v0.9.5

v0.9.5

Artifact and task workflow

• Versioned artifacts now follow one consistent grammar, and plans are checked against that grammar before graph validation. This makes malformed or outdated artifact structures easier to catch.
• Portion promotion now produces bounded task briefs, while implementation and review prompts stay focused on the current portion. This reduces scope drift and makes delegated work more predictable.
• Legacy task prompts are constructed more safely, improving compatibility with older task formats.
• Split proposals remain editable by the person responsible for them, who can correct or discard them before promotion.
• Unchanged manifest critic tasks are cached, reducing unnecessary repeated work.

Releases and acceptance

• Amendment-only releases now preserve the empty state instead of creating unnecessary task work.
• Commits from accepted document-stage runs are recorded as release amendments rather than being reported as missing task work.
• Release revision decisions are dispatched correctly, so requested release changes reach the appropriate workflow.
• Rebase conflicts are materialized in run worktrees, making conflicts available for inspection and resolution.
• Pull-request publication now follows the configured publication policy, and the harness’s own record receives a commit owner.

Desktop experience

• Accept-then-fix follow-up runs now use the project’s current flock when no ducklings are named.
• Gate screens show one decision card per state, explain the consequence of every action, and identify when a task has already landed.
• Verification results no longer label unrecognised tests as “no test.”
• Verification rows identify the pinning test and the command used to run it.
• The verification queue is presented as a single ledger with typed next steps and links back to the live chat.

Budgets and service behavior

• Calls-per-reply precedence and ceilings are now visible, and script-specific call portions remain distinct. This makes provider usage limits easier to understand and control.
• Provider slots are scoped to active chat turns, preventing inactive conversations from consuming capacity.
• Re-entry and acceptance provenance are preserved, making it clearer how work reached its current state.

Project and file integrity

• Run environment inputs remain immutable, protecting the conditions under which a run was created.
• Duckling edits preserve omitted content instead of accidentally deleting it.
• Bundle copies preserve symbolic links.
• Legacy plan shapes remain nonblocking, allowing older projects to continue through the workflow.
• Requirements can explicitly record intake assumptions, making the basis for accepted work clearer.

What shipped

M-01

• T-262 Centralize the versioned artifact grammar (82f67b8)
• T-262 Centralize the versioned artifact grammar (332e934)
• T-267 Make portion promotion emit bounded task briefs (5d4bed1)
• T-267 Make portion promotion emit bounded task briefs (8c30dd4)
• T-268 Constrain implementation and reviewer prompts to the current portion (e89d9e7)
• T-268 Constrain implementation and reviewer prompts to the current portion (ce3fa48)
• T-269 Harden legacy task prompt construction (7af9df7)
• T-269 Harden legacy task prompt construction (45d9d7d)

Landed outside the loop

• artifact: admit intake assumptions in requirements (f25d893) — Jose Rullan [PR #26: artifact: admit intake assumptions in requirements (B-352)]
• release: only document stages amend; an amendment-only release keeps the empty state (1ad2a7b) — Jose Rullan [PR #25: release: inventory an accepted document-stage run's commit as an amendment, not as missing task work (B-351)]
• release: inventory an accepted document-stage run's commit as an amendment, not as missing task work (2262121) — Jose Rullan [PR #25: release: inventory an accepted document-stage run's commit as an amendment, not as missing task work (B-351)]
• test: preserve document critic call ceiling regression (8e2bb5a) — Jose Rullan [PR #24: budget: make calls/reply precedence and hard ceilings authoritative]
• budget: preserve script-specific call portions (4ae0937) — Jose Rullan [PR #24: budget: make calls/reply precedence and hard ceilings authoritative]
• budget: expose calls-per-reply precedence and ceilings (298d86b) — Jose Rullan [PR #24: budget: make calls/reply precedence and hard ceilings authoritative]
• bugs: the split proposal is the person's to write, correct or discard before promote (5dc2dcf) — Jose Rullan [PR #23: bugs: the split proposal is the person's to write, correct or discard before promote (B-284)]
• fix: dispatch release revision decisions (1d3a0a0) — Jose Rullan [PR #22: fix: dispatch release revision decisions (B-345)]
• accept: materialize rebase conflicts in run worktrees (5081867) — Jose Rullan [PR #21: Leave accept-time rebase conflicts resolvable (B-283)]
• strategy: cache unchanged manifest critic tasks (3b166f3) — Jose Rullan [PR #19: Cache unchanged plan-manifest critic tasks (B-342)]
• service: honour the pr publication policy; give the harness's own record a commit owner (14d4311) — Jose Rullan [PR #20: service: honour the pr publication policy; give the harness's own record a commit owner (B-289, B-291, B-287)]
• desktop: accept-then-fix names no ducklings, so the follow-up run takes the project's current flock (c87d71e) — Jose Rullan [PR #18: desktop: one decision card per gate state, with every action's consequence; say when the task already landed (B-261, B-247)]
• desktop: one decision card per gate state, every action with its consequence; say when the task already landed (bcbe686) — Jose Rullan [PR #18: desktop: one decision card per gate state, with every action's consequence; say when the task already landed (B-261, B-247)]
• desktop: the verification row never calls an unrecognised test "no test" (b0c4222) — Jose Rullan [PR #16: desktop: fold verification into one ledger, type the guide's next steps, link back to a live chat (B-281, B-282, B-251, B-285)]
• desktop: the verification row names the pinning test and the command that runs it (fdcca25) — Jose Rullan [PR #16: desktop: fold verification into one ledger, type the guide's next steps, link back to a live chat (B-281, B-282, B-251, B-285)]
• desktop: fold the verification queue into one ledger, type the guide's next steps, link back to a live chat (66bd809) — Jose Rullan [PR #16: desktop: fold verification into one ledger, type the guide's next steps, link back to a live chat (B-281, B-282, B-251, B-285)]
• service: scope provider slots to active chat turns (88e93c2) — Jose Rullan [PR #17: service: pin provider-slot lifecycle across pause and chat (B-256 B-257)]
• vcs: keep run environment inputs immutable (c05f30f) — Jose Rullan [PR #15: vcs: keep run environment inputs immutable (B-178)]
• fleet: make duckling edits omission-preserving (fa663f0) — Jose Rullan [PR #14: fleet: preserve omitted duckling fields (B-301)]
• service: preserve re-entry and accept provenance (1a9783a) — Jose Rullan [PR #13: service: preserve re-entry and accept provenance (B-270)]
• artifact: keep legacy plan shape nonblocking (c951a48) — Jose Rullan [PR #12: artifact: enforce plan grammar before graph checks (B-346, B-347)]
• artifact: enforce plan grammar before graph checks (0f543c6) — Jose Rullan [PR #12: artifact: enforce plan grammar before graph checks (B-346, B-347)]
• service: bundle copy preserves symlinks; fix a misleading test comment (0357354) — Jose Rullan [PR #11: service: bundle copy preserves symlinks; fix a misleading test comment (B-292, B-295)]

