v0.5.0

Added

• Release automation publishes the workspace before the GitHub Release — pushing a v* tag makes CI derive the dependency-first publish order, upload every publishable crate, verify immutable registry provenance against the tag SHA, and only then create and populate the GitHub Release behind a crates.io parity gate (GH-648)
• Operator daily digest — edda recap --digest prints the deterministic operator digest for the last window, edda notify send pushes free text as a digest event, and scripts/fleet/daily-digest.sh assembles the fleet-wide daily report (GH-765)
• edda verify — top-level verb wiring Ledger::verify_chain so users can audit their own hash chain (GH-647); edda status --json with a golden fixture (GH-730); build identity included in edda --version (GH-746)
• Cross-machine claim guard — scripts/fleet-claim-issue.sh plus edda dispatch --issue/--machine coordinate fleet claim handoff across machines (GH-656), with role-aware issue claims before dispatch (GH-782)
• Merge-precondition gate — merges are gated on recorded preconditions (GH-580)
• Ledger event v1 specification — the ledger's event surface is specified and fixture-backed (GH-608)
• Conductor phase gates matured — gate-wait progress signals with a visible deadline (GH-551), honest gate-timeout state with waiver semantics and an on_gate_timeout policy (GH-552), phase elapsed time accounting (GH-644), infrastructure contract plans (#856), and phase terminal-state notifications through edda-notify (GH-564)
• Review system — REVIEW.md as the one executable review spec (#633), a wiring verdict slot with scripts/wiring-scan.sh (#629), the PR review watcher that launches the read-only reviewer and posts SHA-pinned verdicts plus the Independent Review status (#641), and one resumable reviewer conversation per PR (GH-708)
• Dispatch capabilities — edda dispatch passes through launcher capabilities: model, thinking, tool policy, session dir, and model listing (GH-574); pi session transcripts are ingested post-dispatch (GH-577)
• Fleet lanes — a tracked lane launcher scripts/fleet/lane-launch.ps1 / lane-status.ps1 (GH-606) plus persistent lane helpers (#868); process object claims and merge gate protection (GH-581)
• CI hardening — path-aware CI that skips clippy/test for docs-only changes behind an aggregate CI Gate job (#643), merge_group support (#635), and an MSRV 1.91.0 check (GH-824)
• Machine-detectable CLI docs coverage — scripts/check-cli-docs.sh verifies every verb and long flag in docs/reference/cli.md against the built binary (GH-650, GH-795)

Changed

• The toolchain is pinned to 1.98.1 and rust-version is declared 1.91 — CI no longer floats ahead of workstations (GH-814)
• [profile.dev] uses line-tables-only debuginfo and rust-lld, halving the debug build footprint and cutting Windows link time 12–21% (GH-810)
• dirs::home_dir is banned workspace-wide; home resolution goes through edda_core::paths (GH-812)
• Opening a ledger refuses newer schema_version files instead of guessing (GH-729), and COMPATIBILITY.md documents the upgrade policy plus the enumerated stable --json contracts (GH-651)
• The review transport moved from pi to edda dispatch-launched Claude with Opus pinned and UUID sessions (GH-708), and the verification ladder's L1 is exact-head CI plus the verifier's focused Windows-gap run (#753)
• Large modules were split for maintainability — cmd_bridge/, cmd_reconcile/, runner gate.rs/outcome.rs — and process-spawning tests moved to integration tests (GH-777, GH-778, GH-776, GH-799)
• Pre-commit and commit-msg hooks are git-native via core.hooksPath, enforcing the L0 gates locally, with a file/function-length ratchet (GH-634, GH-779)

