v1.2.0

README.md

• Instructional film: publish the 1.2 onboarding film, Settle the Argument. Before
  CI. (11:52), in media/courses/sam-meets-literate-ai/. LitAI opens with the big
  picture of agentic development, Sam dismisses it as the usual AI slop pitch, and
  seven of his beliefs are settled with terminal sessions recorded against the 1.2
  build: reviewable promises, independent acceptance, the full release gate before
  CI, litai render html views, adoption without a rewrite, learning as reviewed
  changes, and a locally built release wheel; remote workers and the learning loop
  are labelled walkthroughs. Local neural voices only; the integrity receipt verifies.
  The 1.1 feedback edition (13:38) remains at the v1.1.0 tag.

• litai video build and litai video verify now measure media from its decodable
  samples instead of trusting container headers and receipt hashes. Build refuses a
  scene clip with no video or audio samples (video.media_empty) or whose measured
  video length differs from its narration (video.media_duration), and reports the
  final film's measured video duration. Verify re-measures the film and refuses empty
  streams, video that stops before its audio, receipt durations that differ from the
  media, and narrated captions that outlast the picture, even when every artifact
  digest matches. Other video failures keep video.invalid; the receipt schema is
  unchanged.

• Deferred to 1.3 by maintainer decision: clean three-way update merging and reviewed
  resolution application (issue #2; in 1.2 conflict review is plan-only and litai update --apply preserves
  conflicts), and production
  action DAG dispatch with multi-worker shared LAN-cache qualification (issue #4; 1.2
  ships the scheduler and cache foundation).

• litai rebuild now runs bounded candidate repair. Attaching durable checkpoints or
  the source cache rebuilt the lifecycle service without its repair port, so a retryable
  build or generated-test rejection failed the run after one candidate instead of
  requesting up to two fresh replacements. The rejected attempt's checkpoint is closed as
  failed and each replacement opens its own durable attempt, chained to the rejected one,
  because it restarts at source generation. The rebuild result's repair field now
  reports the replacements that ran instead of always not-needed.

• Toolchain observation now accepts the npm @bazel/bazelisk launcher that the
  installation guide recommends. Only the prebuilt binary bazelisk.js runs for the host,
  selected by the Node runtime's own architecture, is observed as the native toolchain.
  The package's other platform binaries are hashed as inert payload, and native files
  anywhere else still refuse.

• litai project validate and Flavor catalog loading discover the project skill catalog
  once per operation instead of once per Component and Flavor (117 times for this
  repository). This removes most of the filesystem metadata calls that made Windows
  gates slow.

• The worker template can declare Windows Defender process exclusions
  (defender_process_exclusions): {python}, the real base interpreter behind the
  template Python, or an absolute .exe path. litai worker align reports a missing
  one and --apply adds it, naming the resolved executable. Shells and script hosts
  are refused, and {python} must resolve to an existing non-Store .exe. The
  repository template now excludes {python}. That covers every process of that
  interpreter on the worker, not only gate work, so Defender no longer scans its pip,
  stdlib or site-packages reads outside the excluded workspace.

• The conformance sample runner now records a bounded, redacted diagnostic_excerpt
  for rejected generated candidates (compiler or Bazel output for build rejections;
  generated expected and observed values for generated-test mismatches) in retained
  evidence and in the next attempt's repair feedback. Previously only a diagnostic hash
  was kept, so neither showed the error. litai rebuild repair prompts still carry only
  a short sanitized failure message.

• Release qualification is local-first: litai release check defaults to the tiered
  target when the release policy declares qualification (this host, then workers, then
  CI), and litai release qualify runs that tiered qualification directly. The host gate and
  the worker gates run concurrently rather than host-first, so a three-platform release
  check takes one gate's wall-clock time instead of two.

