Across Orchestrator v0.12.2

Preserves ordinary task identifiers across every public-output redaction layer while continuing to redact standalone credential-shaped values. This restores hash-verifiable Worker receipts through both socket and CLI fallback paths.

Across Orchestrator v0.12.1

Patch release preserving ordinary task protocol identities during public sanitization so Worker evidence receipts remain hash-verifiable. Token-shaped secrets and private paths continue to be redacted. Includes the v0.12.0 Goal Contract and Worker release capabilities.

Across Orchestrator v0.12.0

Goal Contract v1 revalidation becomes an explicit plan/start/complete protocol with authoritative terminal and evidence receipts. This release also aligns Worker and relay distribution metadata, strengthens stale-attempt fencing, and resolves the remaining CodeQL test-quality findings. Validated with 359 tests, 14 subtests, package smoke, installed AAA provider/consumer acceptance, a real remote Worker completion, reconnect after lifecycle repair, and late-result quarantine.

Across Orchestrator v0.11.0

Adds authoritative Goal Contract execution receipts, revision-aware revalidation, criterion-bound Worker evidence, durable terminal transaction recovery, and stricter host input validation. Includes concurrency and interruption hardening for terminal Job commits.

v0.10.12

Merge pull request #70 from fantasyce/codex/release-v0.10.12-retry

Release Orchestrator v0.10.12

Across Orchestrator v0.10.11

Across Orchestrator v0.10.11 keeps read-only agent reports in Orchestrator-owned task storage, so hosts can display and review analysis without requiring changes to the inspected project. Managed paths and hashes are revalidated when evidence is read; empty, escaped, missing, or tampered records fail closed.

Validation:

• 316 tests passed, 5 platform-dependent tests skipped, 14 subtests passed
• CLI smoke and sensitive-text scan passed
• npm package dry run verified 0.10.11
• GitHub Quality, npm audit, and CodeQL passed
• Worker assets were checksummed and attested
• Relay image was scanned, published, signed, and attested

The tag points to the exact origin/main release commit.

Across Orchestrator v0.10.10

Across Orchestrator v0.10.10 resolves all outstanding CodeQL quality findings across the Worker, Relay, sandbox, and test surfaces without changing public contracts.

Validation:

• 312 tests passed, 5 platform-dependent tests skipped, 14 subtests passed
• CLI smoke and sensitive-text scan passed
• npm package dry run verified 0.10.10
• GitHub Quality, npm audit, and CodeQL passed
• Default-branch CodeQL open alerts: 0

The tag points to the exact origin/main release commit. Worker and Relay assets are built, scanned, signed, and attested by the tag-triggered release workflow.

Across Orchestrator v0.10.9

Patch release that makes the macOS sandbox acceptance probe independent of repository checkout location. Runtime sandbox policy is unchanged.

Across Orchestrator v0.10.8

Relay security remediation release.

• Refreshes Alpine packages in the final Relay image before runtime installation.
• Resolves the SQLite vulnerabilities that correctly blocked v0.10.7 Relay publication.
• Preserves the strict HIGH/CRITICAL Trivy publication gate, signed digest, SBOM, and provenance requirements.
• Keeps the portable MCP schema, provenance, and sandbox hardening from v0.10.7.

Validated by 311 tests, 14 subtests, CLI smoke, sensitive-path scanning, uv lock consistency, package dry-run, CodeQL, and GitHub Quality CI. The tag targets the exact origin/main release commit.

Across Orchestrator v0.10.7

Portable MCP schema and managed-runtime provenance hardening release.

• Publishes strict-host-compatible MCP tool schemas.
• Preserves host-managed plugin provenance through runtime calls.
• Refreshes sandbox idle timeout from actual stdout/stderr activity while preserving the maximum wall-clock limit.
• Adds dual-stream backpressure and timeout regression coverage.
• Includes the cryptography 50.0.0 security update.

Validated by 311 tests, 14 subtests, CLI smoke, sensitive-path scanning, npm audit, package dry-run, CodeQL, and GitHub Quality CI.