v2026.10.17

hooks-v1 stable promotion. Project hooks (hooks-v1) are released on stable: this release stamps cleo.releasedFeatures: ["hooks-v1"] into @cleocode/core, so cleo hook sync --activate works and activation receipts run on a stable build. The promotion was gated on the VidaPeps pilot against 2026.10.17-canary.1 (packed and published installs, read-only dev and prod ledger checks, live Claude Code and Codex sessions, hosted exact-candidate CI), bound to the same implementation source as this release. Cross-device sync (Stage C) stays unreleased and inert.

hooks-v1

• Project hooks activate and run on stable builds; the hooks-v1 gate (release-gate.ts) opens from the promotion stamp, not a source change (provenance: T13350, T13557)
• Codex hook delivery has known limits (T13772–T13775): hooks fire only in a standalone checkout, need a one-time hook trust step, and Codex's env filtering can let a push through ungated. Claude Code hooks are unaffected.
• Verified for this promotion (code shipped in v2026.10.16): the release-plan guard does not refuse the post-promotion cleanup once the previous release shipped the gate open (provenance: T13607)

Fixed

• ci: is refused when no check is required; tool:config-schema tests a change to CLEO config alone (provenance: T13757, T13758)

Also in this release

• cleo cloud push checkpoints the change journal and cleo cloud verify compares a journal store with the journal tallies (inert on stable until Stage C) (provenance: T12999)