Documents amended in the loop

• plan amendment (5ff7f11) — La enmienda focaliza T-262 en el contrato común de grammar ya cubierto por el test rojo aceptado, elimina el conflicto con tareas posteriores y conserva un único lane de ownership. [run r-20260908-221704-z22k]

v0.9.4

v0.9.4

Planning and documents

• Plan reviews now verify that every task is executable, atomic, traceable to a specification, and consistent with ownership and dependency rules before approval.
• Plan diagnostics now explain the cause of failures and can be checked consistently by automated tooling.
• Plan manifests and document revisions are repaired transactionally, preserving complete drafts and preventing partial or contradictory updates.
• Document and plan reviews now stay within their assigned scope, preserve review evidence across pauses, and converge on a single materialized candidate before the human gate.
• Amendments now preserve field ownership and modality, limit changes to the requested subject, and support explicit, safely persisted deletions.
• Requirements now require valid, unambiguous priorities and consistent requirement language.
• Artifact fields and structured references now use a centralized vocabulary with validation, making artifact contracts clearer and failures easier to diagnose.
• Artifact composition is followed by semantic review, helping catch content that is structurally valid but does not satisfy its intended obligations.
• Acceptance evidence and verification gates now fail closed when results cannot be verified, preventing unverifiable work from being approved.

Reviews and implementation quality

• Review findings are now validated against project facts and available capabilities, with inadmissible or self-contradictory findings rejected deterministically.
• Blocking findings are surfaced before successful or informational results, making required repairs easier to identify.
• Focused retries now target specific repairs, preserve their remaining budget, and stop once the work is verified.
• Native and asynchronous API reviews now inspect ownership, worker signatures, return paths, and completion contracts, reducing unsafe or incomplete native implementations.
• Build and capability checks now provide actionable preflight results when the machine lacks a required toolchain or capability.
• Verified resumes are treated as report-only, avoiding unnecessary repair loops after work has already passed verification.

User interface and workflow

• Ducklab rooms now share a consistent interaction grammar, making transitions between workspaces easier to understand.
• Contextual UI interactions have been polished for clearer, more predictable operation.
• Stage runs now stream their progress to the desktop, so CLI-launched work is visible while it runs.
• Small-seat workflows now receive appropriately scoped plans, readable artifacts, preserved review context, and bounded review and repair rounds.
• Paused runs resume from their recorded drafts, ledgers, and review feedback instead of restarting work or losing context.
• Budget pauses and capability-related pauses now identify the constraint involved and resume at a safe point.

Intent and release workflow

• Human intent is now a first-class document that can be reviewed and carried through the workflow.
• Release publication now records the release line before tagging, providing a clearer source of truth for published versions.

What shipped

M-01

• T-260 Centralize artifact field vocabulary and validation (8353459)
• T-261 Make plan diagnostics causal and lintable (9c3269a)

Landed outside the loop

• Reject unverifiable plan approvals (d934dca) — Jose Rullan
• Make plan review converge on executable topology (0e375dc) — Jose Rullan
• Align plan review with ownership invariants (c9e19d3) — Jose Rullan
• Scope plan audits to coverage ledger (cef51e5) — Jose Rullan
• Separate plan coverage from task topology (8c1b742) — Jose Rullan
• carry support policy through all turn runners (692c970) — Jose Rullan
• separate plan structure from support policy (fb15097) — Jose Rullan
• declare model tiers and record support profiles (4f02787) — Jose Rullan
• seed first plan manifests from accepted specs (6a24729) — Jose Rullan
• patch rejected plan manifests transactionally (00a3c5a) — Jose Rullan
• record reasoning versus content per model call (6317a9b) — Jose Rullan
• isolate nested task audit fragments (e666f66) — Jose Rullan
• account for contract repair calls (4517f07) — Jose Rullan
• preserve grounded manifest review evidence (b3b9c7f) — Jose Rullan
• bound and audit frozen plan work (e6352bc) — Jose Rullan
• compose manifest audit and artifact graph contracts (72435e0) — Jose Rullan
• make manifest review account for every target (e659e8b) — Jose Rullan
• keep frozen plan tasks semantically stable (4d1ee21) — Jose Rullan
• review plan manifests before freezing topology (6732be8) — Jose Rullan
• harden plan evidence and critic filtering (6840d90) — Jose Rullan
• Validate task atomicity before freezing plan topology (507510c) — Jose Rullan
• Validate plan critic findings against project facts (9739a01) — Jose Rullan
• Close and focus document critic turns (623e8ff) — Jose Rullan
• Ground plan reviews in obligation semantics (87417ac) — Jose Rullan
• Make plan reviewers audit specification obligations (9fe2f93) — Jose Rullan
• Bound filesystem content searches (2d7783d) — Jose Rullan
• Widen repairs for isolated graph collisions (8c7837d) — Jose Rullan
• Materialize executable reference metadata (e791c57) — Jose Rullan
• Make reference contract declarations unambiguous (265bcb4) — Jose Rullan
• Derive artifact participants from run calls (f707a23) — Jose Rullan
• Enforce structured references at spec gates (2306297) — Jose Rullan
• Model executable reference contracts (11602a8) — Jose Rullan
• Enforce semantic review after artifact composition (b87315f) — Jose Rullan
• Define portable capability conformance (ede8195) — Jose Rullan
• Make focused task retries evidence-driven (22cdaf7) — Jose Rullan
• Make acceptance evidence executable (9757d7b) — Jose Rullan
• Require verification after text-seat mutations (c330efb) — Jose Rullan
• Put blocking evidence before successful noise (352a875) — Jose Rullan
• Close stale tool syntax and invalid GLib advice (35e44c3) — Jose Rullan
• Make verified resumes report-only (a8ca20c) — Jose Rullan
• Guard deferred GLib ownership contracts (afc127c) — Jose Rullan
• Stop verified small-seat repair loops (3bafc9c) — Jose Rullan
• Strengthen native async gate inspection (138e32e) — Jose Rullan
• Preserve repair budget after red deliverable retry (e6cfe64) — Jose Rullan
• Reject self-contradicting native reviews (b843550) — Jose Rullan
• Harden GLib async review contracts (125218c) — Jose Rullan
• Persist rejected review findings (17b420a) — Jose Rullan
• Reject inadmissible review findings deterministically (501a41b) — Jose Rullan
• Make capability verdict repairs authoritative (69e6d0d) — Jose Rullan
• Validate reviewer remedies against stack capabilities (9a1f3c7) — Jose Rullan
• Block approvals the build did not earn (4cbe61e) — Jose Rullan
• Keep experiment tags out of protocol versions (3b35484) — Jose Rullan
• Require approval for composable section passes (ecf1611) — Jose Rullan
• Close Exercises repairs over current Produces (0684fe6) — Jose Rullan
• Disambiguate acceptance slices from plan metadata (8a2a8a0) — Jose Rullan
• Name the binding cap in CLI budget pauses (05c79d1) — Jose Rullan
• Recognize plan fields only at structural markers (056af4a) — Jose Rullan
• Replace multiline fields transactionally in structure repair (2102dfa) — Jose Rullan
• Resume sectioned document transactions from their ledger (63b8c30) — Jose Rullan
• Make bounded structure repairs self-contained (46ee3b0) — Jose Rullan
• Review composed plans before the human gate (837771e) — Jose Rullan
• Require plan tasks to implement specifications (ed948b6) — Jose Rullan
• Strip bare task IDs from new-section titles (23b96f8) — Jose Rullan
• Resolve new plan sections by assigned title (e90e889) — Jose Rullan
• Clarify isolation semantics for split sections (3db73d0) — Jose Rullan
• Guide bounded repair of plan verification fields (419bafe) — Jose Rullan
• Accept ordered atomic acceptance slices (c02f435) — Jose Rullan
• Retry incomplete triage for explicit splits (fed307d) — Jose Rullan
• Preserve engine-owned IDs in isolated plan passes (d79f2dd) — Jose Rullan
• Enforce isolation and v2 contracts on plan tasks (c12cfe6) — Jose Rullan
• Parse labeled section triage responses (5ad609d) — Jose Rullan
• Validate GTK4 contracts during task planning (b979e54) — Jose Rullan
• Keep sectioned reviews inside their assigned scope (80f7cc1) — Jose Rullan
• Keep document updates atomic across duration alerts (c953c5c) — Jose Rullan
• Express plan tasks as atomic acceptance slices (e8a12b3) — Jose Rullan
• Enforce advisor toolbelt during text turns (697645d) — Jose Rullan
• Inspect GLib async ownership contracts (afb1b5d) — Jose Rullan
• Limit small-seat advisor rescue loops (1ba25ca) — Jose Rullan
• Refresh text tool availability after brakes (8d69055) — Jose Rullan
• Propagate small seat controls to task runs (102d785) — Jose Rullan
• Reserve pair review budget for small seats (a063db7) — Jose Rullan
• Send completed work straight to review (44628e4) — Jose Rullan
• Bound retries to targeted repair (7b164e2) — Jose Rullan
• Make GLib async invariants executable (0fd17ea) — Jose Rullan
• Audit deferred native API contracts (62fe17d) — Jose Rullan
• Share stack invariants with advisors (614189a) — Jose Rullan
• Bound research before implementation (db3ce82) — Jose Rullan
• Preserve review feedback across pauses (e365bb6) — Jose Rullan
• Clarify GTK clipboard completion contracts (697e5e0) — Jose Rullan
• Enforce task artifact contracts (6a143a2) — Jose Rullan
• Reject unsafe native API calls (0466a83) — Jose Rullan
• Validate GLib worker signatures (c9f2952) — Jose Rullan
• Check GLib worker return paths (e79616e) — Jose Rullan
• Run deterministic capability inspections (2c442e3) — Jose Rullan
• Make stack invariants operational (fb59ace) — Jose Rullan
• Compose stack review rules as capabilities (388...

