agy-worker v0.24.9

Maintenance release aligning provider configuration handling and package guidance,
with regression coverage and consistent plugin version metadata.

agy-worker v0.24.8

Reject documented workspace Markdown custom-agent configuration during provider preview and immediately before launch: .agents/agents/*.md and .agents/agents/*/agent.md. Loader symlinks are rejected, while ordinary non-loader Markdown remains usable.

The checks use the existing normalized path policy and bounded shallow enumeration. Regression tests cover both entry-point forms, late additions and provider-spawn prevention. The security guide distinguishes offline rejection from live AGY discovery or invocation; this release does not claim a live Markdown-agent canary.

agy-worker v0.24.7

This release protects controller startup signal handling, clarifies execution and recovery boundaries, and partitions CI work.

• Distinguish local receipt processing from driver-selected verifier commands, which can execute candidate code with the user's filesystem and network authority.
• Document global and enabled-plugin hooks in headless session runs, including with slash commands disabled. Preview rejects workspace .agents/hooks.json. Native private-HOME exclusion is supported by local mechanism tests; no live native hook-negative test is claimed.
• Add bounded task-sizing guidance and a focused check for report-free maximum-runtime cleanup. The recorded agy 1.4.0 run is one observation, not a task-capacity guarantee; the synthetic cleanup check does not establish remote provider cancellation or recovery of partial writes.
• Clarify quota, rate-limit and credit-exhaustion diagnostics: the terminal reason alone does not identify the cause. Recovery remains owner-authorized; no automatic retry is introduced.
• Make invalid timeout input actionable by explaining positive integers with s, m or h, such as 30m. Accepted duration grammar, duration-validation exit codes and deadline limits are unchanged.
• Close a controller startup signal-ordering gap: block SIGHUP, SIGINT and SIGTERM around controller process creation, install the child handlers before unblocking them, and restore the parent's exact prior signal mask even if process creation fails. This does not guarantee remote provider cancellation.
• Repair parent-side terminal publication after signalled controller startup: once the actual child is reaped, recover only a still-unpublished prelaunch attempt matching the original attempt number and that owned child's PID. Reuse existing terminalization and preserve source vetoes and candidate rules; ambiguous or running provider states fail closed. The existing five-second child wait is unchanged.
• For cancellation already approved at the post-reap cutoff, observe it before validating a new report, inspecting the source again or copying scoped stage writes. When cancellation is observed before parsing, keep raw output as untrusted evidence, leave current provider status unknown and admit no new report candidate. Keep subsequent cancellation checks, source-change vetoes and deferred proof before reusing an inherited candidate; uncancelled reports retain real validation and their after-source proof. Later cancellation does not roll back an already authorized stage copy. The original whole-controller two-second assertion is unchanged.
• Make affected cancellation and deadline fixtures exercise their intended phases: wait for actual provider/descendant readiness before signalling, cancel after real reap/freeze, and drive the real control/state-refresh monitor with a deterministic test clock. Latency and deadline thresholds remain unchanged.
• Document observed Codex desktop recovery through exact-command approvals, with host-policy limits and sandbox boundaries explicit.
• Split the long dispatcher/remediation suites into five parts within seven-shard CI. Successful aggregate verification requires all 26 stages and 409 partitioned dispatcher/remediation cases exactly once, with neutral case IDs bound to the inventory.

The original shard-split performance comparison remains qualified: it contains one complete successful hosted sample (n=1). The second measured run failed; the original PR attempt also failed before its successful rerun. Both failed executions were rejected by the aggregate. Their historical causes have not been established, and these fixture changes do not establish a durable speedup or a repair of those historical failures. No latency or deadline threshold was relaxed.

Install the managed update on Codex and Claude Code, then start fresh host sessions. See the security and compatibility guide and privacy disclosure.

v0.24.6

This release rejects executable provider workspace configuration before provider startup and simplifies existing boundary helpers.

• Snapshot collection combines fixed Git metadata reads, reducing a normal snapshot from 33 reads to 30 while preserving all four executable-validation points for each remaining read. One serialized local before/after comparison measured 2475.139s → 2396.195s (3.19% observed difference, n=1); it does not establish attribution. Three of four hosted shards were slower in that comparison, so no hosted speedup is demonstrated.
• Equivalent transient stat projections and bounded readers share existing helpers. The simplification reduces runtime code by 68 lines, with focused preservation and rejection coverage.
• Preview and every provider launch or repair reject executable workspace configuration, including .agents/mcp_config.json and the conservative manifest/loader family. The boundary covers scoped selections, native mode, loader symlinks, and bounded actual-working-directory ancestry without another recursive worktree traversal.
• Regular .git files and directories stop ancestry, supporting disposable Git worktrees. Internal candidate copying and scoped self-verification remain available. Ordinary content handling and existing user HOME plugin behavior are preserved.

