v0.60.6

[0.60.6] - 2026-09-29

Security

• Require AnyIO 4.14.2 or later so installs cannot resolve the versions affected by
  its TLS hostname validation and process-pool stderr advisories.

Changed

• intent_trial collection is session-independent. Trial cohort membership now derives
  only from public status/reconcile/decision calls, never from a live process or PID — a
  workflow-owning trigger writes a trial_feedback observation and a later, separate session's
  ordinary reconcile call picks it up. Protected decisions (policy, source_review, assessment)
  are typed, ID-keyed and conflict-checked against an expected destination revision, coordinated
  with the repository merge fence so no unrelated prose can be swept into a land. Fixed a
  worktree-name-match bug where a member's source_refs could capture unrelated files from a
  different task's worktree when the directory name coincided with the task slug — refs now
  bind to the task's exact artifact paths. An approved equal-time source-review order now
  extends only when growth is unambiguous — a same-slug resume append or one later-acknowledged
  task keeps the frozen order, but two or more later tasks that themselves tie fail closed; a
  trial-less rejection keeps _read's own classification instead of a generic catch-all. Task-
  start span evidence is now fatal only while a trial is actually active — a project with no
  active trial warns and proceeds instead of blocking preflight — and status() reads under the
  same trial fence, returning lock_busy/unsupported_lock rather than falling through to an
  unfenced read. _publish revalidates its destination immediately before writing, and both
  restore paths (post-commit-pop and the fenced restore) now refuse to restore a stash that
  holds a protected trial path, so a peer's in-flight trial state can never be overwritten by
  someone else's stash pop.

Boundary tests (advisory)

Layer 1 of PLAN-test-fidelity-gap. Pure parser checks; advisory only.

Status: ✅ PASS

============================= test session starts ==============================
platform linux -- Python 3.12.14, pytest-9.0.3, pluggy-1.6.0
rootdir: /home/runner/work/harness-maker/harness-maker
configfile: pyproject.toml
plugins: asyncio-1.3.0, anyio-4.14.2, respx-0.23.1, hypothesis-6.155.7, xdist-3.8.0
asyncio: mode=Mode.STRICT, debug=False, asyncio_default_fixture_loop_scope=None, asyncio_default_test_loop_scope=function
collected 50 items

tests/integration/test_boundary_codex_toml.py ............               [ 24%]
tests/integration/test_boundary_cursor_mdc.py .......                    [ 38%]
tests/integration/test_boundary_harness_yaml.py ........                 [ 54%]
tests/integration/test_boundary_hooks_json.py .........                  [ 72%]
tests/integration/test_boundary_meta.py .......                          [ 86%]
tests/integration/test_boundary_settings_json.py .......                 [100%]

============================== 50 passed in 4.11s ==============================