v0.9.3

v0.9.3

Escalation cards

• "Open task body" on an escalation card used to be a dead end. It now actually opens the task, where you can edit the body, relaunch it, or split it.

When the engine stumbles

• The engine now recovers in seconds instead of a long stall, and the app waits for it to genuinely be ready before continuing — it no longer presses ahead against an engine that is still booting.

Resuming runs

• Resuming a test-first run reuses the baseline check from launch time and no longer re-runs the gates of rounds that have already run, so a resume just continues instead of re-checking completed work.

Documents

• The Documents area is now an operational workspace, including a chat summary.

Flock map

• Candidates on the Flock map are now spread out by relative rank, so the map shows where each candidate stands instead of clumping them.

Journey and guide

• In the journey, an accepted task's next door is now the release, with the redo option sitting behind it.
• The guide — in every locale — now shows each bug and task its position on the ladder and its next door.

Written directly from terse commit titles, so two bullets are read as best understood rather than verified against the UI: the exact shape of the new Documents workspace (and whether the chat summary is user-facing), and the precise Flock map layout change. The internal items (API schema regenerations, test double changes, desktop build plumbing) have no user-visible effect and are omitted.

What shipped

M-001

• T-253 Refining scope is not a workflow: the escalation card's 'Open task body' is a dead end — no editor, no relaunch, no split (b01f424)
• T-253 Refining scope is not a workflow: the escalation card's 'Open task body' is a dead end — no editor, no relaunch, no split (294b4b1)
• T-254 Reuse the launch-time baseline gate when resuming test-first runs (ffa9762)
• T-254 Reuse the launch-time baseline gate when resuming test-first runs (f8711b5)

Landed outside the loop

• api: regenerate openapi.json after #7 (chat summary) (03573bf) — Jose Rullan
• Turn Documents into an operational workspace (#7) (5b4218f) — jrullan [PR #7: Turn Documents into an operational workspace]
• api: regenerate openapi.json and generated.ts (split_task had drifted) (ae757d5) — Jose Rullan
• engine start: recover in seconds, and let the caller wait for the process rather than a guess (B-298) (dd8a384) — Jose Rullan
• engine: advertise engine.json only once the bound socket is about to serve (B-298) (f459466) — Jose Rullan
• strategy: a resume does not re-run the gate of the rounds it replays (ff24c38) — Jose Rullan
• fake-engine: answer the journey projection (GET /v1/projects/{id}/next/{ref}) (180ba4c) — Jose Rullan
• Spread Flock map candidates by relative rank (9a22ef7) — Jose Rullan [PR #6: Improve relative spacing in the Flock map]
• journey: an accepted task's door is the release, the redo stays behind it (75b719d) — Jose Rullan
• guide, localized: every bug and task carries its ladder position and its next door (21f9fad) — Jose Rullan
• build: make desktop embeds the fresh bundle but never dirties the tracked one (6d34442) — Jose Rullan

v0.9.2

v0.9.2

Runs pause through upstream trouble instead of dying. When a provider throws a transient error mid-stream — a 502 or a 520 — the run now pauses as bad weather and picks up once conditions clear, instead of one bad response failing the whole run.

