v0.7.0

Added

• Demo GIF + scripted replay. New demo/replay.mjs (a presentation-only
  replay of a /maestro task run that closely mirrors the runtime's real log
  output) and demo/demo.tape (VHS scene) render docs/assets/demo.gif,
  now embedded at the top of both READMEs. Dev-only: demo/ and
  docs/assets/ are excluded from release archives.
• Always-on token accounting. Completed task runs log their total token
  usage (tokens=<used>[/limit]) and persist tokensUsed in the run
  manifest (budget-stopped runs too); /maestros shows tokens=<n> per run.
  Enforcement stays opt-in via GHCP_MAESTRO_BUDGET_TOKENS — accounting
  always-on, spend caps only when explicitly configured.
• Cross-agent prompt-injection hardening. Dependency outputs
  (augmentPromptWithDeps) and the synth digest (buildSynthPrompt) are now
  fenced in <<<UNTRUSTED-AGENT-OUTPUT>>> sentinels with an explicit
  treat-as-data instruction, per OWASP Agentic Security guidance — agent
  output is data, not instructions. Always-on, zero token cost. (#33)
• Opt-in per-label model routing. New core/model-routes.mjs:
  GHCP_MAESTRO_MODEL_ROUTES (or opts.modelRoutes) maps label patterns
  (plan, explore:<agent>, verify, synth; * wildcards,
  first-match-wins) to models so fan-out workers can run on cheaper models
  than the planner/synth. No routes → adapter default, specs unchanged. (#17)
• Opt-in verify phase. GHCP_MAESTRO_VERIFY=1 (or opts.verify) inserts
  a verification agent between explore and synth that judges each subtask
  output against the original task objective (met / partially-met /
  not-met + gaps, MAST-style); the report feeds the synth prompt. Verify
  failure is non-fatal. Off by default — one extra agent per run. (#31)
• OTel GenAI-style trace export. New core/trace.mjs + writeRunTrace
  in run-flow.mjs: every terminal run (complete / stopped / error) writes
  trace.json — an invoke_workflow root span plus invoke_agent child
  spans with gen_ai.* semantic-convention attributes. Always-on, zero deps,
  best-effort (never fails a run). (#32)
• Release polish. New docs/DEMO.md — a five-minute end-to-end
  /maestro task walkthrough with real log-line formats (install → plan gate
  → parallel explore + /maestros dashboard → synth → resume/stop). READMEs
  gain a Known limitations section, the copilot plugin install flow was
  verified end-to-end against the self-served marketplace (0.5.0 → 0.6.0
  upgrade), and the release-archive file list was re-confirmed lean after the
  docs reorg. (#24)
• /maestro install <source> [--force] — one-command workflow install.
  New core/workflow-install.mjs: accepts a github.com blob URL, a
  raw.githubusercontent.com URL, or owner/repo/path/flow.mjs[@ref] shorthand
  (ref defaults to main; https only), downloads the file (256 KB cap, checked
  against Content-Length before the body is read; redirects refused so a raw
  URL cannot bounce off GitHub), and validates it without executing it —
  node --check parse + default/run export scan on a quarantined temp copy —
  before writing to the user workflow dir; project workflows still shadow
  it. Existing names are never overwritten without --force, installs confirm
  via elicitation when the host supports it (dialog errors fail closed), and
  every install prints a review-before-running warning. install joins the
  reserved workflow names. (#23)
• Agent auto-retry with exponential backoff. spawn/spawnAll retry
  error-status attempts (API blips, rate limits) with exponential backoff +
  jitter — GHCP_MAESTRO_RETRIES extra attempts (default 1, 0 disables).
  timeout/aborted outcomes never retry, backoff sleeps abort with the run
  signal, and results/persisted agent records carry an attempts count. The
  quality helpers forward retries/retryBaseMs. (#20)
• Cost visibility + token budget cap. New core/budget.mjs: the task
  workflow logs a run-size estimate at the plan gate (also shown in the
  approval dialog), warns on fan-outs of GHCP_MAESTRO_LARGE_RUN_AGENTS+
  subtasks (default 5), and GHCP_MAESTRO_BUDGET_TOKENS (accepts 500k/2m)
  soft-stops a run once exceeded — in-flight agents finish, un-started agents
  are skipped as aborted, the run is marked stopped and stays resumable
  via /maestro-resume. spawn/spawnAll/runPhase accept a shared
  budget tracker. (#14)
• DAG plans: dependsOn between subtasks. The plan schema gains an
  optional dependsOn: string[] (validated: known agents, no self-reference,
  no cycles). planLayers groups specs into topological layers; the task
  workflow fans each layer out in order and injects dependency outputs
  (truncated to 4 000 chars each) into dependents' prompts via
  augmentPromptWithDeps. Dependents of a failed dependency are persisted as
  a new skipped status without invoking the adapter, so /maestro-resume
  reruns them. Plans without dependsOn behave exactly as before. (#21)
• Partial-failure disclosure in synthesis. agentDigest renders non-ok
  results as ## <agent> (FAILED: <status>) blocks with the error text;
  buildSynthPrompt adds a "state explicitly which angles are missing"
  instruction when any subagent failed (all-ok prompts are byte-identical to
  before); the task workflow logs a coverage: N/M subtasks ok (…) line next
  to the final answer. Both surfaces share the change via core/synth.mjs. (#22)

Fixed

• Resume now reruns failed agents. spawn replays only cached ok records
  from the run store; cached error/timeout/aborted records re-invoke the
  adapter on /maestro-resume, matching the documented resume contract
  (previously a failed agent's cached failure was replayed forever).
• In-flight cancellation actually interrupts agents. The standalone-client
  adapter races sendAndWait against the caller's AbortSignal (raceAbort),
  so timeouts and user cancellation no longer wait for the model to finish.

Changed

• READMEs slimmed, docs split. The long "Features" section and the
  configuration table moved to docs/GUIDE.md / docs/GUIDE.ko.md; the
  CLI-vs-VS-Code install-surface details moved to docs/SURFACES.md. The
  READMEs keep a compact feature summary, the commands table, and links.
• Design docs consolidated under docs/specs/. The docs/superpowers/
  tree (specs + implementation plans) is gone; all design/plan documents now
  live in docs/specs/ and the stale export-ignore rule was dropped.
• /maestro-stop aborts in-flight agents. New core/run-registry.mjs
  (process-local runId → AbortController); runPhase wires the registry
  signal by default and stopRun aborts it, so stopping a run started in the
  same session interrupts its agents instead of only flipping the manifest.
• /maestro workflows rescans the workflow dirs (and /maestro run
  rescans on a name miss), so workflows added after startup are picked up
  without restarting the CLI.
• VS Code runtime bridge deduplicated against core: uses
  runWithConcurrency and DEFAULT_CONCURRENCY from core instead of local
  copies; the <name> [args] split is shared as
  splitWorkflowInvocation in core/saved-workflows.mjs.