v1.1.1 — MCP tests skip on an older SDK (AUR check surface)

Packaging fix for v1.1.0, found by building the AUR package locally after the publish.

1.1.0 moved the MCP host surface to SDK v2 (MCPServer, Client) and pinned the extra at mcp>=2, but tests/mcp/test_mcp.py guarded only on import mcp. With an older SDK installed the two v2-only tests failed instead of skipping — and Arch's extra/python-mcp is 1.28.1, while the AUR recipe runs the offline suite against system packages in check(). makepkg on mklang 1.1.0 therefore fails on an up-to-date Arch box. Repo CI cannot see this: it always installs the extra at its declared floor.

• The suite now probes mcp.server.mcpserver — the v2 module it actually needs — instead of a version string. Verified on the extracted sdist against mcp==1.28.1: 567 passed, module skipped; unchanged at mcp 2.0.
• mklang-mcp names the SDK floor and echoes the import error, so "installed but too old" is distinguishable from "not installed".
• packaging/arch/PKGBUILD records the python-mcp>=2 floor in optdepends.

No language or interpreter behaviour change; 1.1.0's contents are otherwise unchanged.

v1.1.0 — total gate transitions, control-flow taint, honest freeze

Three holes in the control model, closed together. Language stays 0.3; this is a package MINOR under ADR 0026.

Gate judging is total (SPEC §5)

A gates: list is a relation, not a function — but the fused judge was a forced choice: it had to name one of the batch's conditions even when none held, silently turning first true into best match and making a when: otherwise after a prose gate unreachable except through the unparseable-judge fallback.

• The batch is now presented with one extra option, "none of the above conditions is true" (N+1). A none verdict falls through to the next gate, exactly like a hook returning False; running off the end halts with no-gate-matched.
• LLM.judge gains allow_none; adapters that predate it are detected by signature inspection and traced as judge_forced_choice.
• lint: no catch-all gate and the only when: otherwise gate is a repair are structural — lint --strict now fails a state without a non-repair when: otherwise. This is the one intentional authoring break.

Control-flow taint (SPEC §6 / ADR 0030)

ADR 0025 fenced untrusted values so a model can tell data from directives. That protects the text a state reads; it said nothing about the transition a gate chooses after reading it.

• The engine tracks external ⊆ tainted. A transition judged with any external key in scope is decision_tainted, and the run stays flow-tainted until a hook: gate or a human.reply injected for that suspension confirms it.
• An effectful tool: reached under a tainted decision is recorded as untrusted_control_flow; --untrusted-flow halt refuses it before the tool runs. Unclassified tools are effectful by default. The flag crosses call: into sub-runs, so one level of indirection does not launder the decision.
• The policy is on every surface: CLI run/resume, engine.run(...), the MCP run/resume tools (stored on the session), and ConsoleTools.
• lint reports the same shape statically, following call: edges when a registry is available.

Honest freeze and metrics

• SPEC §8 "What a trace attests" (normative): the trace records who decided, not why or that it was correct.
• The conformance boundary is written down: every case scripts the oracle, so conformance pins the mechanical contract and nothing about which verdict a model gives.
• ADR 0031 names the falsifiers that would force a language 0.4, with thresholds set before the data.
• scripts/gate_divergence.py gained metrics that can fail (boundary corpus, gold accuracy, gate blind spot, cross/intra-provider split, paraphrase invariance); scripts/repair_convergence.py asks whether repair(N) actually lifts the pass rate. No live rows yet — instrumentation, not findings.

Fixed

• Console HITL replies were written into the resumed context unfenced — the one value typed by a human answering a machine. They are now marked untrusted like every other host-injected value (ADR 0025).
• A human.reply left on the blackboard by an earlier HITL cycle cleared the taint of a later decision the human never saw.
• console/capabilities.py restated read-only/effectful alongside controlflow.TOOL_EFFECTS; there is now one source of truth, pinned by a test.

Full detail in CHANGELOG.

mklang 1.0.13

mklang 1.0.13

Dogfood release from the meeting2workflow emission path.

Added

• Parametric host hooks: eq:key:value / neq:key:value
• Builtin write_failed for write_file observations
• Lint: unquoted # inside raw when: conditions (YAML comment truncation)

Fixed

• mklang test accepts scenario context: as synonym of input:

See CHANGELOG.md for full notes.

mklang 1.0.12

Fixed

• AUR / sdist check() no longer crashes on test_pkgbuild_version_is_synchronized: the test skips when packaging/arch/PKGBUILD is absent (intentionally excluded from the sdist).
• Docs strict build: CONTRIBUTING links to the Arch packaging README via GitHub URL (path is outside the docs site).