The roster board has been redesigned, and renamed Flock. The board is more than renamed: it has been redesigned and promoted, and the redesign makes selection contextual — pointing at an entry shows the context it sits in. It also gains an evidence map: when you point at a seat, the board surfaces the ducklings eligible to fill it and labels each one with the evidence for why it's a candidate, so you can see the reasoning behind a suggested fit before you decide, instead of picking a name on faith. Promoted tasks that land in multiple parts now nest under a single Reported-bugs milestone instead of being scattered across ones.

Escalations are one card you can act on. The escalation multiplier is now rendered in the interface and can be submitted from it. Only the current escalation card is shown at a time, and it closes itself once a decision has been made.

Accepting a task now honors your publication policy. Accept lands the work first, then pushes it according to the publication policy you've configured for the project. The interface presents what acceptance means and keeps track of unpublished state, and the policy and publication state are also exposed in the API.

Task cards and launch controls. Task cards now expose a retry option when no changes are detected, and notes can be routed through the shared launch controls.

The release view is more complete. The release inventory now collects the full commit range, and both classes of release items are rendered honestly, so nothing that landed is missing or mislabeled.

Stale-bundle warnings name the release path, so you can tell which bundle is stale and where to look.

Configured role caps now win. A role cap you have configured overrides the turn cap baked into the script on the main path, so your setting actually takes effect.

A small correctness fix. Bare 404 fallback responses from legacy servers are now recognized as 404s instead of being misread.

2 of these changes (T-251, T-245) were accepted with no gate that could run, so nothing was verified about them beyond a person reading the diff.

2 of these changes (T-251, T-245) were accepted with no gate that could run, so nothing was verified about them beyond a person reading the diff.

What shipped

M-001

• T-223 A single provider 520 mid-stream kills the whole run: transient upstream errors should pause as weather, not fail terminal (bb451fe)
• T-223 A single provider 520 mid-stream kills the whole run: transient upstream errors should pause as weather, not fail terminal (e0a9559)
• T-231 Reword the pre-promotion task-count assertion message (8fd6a79)
• T-232 Rename the roster admission test and update its comment to match turn-level binding (b683c44)
• T-233 Reformat the Settings content block for auditable closing-tag nesting (630f91d)
• T-234 Nest multi-portion promoted tasks under one Reported bugs milestone (6bce1ab)
• T-234 Nest multi-portion promoted tasks under one Reported bugs milestone (ff944bc)
• T-237 Trim the response body before matching the legacy Go 404 fallback text (9276569)
• T-237 Trim the response body before matching the legacy Go 404 fallback text (b921e4c)
• T-238 Make TestAnAbortKillsTheGateAndItsChildren load-tolerant: unique marker and poll-until for the survivor check (703bb85)
• T-238 Make TestAnAbortKillsTheGateAndItsChildren load-tolerant: unique marker and poll-until for the survivor check (9ea9792)
• T-243 Synchronize version-bearing project files during release cuts (820bbaf)
• T-243 Synchronize version-bearing project files during release cuts (3a73124)
• T-244 Show one current escalation card and close it after a decision (42edc48)
• T-244 Show one current escalation card and close it after a decision (d47dff7)
• T-245 on_accept publication policy: accept lands, then pushes per the project's configured policy (df62caa)
• T-245 on_accept publication policy: accept lands, then pushes per the project's configured policy (1524245)
• T-246 Expose policy and publication state in the API (69a56c5)
• T-247 Present accept consequences and unpublished state (8a3df5b)
• T-247 Present accept consequences and unpublished state (a4da50b)
• T-248 Own desktop bundle generation in release cuts (0e2c9de)
• T-249 Name the release path in stale-bundle warnings (36ed0a7)
• T-249 Name the release path in stale-bundle warnings (aad370e)
• T-250 Strengthen worktree rejection regression coverage (c26ddc9)
• T-250 Strengthen worktree rejection regression coverage (0b249c6)
• T-251 Collect complete commit-range inventory (91293cb)
• T-251 Collect complete commit-range inventory (56f3d9b)
• T-252 Render both release item classes honestly (f989b01)
• T-252 Render both release item classes honestly (f32e5dc)

M-002

• T-235 Render and submit the escalation multiplier (60e3421)
• T-235 Render and submit the escalation multiplier (854f809)

M-003

• T-239 Isolate snapshot and restoration roots (80543b1)
• T-239 Isolate snapshot and restoration roots (1fb85d7)

M-004

• T-240 Add worktree snapshot regression coverage (77f70d1)

M-006

• T-242 Wire notes through shared launch controls (e38d06a)
• T-242 Wire notes through shared launch controls (b1206d8)

Landed outside the loop

• desktop: rebuild bundled dist (post-B-296) (0aafd1b) — Jose Rullan
• Rename Roster to Flock and contextualize selection (500ec48) — Jose Rullan [PR #5: Promote Roster as Flock with contextual duckling map]
• Bundle revised Roster in desktop (cdc0385) — Jose Rullan [PR #5: Promote Roster as Flock with contextual duckling map]
• Promote Roster and add evidence map (771de7c) — Jose Rullan [PR #5: Promote Roster as Flock with contextual duckling map]
• test: the OpenRouter index stub returns a FRESH cache, ending a race with the background refresh (ddc30f1) — Jose Rullan
• desktop: rebuild bundled dist (T-247 publication surfaces) (f77b6c7) — Jose Rullan
• desktop: rebuild bundled dist (B-276 note controls + retry door wave) (54b9e87) — Jose Rullan
• retire: a branch-only chained test needs no revert — and a bad sha is not 'not an ancestor' (a9edb18) — Jose Rullan
• strategy: the configured role cap overrides the script's baked-in turn cap on the main path (f31dcdc) — Jose Rullan

v0.9.1

v0.9.1

The Now view

• The Now view no longer shows the rail's running list twice, and the floating utilities drawer no longer overlaps page content.
• Chats that ended, were aborted, or had their stream cancelled no longer linger in Now under "failed, awaiting your call" — a finished chat no longer claims it needs your decision.
• Approving a plan is now a real decision made in Now: a card shows what the plan covers, with evidence, and a drawer explains exactly what approving will do.
• The unexplained "N/M passed" stat in the Now footer has been reworded or removed.

When something is wrong, it tells you why

• A single stale (404) page no longer dims and freezes the whole desktop.
• Whenever part of the app is dimmed or disabled, it now says why it is and how to get out.
• Items marked blocked now explain why they are blocked, and manually landing a task no longer leaves it stuck in a phantom "blocked" lane.
• The doctor's standing finding no longer interrupts every chat, and when it is shown it renders as readable text instead of raw data.

