Squadra 3+ 3.11.0

Refresh, 26 October 2026: security and reliability fixes under the same version

After the first 3.11.0 was published, two squads tested it live and four review councils read the whole code. Everything they found that matters is fixed here. Update even if you already installed 3.11.0.

• Save and checkpoint keep secrets out. Saving a squad no longer exports:

  • a private key that is only staged;
  • a key embedded in JSON (service-account files), a PGP private key, or .pfx, .ppk, .git-credentials, .npmrc and .pypirc files;
  • an untracked .env carried inside a frozen delivery copy while the manifest called it excluded.

  Frozen copies are checked when they are made and when they are copied. Content already committed is treated like Git history, as before.

• Git never runs the project's configured programs in Squadra's own commands (fsmonitor, filters, textconv, hooks, URL rewrites). The one exception is migliora's commit, which keeps the project's hooks on purpose.

• Reads bind to what was delivered.

  • The handoff names the frozen copy.
  • A reader's probe runs on it.
  • A window cannot change its model to bypass the rule that Codex writes and Claude reads.
  • An ACK can no longer reopen a closed task or free a release gate.
  • Proofs with skipped tests no longer count as complete.

• Long-running windows stay light. An open dashboard no longer pins the registry's WAL. Followers and resource waits stay clean. Delivery and save on large repositories use a bounded number of Git processes.

• Clearer recovery and plugins.

  • squadra save --allow-name records a one-save exception for a tracked file that is refused only because of its name.
  • restore-check says when it is given a checkpoint.
  • An old plugin installation explains how to adopt it.
  • plugin list verifies the installed files.
  • install.py --undo restores earlier skills.

• Upgrade is transparent. Registries written by the first 3.11.0 keep working with no repair.

Plugins: memoranda 1.0.9, Playwright 1.0.10, Sentry 0.1.7. The memoranda bridge accepts the refreshed registry reader.

---

Squadra 3+ 3.11.0: builders keep working after delivery, reads can change hands without a new proof, and a new skill, migliora, turns repeated friction into project rules.

It builds on 3.10.4. New tasks use journal format 3, so update every window before you create new tasks.

What changes

• Builders can continue after delivery. At delivery Squadra keeps a read-only copy of the proved candidate in the registry, uncommitted changes included. The builder goes on in its own tree while the reader checks exactly what was proved. squadra candidate status shows the copies and the space they use (by default up to 512 MiB per copy and 2 GiB in all). The coordinator can recover a delivery (repair), retire a closed copy (retire) or change the limits (limits). Commands
• Change readers without rerunning the proof. reassign moves a read to another reader. Candidate, proofs and budgets stay as they are, and the new reader must acknowledge.
• Clearer mail and resources. inbox --follow saves where it stopped. resource status shows who holds a resource and who is waiting, and a reservation can name its task (--task).
• Shorter commands. Repeating the same verdict does not record a second read; review --amend replaces one on purpose. deliver and close take a --note, task proofs accept the command directly, and send returns a short receipt.
• Migliora, a new skill. When the evidence shows the same friction coming back, migliora writes a scoped rule in the project's AGENTS.md, runs its check and, after the reviews the project requires, makes a local commit of its own files only. Changes other windows have staged stay as they were. The installer adds it, and the Claude Code plugin loads both skills. Migliora
• System skills audited. The Cisco static scan of this release (cisco-ai-skill-scanner 2.2.2, balanced policy, no HIGH or CRITICAL) refreshes the audit records of the five system skills.
• Plugins: memoranda 1.0.9, Playwright 1.0.10, Sentry 0.1.7. The memoranda bridge accepts the 3.11.0 registry reader.

Updating

• In Claude Code run /plugin marketplace update squadra, then /plugin update squadra@squadra. In Codex run codex plugin marketplace upgrade, then codex plugin add squadra@squadra. For a standalone install, run git pull and the installer with a new backup folder. Then restart the windows.
• Update every window and reinstall the bundled plugins (squadra plugin install <name>) before you create new tasks or reassign reads. New tasks use frozen delivery and journal format 3, which older windows refuse. Tasks recorded before the update keep their behavior.
• Before you update, the coordinator saves the squad: squadra save --actor <coordinator> --to <a new folder>.