SPC error-budget with a two-sided noise band (age-membrane-memory-arch-tz2s.3, .7).
Gate wave (age-gate-the-ungated-egwt, age-push-equals-ci-0ua): full -race suite on push-to-main, provenance hash-chain gate at the pre-push boundary, docs.cli-snippets (live docs resolve against the cobra tree), docs.skill-refs --all-docs, docs.demoted-claims honesty lexicon, script-preamble ratchet, ADR-registry check, fail-closed pinned golangci-lint, static shell-portability gate, jsonl-scanner ratchet, and a report-only CI verdict backstop (age-wedge-all-in-dyr0.9).
Land pipeline (agentops-2pl, age-genn, age-qeqv, age-tkxq): single-writer land lane with branch submit queue and default-deny gh shim, deterministic land wrapper, staged-scope pre-commit guard against concurrent-lane contamination, first-class per-item consumed markers in next-work.
Eval instruments (age-cwo, age-7q7d, age-kf-s1-close-loop-0ly): verification-membrane eval (false-done catch rate over deterministic oracles + cross-family verifiers), real-false-done trap tasks, escape-harvest tooling, measured local-MLX eval membrane (100% per-task concordance vs codex; eval-path only), scenario-ab environment-level arm isolation (macOS sandbox-exec), deterministic answer-key grading, ceiling pre-screen, absolute task-success judging.
Codex runtime hardening (ag-p273x, ag-codex-runtime-enhancement-o0nds): task-packet and run-receipt JSON Schemas enforced at runtime, required_commands executed and recorded, dispatch paths bounded to cwd/allowed_paths, packet-injected auth env rejected, dispatch receipts, image health doctor with per-check timeouts.
ms integration: the ms skill (meta_skill search/load doctrine), session-bootstrap surfacing, ms-reindex wrapper + post-merge hook installer, and "ms search first" folded into discovery/plan/skill-builder (age-l6y3, age-22g0, age-50pr).
15-skill spine partition: spine: true frontmatter with a behavioral GOALS gate, plus flywheel/legacy archive build tags — the default ao build omits archived families (age-focus-membrane-bookkeeper-m1wg.12/.23, ADR-0012).

Changed

The ship path routes to the Go release authority — ao gate check is the default gate on the ship path (age-fkps), #trivial waivers verify the diff is genuinely provenance-only (age-u43w), and non-trivial commits hidden behind a #trivial tip are gated individually (age-8ais).
The default pawl routes through the standing service when it is up, with size-scaled review timeouts for large read-files packets (age-standing-pawl-service-ml8.7, age-wedge-all-in-dyr0.11).
Skill catalog consolidated hard: the corpus prune folded 39 sources into 21 targets (105→65, ag-s43tg), then 70→63 with six skills folded into canonical owners (#889); six corpus-flywheel skills plus evolve/autodev/acfs demoted to a new experimental tier; substrate skills folded 13→5; ao skills retire makes retirement deterministic via the dispositions ledger; all 50 trigger-marker offenders cleared behind a new skill.triggers gate.
Codex twins are generated self-contained from source with pointer exemptions, a byte-verify drift gate, and content-divergence gates extended to SKILL.md bodies and references; twin regeneration scoped to the spine set (~70% regen cut) (age-8wm, age-codex-twin-generator-qlj, age-k2ag, age-focus-membrane-bookkeeper-m1wg.18).
CLI consolidation: session-continuity commands under ao session, eval-family commands under ao eval, an experimental help group for corpus/flywheel surfaces, and a quick-start that lands the first verdict in one command (age-focus-membrane-bookkeeper-m1wg.16/.17, age-h4y3, age-wedge-all-in-dyr0.5).
Storage discipline: canonical storage.AtomicWriteFile (quest/llmwiki/doctor/wiki delegate), exported JSONL helpers with a loud-failure buffer policy, fsync-safe atomic writes + parent-dir fsync, and tar extraction containment (age-3azc, age-uja6, age-storage-hardening-roxg, age-y9jy).
Out-of-session substrate wording reconciled (Wave F). Live multi-agent orchestration is documented as NTM/ATM + Agent Mail; Gas City remains an optional reference SDK, not the default operator substrate. Historical 3.0.0 CHANGELOG entries that name Gas City as primary orchestration are superseded by this note for current doctrine — see docs/3.0.md and docs/architecture/codebase-overview.md.
Doc-debt reconciliation waves A–F (2026-06-16): cli/AGENTS.md br pointer stub + cli.agents-tracker drift gate; RPI terminology glossary; ports-and-adapters.md + BC5 + hookless framing with a docs.architecture-drift gate; worktree disposition audit (dry-run); skill-probe-i0.sh + check-provenance-orphans.sh registered in the Go gate registry; skill-disposition triage checklist.
Root agent docs reconciled to executable truth (age-2d8m) — source-of-truth precedence stated inline; stale hook-era/bd wording swept; README claims PMF-linted with evidence citations (age-ejk).

