v3.7.0

brew update && brew upgrade agentops · cd ~/.local/share/agentops && git pull --ff-only && ao skills link · checksums · verify provenance

---

Highlights

AgentOps 3.7 makes native coding the default. Give your coding agent accepted behavior and repository checks, implement the change, and have a fresh context judge the exact result. No AgentOps skill, session bootstrap, hook or orchestration service is required. The optional menu has 34 skills, down from the 52 shipped in 3.6.0, with clearer owners for engineering, memory, review and runtime tasks.

The CLI adds recovery repairs and exact-content evidence helpers. Optional context-budget delegation lets Claude Haiku or Codex Luna read large files and write individual targets while the parent receives compact findings or receipts. Separate opt-in read guards block oversized unbounded reads. This release also removes published command, skill and scripted workflow entry points; the migration guidance below is part of the upgrade.

Upgrade Notes

• Update explicit uses of the retired skills using the migration table. The 34-skill menu is optional; ordinary native work needs no replacement skill invocation. learn moves to memory, swarm to agent-native, codebase-recon to research, and bootstrap / handoff to doc.
• Replace ao eval and ao redact automation before updating the binary. Use your repository's evaluator and the owner's disclosure-review process. Generic ao provenance can retain factual evidence but does not run either retired service.
• Replace workflows/rpi.js calls with native execution or an explicitly selected RPI skill invocation. The scripted retry machinery has been removed. Trackers, Git, scheduling and delivery remain under their existing owners.
• Update managed plugins through their runtime. For source links, update the canonical checkout, inspect retired names, and relink the surviving skills you selected. ao skills link --skill NAME can be repeated; without selectors it links the full menu. It does not remove foreign entries or uninstall previously selected skills.
• Codex role resources ship in the skill bundle, but installing the plugin alone does not register them. From a checkout, run bash scripts/install-codex-context-agents.sh for personal configuration or add --project, then restart Codex. See Codex installation for prerequisites and separate hook setup.
• Read-budget guards remain disabled until explicitly installed. The Claude and Codex installers preserve existing settings and backups. Codex hook definitions still need review/trust in its native hook manager; linked-worktree hook installation has documented restrictions.
• Preserve existing .agents/ evidence. New CDLC proof uses a caller-selected protected external non-Git destination. A missing route is a failure, not permission to fall back to repository storage. ao init remains an optional local setup command and is not required for native work.
• Builds use the Go 1.27.1 toolchain; cli/go.mod retains a Go 1.26.0 language floor. Older installations download the selected toolchain or fail according to GOTOOLCHAIN. CI and maintained Python checks use Python 3.14.

Breaking Changes

• The entire published ao eval family and ao redact are removed. Invocations fail as unknown commands with migration pointers.
• workflows/rpi.js and its scripted control machinery are removed. AgentOps no longer provides that aggregate retry controller.
• Twenty skill roots present in 3.6.0 are removed: anti-ceremony, automation-shape-routing, bootstrap, codebase-recon, converter, fitness, goals, handoff, learn, operationalize, pattern-mining, product, scaffold, scope, shared, standards, status, swarm, toil-mining and workflow-builder. Surviving owners cover useful retained behavior; the old names are not aliases. memory and skill-eval are the two new roots relative to 3.6.0.
• The default workflow no longer performs mandatory RPI, recall, bootstrap or learning stages. Callers that need those selected behaviors must request them explicitly. Acceptance, exact content and fresh independent judgment remain the completion bar.

At a Glance

Area	What changes for the user
Native work	Zero mandatory skills; optional guidance when a task needs it.
Skills	34 current roots with explicit migration from the 52-root 3.6.0 bundle.
CLI	Recovery repairs, external context routing and exact-content evidence helpers.
Context use	Optional Claude/Codex readers, writers and separately installed read guards.
Validation	Fresh author-distinct judgment; structural and runtime checks report their actual scope.
Ownership	The caller's tracker, Git, runtime, memory destination and delivery policy stay authoritative.

