v0.10.0 — reliable lifecycle and Codex-owned assurance

Highlights

• Separates provider terminal status, schema-valid worker reports, physical worktree evidence, and Codex-owned driver disposition.
• Preserves valid reports from provider errors as unverified candidates without promoting them to success; cancellation remains fail-closed.
• Adds additive lifecycle/state compatibility, bounded resume/continue/finalize recovery, strict verification binding, and private actionable text output.
• Hardens repository identity, symlink, Git-probe, state-SHA, concurrency, deadline, and legacy-result boundaries.
• Binds provider/canonical schemas and caller-owned model/runtime selection while keeping version drift observational rather than an automatic product blocker.
• Removes descendant-held-pipe probe delays and reduces safe worktree snapshot process amplification.

Verification

• PR #62 protected check: success on exact candidate 5fa7cc4d63fca3c8f7781922a6f03ae8f4b10ff2 (run 32957450748, 50m28s).
• Squash-merged main 2ac893ef837dbcbb0ff0b3b9d62eecd164445bf6 has the identical Git tree 201e807a47325414d6b8a7026d8267fc4a6ff50b.
• Canonical offline runner: 32 suites, 3,374 checks; syntax, compile, diff, package/runtime/persona/benchmark parity, ground truth, help, and bytecode hygiene passed.
• Fresh independent Sol xhigh reviews accepted the final diff with no blocking finding; two unchanged UX/user-proxy rounds scored every critical axis at least 4/5.

Known limitation

• A fixed Gemini Pro task canary returned provider SUCCESS with an empty response and no structured_output in direct agy capture. agy-worker correctly rejects this as missing_structured_output; it is reported as an external provider/agy-path blocker, not a product pass and not bypassed by fallback parsing.

Upgrade

After checking out this exact tag, run ./install.sh to refresh the global Codex skill bundle. The installer does not modify agy or Codex configuration.