Changed

• Quality gate re-runs the offline suite against the extracted sdist after uv build.
• Documented the sdist-as-consumer contract in packaging/arch/README.md and CONTRIBUTING.md.

Full notes: CHANGELOG

mklang 1.0.11

Documentation coherence for the host tools: config surface.

Fixed

• ADR 0016 Status (and the ADR index) no longer claim the runtime.yaml tools: block is deferred — it shipped with the generalized host-tool config; a release-suite guard pins the status against that drift.

Language remains 0.3. Package 1.0.11.

Validation: offline quality matrix green on PR #68; release workflow runs quality + live gate + PyPI Trusted Publishing.

mklang 1.0.10

Workspace isolation, runtime budget accounting, packaging hygiene and an
internal layout refactor.

Added

• Workspace-scoped session continuation, registry safety diagnostics and
  regression coverage for environment, filesystem and judge-cost boundaries.
• All examples/*.test.yaml scenarios run in the offline suite
  (tests/repo/test_examples.py), which also pins every machines/ workspace
  copy byte-identical to its examples/ twin; machines/*.mkl joins the CI
  schema/check/lint gates.
• Version headings in this changelog link to the GitHub compare view.

Changed

• Make console/configuration workspace selection authoritative and make
  mklang init transactional with rollback on failure.
• Include judge usage in cost accounting, partition fan-out budgets and apply
  the console default budget to agent turns.
• Document the corrected isolation, budgeting, initialization and console
  contracts.
• Internal layout (no user-facing changes, ADR 0029): the doctor
  diagnostics and the argparse tree moved out of cli.py
  (cli_doctor.py, cli_parser.py); the console worker bridge and the
  capability policy moved into console/ (bridge.py,
  capabilities.py); tests/ mirrors the src layout.
• Support policy restated post-1.0 (SECURITY.md, stability guide);
  conformance README scope now covers the 0.3 parse: list and raw-input
  cases; .env.example documents the MKLANG_* host-layout and plugin-policy
  variables.

Fixed

• The sdist no longer bundles release artifacts: dist-release/, packaging/
  and uv.lock are excluded (the 1.0.9 sdist shipped a stale copy of itself
  and an old makepkg tarball).

mklang 1.0.9

Agentic console completion and provider/configuration hardening.

Highlights:

• persistent goal/plan/progress ledger with session continuity and inspector visibility
• explicit decision repair path and bounded agent lifecycle
• atomic machine authoring after validation
• explicit OpenAI-compatible provider protocols and structured diagnostics
• updated documentation, release metadata and Arch packaging

Validation: 486 passed, 1 skipped; Ruff, MyPy, schema/lint and distribution checks passed.

mklang 1.0.8

Highlights

• Migrates the DeepSeek provider configuration to the current deepseek-v4-flash API model.
• Makes thinking mode explicit per tier: disabled for fast/balanced, enabled with high effort for reasoning.
• Forwards OpenAI-compatible thinking parameters correctly and improves model-not-found diagnostics.
• Stabilizes the cross-provider severity release fixture with an explicit deterministic policy.

Validation

• Live DeepSeek V4 smoke passed (react, result 153)
• Cross-provider gate passed at 1.0 agreement on 12 runs
• 460 tests passed, 1 skipped in the pre-release suite
• Ruff, format, mypy, uv lock, and demo drift checks passed

mklang 1.0.7

Highlights\n\n- Console workspace defaults to the absolute launch directory and injects it into every brain execution path, including resumed turns.\n- Workspace snapshots and read-only tool observations now report the absolute workspace root while keeping paths confined and relative.\n- Live demo tapes and assets are pinned and validated against the repository source.\n\n## Validation\n\n- 469 tests passed, 1 skipped\n- Ruff, format, mypy, uv lock, demo drift checks passed

mklang 1.0.6

Console safety, recovery, and host-policy hardening.\n\nHighlights:\n- scoped machine:tool capabilities and redacted audit records\n- conservative plugin allowlist via MKLANG_ALLOWED_PLUGINS\n- uniform untrusted tool observations and high-risk confirmation handling\n- transcript replay, actionable worker recovery, strict /run parsing, and responsive inspector states\n- expanded regression and security coverage