Product Areas

Install, Upgrade, and Distribution

• Fixed: Full release security checks scan repository-wide and block on Python collection or runtime failures. Nightly installs the declared evaluator dependencies, and importlib collection handles duplicate source/projection test names.
• Added: Optional context-role and read-guard installers preserve unrelated configuration, use unique backups and refuse malformed or unsupported destinations before publishing changes.
• Changed: Native onboarding leads with the agent and shell; managed full plugins and selected source links remain optional distribution paths. Release version defaults are aligned at 3.7.0.
• Changed: Release and installation CI use Go 1.27.1 and Python 3.14. Snapshot release builds remain a no-publish check of the distribution path.

CLI and Operator Commands

• Added: ao provenance snapshot-intent, manifest, digest, store-verdict, verify-manifest, verify-verdict and verify-subject support exact-content evidence without invoking a tracker, Git or a semantic judge. evidence-orphans inspects references whose bound subjects changed.
• Added: ao provenance verify-judgments checks caller-required review profiles against native receipts, independent acceptance and exact subject identity. Requested model names or assistant self-descriptions cannot establish runtime identity.
• Added: ao config context resolves explicit external routes and can recover the same route from a selected native BD maintenance anchor. ao session read-source emits bounded source spans, continuation hashes and file identity facts under an explicit policy.
• Added: ao provenance mine-session --view excerpts provides bounded cited transcript excerpts without checkpoint writes. The existing event view remains available.
• Changed: ao demo and ao quick-start describe native execution; ao demo --rpi opts into the workflow example. ao status --evidence-root reads an explicitly selected evidence store. ao skills link --skill supports selected skills.
• Fixed: Doctor uses unique action backups, validates undo inputs before restoration and protects rename conflicts. Mining checkpoints reject unsafe paths and overlapping writers. Handoffs preserve work/session associations and select the newest valid artifact correctly.
• Fixed: Skill search, evidence status, provenance graph validation, scenario-result publication and changed-path gate routing handle previously missed malformed, corrupt and path-dependent cases.
• Removed: The ao eval family, its unused runtime adapters and ao redact.

Skills and Workflows

• Fixed: Claude writers capture check status without a second invocation. Live success and deliberately failing checks ran once, and the direct child returned a plain JSON receipt.
• Changed: The 34-skill menu consolidates retained behavior into existing owners. Plan shapes missing acceptance in the conversation or tracker; Implement repairs known defects; Validate judges exact content from fresh context. RPI remains explicitly selectable.
• Changed: Final judgment is assigned once while preserving every required review leg. A requested retrospective consumes the known outcome and judgment, or names an interim cutoff; it does not become an extra code-acceptance gate.
• Added: Memory combines optional recall, bounded episode mining and reviewed topic curation. CASS and MS retrieve supporting evidence on demand; later work must demonstrate whether adopted guidance helped.
• Added: Skill Eval provides bounded routing and coding evaluations for a named skill decision. Structural conformance, repeated agreement and completed runtime sessions are not evidence of universal skill benefit.
• Added: Claude bulk-read and code-write workflows delegate to cheap workers and return bounded findings or receipts. Readers continue to EOF despite answer caps; writers require a reference, preserve caller target identities and preflight distinct batch targets.
• Removed: The retired skill roots and scripted RPI loop listed under Breaking Changes. Anti-ceremony obligations survive in the operating contract without requiring a standalone skill.

Codex and Runtime Integrations

• Added: Codex-native bulk-reader and code-writer TOML roles pin gpt-5.6-luna with low/medium effort and fresh child contexts. The generated bundle carries their resources; the optional installer registers the names.
• Fixed: Project registrations point at the real source-owned role TOML files. The installed Codex runtime rejected registrations that pointed through symlinked role paths.
• Added: Claude plugin reader/writer subagents default to Haiku. Native agent dispatch is the default executor path; headless and factory adapters remain selected alternatives.
• Changed: Runtime guidance distinguishes actual native model/session identity, completion, deterministic checks and semantic judgment. Read-only reader instructions do not establish sandbox confinement.

Hooks and Lifecycle

• Added: Separate opt-in Claude Read|Bash and Codex Bash read-budget guards block supported oversized unbounded reads above a configurable budget, default 350 lines. Refusals suggest a bounded slice or reader delegation; waivers and hashed telemetry remain supported.
• Fixed: Shell parsing handles quoted literal paths, end-of-options and negative head limits without overflow, and avoids false file attribution for uncertain syntax. Repeated refusals are compact.
• Fixed: Installer checks include matcher and handler type, preserve unique settings backups and leave hook trust with the native runtime.

