v0.5.0 — a fourth runtime, a stateful workflow, and one contained write path

Three things land together: a fourth runtime, a stateful workflow layer, and the one contained write path that layer is allowed to use. Nothing in the 0.4.2 consult or review tools breaks.

OpenCode as a fourth runtime

Hosted providers only. The adapter refuses an inherited config and a writable ancestor, checks what its comments claimed rather than what they hoped, and counts what was actually billed; an unknown cost stays unknown instead of being reported as zero.

isolated_write is not supported here, and says so with its reason: OpenCode's permission set isolates configuration, not filesystem effects — an allowed bash command can leave the worktree and write anywhere the user can. A root allowlist and a prompt instruction are not containment.

A three-phase workflow no agent can write through

research → plan → author_execution_prompt → implement → test → review → synthesize → fix, the last three in a capped loop. Orchestrator owns state, transitions, agent selection, artifacts and the round cap; the host still decides when to advance.

• Models are bound to steps by configuration. Any model reachable through a supported runtime can take any compatible step.
• Consulted agents stay read-only. Delegated implementation returns a patch, over the existing read-only consult path — the first delegated implementation mode carries zero new write surface.
• Public consult tools cannot reach a workflow-owned session; _bind_public refuses a row with a workflow_id, so a caller who learns a step's consultation id from status cannot resume it.
• One token per side-effecting step, spent in the same statement that moves the step to running. It proves snapshot integrity, not human approval.
• Bindings and the policy they run under are frozen at creation. Editing config.yaml reroutes nothing and moves no cap; that takes the replan handshake, and a replan re-decides only the steps it was asked about.
• loop_done is computed here, never asked of a reviewer.
• Tests are observed, not claimed: a coding agent's claim that it ran tests is retained as reported information, reported_by and the commit are stamped by the service, and status is cross-checked against exit_code.

The contained write path

execution: isolated_write, codex only, in a disposable git worktree outside the repository. Codex's sandbox_mode="workspace-write" is enforced by the CLI at OS level; claude and antigravity are refused with their own reasons. What the step produced is read from git, not from anything the model said, and the worktree is removed after capture. Worktree directories are created 0o700, and a path this user does not own is refused by name.

Secret handling

Detected secrets are replaced in both inputs and reviewer outputs before storage, and the storage copy is redacted before the row is inserted — a crash immediately after record_turn leaves no raw secret in the database. Patches are the carve-out: the raw patch goes to the host once, storage keeps a sanitized audit copy plus the raw hash, and the sanitized copy is never applied. Database redaction cannot control history files that Codex, Claude or another external CLI writes on its own.

Review rounds

Every commit from d52a211 on answers findings from an external review run through this server against its own diff, each fix carrying a test verified to fail without it.

Verification

910 tests, offline, against stub executables — no mocks and no network. Plus a live two-path workflow smoke test in a scratch repository, and a live spike that pointed a command outside the worktree and got Operation not permitted back, which is the only honest check of the sandbox.