speccoder 0.2.0

Added

• Bug fixes as their own lane. speccoder bug "<what happens>" --expected "<what should>" records the bug where the format keeps them (Spec Kit's
  bug extension, else a standing bug unit), writes one reproduction per
  expected behaviour that must fail by an assertion, asks you once to
  confirm it, and ticks the fix only when the reproductions pass, the
  unchanged behaviour still passes, the held-out variants pass and the
  revert is rejected. cannot_reproduce and already_satisfied never tick.
  --test brings your own failing test, --candidate PATCH|pr:N judges
  someone else's fix, --issue N closes the issue when the fix is verified.
• Review the oracle. speccoder review tests <REQ> writes a
  requirement's acceptance tests during review: two independent authors,
  disagreements shown as ambiguities, red-checked in the sandbox, a held-out
  set sealed. speccoder review approve --run ask|autopilot freezes them and
  starts the run, which reuses them without another author call.
• Anchored comments. Comment on spec passages, tests and findings, send
  them as one revision; Undo Revision restores the documents byte for byte.
• speccoder-verify and the speccoder / evidence check. A small
  binary — no model, no network — checks every ticked task of a branch
  against its signed evidence with the maintainer's trust. A GitHub Action
  publishes the result as a check run on the pull request.
• The evidence tour of each task — requirement, frozen tests, red, diff,
  green, strength — in the check, the pull request, the app and
  speccoder-verify tour. The task-verification predicate is documented,
  with a JSON Schema.
• speccoder actions [--task T] [--json]: what can be done now, the list
  every interface offers.
• An asking budget: after [approvals] budget prompts (default 12) further
  calls wait together in one Needs You item (speccoder approvals batch).
• The model's reasoning summary (Anthropic, OpenAI Responses), shown as its
  account, never as evidence.
• task restore and task drop for changes a run set aside.
• Setup gaps a run would trip on (an uncommitted lockfile, unignored build
  output) stop it with a one-click fix (SETUP-INCOMPLETE, speccoder fix).
• The app shows runs started in a terminal, and untracked and ignored files
  in its Files view.
• cargo binstall speccoder.

Changed

• Approvals cover exactly what you saw — the file a write reaches, a
  command's exact argv with its directory and program, an MCP tool's
  definition — are checked again when the call runs, and end with their
  run.
• [commands] allow and [sandbox] network_allow match exact commands.
  Prefixes go in allow_prefix / network_allow_prefix and are saved only
  after a preview of what they would allow (speccoder config coverage).
  Always Allow adds exactly one command. An approvals.json from 0.1.0 is
  refused; speccoder doctor says so.
• A write that removes a test is refused before it happens.
• speccoder pr also pushes the held-out tests of the closed tasks and adds
  each task's tour to the description.
• Decisions record the interface they were made in (terminal, web,
  acp).
• A feature's branch takes setup changes (configuration, .gitignore,
  lockfiles) from the checkout.
• error[CHECK-BROKEN] quotes the check's own error.
• agentplane 0.53.0.

Fixed

• Needs You, inbox and status said nothing was waiting when another
  speccoder held the journal or the decisions could not be read; they now
  say the calls are unknown, and why.
• An OpenSpec project without a change was offered no first step.
• With CARGO_TARGET_DIR set, every Rust check failed in the sandbox (it may
  not write outside the worktree); checks build in the worktree instead.
• The app refused its own concurrent journal reads.
• attest verify reported a missing cosign as an untrusted signer.

Security

• On a case-insensitive volume (macOS) another letter case reached a
  protected file (Speccoder.toml, .CURSOR/…); protected paths now match
  in any case.
• A write through a symlinked directory could reach a protected file;
  protection is judged on the file a write reaches.
• An approval could reach more than was shown: an Always Allow that widened
  to a prefix, a path grant a symlink carried to another file, an MCP grant
  that outlived a changed tool definition, a task grant that seeded later
  runs.
• Approve and Reject in the app, the dashboard and Needs You decided
  whichever call waited for the task; they now name the call and its
  digest, and a changed call is refused (CALL-CHANGED).
• A command whose arguments the model copied from content it read can be
  approved once only.
• Claude Code as the executor got each allowed command as a prefix rule
  (Bash(cargo test:*)); it gets the exact command (Bash(cargo test)).