Fixed

• Verdict gates fail closed: bad freshness bounds, unparsable gate_entered_at, and unreadable ledgers surface errors instead of proceeding (GH-541, GH-744)
• Conductor reconciles in-memory state with disk before phase selection (GH-750), clears stale waivers on retry (GH-747), anchors gate-progress budgets to entry (GH-751), and survives concurrent runner saves and manual skips (GH-556)
• Fleet lane lifecycle: lane-stop kills the whole process tree (GH-672), process snapshot and child PID ordering fixed (GH-706), review lanes supported in lane-stop/lane-status (GH-712), git-config-guard detects and recovers corrupt refs (GH-797), and .git/config backups are validated and restored post-kill (GH-715)
• Bridges surface swallowed hook-path write errors (GH-745, GH-692), fix per-turn peer dedup defeated by wall-clock age (GH-678), and stop writing empty session digests with absurd durations (GH-578)
• Claims report standing bare-CLI claims and share one liveness criterion through session inference (GH-705, GH-617)
• edda ask and export projections report the governance tier (GH-806) and disambiguate empty vs unregistered stores (GH-701)
• Postmortem command_failure keying, segment command-word matching, and a separate show counter (GH-813)
• Background sharing of the current Haiku model selection (#875); cost estimates return Option and refresh the pricing table (GH-585)
• Release automation enforces distribution channel parity before publishing (GH-655)

