v0.6.0

The ICP round: the secret sweep stops blocking ordinary code, the plan becomes an editable graph, runs can commit and open PRs, and every phase shows what it cost and what changed. Five founder-journey evaluations and three adversarial reviews drove this release; the verdict moved from "trial" to "adopt".

Breaking

• Adding or editing a task now requires naming at least one requirement (requirement_ids; a task may implement several). A task with no requirement used to be accepted silently.
• A vocabulary marker (password, token, secret, auth) in a patch no longer blocks a change set. It raises a non-blocking sensitive_area finding; only a real credential value blocks.
• Approving a change set whose adversarial review never completed is refused. Run idea review <id> rerun (a fresh, paid review). A change set created before this release predates review tracking and says so.
• idea verify --json exits non-zero on an unmet gate, like the human-readable form. It always exited 0.
• Deleting a task with dependents names them in the error.
• Near-duplicate judgment items merge on a stricter measure, so some items that used to merge now stay distinct.

What's new

• The secret sweep tells you what it found and lets you overrule it. A finding names the file, the line and the kind, with a masked preview. Placeholders and test fixtures no longer block; real provider keys still do. "Not a secret" records a per-project exemption scoped to that value in that file, revocable in Settings. Configured secrets can never be exempted.
• The plan is an editable graph. Merge, split, reorder, set dependencies (cycles refused), and see each task's requirements. Requirements keep their codes across revisions.
• Git-native. Opt-in commits, a branch per idea, and idea pr with CI status. Guards refuse to commit on your default branch or over uncommitted work, and never commit files the change set didn't produce.
• Review rigor scales to the work (review.rigor: auto), so a small change gets one pass, not five.
• Verification from your tests. Passing tests map to requirements, with one action to confirm them. Evidence only counts from an applied, non-reverted change set whose check run exited cleanly.
• You can see where the money and time went: cost and duration per phase, the current step while a run is in progress, and a timeline of what changed per idea.
• A cross-idea "Needs you" queue, triage, "accept all recommendations", and a stale banner when a decision you reopened invalidates work.
• The CLI judgment loop: idea questions, answer, resolve, reopen-decision, accept-recommendations, triage.
• Runs are resumable and legible: live agent output, an optional note when you re-run, "Stopped by you" instead of a raw cancellation, and detected build/test commands for Go, Node, Python and Rust projects.

Notable fixes

• A change set could delete tracked files that matched a .gitignore pattern, and commit those deletions.
• Credential redaction was gated by the detection rules, so some real secrets were persisted unmasked.
• An empty change set could mark its task done and strand every dependent task.
• A revised requirement could stay "verified" for a statement it no longer had.
• Approving used to re-run the paid adversarial review every time and reword findings you had rejected.
• A truncated review could wedge an idea with no way forward that didn't involve editing config.

Known limitations

• Coding-agent spend is not measured; idea status says so rather than showing a misleading total.
• Plan editing (merge, split, dependencies) has no CLI verb yet — web UI or API only.
• Exemptions granted before this release must be re-granted: fingerprints are now per-project HMACs.

Installing

Download the archive for your platform and put idea on your PATH. The web UI is embedded — no Go or Node toolchain needed.

shasum -a 256 -c checksums.txt

linux/arm64 is built and shipped, but its SQLite driver is compiled per-architecture and is not exercised in CI; see the install section of the README.

Pre-1.0: the CLI surface, HTTP API and config schema may change in any release.