Caller-visible change: repositories containing the rejected executable configuration must first use scoped mode that excludes that configuration, or use a different disposable worktree without it. No new public flag, schema, module, dependency, or timeout increase is introduced.

agy-worker v0.24.5

This release closes native settings ancestor replacement paths and repairs reconciliation and lifecycle recovery.

• Native isolation now protects the settings file's ancestor chain against rename, unlink/recreate and symlink replacement. Real macOS sandbox regressions exercise the boundary; two synthetic Claude Code native canaries passed on the reviewed change.
• Reconciliation records preparation before creating backups, recovers preparation failures, reports verified rollback when created parents are gone, preserves existing directory modes, and removes owned temporary files after failed writes.
• Status binds passed and routed receipts correctly. Interrupted verification can retry with fresh evidence, routed receipts have an explicitly approved cleanup path, and rejected/routed receipts no longer cause repeated automatic finalization guidance.
• Candidate/evidence reads and verification cleanup are hardened against file races, special files, signals and early pipe closure. Input validation and shipped guidance are aligned with these boundaries.

Caller contract changes: the unreachable provider_quota_exhausted reason, exit code 24 and provider retry countdown fields are removed. Dispatch state format is now 21; format 20 is retired. Finish or discard older jobs with the release that created them; there is no migration reader.

Verification includes independent review, canonical packaging, pinned Ruff/Mypy, the complete offline gate, and seven successful exact-head CI checks. Live evidence is limited to the two synthetic Claude Code native canaries; it does not establish other models, session mode or other hosts.

v0.24.4

This release hardens initial persisted command validation and records bounded AGY 1.3.5 observations.

• Reject unapproved persisted --dangerously-skip-permissions, --log-file, --continue/-c, and --prompt-interactive/-i options before initial state binding. The normal wrapper already generated safe commands; existing post-binding command integrity is unchanged. The rejection set remains intentionally bounded and does not promise hostile same-user tamper isolation.
• Keep --mode auto refused, with tests at every entry point. Supported modes remain plan and accept-edits.
• Preserve permission classification: the observed 1.3.5 headless denial used the existing wording and denied_actions shape. No classifier change or new failure reason was added.
• Document bare model-name acceptance with and without explicit effort, and rejection of conflicting suffixed-model/effort selection. Model and effort remain caller-owned; no model catalog or default-thinking-level claim is added.
• Clarify that session isolation preserves ambient configuration and provides no wrapper-level plugin, hook, or MCP suppression. Observed tool availability does not establish tool execution, installed hook startup, repository auto-loading, or AGY-specific native plugin suppression.

Live evidence came from Claude Code using the installed v0.24.3 plugin with AGY 1.3.5 and synthetic content. Codex-host live evidence remains installed v0.24.3 with AGY 1.3.2. These observations do not claim a live v0.24.4 run. Real 1.3.5 timeout, authentication-expiry and quota framing remain unobserved.

Independent reviews found no open findings. Final quality and complete offline gates passed separately on the compatibility and five-line version candidates, and all seven exact-head hosted checks succeeded for each PR. Six new option regressions failed on the base and passed on the compatibility candidate. Ordinary supported caller behavior is unchanged.

v0.24.3

Adds source_checkout_changed and source_checkout_guard_unavailable: a bounded check of the verified main source checkout rejects changed or unverifiable proof before candidate admission or retention and before later launches. The original job baseline is immutable across resume, continue, repair and restart attempts.

No-candidate cancellations and failures without a report do not re-digest after a confirmed provider exit; any change is caught before the next resume/continue. Valid reports and inherited candidates still require proof. The prompt-cancel median is 0.5590900000 s versus 0.4693521670 s on v0.24.2 (+0.0897378330 s); the existing timing bound is unchanged.

State schema is 20; command schema remains 16. Finish old jobs with the release that created them. No legacy state migration is provided.

This detects bounded source observations; it does not confine or attribute writes. A job already running in the main worktree skips the separate-source guard. Ignored untracked files, unrelated host paths and wholly reverted changes between observations remain outside detection. Owner edits to the source checkout during a job can also trigger the guard.