Eval, Validation, and Release Gates

• Added: Source-span integrity tests, native judgment-receipt verification, evidence-orphan checks, seeded-defect probes and bounded installed-skill coding trials strengthen evidence about specific behaviors.
• Fixed: Probe contamination and incomplete binding cannot silently count as proven coverage. Skill-trial reporting separates independently accepted work from control artifacts and runtime completion.
• Fixed: Component-owned checks, changed-path routing, generated projections, executable script modes, documentation checks and the local aggregate runner received conformance repairs.
• Changed: Required Go checks include the repository lint contract as well as build, vet and race/shuffled tests. CI and release checks remain mechanical evidence, separate from fresh semantic judgment.

Docs and Onboarding

• Changed: README, runtime installation pages, migration guidance, the workflow reference and the generated skill router describe native execution and the current menu consistently.
• Added: Context-budget design and runtime evidence document invocation, installation, refused reads, role discovery and observed limitations. Memory references document authorized sources, protected drafts and supported topic curation.
• Changed: The release summary covers the full v3.6.0-to-v3.7.0 interval, including CLI removals, recovery, evidence helpers, skill consolidation and runtime changes.

Security, Privacy, and Supply Chain

• Security: Evidence helpers require explicit protected non-Git storage, reject malformed identities and conflicting JSON fields, and publish immutable content-addressed artifacts atomically. Declared Git storage boundaries must resolve before writes.
• Security: Session-mining state protects source files and rejects unsafe ownership, permission and path configurations. Bounded excerpt extraction labels provenance and preserves source/destination authorization boundaries.
• Changed: Source routing checks owner, task, model, destination and native maintenance facts. They do not implement restricted-source access enforcement; the supported source-reading path remains limited to synthetic or already-cleared inputs.
• Changed: Pinned GitHub Actions and dependencies were refreshed, including golang.org/x/text 0.42.0, NumPy 2.5.3, SciPy 1.18.1 and Harbor 0.23.0.

Contributor/Internal Refactors

• Refactored: Consumer-free evaluation machinery and retired workflow scripts were removed while supported bounded evaluation tooling stayed with its declared consumers.
• Changed: Canonical skill sources own behavior, and integrated regeneration owns portable Codex, skill inventory, image and documentation projections. The menu no longer carries retired roots as live skills.
• Fixed: Architecture-check temporary-directory races, Go lint compatibility and source-equivalence checks received targeted repairs.

Known Issues

• Codex's reader followed read-only instructions in live testing, but inherited its writable parent's sandbox. Enforced reader write confinement remains unproven; do not treat the role as a security boundary.
• Installing a Codex plugin does not activate custom agent registrations or trust hooks. The separate role installer and native hook review are required for those optional features.
• The guard covers supported native read/shell paths, not every possible way a program or hosted tool can read data. Bounded output and a reader's completion receipt do not prove semantic comprehension.
• Structural validation of all 34 packages and live tests of selected paths do not establish behavioral efficacy for every skill or task. No generalized token-cost reduction percentage is claimed.
• Restricted-source enforcement remains unavailable for the context/source helpers. Native freshness facts are attestations with documented trust boundaries, not cryptographic proof of process isolation.

Full changelog

---

Full changelog

AgentOps 3.7 makes native coding the default: accepted intent, implementation and checks, fresh independent judgment, then finish. No AgentOps skill, bootstrap, hook or orchestration service is required. The optional skill menu is consolidated from the 52 roots shipped in 3.6.0 to 34, and the CLI gains recovery and exact-content evidence helpers. Upgrade guidance covers the published command, skill and scripted workflow entry points that were removed.

See the curated release notes for upgrade instructions, the complete product-area summary and known limits.