What's Changed

• fix(gitignore): ignore backups inside the re-included .claude trees; anchor the CLAUDE.md pattern by @fagemx in #621
• fix(skills): issue-pipeline and pull-request stop skipping review, deleting branches, and removing worktrees by @fagemx in #622
• fix(skills): intel-scan branch bootstrap — group the orphan path; pop the stash only if one was pushed by @fagemx in #625
• fix(skills): fleet-review follows the verification ladder — READ receipts and exact-head CI, RAN only uncovered checks by @fagemx in #623
• ci: merge_group trigger and an aggregate CI Gate job over fmt, clippy, and test by @fagemx in #635
• chore(repo): untrack the .tmp/ files that the ignore rule already covers by @fagemx in #636
• design(fleet): substitutable reviewer — engine pool, canary set v0, brief template v1, calibration demo by @fagemx in #638
• feat(skills): wiring verdict — required four-question slot per new surface at review time, plus scripts/wiring-scan.sh by @fagemx in #629
• ci: path-aware CI — detect job skips clippy/test for docs-only changes; CI Gate accepts those skips (#631) by @fagemx in #643
• feat(edda-cli): wire launcher capabilities through edda dispatch — model, thinking, tool policy, session-dir, model listing (GH-574) by @fagemx in #627
• feat(conductor): phase terminal-state notifications through edda-notify (GH-564) by @fagemx in #620
• feat(skills): fleet-epic-split absorbs plan-decompose — four inputs, dedupe + confirmation table + cross-refs + provenance, one ready-bar body; retire plan-decompose (#599) by @fagemx in #653
• fix(edda-bridge-claude): stop writing empty session digests with absurd durations (GH-578) by @fagemx in #607
• chore(repo): git-native pre-commit and commit-msg hooks via core.hooksPath — L0 gates machine-enforced (#634) by @fagemx in #640
• fix(edda-conductor): phase cost reaches the ledger structured, loud, and library-written (GH-584) by @fagemx in #624
• feat(edda-cli): wire Ledger::verify_chain to a top-level 'edda verify' verb (GH-647) by @fagemx in #657
• fix(bridge): session digest cost distinguishes unmeasured from zero (GH-585) by @fagemx in #658
• feat(fleet): pr-review watcher — launches the read-only reviewer on PR open and on push, posts the SHA-pinned verdict by @fagemx in #641
• chore(skills): retire the Karvi dispatch skill and purge stale Karvi references (#661) by @fagemx in #662
• chore(repo): reconcile .gitignore with GH-649 operator ruling by @fagemx in #660
• fix(conductor): check capture records executed shell line and keeps stream heads (GH-558) by @fagemx in #659
• docs(canon): align the canon with fleet.merged-artifact-cleanup and fleet.review-engine-pool; installation typo (#663) by @fagemx in #664
• docs(specs): edda review design — cross-vendor, read-only, SHA-pinned review verb by @fagemx in #654
• feat(fleet): a tracked lane launcher — scripts/fleet/lane-launch.ps1 and lane-status.ps1, plus the runbook entry (#606) by @fagemx in #668
• docs(reference): bring cli.md up to the 0.4 surface + machine-detectable gap check (GH-650) by @fagemx in #670
• docs(fleet): manager agent design — blackboard, workers, and a scheduled manager that decides by rule (#674) by @fagemx in #675
• docs(node): edda node design — a resident per-machine node over Tailscale with delivery receipts, reversing the transport-free doctrine (#685) by @fagemx in #686
• fix(release): enforce distribution channel parity by @fagemx in #655
• docs(specs): lane profiles v1 design — an agent actor is the dispatch profile (GH-593) by @fagemx in #684
• fix(edda-cli): claim check applies the shared peers liveness criterion (GH-617) by @fagemx in #687
• fix(fleet): lane-stop.ps1 — Stop-ScheduledTask does not kill the lane process tree (GH-672) by @fagemx in #696
• fix(edda-cli): classify backend auth failure as a crash, not a done turn (#669) by @fagemx in #700
• fix(edda-bridge-claude): per-turn peer dedup defeated by wall-clock age in hashed block (GH-678) by @fagemx in #698
• docs(review): REVIEW.md — one executable review spec (#633) by @fagemx in #689
• docs(edda-conductor): verdict gate documentation debt (GH-542) by @fagemx in #707
• fix(scripts): review-pr.sh — Git Bash launch, silent doneWhen loss, browser manuals, inverted verdict label (#683, #691, #697) by @fagemx in #709
• design(fleet): lane privilege threat model — what a lane can reach (GH-690) by @fagemx in #695
• fix(edda-conductor): manual skip on a pending phase survives concurrent runner saves (GH-556) by @fagemx in #713