• Forge issues and PRs/MRs are the documented default tracker and agent coordination
  channel (ADR 0050); other trackers or review systems are overrides. Landing now passes
  the policy target branch (gh pr create --base, glab mr create --target-branch).
  litai prompt translate recognizes --external-envelope / LITAI_EXTERNAL_TASK_ID
  (error prompt_routing.external_envelope_bypass, envelope prompt-task@2); the MAC
  spellings remain deprecated aliases. litai init no longer installs the opt-in
  write-mac-project-contract skill; litai update keeps an existing copy unless the
  parent does not ship it and it is unedited. Projects whose forge default branch is not
  main must declare repository_policy.default_branch, which landing now targets.

• Remote live gates no longer require OPENAI_API_KEY in the worker login
  environment. They still require opencode, which resolves credentials for the
  pinned model's provider from its own configuration (ADR 0017 amendment). A
  missing provider key reported by OpenCode is now
  coding_cli.authentication_required.

• make release-check now runs public-export-check, so an organization-internal
  reference in tracked files fails the release gate instead of surfacing only at
  export (#55).

• Retained Cargo receipts report unselected ignored cases as explicit exclusions,
  preserving strict selected-test failures and empty-suite rejection.

• Cross-host workers: when BUILD, TEST, EXECUTE and FINALIZE all run on admitted
  workers, litai rebuild derives locked toolchain identities, commands and
  native dependencies from the worker instead of the controller host, which then
  needs none of the project's tools. Workers serving PACKAGE or FINALIZE are no
  longer refused for tool observation, and worker dependency observation is
  several times faster.

• Add python -m literate_ai.standard_receiver, a reference action receiver for
  portable Standard projects configured by one private operator document. It
  runs BUILD, TEST, EXECUTE, ACCEPT, PACKAGE and FINALIZE for single-Component
  Make/Python projects and refuses any contract that names a tool, driver or
  layout other than the packaged profiles for the worker's own tools.

• litai rebuild with admitted action workers: install the bounded evidence
  recorder remote phases need (every such rebuild previously failed at BUILD),
  report project-level PACKAGE/FINALIZE refusals as typed CLI errors instead of
  tracebacks, and run the full worker health and capability probe once per
  action boundary instead of on every guarded read.

• FINALIZE grants: when a worker has no grant, the controller writes the exact
  request to an operator-owned path and waits a bounded time for the operator to
  grant it with --issue-finalize-grant, then continues in the same run.

• FINALIZE receivers check private grants in the parent as well as the child.
  Before staging, the grant must be current and scoped to the exact input,
  revision and privilege; after staging, the parent measures the child's portable
  runtime and applies the full guard on every poll. The command-controller chain
  now runs with real file grants instead of synthetic permission callbacks.

• A describe-only FINALIZE dispatch reports the exact grant request a receiver
  measured, without executing, so an operator can authorize precisely that
  runtime. The controller refuses descriptions for any other input, revision,
  privilege set or builder.

• Reconcile HTML observability scope: distinguish delivered graph/health views
  from remaining run-history, dashboard controls and later-view qualification.

• Require the versioned release line even for historical policies without a
  default branch; refuse arbitrary-branch plans and legacy-plan preparation.

• Require explicit SemVer policy for release operations, including legacy policies;
  retain historical policy inspection and migrate the framework policy to SemVer.

• Release publication and published verification independently validate
  policy-bound tag names and declared release-line requirements. Altered prepared
  records are rejected before tagging or pushing, even when substituted refs
  select the same prepared commit.

• Provide a portable FINALIZE child startup adapter with private contracts/tools,
  measured runtime grants, owned output cleanup and stage authority checks.
  Operator provisioning and full CLI qualification remain pending.

• Add private file-backed FINALIZE grant lookup with live revocation checks for
  parent supervision and child stages. Grant issuance and deployment provisioning
  remain separate requirements.

• Add a pinned private FINALIZE policy for Standard rebuild with controller-owned
  portable package/test/oracle verification. Production worker grant provisioning
  and complete CLI rebuild qualification remain pending.

• Update: recover digest-verified historical bases recorded with GitHub's SCP
  spelling (git@github.com:owner/repository) over the same SSH transport, while
  preserving the original repository, revision and provenance. Recorded URLs keep
  their transport, and an unusable historical locator leaves the conflict
  unresolved instead of aborting the update (#36).