Added

• Native Go evidence helpers under ao provenance: immutable intent snapshots, subject manifests and digests, verdict storage, exact-subject verification, required native judgment receipts, and orphaned-evidence inspection. Storage uses an explicitly selected protected non-Git destination; mechanical verification does not issue a semantic verdict.
• ao config context resolves caller-owned external context routes, including recovery from a selected native BD maintenance anchor. ao session read-source returns explicitly bounded source spans and integrity facts for synthetic or already-cleared sources; restricted-source access remains unsupported.
• Bounded ao provenance mine-session --view excerpts extracts cited transcript evidence without writing a checkpoint. Optional Memory guidance covers recall, mining and reviewed topic curation; Skill Eval measures a named skill decision.
• Claude bulk-reader and code-writer subagents, pinned to Haiku, and parallel bulk-read / serial code-write workflows return compact findings or receipts while keeping source and generated code out of the parent context.
• Codex-native bulk-reader and code-writer roles pinned to gpt-5.6-luna, generated with the portable bundle, plus explicit project registrations and an opt-in personal/project installer that preserves existing configuration.
• Separate opt-in Claude and Codex read-budget guards refuse oversized unbounded file reads, suggest bounded slices or reader delegation, honor scoped waivers, and record hashed telemetry. The default line budget is 350; installing skills does not activate these hooks.

Changed

• ao quick-start, ao demo, the README and runtime onboarding describe native execution with zero mandatory skills. ao demo --rpi retains the explicitly selected workflow; ao init remains optional. ao skills link --skill NAME supports a selected subset while no-selector linking still installs the menu.
• The 34-skill menu groups intent, implementation and judgment; engineering specialists; Memory; deliberate review strategies; and optional tool/runtime adapters. Consolidated names and replacements are documented in docs/MIGRATION.md.
• Plan uses existing conversation or tracker acceptance, Implement repairs known defects directly, and Validate judges exact content from a fresh author-distinct context. RPI is optional; final review is assigned once with every required leg preserved. Requested retrospectives follow the known outcome and judgment.
• Memory and instruction-improvement guidance uses authorized source episodes, bounded CASS/MS retrieval, protected drafts and independent support/disclosure review. Later work must demonstrate benefit; a generated lesson is not proof.
• The CLI and CI build with the Go 1.27.1 toolchain; CI Python moves to 3.14. Dependency and pinned GitHub Actions updates are included across the full 3.6.0-to-3.7.0 interval.

Fixed

• Full release security checks scan the whole repository and treat Python collection or runtime errors as blocking failures. Nightly checks install the declared evaluator dependencies; test collection supports duplicate source/projection module names.
• Claude writers capture a supplied check's status in its original invocation, avoiding the observed status-confirmation rerun. Native success, failing-check and direct-writer trials each ran the check once; the direct child returned plain JSON.
• Plugin conformance verifies exact skill membership and link destinations. Clean Claude and Codex plugin installs and upgrades are exercised separately from source linking; Codex metadata checks use the current Skills-only manifest contract.
• Doctor keeps unique per-action backups and preflights undo integrity before restoration. Session mining protects checkpoint paths and concurrent writers; handoffs preserve work/session associations and use correct newest-first ordering.
• Evidence status, skill search, changed-file gate routing, constraint checks, provenance graph validation and scenario-result publication handle previously missed corruption, path, matching and recovery cases.
• The read-budget parser preserves quoted paths, handles end-of-options and negative head limits, and avoids attributing uncertain shell constructs to the wrong file. Repeat refusals stay short; installers preserve unique backups.
• Context-budget workers count physical lines, preserve the caller's target identity, remove raw check output from returns and report unknown state after worker failure. Batch writers preflight distinct target identities.
• Codex role registration points to real source-owned TOML files instead of symlink paths rejected by the installed runtime.
• Generated skill projections, executable entry points, documentation checks, seeded-defect probes and contamination detection received conformance repairs.

Removed

• The published ao eval command family and ao redact. Use a repository-selected evaluator and owner-authorized disclosure review; generic provenance can retain the resulting evidence.
• workflows/rpi.js and its scripted retry machinery. Invoke the optional RPI skill when selected, or execute natively. AgentOps does not own an aggregate retry controller, queue, work ownership, Git or delivery transition.
• Twenty skill roots published in 3.6.0, including learn, swarm, codebase-recon, bootstrap, handoff, standards and workflow-builder, after useful behavior moved to surviving owners or native work. memory and skill-eval are the two new roots relative to that tag.

---

Full Changelog: v3.6.0...v3.7.0