• feat(cli): merge-precondition gate (GH-580) by @fagemx in #711
• fix(edda-ledger,conductor): verdict gate fails closed on a bad freshness bound and surfaces unreadable-ledger errors (GH-541) by @fagemx in #718
• feat(edda-conductor): honest gate-timeout state, waiver semantics, and on_gate_timeout policy (GH-552) by @fagemx in #721
• fix(cli): re-declare non-check edda claim usage diagnostics contract (GH-589) by @fagemx in #722
• feat(coord): process object claims and merge gate protection (GH-581) by @fagemx in #723
• fix(bridge): estimate_cost returns Option and updates model pricing table (GH-677) by @fagemx in #724
• feat(edda-conductor): gate-wait progress signals and a visible deadline (GH-551) by @fagemx in #725
• feat(bridge): ingest pi session transcripts post-dispatch (GH-577) by @fagemx in #726
• fix(edda-ask): disambiguate empty/unregistered store and resolve worktrees under home (GH-701) by @fagemx in #728
• fix(ledger): enforce the refuse-newer schema_version gate on ledger open (GH-729) by @fagemx in #735
• chore(conductor): serialize state.json writes with plan-scoped file lock (GH-714) by @fagemx in #737
• docs(specs): align RAN-timeout and lattice prose with combine_gate_status semantics by @fagemx in #727
• fix(fleet): review transport pi → edda dispatch claude — Opus pinned, UUID sessions, narrowed closing-keyword rule (GH-708) by @fagemx in #720
• fix(fleet): fix process snapshot order and child PID indexing in lane-stop.ps1 (GH-706) by @fagemx in #740
• fix(edda-conductor): propagate load_state error in save_state_reconciled (GH-741) by @fagemx in #758
• fix(scripts): pr-review-launch resolves pwsh.exe to an absolute path and DryRun fails on non-zero LastTaskResult (GH-694) by @fagemx in #755
• fix(fleet): one resumable reviewer conversation per PR (GH-708) by @fagemx in #754
• fix(fleet): support review lanes and action-based wrapper resolution in lane-stop and lane-status (GH-712) by @fagemx in #759
• fix(conductor): reconcile in-memory state with disk before phase selection (GH-750) by @fagemx in #768
• docs(core): COMPATIBILITY.md — schema_version upgrade policy and enumerated stable --json contracts (GH-651) by @fagemx in #732
• fix(bridge): surface swallowed hook-path writes and add pre-commit ratchet (GH-692) by @fagemx in #736
• fix(edda-cli): restore the build — dispatch golden fixture matches the 5-arg signature (GH-770) by @fagemx in #771
• fix(tests): make workspace- and store-dependent tests hermetic (GH-646) by @fagemx in #719
• fix(edda-cli): make the claim machine gate see bare CLI claims; one liveness criterion through session inference (GH-705) by @fagemx in #717
• feat(fleet): cross-machine claim guard — fleet-claim-issue.sh + edda dispatch --issue/--machine (GH-656) by @fagemx in #716
• fix(conductor): clear stale waivers on retry, wire gate-timeout ledger recorder, and bucket in runner-status (GH-747) by @fagemx in #781
• fix(fleet): validated .git/config backup and post-kill restore (GH-715) by @fagemx in #773
• refactor(edda-serve): externalize test monoliths into mod tests files (GH-775) by @fagemx in #785
• chore(githooks): file- and function-length ratchet (GH-779) by @fagemx in #787
• fix(edda-conductor): fail-closed on unparsable gate_entered_at; keep waive on unread ledger (GH-744) by @fagemx in #796
• fix(conductor): anchor gate-progress budget to entry and route to notify channels (GH-751) by @fagemx in #798
• feat(edda-cli): add edda status --json with its golden fixture (GH-730) by @fagemx in #788
• test(edda-cli): move process-spawning e2e tests to integration tests by @fagemx in #799
• refactor(edda-conductor): split runner/sequential.rs into gate.rs + outcome.rs (GH-776) by @fagemx in #807
• fix(fleet): tear down fake lanes from trap in test-git-config-guard.sh (GH-786) by @fagemx in #803
• feat(cli): include build identity in edda --version (GH-746) by @fagemx in #804
• refactor(edda-cli): split cmd_bridge.rs into cmd_bridge/ directory module (GH-777) by @fagemx in #815
• fix(edda-cli): report governance tier in export and ask projections (GH-806) by @fagemx in #816
• fix(fleet): extend git-config-guard to detect and recover corrupt refs (GH-797) by @fagemx in #805
• fix(bridge): surface swallowed hook-path write errors in agent_phase (GH-745) by @fagemx in #818
• refactor(edda-cli): split cmd_reconcile.rs into cmd_reconcile/ directory module (GH-778) by @fagemx in #819
• chore(repo): ban dirs::home_dir and resolve home through edda_core::paths — it ignores HOME on Windows while the lane wrapper sets it by @fagemx in #812