• Release: classify SemVer numbered drafts with SemVer precedence and match GitHub
  prerelease publication/verification to the prepare...

v1.1.0

README.md

• Initialization: seed the starter acceptance oracle from the hello-component
  contract the project actually received. Projects derived with init --from the
  framework repository inherit its greeting-card sample (name plus messages) and
  previously got name-only expectations, so every live rebuild failed acceptance.

• Documentation: point getting started, installation, worker registration and
  adoption guidance at the onboarding film and instructional courses, and link the
  course index to repository files instead of a feature branch.

• Continue existing installations across the repository move: projects initialized
  from NVIDIA-dev/literate-ai plan litai update against public-repository builds,
  and self-update follows the declared successor. Other repository origins are still
  refused. See the
  migration guide.

• macOS dependency observation reuses dyld_info facts within a process only for
  identical inspector bytes, arguments and image identity: content and symlink chain
  for on-disk images, the boot session for shared-cache images. Retained Cargo native
  test guards no longer re-inspect ~700 unchanged system images per check (#13).

• Elixir: add lang-elixir with portable script-tree generation, syntax validation,
  Standard runtime/test dispatch, exact Elixir/OTP toolchain identities, and
  init/flavor add assets. Requires Elixir 1.18+ and Erlang/OTP 27+; native
  macOS smoke verification passes with Elixir 1.20.4/OTP 29. Mix/Hex/Phoenix
  are outside this dependency-free profile.

• Documentation tooling: update DOMPurify to 3.4.16. Gate the dependency audit
  through reviewed, expiring per-advisory exceptions. The only exception covers the
  unpatched braces advisory GHSA-vfj7-8cjw-p6xm in OpenSpec's glob dependencies (#24).

• CLI self-update: refresh bytecode in the caller-selected cache and optimization
  mode so a successful wheel upgrade cannot immediately execute stale code from
  an equal-size, equal-timestamp previous version. Keep import-path overrides
  excluded from the installer environment.

• Retained adoption: add explicit read-only Standard planning with bounded binary input
  custody and complete action inventories. Execution and release qualification remain
  unavailable until the retained-origin receipt path is complete (ADR 0048).

• CLI: keep pip installation and command re-execution on the same configured
  bytecode cache during self-update, preventing stale code after equal-size,
  equal-timestamp upgrades while preserving unrelated caches.

• CI: run one full Linux suite plus cross-platform native/install smoke on ordinary
  PRs, consolidate documentation jobs, cache dependency downloads, and preserve
  independent failure diagnostics. Full multi-platform release qualification remains
  required. Publication subprocess timeouts now stay within their reviewed limit
  even when floating-point deadline arithmetic rounds upward.

• CI: separate focused macOS PR smoke checks from full main/release qualification,
  bound conformance steps, and retain verbose test names and self-update failure
  diagnostics. Full release gates remain unchanged.

• Onboarding: feature the continuous narrated video in the README, with a clickable
  preview, chapters, subtitles, and a public-feedback link.

• Move the canonical repository to
  jordanhubbard/literate-ai: release
  publication, the Homebrew formula, install documentation, and initialized project
  READMEs now reference it. Earlier issue and CI links refer to the archived
  NVIDIA-dev/literate-ai repository.

• CLI: identify Git/source builds and their exact revision in version output,
  without treating package metadata as published-release evidence. Explicit
  litai update now checks for and applies a newer stable release in an enrolled
  prefix before continuing project reconciliation; opt-outs remain effective.

• Bind TEST dispatch to the exact worker, deadline, planned predecessors and
  BUILD/result handoff before child execution, then re-admit returned evidence.
  Configured receiver and scheduling integration remain pending.

• Add a supervised TEST child with current grant/deadline checks, cancellation,
  bounded streams and descendant cleanup, sharing BUILD's process supervision.
  Configured receiver dispatch and production TEST scheduling remain pending.

• Import worker TEST results through explicit verified return transport, retaining
  evidence before registration and refusing corrupted records or changed worker
  authority. Production TEST dispatch remains pending.