Your work survives

• A budget pause mid-run no longer destroys progress: the interrupted turn's work is kept, the resume lands on the right role, completed work no longer regresses, and the transcript shows a checkpoint note where the run was interrupted and resumed.
• Accepts are more robust: an accept completes fully or fails clearly, some former hard errors are now reported as warnings, leftover render captures no longer block the accept's branch switch, and unusual file layouts (ignored or symlinked links) no longer break accept staging.
• A run taking roughly twice as long as its kind usually does is now flagged for escalation — and that clock counts only active work, not time spent queued or paused.
• Runs no longer serialize behind a single seat holding a provider slot for the run's whole lifetime; slot reservations now behave the same on either side of a pause.
• After an accept, your checkout now advances by itself: sync checks only the files it is about to touch, so unrelated local changes — including the app's own state files — no longer block it and are never overwritten. If a file the landing would update has local changes, sync leaves everything untouched and says so.

Chat

• Project chat now has a proper door, and the roster seats you picked are pre-seated when you open it.
• A configuration-amendment suggestion now accompanies the consultant's answer instead of replacing it.
• Expanding one turn in a transcript expands only that turn, not every turn by the same role.
• Launching a run from the desktop no longer silently forces solo mode — your configured "build runs open in: pair" setting and pinned seats are honored.
• Adjust-seats now shows the seats of the phase being tuned, instead of blank ones.

Settings & status

• Settings is no longer a one-way trap: the section buttons keep working once you've entered a room.
• The Providers list shows the real per-provider run cap (1 local, 8 remote, or your configured value) instead of "unlimited".
• The sidebar footer now shows when an update is available, with a checkpointed restart action to take it.
• Small text fixes: "N runs hit this ceiling" now pluralizes correctly, and budget aggregates show money to two decimals.

Tasks

• Triage can now break a big ask into a set of smaller tasks sized to the work, each on its own lane, instead of handing over one oversized task.

1 of these changes (T-208) was accepted with no gate that could run, so nothing was verified about it beyond a person reading the diff.

1 of these changes (T-208) was accepted with no gate that could run, so nothing was verified about it beyond a person reading the diff.

What shipped

M-001

• T-181 T-177 left the dissolution half-done: a floating utilities drawer overlaps content and the whole GuideRail is embedded in Now, duplicating its running list (bb0a7be)
• T-198 One stray 404 bricks the whole desktop: staleness inference dims every surface with pointer-events-none and never says why (f5ef2d8)
• T-199 Fake engine drifted again: seven endpoints unknown — the parity test does not walk the real routes (479deb6)
• T-200 F2a — plan sections declare their lanes: owned files become a validated contract that briefs inherit (76bb4dd)
• T-201 F2b — approving a plan is a Now decision: a card with coverage evidence, and a drawer that says what approving means (4f56136)
• T-202 Dedupe staging exclusions and make accept staging immune to ignored/symlinked link_deps (7a78f99)
• T-203 The project chat has no door and seats nobody: the consultant hides in the command palette and the roster's pick is not pre-seated (d5c38a7)
• T-204 The configuration-amendment card replaces the consultant's answer instead of accompanying it (8563368)
• T-205 Make accept atomic: commit merge succeeds before checkout advance, downgrade advance errors to warnings (521dccf)
• T-206 The engine never notices a run is taking twice as long as its kind: wall-clock vs history joins the escalation thresholds (26600c0)
• T-207 run_list punishes big asks (over-limit falls to the DEFAULT of 20) and analytics have no honest path: aggregates belong to the engine (291d737)
• T-208 An ended or aborted chat lingers in Now wearing accept-framing it can never satisfy (d3e74ba)
• T-209 The doctor's standing finding gatecrashes every chat and renders a raw struct at the user (a2c09ca)
• T-210 Manual /land leaves the task in a phantom 'blocked' lane — and blocked never says why (2fd47ec)
• T-211 A tail-role seat serializes whole runs: provider slots are reserved for the full roster for the run's lifetime, and inconsistently across pauses (f133e4d)
• T-212 No terminal chat belongs in Now, whatever killed it: stream-canceled chats still squat in 'failed, awaiting your call' (aa0f8b0)
• T-213 The disabled-surface state is still silent: whenever the app dims MAIN it must say why and how out — the undelivered half of B-228 (6802843)
• T-214 The Settings frame is a one-way trap: section buttons die once you enter a room — two navigation mechanisms, one owner needed (6702d6d)
• T-215 Expanding one reviewer turn expands them all: transcript expansion state is keyed by role, not by turn identity (b0663da)
• T-216 A budget pause mid-turn destroys work: the interrupted turn's progress is discarded, the resume skips to the wrong role, and even completed work regresses (0dc4b47)
• T-217 Replace the fabricated reviewer checkpoint with a real budget-interruption resume test (d7fa5bd)
• T-218 Render interrupted-turn checkpoint notes and resumed status in the transcript (29aea0f)
• T-219 A desktop launch surface requests mode=solo, silently overriding the configured 'build runs open in: pair' and the pinned seats (3e8880e)
• T-220 Render captures still live inside the worktree and now block the accept's branch switch: move them out of the tree for good (842b838)
• T-221 Refuse to synchronize any dirty default-branch checkout, including .ducklab (938e212)
• T-222 Triage proposes decomposition and promote can birth N tasks with disjoint lanes: portion the food to the duckling's size (ea634cc)
• T-224 Enforce one checkout root throughout turns, gates, and accept staging (65cf4ee)
• T-225 Reword or remove the unexplained 'N/M passed' stat in the Now footer (f2993a1)
• T-226 Show the effective per-provider run cap (1 local, 8 remote, or configured) instead of 'unlimited' in the Providers list (b666835)
• T-227 Pluralize 'N runs hit this ceiling' and add a two-decimal money variant for budget aggregates (9ffaf72)
• T-228 Show available update in the sidebar footer with a checkpointed restart action (3d22b8f)
• T-229 The history_duration trigger counts queued and paused time as work: elapsed should be active wall clock only (471b597)
• T-230 Adjust-seats shows empty seats: the rail fetches the roster for mode=solo regardless of the phase being tuned, and the one-shot pre-seed bakes the blanks in (99811cb)

v0.9.0

---

kind: release
version: v0.9.0
since: v0.8.0
tasks: 59

v0.9.0

This release adds remote support, gives the system a configuration doctor (and a consultant who can act on its findings), reworks the documents experience, and makes most surfaces — launching runs, Now, roster, budget, settings, navigation, and errors — say more in fewer words.

Working with a remote

• New pull, push, and pull-request verbs, each with a receipt showing what actually happened.
• The system is now aware of the remote: it notices when the repository has drifted, audits orphaned work, and can recover it.
• Recovery by cherry-pick now preserves the original commit, so recovered work keeps its identity.

Accepting runs

Two failure modes around accepting work are fixed:

• Accepts no longer fail when a staging exclusion leaves excluded paths staged in the index — this was breaking every non-fast-path accept.
• Retrying an accept after a failed rebase no longer dies on "nothing to commit."