Fixed

Pawl truthfulness arc: each pane's ACTUAL verdict is recorded (no fabricated REFUTED from timeouts), all verdicts are collected (no first-REFUTE guillotine), cc/agy sends are delivery-based (the unreliable atm-wait engagement gate removed), cold codex reviews are echo-safe with a hardened shared codex-exec runner, a hijack guard refuses verdict binds when the worktree HEAD moved mid-review, and backgrounding-reap failures self-explain (age-pawl-good-bar, age-55qz.10/.11, age-sylz, age-wjp0, age-gate-the-ungated-egwt.8/.13).
Full-tier gate reds greened (age-hl9q): the flywheel proof builds its sandbox ao with the ADR-0012 archive tags (PROOF_BUILD_TAGS), heal.sh --strict resolves skill CLI references against the full command surface via the shared snippet resolver (third instance of the archived-command escape class), and computeVerifyStats was split under the gocyclo budget.
macOS portability sweep: bats suites and release scripts fixed for BSD wc/stat/find/sed/touch divergences; a static shell-portability gate guards regressions (age-qzvm, age-lz4b, age-m9rf, age-jtz0, age-i0ky, age-7jm6).
Test isolation hardening in cli/cmd/ao: cobra flag/writer state restored via t.Cleanup, tmux socket isolation, deterministic process-group tests, os.Setenv ratchet, and the trustworthy cmd/ao test floor restored with the gate blindness that shipped it red closed.
Regen determinism: registry.json drops wall-clock generated_at (age-9itj), the skill catalog regen folded into regen-all/regen-check (age-biop), and the catalog/registry inventory surfaces agree at 64 skills (age-61ci).
Provenance integrity: strict bead-id extraction kills false edges from prose, post-land emit is race-proof via disposable worktrees, merge_sha is trunk-bound, and ledger appends serialize under a cross-process lock.

Removed

The ao rpi command surface — ADR-0009 executed; the operating loop + process skills are the navigation path, and the engine's live helpers were extracted to internal/worktree, internal/runtimecmd, and internal/rpi (age-tlj6, age-3pdt).
ao recall and ao memory ingest-claude — the v1 unified-memory experiment retired; recall is consumed from the coexisting open-source tools (cass / cass-memory) rather than rebuilt in-tree (age-5nvy, age-7grl).
The bd/Dolt tracker lane — br (beads_rust) + bv are canonical over a git-JSONL ledger; bd wrappers, docs, and workflow references swept with regression gates (ag-joto6, age-m44f, age-u1u6).
Archived command families — turn, harness, operator, harvest, refinery, mind, and curate moved behind the flywheel/legacy build tags; the dead ao cron compat shim deleted (age-focus-membrane-bookkeeper-m1wg.13/.14/.15).
The unproven memory-moat machinery — retired per ADR-0004 honesty; the membrane stays, the moat claims went (age-7grl).

Security

tar extraction containment (IsAbs reject, canonical path-inside assertion, typed rejects); fail-closed full-tree pre-push path guard for private artifacts; ao corpus scan deny/PII leak detector; cwd-relative script execution routed through the aoBinaryInside trust chokepoint; Codex dispatch rejects packet-injected auth env; the SDLC provenance ledger is tamper-evident with hash-chain verification at the pre-push boundary (age-storage-hardening-roxg.2, ag-ao0eo, ag-b0x50, age-gate-the-ungated-egwt.2/.9).

Full Changelog: v3.1.0...v3.2.0

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

v3.2.0

Choose a tag to compare

Sorry, something went wrong.