• Add a worker TEST operation over verified transferred source and BUILD artifacts,
  returning bounded evidence tied to the exact handoff. Supervised command/SSH
  dispatch and production queue integration remain pending.

• Add controller admission for transferred generated-test evidence, checking exact
  suite, build and entrypoint authority before registration. Worker TEST execution
  and production dispatch remain pending.

• Remote tool discovery verifies authored command names against a worker's private
  search environment and rechecks them before reuse. Changed resolution, including
  a newly shadowing executable, is refused without running the supplied command.

• Make locked-command BUILD export and provider checks reusable from portable
  records, preserving local refusal before command execution. Remote BUILD
  execution and artifact transfer remain pending.

• Standard rebuild dispatches AUTHORIZE through the shared admitted worker pool,
  captures controller time after reserving capacity, and rechecks returned grants
  against current SDK custody and expiry without local retry or grant renewal.

• Add bounded command-worker AUTHORIZE execution using the controller-selected
  issuance time and fixed constrained policy. Changed index custody, future/expired
  grants and payload substitutions are refused; production queue wiring is pending.

• Report hardware probe error codes when no candidate can be observed, preserving
  healthy-worker admission and excluding raw exception messages from the refusal.

• Construct Standard authorization from explicit intent, index and controller time,
  preserving the existing grant policy while retaining local SDK admission and
  evidence recording. AUTHORIZE transport remains pending.

• Retain remote PLAN result evidence before registering local plan or SDK authority;
  an evidence-store failure leaves registration unchanged and frees worker capacity.

• Command workers can construct build intent from an exact indexed-source handoff
  and typed provider acceptance records, checking the canonical DAG and bounded
  predecessor custody. Standard rebuild now dispatches BUILD_INTENT through the
  shared INDEX/PLAN worker slots, retaining results before local admission and
  refusing missing provider acceptance evidence without local retry.

• Build-intent admission rechecks current inputs and registers provider bindings
  only after library validation and required evidence recording succeed. Rejected
  intents no longer leave partially registered provider state.

• Standard rebuild can finalize plans through admitted command/SSH workers, sharing
  capacity with source indexing and independently verifying returned plans before
  local registration. Native Linux and Windows PLAN receiver and SSH checks pass;
  remaining lifecycle phases and release qualification stay open.

• Construct build intent from exact portable source, command, dependency and SDK
  inputs, rejecting mismatched candidate and generation-plan bindings. Local source
  admission, live SDK checks and library-import custody remain enforced.

• Test qualification: preserve the long coordinator-path regression on native
  Windows by creating its fixture through the existing native filesystem boundary.
  Real SSH PLAN checks now confirm exact results and authorization refusals on
  Linux and Windows without executing a build.

• Add opt-in local worker provisioning through an organization-owned command, with
  credential bindings, help discovery, bounded request/response validation, durable
  duplicate-allocation protection, and registration recovery. Static worker CRUD
  and SSH tests remain independent of provisioning.

• Windows action dispatch preserves case-insensitive runtime environment names.
  Capability probes allow up to 60 seconds for native identity checks and startup,
  while retaining any shorter action deadline and the existing environment allowlist.

• Framework core: local builds no longer wait for packaging-only providers or bind
  their artifacts into compilation. Final packages still require accepted providers;
  provider failure prevents publication.

• Framework core: artifact graphs retain explicit runtime and packaging dependencies
  with locked-edge and provider-acceptance evidence, preserving compiled artifact
  identities while validating exact package closure.

• Framework core: execution evidence records exact provider artifacts; lifecycle
  admission and independent evidence reopening reject omitted or substituted inputs.

• Framework core: toolchain dependencies now bind accepted provider exports into
  consumer build intent, build actions, worker imports, process bindings, and
  resulting artifact provenance.

• Framework core: consumers of locked public interfaces can build while providers
  are still running. Artifact consumers retain acceptance barriers, and any failed
  component still prevents project acceptance and publication.

• Framework core: private action workers can configure an SSH receiver for capability
  probes and source indexing, using bounded stdin and exact worker/receiver checks.

• Framework core: action plans now bind accepted build/toolchain inputs before build
  intent and authorization, while p...