• chore(repo): halve the debug build footprint locally and cut Windows link time 12-21% — [profile.dev] line-tables-only plus rust-lld by @fagemx in #811
• chore(repo): pin the toolchain to 1.98.1 and declare rust-version = 1.91 — CI floated five releases ahead of this workstation by @fagemx in #814
• fix(scripts): check-cli-docs.sh enumerates options flags per verb (GH-795) by @fagemx in #817
• chore(skills): pr-review-loop is an author self-check, not a review (GH-743) by @fagemx in #826
• docs(core): fix COMPATIBILITY.md line citations for dispatch, verify, status (#774) by @fagemx in #827
• docs(review): list reviewer_session in section 7 and bump edda_review to 2 (#756) by @fagemx in #829
• docs(ladder): L1 is exact-head CI plus focused Windows-gap run by verifier (#753) by @fagemx in #832
• docs(fleet): point merge-gate text at CI Gate (ci.merge-gate) by @fagemx in #830
• chore(skills): point five skills at REVIEW.md instead of restating rules by @fagemx in #831
• chore(skills): fleet-worker adds gate-ownership rule to 五禁 (#791) by @fagemx in #833
• fix(fleet): isolate lane-launch.ps1 -DryRun artifacts to $Name.dryrun* namespace by @fagemx in #828
• chore(build): build-hygiene cleanup (7 unused dirs deps, redundant CI env, CLAUDE.md §3.1, thin ban reason) (#821) by @fagemx in #835
• chore(skills): align issue-pipeline with fleet lanes, taking, and house review by @fagemx in #834
• docs(claude-code): document all 12 installed hooks and evidenced injection by @fagemx in #839
• fix(review): embed write-end swallow lens from wiring-scan into brief (#733) by @fagemx in #837
• docs(fleet): R21 start-path claim check; R1 carrier is taking+claimed by @fagemx in #840
• chore(fleet): drop fleet:ready at merge and skip delivered issues when picking by @fagemx in #836
• docs(review): U3 must not claim an empty doneWhen without Issue: by @fagemx in #842
• feat(release): publish workspace before GitHub release by @fagemx in #847
• docs(bridge): retain captured hook stdout for GH-710 by @fagemx in #845
• docs(fleet): brief template for role × runtime composition by @fagemx in #843
• docs(bridge): map shared core extraction boundaries and slices by @fagemx in #851
• feat(docs): gate anchored source citations in CI and staged commits by @fagemx in #852
• docs(readme): name Layer 3 as the control layer and #560 epic by @fagemx in #854
• chore(skills): collapse fleet-worker claim to one script call by @fagemx in #853
• ci: add MSRV (1.91.0) check job to CI gate (#824) by @fagemx in #838
• feat(conductor): add infrastructure contract plans by @fagemx in #856
• docs(cli): dispatch networked Codex via edda, not the plugin sandbox by @fagemx in #861
• feat(cli,conductor): add elapsed time accounting by @fagemx in #859
• feat(skills): give controllers a ready-batch selection procedure by @fagemx in #864
• feat(core): specify ledger event v1 by @fagemx in #857
• fix(edda-cli): role-aware issue claims before dispatch (GH-782) by @fagemx in #850
• test(bridge): isolate parallel store and environment state by @fagemx in #866
• feat(fleet): post the Independent Review commit status from the PR review watcher (GH-742) by @fagemx in #823
• feat(fleet): add persistent lane helpers by @fagemx in #868
• docs(architecture): GH609 signing design, threat model, and Node Ed25519 spike by @fagemx in #863
• fix(postmortem): command_failure keying, segment command word matching, and separate show counter (GH-813) by @fagemx in #862
• fix(review): enforce structural read-only review capabilities by @fagemx in #858
• chore(fleet): GH-690 lane privilege spike harness — fail-closed, prepared NOT RUN by @fagemx in #855
• fix(edda-cli): detach dispatch from controller jobs (GH-605) by @fagemx in #860
• fix(edda-cli): report standing bare-CLI claims, and decide liveness through the one shared criterion (GH-780) by @fagemx in #790
• feat(edda-cli): operator daily digest — edda recap --digest, edda notify send, scripts/fleet/daily-digest.sh (GH-765) by @fagemx in #825
• docs(fleet): require released claim withdrawal by @fagemx in #874
• fix(background): share current Haiku model selection by @fagemx in #875
• fix(review): route source claims to pinned code by @fagemx in #878
• fix(edda-conductor): preserve cost measured-ness in brief.json (GH-571) by @fagemx in #877
• docs(skills): track edda-release skill for the CI publication flow (GH-648) by @fagemx in #889
• chore(release): prepare v0.5.0 by @fagemx in #891

Full Changelog: v0.4.0...v0.5.0