Configuration

• A new configuration doctor checks your project configuration and reports concrete findings: the exact key, the proposed value, and the reason. Its output is fully deterministic, and it no longer double-reports a finding when a project has both a root and a frontend package.json.
• The consultant can now act as a configuration expert: it answers configuration questions and applies fixes directly, including list values and whole sections, and settings nested three levels deep that the configuration previously refused to write.
• The consultant's offer to review your configuration now actually appears when you open a project.
• Configuration-related failures now show one actionable card instead of none, or two competing cards for the same finding.
• Concurrency limits (maximum concurrent runs and per-provider caps) can be changed from the desktop without a restart.
• Settings are reorganized around the questions you actually ask. The category menu stays in place as you move between rooms, every room is reachable, and the old seat dropdown is gone — the Roster board is the single place to manage ducklings.

Documents

• The documents surface now narrates the chain: three stages, each stating who writes and what you approve; sections show their live state; proposals are presented as decisions.
• Rejecting a document stage now tells you the reason, clears the stale stage marker, and offers the revise action as the next step — in the app, the CLI, and MCP.
• The documents page is properly framed: the header stays in place while you read, a finder takes you to a section, and the filters reflect the true state.
• The documents health line no longer reports a false all-clear when the underlying trace and check report breaks.
• The document detail pane shows verified claims, summary-first cards, and puts the redraft machinery behind a single plain line.
• The Requirements tab renders spec sections correctly, with no section shown twice on one page.

Launching and watching runs

• Launching work is now a guided modal: each mode card explains when to use it and estimates the cost from this project's own history, and seats are prefilled from the roster.
• The Now card leads with the conclusion and verdict, with technical detail tucked into an evidence drawer. The four unexplained terms are gone, the amber warning beside "passed" now says what it means, and the decision buttons are never lost.
• The Now page no longer hides a second, duplicated running list behind a utilities drawer.
• The spent card now shows wall-clock time — how long you actually waited.
• Every run now answers "why does this run exist": the requirement sentence that asked for it, quoted, with the chain as a breadcrumb. Runs with no chain say so honestly.
• Task cards carry their origin line — the plan-section sentence that bore them, clickable — and tasks with no origin say so.
• The runs list now paginates: honest counts, filters preserved, newest first.
• Marking work landed no longer asks you for forensics the system can do itself, and its always-visible fields no longer invite you to fill in records by hand.
• New [render] setting in project.toml: screenshot captures are attached to runs at the gate and shown in the evidence drawer. Two bugs that discarded these captures on failure are fixed.

Roster and budget

• Roster suggestions now show their arithmetic, ducklings get evidence portraits, and an empty seat explains itself.
• Budget ceilings now show what actually happened against them: hits last month, a suggested adjustment when one is warranted, and where the money went. Zero-hit rows are hidden, and money is formatted consistently everywhere.

Layout, navigation, and errors

• Desktop navigation moves to a stable left sidebar rail. The sidebar itself is decluttered — the app name the window bar already shows, the duplicate project card, and a bare branch label that read as jargon are all gone, and the configuration block is back to a single entry.
• The floating utility panel (autopilot, next steps, recent runs) is gone. Its jobs moved to the surfaces that own them: next steps live on Now, recent runs in Records, and the autopilot control is in the sidebar.
• Every room has a door: Roster, Skills, and Projects are all reachable, and the Roster board displays in full inside the Settings frame instead of truncating and losing seats.
• The roster filter chips are labeled, and the Skills header is no longer an implementation dump.
• Errors are consistent across all views: one shared error card everywhere, and messages no longer leak raw API paths or error-type prefixes around otherwise-perfect sentences.

---

What shipped

M-001

• T-136 Signpost discard on document-stage reject with a reason and surface the revise verb in next[], MCP/CLI, and desktop (8064f02)
• T-138 Config API writes slices and tables (fed7459)
• T-139 Config doctor: deterministic findings (4e1f240)
• T-140 Remote awareness, orphan audit, and recovery (29d424e)
• T-141 Remote verbs: pull, push, PR with receipts (0a27c01)
• T-142 Consultant as configuration expert, and the settings surface (4bb86f9)
• T-143 Staging exclusion leaves excluded paths STAGED: a dirty index blocks the accept's rebase, so every non-fast-path accept fails (f5e72c8)
• T-144 acceptWorktreeRun retry is not idempotent: after a failed rebase, the retry re-runs the commit step and dies on 'nothing to commit' (6ab35bc)
• T-145 ConfigFailureCard can never render: config_amendment events are not emitted on the run-failure path it listens for (d45f57b)
• T-146 config_amendment emission is untested: no Go test verifies ChatStart emits amendment events when the doctor has findings (47de4b8)
• T-147 Adopt-end and project-open consultant offers are unwired or untested (adopt-config-offer, project-config-offer) (be31388)
• T-148 ValueKey misses 3-level nested map keys (mode_seats.pair.implementer): doctor finding keys cannot round-trip through the config API (f0b99dd)
• T-149 config doctor emits duplicate findings when both root and frontend package.json exist (41b40f0)
• T-150 The spent card omits wall clock: the run's most expensive dimension — the human's waiting time — is the one not shown (e08ff37)
• T-151 Mark Landed asks the user for forensics the system can do itself, and its always-visible fields invite record falsification (c5a39eb)
• T-152 Concurrency knobs have no desktop surface: max_concurrent_runs and per-provider max_concurrent live only in the engine TOML and need a restart (276e3d8)
• T-154 The failure-path config_amendment event renders two competing cards: Apply-amendment and ask-the-consultant for the same finding (1294163)
• T-155 Timing-sensitive tests flake under parallel gate load: TestShellContextKillsTheWholeGroupAtTimeout failed a gate for an unrelated one-line diff (e61b862)
• T-156 ProviderSet cap-raise poke path is untested: no test verifies a queued run is admitted when a provider max_concurrent rises (bce87af)
• T-157 Fake engine drifted behind the app: six newer endpoints unknown, breaking the documented frontend dev flow (67d9b8a)
• T-158 The Now card speaks four unexplained terms to the novice, and the amber warning beside 'passed' says nothing (9b337e2)
• T-159 Roster filter chips are unlabeled and the Skills header is an implementation dump (c17b7f6)
• T-160 User-facing errors leak developer debris: raw GET /v1/ paths and an ApiError: prefix around otherwise-perfect plain sentences (707bf47)
• T-161 Browser dev against a REAL engine fails silently: no CORS, misleading 'session died' banner (a4bc1b7)
• T-162 TestProjectRecoveryDoors/cherry-pick-chain flakes under concurrent gate load (f7e93c5)
• T-163 Roll the ErrorCard out to the remaining views — only Skills adopted it (f6378f3)
• T-164 WaitingCard/Now duplicate a zero-dollar money helper and declare a function between imports (1c32c20)
• T-165 killrepro test marker is shared across concurrent gates: parallel runs could pgrep each other's sleeper and falsely fail (a788ef7)
• T-166 Pin committer/author dates in cherry-pick recovery so the orphan SHA is preserved (8bfec63)
• T-167 Now decides through an evidence drawer: conclusion and verdict up front, technical detail behind it, decision buttons never lost (e518c34)
• T-168 Launching work becomes a modal that pre-answers everything: mode cards with when-to-use and cost estimated from this project's history, seats prefilled from the roster (ff52f78)
• T-169 Roster suggestions show their arithmetic, ducklings get evidence portraits, and an empty seat explains itself (45f4fb8)
• T-170 Budget ceilings show what actually happened against them: hits last month, a suggested adjustment, and where the money went (4d34e05)
• T-171 The desktop nav moves to a left sidebar r...

