0.9.0 — 2026-10-05

A minor release, because a tracker store this version enrolls cannot be
written by an older whip, and four published crates changed public types
that a dependent can match on, construct or call:

• Stored data. Once a tracker store publishes discovery files (below), it
  carries triggers that refuse any writer that does not take the publication
  lock, and whip 0.8.0 and earlier do not. Their reads still work, but every
  write fails with no such function: whip_tracker_discovery_writer_v1.
  Upgrade every whip that shares a tracker store before using this one on it.
• whipplescript-store: NormReferenceInventory, NormReferenceField,
  NormCharter, RunView, ProgramImportAdmissionRecord and
  ProgramImportWitness gained fields; Unready gained Initiative, which
  moves its later variants' discriminants; FlowingTargetEffectsOutcome gained
  InitialNoopNeedsGenesis.
• whipplescript-parser: IrProgram and Effect gained fields;
  IrEffectKind and BodyEffectKind gained TrackerMembership and
  TrackerInspect, which moves their later variants' discriminants;
  BodyEffectKind::TrackerFile and TrackerFinish gained initiative;
  Resource gained Pair.
• whipplescript-kernel: ShellOutput, ShellRequest, ResourceRef,
  ReadActionResult, ReconcileEffectCommand, BrokeredTurnInput,
  CheckedImportBasis, AssembledContext, ModelRequestProvenance and
  Planned gained fields; ResolvedPackage gained private fields and can no
  longer be built with a literal; InstructionAuthority gained AgentAuthor,
  which moves and renumbers its later variants; ChatMessage gained
  Developer; TransportError and HarnessModelError gained
  RetryBudgetExhausted; and
  RuntimeKernel::create_program_version_for_compiled_program_with_imports
  takes a fifth parameter.
• whipplescript: HostedRuntimeContextRequest gained notices;
  HostRuntimeError gained HomeJournal; NativeWorkspaceResolver is no
  longer UnwindSafe or RefUnwindSafe; and workspace_grep::GrepMatcher,
  grep_file_into and cap_grep_line are gone, replaced by the shared
  workspace helpers.

Code that matches those enums without a wildcard arm, builds those structs with
a literal, calls that method, compares or casts those enums by position, or
uses the removed grep items must follow the change. The command line and
configuration stay compatible.

• A tracker store can publish its current records into each enrolled
  checkout's tracker/ directory as searchable HJSON, with a startup
  context.hjson, refreshed under one lock with every write (WS-571).

• Native workspace embeddings can retain exact prepared file bytes through an
  explicit callback before write, edit and virtual bash effects. Refusal prevents
  the file changes; retained preparation still requires a successful saved owner
  witness before result publication.

• Version 2 effect reconciliation names the original action issuer separately
  from the current investigator's authority. Its signature and retry identity
  bind both coordinates; the target evidence keeps its own authority. Version 1
  bytes and receipts remain compatible. Rust embeddings add original_issuer: None to V1 constructors, or supply the original issuer for V2 commands.

• The curated mirror publisher accepts an explicit maintenance destination with source/tree and forward-history checks; its default remains main.

• Version 2 action-result reads name the current policy authority separately
  from the original command issuer. Version 1 retains its original contract.
  Rust embeddings add read_authority: None to existing V1 request constructors;
  V2 requires an explicit authority. Reads still require current access and
  exact original evidence.

• Hosted lease expiry preserves the original event completion time when rebuilding run projections, including tracker result recovery.

• Workspace edit and grep semantics now share pure helpers across native and Durable Object hosts. The native workspace resolver rejects overlapping edits while preserving leading BOMs; hosted grep keeps the same parameter behavior and 500-character line cap.

• Embeddings can fence a native imported diff with their original current
  authority. A final refusal rolls back the branch head, cut and operation
  receipt; exact recovery also requires current authority under retention.
  Backends without a final transaction check refuse guarded publication.

• The owned harness knows the limits of the newest models. Claude Fable 5 and
  5.1 compact against their 1M window and default to a 128K output ceiling,
  not 200k and 64K. GPT-6, GPT-5.6, GPT-5.4 and GPT-5.5 compact at their
  922,000-token prompt limit, the rest of GPT-5 at 272,000, and Grok 4.5 to
  4.7 at 500k. An unlisted Claude, GPT, o-series or Grok model now gets a
  250k window rather than 128k–200k. Any other unlisted model keeps its
  default. The limits are one table checked daily against models.dev
  (DR-0161).

• An authenticated host opts in to recorded presented-root renames with
  "workspace_root_renames": "recorded" on its turn request; the Durable
  Object worker forwards it into the placement's agent configuration, which
  the host cannot write itself. A public session cannot opt in.

• A v1 Agent's hosted session no longer makes a host's work-target references
  read-only. Only the root reference and references touching agent/,
  artifacts/ or work/ are narrowed, as the harness specification
  describes; any other subtree keeps the writability its host admitted.

• A Durable Object host can now admit presented-root renames: a host that sets
  "workspace_root_renames": "recorded" has the placement admit a rename of a
  writable root to a free name and record it at
  .whipplescript/root-renames/<n>.json for the host to ratify (DR-0148).
  Without the setting, hosted renames are still refused.

• A Durable Object's authored external tools reach the placement's
  implementation again. The shared SQL handle did not forward
  external_tool, so every call was refused before the placement was asked.

• A file-store ResourceRef may present its selected root to the model at
  another path, presented_as (DR-0148). The native and Durable Object hosts
  map every file tool and the virtual shell through one file_view module,
  keep selectors in every record, and report a shell mv of a presented root
  as a rename the embedding host admits through with_root_rename_admission.
  This breaks construction of ResourceRef, ShellRequest and ShellOutput:
  a dependent that builds one adds presented_as: None, presented_roots: Vec::new() or reads renames.

• The native host no longer refuses a bash command because an unchanged file
  it left behind is read-only; only changed, added and removed paths are
  checked for write access.

• The native host verifies the exact registered skill catalogue before asking
  an embedding resolver for its system-prompt source labels. Missing or changed
  skill bodies keep that model request's provenance incomplete.

Verifying this release

Built on GaugeWright's own fleet. Every file's SHA-256 is in
whipplescript-0.9.0.intoto.json, signed with the key in
docs/release-provenance.pub:

minisign -V -p release-provenance.pub -m whipplescript-0.9.0.intoto.json