v0.4.0

Added

• Multi-agent conductor runtime — edda conduct run --agent <claude|pi|codex> can launch the selected host, while edda dispatch provides a hardened single-turn agent command with persistent Codex session-to-thread continuity, honest budget reporting, and cross-process recovery
• Operator-controlled phase gates — plans can pause in AWAITING_VERDICT, expose the gate during dry runs, and resume through edda phase approve or edda phase reject; phases can also declare owned write surfaces that become coordination claims
• Recoverable task execution — scoped task leases, Codex App Server task clients, unfinished-attempt reconciliation, and validated Windows scheduler launch manifests let interrupted work re-enter safely instead of silently disappearing
• Coordination inspection and distribution — edda claim check reports path intersections before editing, edda init scaffolds coordination skills for Codex as well as Claude, and repository-tracked fleet skills now include sync tooling plus executable CLI doctests
• Operator control-layer guidance — the operator runbook and Layer 3/L2 design rulings describe how goals, evidence, verdicts, and non-coding work fit above the ledger and fleet runtime

Changed

• Coordination reviews now use bounded, SHA-pinned scopes with a verify-once ladder and reusable build lanes, reducing repeated full-workspace runs while keeping Windows-only gaps explicit
• Conductor scheduling now uses runner-owned lane heartbeats, declaration-order tie breaks, time-based retry and timeout deadlines, bounded child reaping, both-stream failure tails, and measured-versus-estimated cost reporting
• Claim and session resolution now disclose replacements and widening, avoid guessing ownership during unclaim, bind process identity consistently across Claude, Codex, and OpenClaw bridges, and expose claim age/staleness through edda peers --json for automation consumers
• Existing SQLite stores migrate automatically through the current schema when opened; no manual data migration is required
• Existing installations should run edda init --force-skills once to refresh embedded coord-* skills; this overwrites local edits to those generated skill files

Fixed

• Ledger writers now retry bounded SQLite lock contention instead of failing concurrent writes immediately
• Conductor launchers now handle Windows executable lookup, child liveness, dead-child stdin writes, protocol failures, zombie processes, and app-server cleanup consistently
• Windows scheduler manifests now preserve runtime configuration, validate task/query structure, reject unsafe actions, and clean up exact owned tasks
• Coordination output no longer reports releases, claims, widening, or unclaims that did not actually occur
• Markdown-content linting and coordination-skill doctests now distinguish executable commands from nested, indented, or demoted fences without silently skipping assertions
• Release automation now validates tag/workspace/lock consistency before building, safely reuses draft releases, replaces partial assets on retry, verifies the complete non-empty asset set before publishing, and uses the Node 24 checkout runtime