v0.8.0 — runs in worktrees, accepts as merge proofs

---

kind: release
version: v0.8.0
since: v0.7.0
tasks: 23

v0.8.0

At launch

• The ducklings you pick for a run now actually sit in the seats you picked. The launcher used to map your roster positionally, so a custom roster could seat the wrong duckling in the wrong role.
• The advisor is now visible and selectable in the pair and solo launchers — there was previously no way to give an advisor a seat at launch.
• Relaunching a legacy chain_build run now maps its recorded ducklings to the correct roles instead of reinterpreting them positionally.

While a run is going

• Build and test-first stages run in their own worktree outside your repo, so a run no longer touches your checkout mid-work.
• A test-first run paused at a gate is now kept intact; pausing used to delete its worktree.
• Rejecting a test-first run now cancels the chained build step and lands the red-test commit on the run branch so the failure is preserved. Linked dependencies no longer get swept into run commits.
• Runs that change frontend source without rebuilding the desktop bundle are flagged as desktop-stale on the run record and shown at the human gate, so you won't silently accept changes the desktop hasn't built.

Accepting

• Accept is now a merge proof: the run is rebased, the gate runs on the exact rebased commit, and it is merged only if it applies cleanly. What lands on your default branch is exactly what was gated.
• When an accept advances the default branch, your local checkout is now synced to it — no stale working tree after accepting.

On the desktop

• Switching projects now clears the board, and a fetch failure is shown instead of stale rows from another project.
• The final gate's result is now rendered on the run card and in the sidebar gate box.
• Escalation suggestions now actually reach you on the desktop. Runs that die of turn or budget exhaustion, and repeated failures across runs on the same task, now trigger one.
• When a command isn't on the shell allowlist, you're no longer offered approvals the policy can't honour; the message and guidance now match what will really happen.
• In yolo mode, when the advisor answers a human prompt on your behalf, the consent surface now says so, and the answer is recorded as coming from the advisor instead of as an unattributed "human" event.

The advisor

• Advisor answers are judged by their actual content, not by counting dots. Useful answers were being discarded for containing file paths or phrases like "I recommend"; they now get through.
• The advisor's consult cap is now enforced like every other role's turn cap, and the default matches what's advertised.

Settings and governance

• Run implementers can no longer write to .ducklab/project.toml mid-run, and any change to a governance key is now surfaced at review and at the human gate instead of happening behind your back.

Numbers

• The scorecard now counts accepted document-stage work as a success, so pass rates reflect what was actually accepted.
• Items you land by hand now settle as "landed" instead of being counted as failed.

Command line

• Bare ducklab release with no arguments now prints usage instead of quietly starting a plan run.

What shipped

M-001

• T-113 Run build and test-first stages in per-run git worktrees outside the repo (df7d72e, 5b74a84, f6e6e58)
• T-114 Accept becomes a merge proof: rebase, gate the rebased sha, ff-only merge (80e8e29)
• T-115 Worktree hygiene on engine start and the desktop worktree surface (e75d45d)
• T-116 Block run implementers from writing .ducklab/project.toml and surface governance-key changes at review and the human gate (971cf8c)
• T-117 Make scorecard pass_rate count ACCEPTED as success for document stages (de9e8d1)
• T-118 Clear board state on project switch and render fetch failure instead of stale cross-project rows (7197fac)
• T-119 Stop offering approvals shell policy cannot honor: fix the not-in-allowlist message and the ask guidance (6df5125)
• T-120 Add a 'landed' terminal resolution so operator-landed rejects stop counting as FAILED (766fc67)
• T-121 Run launcher seats the wrong ducklings: roster entries mapped positionally into mode seats, and filter(Boolean) shifts seats on 'default' (61df20f)
• T-122 Sync the person's checkout with the ref when acceptWorktreeRun advances the default branch (89d51a4)
• T-123 Flag diffs that touch frontend/src without a dist rebuild as desktop_stale on the run record and surface them at the human gate (b384a47)
• T-124 Confirm verifyAcceptedCommit populates linked deps and setup before the gate, or close as fixed (3a7d2a2)
• T-125 Cancel a test-first run's then_build chain on reject, land the chained red-test commit on the run branch, and exclude linked deps from every commit stager (e76301e)
• T-126 Stop executeTestFirst from cleaning up the worktree when pausing at a gate (1fdfce7)
• T-127 Render the phase:final gate result on its card and key the sidebar gate box on the final gate event (1ef8d3f)
• T-128 Advisor contract counts dots, not sentences: useful answers discarded over file paths, 'I recommend' is banned, and the discarded text is not logged (3497cf9)
• T-129 Yolo auto-answers ask_human via the advisor, but the consent surface never says so and the answer is recorded as an unattributed 'human' event (994f4f5)
• T-130 The advisor seat cannot be chosen (or seen) at launch: pair/solo launchers render no advisor chip and the positional RunRequest.Ducklings cannot carry one (f87b234)
• T-131 escalation_suggestion events have no desktop surface: the run emits them, the person never sees them (9b89eb2)
• T-132 Escalation is blind to the loudest distress: runs that die of turn/budget exhaustion produce no trigger evidence, and cross-run failure repetition on one task is not a trigger at all (877fe07)
• T-133 Make bare ducklab release print usage instead of starting a plan run (e740622)
• T-134 Route the rubber-duck consult cap through role_turns/TurnCaps and reconcile the advertised advisor default (b592cba)
• T-135 Legacy chain_build records relaunched via RunView reinterpret positional ducklings through the new role mapping (079371b)

v0.7.0

Adopt surveys: see what the survey actually found

• Proposal cards and the run view now show the survey's inventory and flag any unaccounted coverage — parts of the codebase the survey couldn't account for — so you can judge a proposal's completeness before accepting it.