Independent review and the full offline gate passed. AGY 1.3.2 was checked: an ordinary scoped fix completed and was independently verified; the source-writing request was explicitly refused with an unchanged source. No live mutation occurred, so the actual mutation-veto evidence is offline. The cancelled initial request is unassessed.

Includes #151 and the 0.24.3 metadata update.

v0.24.2

Worker instruction precedence is now narrower: security, privacy, permission and scope constraints remain protected, including secrets, data destinations, destructive actions and required authorization. Routine conversational questions are recorded with a safe assumption so a bounded non-interactive task can continue. Compatible report requirements stay in schema fields; incompatible templates use the output contract.

Bounded live evidence with agy 1.3.1: two routine-question fixtures completed the correct minimal fix (driver oracle 7/7 each), recorded the unanswered question and safe assumption, and required no human response. Two privacy-conflict fixtures returned blocked with human input required, cited the privacy rule and left an empty diff. These four synthetic runs are not a frequency estimate or a general guarantee.

agy 1.3.1 checked (headless-irrelevant changes). No migration needed: no schema changes.

Validation: independent review accepted; regression tests fail on the previous preamble; focused tests, Ruff, Mypy and the full offline gate passed. Required GitHub checks passed on each merged PR head.

v0.24.1 — preserve worker instruction constraints

Worker prompts preserve applicable user and repository constraints. Conflicting task or output requirements produce the existing blocked, human-required result; compatible report requirements remain in the JSON schema fields.

The shared prompt builder keeps transmission previews, initial launches, staged prompts and dispatch checks consistent. Generate new launch previews and approvals with the selected release; finish existing jobs with their creating release.

SECURITY.md now accurately describes support for both Codex CLI and Claude Code. Session, native, verifier network and credential authority are unchanged; their documented limits still apply.

Validation: the new regression failed on the previous prompt in all four mode/isolation combinations and passes after the change. The dispatcher suite passed 245 tests; Ruff and Mypy passed; independent review accepted. The final canonical offline gate passed all 23 stages (exit 0), and all seven required GitHub CI checks passed on the reviewed candidate. No new live provider execution or compatibility claim.

v0.24.0

Migration

• --tier and model-recommendation are removed. A non-empty AGY_WORKER_TIER fails closed. Choose --model with optional --effort, or omit both to retain AGY's default. Use agy models to obtain model names; the worker does not infer a model or retry with another selection.
• Finish v0.23.0 jobs and approvals with v0.23.0 before upgrading. Retired formats are not accepted: model-selection schema 4 → 5; launch-authority kind v1 → v2; Evidence Receipt and Evidence Report 1 → 2; dispatch command 15 → 16; dispatch state 17 → 18; workflow state 7/8 → 9/10; local job lifecycle state 1/2 → 3/4. Create new jobs and approvals with v0.24.0.
• workflow.sh usage errors now exit 64 instead of 2.

Changes

• AGY 1.3.0 compatibility (#144): bounded live observations cover headless denial, partial-output print timeout, and startup model-selection rejection shapes. Denial and timeout remain failure outcomes; independently valid candidates remain subject to driver review. Persisted commands reject the newly observed --remote-control, --input-format, --project, and --new-project options.
• The strictly recognized startup model/effort rejection now ends with model_selection_rejected (exit 26) instead of an envelope/framing error (#146). Status supplies fixed guidance to check model names and the --model/--effort pair without copying raw provider prose. It produces no candidate, permits no resume or continuation, and does not retry automatically.
• Model tiers and model-recommendation have been removed across the runtime and evidence formats (#145). Model and effort remain caller-owned.
• Plugin identity is agy-worker for Codex and Claude Code. The canonical repository is cagdasyurekli/agy-worker; the Pages site and installation guide cover both hosts.

Verification and known limits

The last live-tested AGY version is 1.3.0 from Claude Code. The Codex host was not live-tested for this release. Offline tests exercise synthetic provider behavior and do not establish live provider availability or task quality.

• Session isolation does not isolate provider reads. Approved content can reach Google/Gemini through AGY; review the privacy guidance and exact transmission scope before dispatch.
• The observed gemini-3.8-flash-medium plus --effort high pair was rejected by AGY. This observation does not establish that every suffixed model conflicts with explicit effort; bare-name plus effort remains unobserved.
• Native isolation under an already-sandboxed driver host is unsupported; the worker preserves native mode and fails closed rather than falling back to session.