What's Changed

• feat(runtime): supervise Codex turns through App Server by @fagemx in #467
• feat(task-rail): add scoped host-neutral task leases by @fagemx in #468
• feat(cli): reconcile unfinished task attempts by @fagemx in #470
• docs(coord): require PR-visible review-fix loop by @fagemx in #472
• feat(ops): schedule reconciliation and prove controller-loss recovery by @fagemx in #473
• test(drill): add reusable process capture harness by @fagemx in #477
• docs(coordination): bound review scope by @fagemx in #476
• fix(skills): own fleet-orchestrate global distribution by @fagemx in #479
• test(edda-conductor): fix ETXTBSY flake in codex_app_server fake server by @fagemx in #480
• docs(coordination): verification cost discipline — ladder, lanes, receipts by @fagemx in #481
• docs(coordination): scope build lanes to local heavy builds by @fagemx in #484
• feat(edda-cli): scaffold coord skills for Codex, and fix the unclaim doc by @fagemx in #485
• fix(edda-cli): make unclaim resolve from the board and never fake success by @fagemx in #487
• test(edda-cli): let shipped skills prove their own CLI claims by @fagemx in #489
• test(edda-cli): make a demoted doctest fence loud instead of silent by @fagemx in #491
• test(edda-cli): aim the doctest guard at edda steps and scan fences once by @fagemx in #493
• test(edda-cli): harden the doctest scanner against real markdown by @fagemx in #495
• test(edda-cli): make the sorted claim true, and name the scan's second cost by @fagemx in #504
• docs(edda-conductor): say what the liveness probe guarantees, and rename a test by @fagemx in #499
• docs(coordination): close the verification-cost wording follow-ups by @fagemx in #498
• fix(edda-cli): unclaim teardown flag and honest refusals by @fagemx in #496
• fix(edda-cli): say which claim a new one replaced by @fagemx in #500
• fix(edda-bridge-claude): remove redundant test imports by @fagemx in #511
• fix(edda-bridge-codex): emit hook event name by @fagemx in #510
• docs(cli): correct claim reference syntax and semantics by @fagemx in #512
• docs(project): correct workspace and CI coverage by @fagemx in #513
• coord(cli): widening a scope reports 'previous paths replaced' when nothing was replaced by @fagemx in #514
• edda-conductor: harden liveness probe follow-ups by @fagemx in #515
• ci: lint markdown tool output outside fences by @fagemx in #516
• fix(coord): bind session identity to process by @fagemx in #517
• feat(conductor): pi RPC launcher + --agent selector (#518) by @fagemx in #523
• fix(conductor): resolve the pi binary on Windows (#525) by @fagemx in #528
• fix(reconcile): replace fixed-count wait budgets with time-based deadlines (#524) by @fagemx in #530
• feat(conductor): codex launcher adapter + --agent codex (#527) by @fagemx in #531
• feat(edda-cli): edda dispatch — single-turn agent verb (#526) by @fagemx in #534
• fix(edda-conductor): route dead-child stdin write into the crash path with stderr tail (#536) by @fagemx in #537
• feat(conductor): verdict-gated phases (AWAITING_VERDICT) + edda verdict ledger object (#519) by @fagemx in #539
• feat(edda-cli): surface verdict gates in conduct dry-run by @fagemx in #548
• fix(edda-conductor): cmd_succeeds timeout defaults and retry classification by @fagemx in #549
• fix(edda-conductor): topo tie-break by declaration order by @fagemx in #550
• fix(edda-conductor): bound the pi_rpc child reaps by @fagemx in #553
• feat(edda-cli): phase approve/reject sugar resolving gate_sha and session from conductor state by @fagemx in #555
• fix(edda-conductor): keep both-stream tails and stop charging LNK1104 to the ladder (#540) by @fagemx in #554
• fix(edda-conductor): model plan-level cost measured-ness (#533) by @fagemx in #568
• feat(edda-conductor): plan phases declare owned write surfaces; phase claims carry them by @fagemx in #572
• docs(readme): reposition around one ledger, two layers — memory and fleet by @fagemx in #570
• feat(conductor): persist codex session-to-thread map across dispatch processes by @fagemx in #559
• chore(skills): track project dev skills and commands in the repo by @fagemx in #587
• fix(edda-ledger): retry lock contention instead of failing the concurrent writers test (#583) by @fagemx in #586
• docs(skills): point fleet skills at the repo's real conventions canon by @fagemx in #592
• docs(readme): land the review findings #570 merged without by @fagemx in #579
• feat(cli): edda claim check — surface intersection query (GH-562) by @fagemx in #576
• docs(specs): control layer (Layer 3) and non-coding L2 shapes — 2026-09-02 rulings by @fagemx in #600
• feat(conductor): decouple the lane heartbeat from the Claude bridge; runner writes it (GH-566 + GH-569) by @fagemx in #588
• docs(plan): unified roadmap — one numbering, two tracks (loop objects ∥ trust objects), stage exit tests by @fagemx in #616
• v0.4.0 chore(release): prepare binary release by @fagemx in #619

Full Changelog: v0.3.0...v0.4.0