Stuck and failed runs get better answers

• When deliverable progress stalls at a FAILED-run or distress decision point, ducklab now suggests a measurably stronger seat for the work instead of retrying at the same level.
• Gate output is now attached to the final gate event and to the failed run's record, so a run that fails at a gate shows you the actual gate output rather than just "failed".
• TDD chain builds now resolve their build mode through the normal run-start path, fixing an issue where the mode wasn't applied as expected.

Prove and share what was accepted

• You can now export acceptance receipts from a run and check them with the new ducklab proof verify command, so results are verifiable outside the app.
• The ducklab MCP server now ships as a standard .mcpb bundle attached to each release, ready for installation and for the official MCP registry.

Settings and layout

• Settings now have default build-mode and test-mode selects, so you set your preferred mode once instead of per run.
• The "your team" roster section is gone from Settings.
• The running section now sits at the top of the Now view.
• When the advisor starts drafting an answer, you now see a live drafting animation in the question card and seat panel instead of the answer appearing silently.

Smaller changes

• Renaming a task id now updates references in task body prose, not just dependency lines, so plans no longer keep stale ids after a rename.
• Every process tree a run spawns is now stamped with DUCKLAB_RUN_ID and DUCKLAB_PROJECT_ID, so you can trace any spawned process back to its run and project.

What shipped

M-001

• T-098 Stamp every run-spawned process tree with DUCKLAB_RUN_ID and DUCKLAB_PROJECT_ID (9389637)
• T-099 Prove the per-repo worktree mutex serializes one repo and never blocks another (d9b0a91)
• T-100 Two-pass adopt survey: inventory turn, coverage diff, and run-record surfacing (89ca88c)
• T-101 Surface survey inventory and unaccounted coverage on proposal cards and the run view (9ae27f3)
• T-102 Add dev-only engine connection fallback via ?engine=&token= query params or VITE_ env when window.ducklab is absent (082fc57)
• T-103 Apply task-id renames to body prose in PlanTaskIDs, not just Depends-on lines (f0d94c8)
• T-104 Add build/test default-mode selects to Settings wired to the existing buildMode/testMode state and save path (d2a1e4d)
• T-105 Remove the 'your team' roster section from Settings (64cb454)
• T-106 Move the running section to the top of the Now view (0b6de83)
• T-107 Suggest a measurably stronger seat at FAILED-run and distress decision points when deliverable progress stalls (d100c8e)
• T-108 Build a ducklab-mcp.mcpb bundle (manifest + linux binary) as a release artifact so the official MCP registry can list ducklab (7cea365)
• T-109 Export acceptance receipts and add ducklab proof verify (22eb067)
• T-110 Leave the TDD chain build's mode empty unless explicitly picked so RunStart resolves it via resolveBuildMode (93f1bc7)
• T-111 Attach gate output to the final gate event and the failed run record (26e2cc5)
• T-112 Emit advice_started and animate advisor drafting in the question card and seat panel (1c1b1ab)

v0.6.3

Queued runs: Two runs aimed at a one-slot local endpoint used to serialize invisibly at inference time; now the second run queues honestly, with a reason that names the provider and the runs holding its slot. The starter defaults work without any configuration: local endpoints cap at 1 concurrent run, hosted at 8, and an explicit max_concurrent overrides either. The cap also keeps you from tripping rate limits or overloading a hosted provider.

Queue status: Runs that are waiting now record the reason, and the desktop shows that reason, so you can see at a glance why a run hasn't started rather than guessing.

Settings: Each provider's maximum concurrent runs (max_concurrent) is now exposed in Settings, so you can view and adjust the cap per provider.

What shipped

M-001

• T-096 Per-provider concurrency caps in the run queue with the reason recorded on the run (5e89bf7)
• T-097 Show the queued reason in the desktop and expose provider max_concurrent in Settings (b8aff05)

v0.6.2

Release v0.6.2

Chat: images

• You can now attach images to the guide chat using the new image picker in the chat controls.
• Attached images are carried into the conversation and are usable by vision-capable consultants.
• The consultant seat now appears in Roster Common and is pre-selected in the guide's chat box, so you can point image questions at it without hunting.
• If the selected provider or model can't actually accept images, the chat now fails fast with an explanation of what's missing and what to do, instead of a raw server error.

Cycle view and guide

• A file-picker button sits beside the reference-documents input, so you can attach documents by picking them rather than typing paths.
• Accepting a plan proposal that would rewrite a task body with already-accepted history now raises a warning first, so you can see the consequences before you accept.
• The guide no longer offers "reopen task" as a next step.

Run transcript and gates

• The accept phase announces its commit step in the run transcript before the commit runs, and gate activity now shows up as a live turn in the transcript instead of appearing only in hindsight.
• Fixed a case where a superseded committing gate block would close with a green check it hadn't earned; it now closes in a neutral state, so the transcript no longer overstates what was verified.
• The ask_human question card now shows the advisor's in-flight work while you wait, and that work now counts against the run's budget, so the budget you see is the budget that was actually spent.

Recent runs

• The guide rail has a fixed Recent runs strip, always in view.
• Each entry shows the run's stage alongside the task id.
• Status indicators use verb-first labels, and unverified runs get an em-dash glyph instead of a check, so a run you can't trust as verified reads differently at a glance.

What shipped

M-001

• T-079 Add a file-picker button beside the reference-documents input in the Cycle view (6b8c92e)
• T-080 Announce the accept's commit step in the run transcript before the commit runs (a576fb4)
• T-081 Warn on plan proposals whose accept rewrites task bodies carrying accepted history (172b69c)
• T-082 Make the accept-phase gate_started event render as a live gate turn in the transcript (f94297b)
• T-083 Carry images through ChatStart and ChatSend to a vision-capable consultant (9d4fb8b)
• T-084 Add an image file-picker action to the chat controls (fe2424a)
• T-085 Classify image-input provider rejections and pre-flight the declared vision claim so an mmproj-less llama.cpp chat fails with guidance, not a raw 500 (6b9f91e)
• T-086 Add a consultant seat to Roster Common and pre-select it in the guide chat box (a61bee5)
• T-087 Add a fixed Recent runs strip to the guide rail (e79079b)
• T-088 Show run stage beside the task id in the Recent runs rail entries (2d35090)
• T-089 Rewrite Recent runs indicators to verb-first labels and em-dash unverified glyph (58c27c5)
• T-090 Emit the pre-commit gate event before staging/committing in RunAccept (e91f9ea)
• T-091 Show the advisor's in-flight work on the ask_human question card and account it to the run's budget (9f2c20d)
• T-092 Remove the reopen-task next step from the guide (5a6f7e7)
• T-093 Thread the request context through validateChatImages to the VerifyVision probe (2f372b7)
• T-094 Close a superseded committing gate block with a neutral state instead of an unearned green check (e70177c)
• T-095 Add gofmt -l to the project gate and settle existing formatting drift (c87a560)