GovernCode 0.1.0-motion.10

Tenth release candidate for Linux x86_64: a sandbox fix everyone should take, OpenCode as a
Runner, Specs that run side by side, recovery from usage limits, and a redesigned Dashboard.

Security

• Sandbox: an AI tool can open internet connections only as plain TCP or UDP. Before, a
  connection using MPTCP (Multipath TCP, which falls back to TCP) was not covered by the sandbox's
  TCP port rules, so a sandboxed tool, or a command it ran, could connect to local services on any
  port, reach remote hosts on ports its policy does not list, or listen on a local port. This
  affects every release up to 0.1.0-motion.9 on kernels with MPTCP enabled
  (net.mptcp.enabled=1, the default on many distributions). Filesystem rules, Gates and
  Checkpoints were not affected. govern-sup now refuses any other kind of internet socket, and the
  self-test checks on every start that an MPTCP socket is refused. If you cannot upgrade yet,
  sysctl net.mptcp.enabled=0 (root, system-wide) closes it.
• Terminal-safe output. gov escapes control and invisible characters in anything an AI
  tool wrote (Trace text, diffs, questions, tunnel output) and shows them as codes, so a tool can
  no longer move your cursor, rewrite earlier lines or hide text. Before accepting a Spec, gov
  warns when its diff holds such characters.

Added

• OpenCode as a Runner (OpenCode 2.0 with an OpenCode Go subscription, or OpenCode's free
  models). gov connect opencode (or Settings › Tools) takes the key from opencode.ai/auth for
  OpenCode Go alone; a paid Zen model is refused by name. govd drives opencode serve in a
  sandbox where it may listen on its one port and nothing inside may connect to it. OpenCode
  reports no usage window, so give it a budget (gov budget opencode ...); until then its
  Runners are held and the Dashboard says so. Tested with 2.0.23 and 2.0.24; another 2.x gets a
  note on the Spec, and other versions are refused. The README lists its honest limits.
• Specs run side by side. Delegating returns at once, Runners work in parallel, and the
  Controller is woken with their results. You can follow up with or cancel a Runner while it
  works. Every Spec still has its own copy, and its diff is reviewed before it is accepted.
• Recovery from usage limits. A Spec or a turn that hits a provider's limit shows as
  "limited", with the reset time the provider gave (never a guessed one). Resume it now, at the
  reset (opt in with gov auto-resume on), or later by hand (gov limited, gov resume). It
  survives a govd restart.
• Project memory that fits the model. A Controller handing over to another gets short
  conversations whole and the relevant parts of long ones, never a shortened version of your
  new message; it says so when something had to be left out, and can fetch older history from
  the Trace.
• gov friction: how often each tool asked, which kinds of steps asked most, which you
  allowed every time, and the steps the sandbox probably blocked (an estimate from tools'
  permission errors; no output text is kept). Also a card on the Dashboard's Overview.
• gov acp search|inspect|install (development): browse the Agent Client Protocol registry
  and keep an agent's download, checked against its checksum. No Runner uses these yet.
• Forecasts: at the current pace, when a usage window would reach its reserve.

Changed

• The Dashboard, redesigned. A new layout in light and dark that follows your system theme,
  with new names: Terminal is now Conversation, Pipeline Specs, Limits Allowance and
  Home Overview. New: Watch, a live view of what the Controller and each Runner are doing,
  with waiting Gates, allowance and elapsed time (also in its own window); the Trace as a timeline
  written as sentences; Allowance with rings, window bars and the next resets; Ctrl K to jump
  anywhere and answer short Gates from the keyboard; Specs review with the full-width diff and a
  bar that names exactly what it applies; Settings as grouped lists; a first-run welcome.
• The Controller hears what you decided. When you accept or discard a Spec (in the Dashboard
  or with gov), your next message tells the Controller, once; before, it did not know until you
  said so.
• Accept applies exactly what you reviewed: if a Spec changes after you looked at it, the
  review refreshes and the old view cannot be accepted.
• Claude Code and Codex step results that show a permission error are recorded as probable
  sandbox blocks (also for Grok and OpenCode).
• Closing the terminal no longer closes the Dashboard. governcode-dashboard started from a
  terminal now leaves it; its output goes to launch.log in the Dashboard's settings folder
  (GOVERNCODE_DASHBOARD_FOREGROUND=1 keeps it attached).
• A mistyped command gets a short answer, with the command you probably meant (gov limit:
  "Did you mean gov limits?"), instead of the whole usage.
• gov budget and gov reserve take short window names: 5h, day, week, month.
• gov limits says "used" (weekly 85% used) gives a reset more than a day away with
  its day, and shows what each window keeps back (a window's own reserve, not the Runner's default).
• ./install.sh --service gives the service your PATH, so govd starts with the Node.js that
  passed the installer's check. Before, early at login, systemd could start it with an older
  system Node, which failed until a retry happened to find the right one.

Fixed

• A Claude Code Controller's turn could hang when Claude Code was slow to exit after its result.
• A project whose folder was gone (moved, deleted, or in a /tmp a reboot cleared) failed with
  the sandbox's spawn error; it now says the folder no longer exists.
• In a long conversation, the mouse wheel could scroll the whole Dashboard window up out of view
  (a hidden screen-reader label stretched the page); only the conversation scrolls now.
• A line holding U+2028 or U+2029 (from an AI tool's text) split a protocol message and crashed
  gov.
• Watch counted an event twice if it arrived twice before the day's totals.
• Discarding a Spec is checked again after you approve it, in case the Spec changed meanwhile.

Upgrading

Run ./install.sh --service from this release (it rewrites the service with your PATH), then
systemctl --user restart governcode. To use OpenCode: gov connect opencode, then
gov budget opencode ....