Release v1.0.60 · comisai/comis

Agent runtime

Replies are grounded in tool receipts. Outbound audio/image/delivery-status claims now require an authoritative receipt — a backgrounded spawn or a runtime voice route is no longer mistaken for a synthesis receipt. enforceRuntimeSelfReportEvidence rejects unsupported cost/duration/outage answers via new observabilityEvidenceLimits (cost: runtime_estimate, providerInvoice: unverified, crossExecutionDurationRanking: unavailable) instead of only checking that an obs_query call happened.
Prompt-skill routing no longer arms off the wrong evidence — recalled history, backgrounded completions, extracted content, and generic stopwords stop triggering the request-tool nudge; citation evidence prefers the current turn's receipts.
Recall keeps space-free prose searchable while blocking opaque-payload inheritance.
Degraded/input-guard replies pick up i18n coverage.

Long-cache markers are anchored explicitly; lookback cache-tail markers are protected from starvation; message TTL is capped to the execution latch; auxiliary/utility calls are isolated from shared cache state.
Prompt stalls pause for operator approval instead of timing out, and the auto-background timer pauses while an approval is pending.
Failed offloads stay inline rather than being silently lost; offload artifacts are labeled by payload type.
Timeout billing is correlated with the originating request trace instead of being orphaned.

Graph/sub-agent delegation carries an explicit completion contract end-to-end. A new per-route dispatch hint only promises notification when an announcement route and durable delivery both exist. IncidentGraphRun gains required announcementDelivery (not-requested/unavailable/committed/retained/failed) plus an optional sessionKey.
obs.explain adds a request.clarification_required trajectory event, recallDisposition, a route_validation_failed skip reason, and reworked completion-evidence/tool-invocation verdicts.
Terminal execution failures now outrank incidental recall misses in the obs.explain verdict ranking.
Config posture adds an execSandboxDisabled signal for skills.execSandbox.enabled: "never".

Every successful ChannelPort.sendAttachment is published through after_delivery hooks, with delivery authority and a dependency warn on hook failure.
Bare-link parsing keeps IPv6 hosts intact.
The secret entropy backstop swaps its delimiter check for a structure check, excluding source expressions while keeping password punctuation covered.
web_search names the exact missing provider secret/knob.
Skill manifests gain comis.min-distinct-web-fetch-urls / comis.min-distinct-web-search-queries, with defensive parsing that ignores malformed values instead of hiding the skill.

Cyber-abuse-shaped provider probes are suspended by default and unlockable only by an explicit, non-persisted operator acknowledgement (COMIS_LIVE_TEST_RISK=cyber-abuse + COMIS_LIVE_CYBER_ABUSE_TESTS=operator-authorized), enforced by one central fail-closed gate.
Two new self-driving simulator workloads: personal-operations (D1–D9 daily-assistant journeys) and artifact-to-action (E1–E6 journeys, A/B/C/degraded worlds, provenance, exact-revision authorization, one commit/readback).
The live conversation audit fails closed with session_evidence_empty instead of discarding readable evidence.

Full changelog: v1.0.59...v1.0.60

test(live): gate cyber-abuse-shaped provider probes behind operator opt-in by @anconina in #491
fix: production observability, cache, approval, and localization defects by @anconina in #492
fix(obs): rank terminal execution failures above recall misses by @anconina in #493
test(live): add personal-operations sim workload and D-journeys by @anconina in #494
test(live): add artifact-to-action sim workload and E1-E6 acceptance journeys by @anconina in #495
fix(agent): ground replies in tool receipts and repair delegation delivery by @anconina in #496
chore(release): 1.0.60 by @anconina in #497

Full Changelog: v1.0.59...v1.0.60