LoopExec v0.4.0

LoopExec v0.4.0

This release adds an opt-in shared model-call budget for projects that launch builder and critic subprocesses under separate LoopExec run IDs. It prevents a new run ID from silently restoring an asset's spent call allowance.

Included

• loopexec budget status and budget reserve with a pinned policy, total and per-phase call limits, durable pre-call reservations, and fail-closed duplicate or damaged-ledger handling.
• An offline adapter and CI proof that two run IDs share one budget and a third child never starts after the allowance is spent.
• Race tests for concurrent reservations, policy drift, and damaged records, plus Linux/macOS CI coverage.

Use

A policy file can specify {"schema_version":1,"scope":"studio-floor-rack","max_calls":2,"phase_limits":{"builder":1,"critic":1}}. The adapter invokes budget reserve --store-dir <absolute-existing-directory> --policy <file> --phase builder --call-id <stable-id> immediately before the model subprocess. budget status --json reports remaining calls. The example and migration guide show a complete offline proof.

budget_exceeded exits 18 when a total or phase allowance is spent. Duplicate IDs, changed policies, and malformed reservation records fail closed as cost_anomaly (18). A failed child still consumes its reservation. This is a call-count gate, not a token or dollar cap; existing workflow metering remains responsible for reporting usage. Nothing automatically migrates older project ledgers.

Installation

With Go 1.26 or newer:

go install github.com/justyn-clark/loopexec/cmd/loopexec@v0.4.0
loopexec --version

Or download an OS/architecture archive and verify it with checksums.txt. macOS, Linux, and Windows builds are packaged. CI runs formatting, vet, tests, scoped-budget race/proof checks, existing dogfood, creative, and SMALL proofs on Linux and macOS. Windows packages are cross-built; native Windows runtime is not CI-verified. No model SDK, Python runner, or credentials are bundled.