v2026.10.18

Goal protocol, Codex worktree hooks, evidence fixes. Agents can now drive a task to done through a goal contract: cleo goal draft writes the goal from the task's acceptance criteria and cleo goal close records per-criterion evidence and completes fully proven tasks. Codex project hooks now fire in linked git worktrees. Cross-device sync itself (Stage C) stays off on stable until Stage C releases its flags; the groundwork below adds migrations and changes audit retention now.

Goal protocol

• cleo goal draft <taskId> [--tasks …] [--out <path>] writes a goal/v1 goal.yaml from task acceptance criteria (provenance: T13793)
• cleo goal close <slug> --outcome <file> records a goal run's per-criterion evidence and completes fully proven tasks through cleo done (provenance: T13794)
• @cleocode/contracts exports the goal/v1 protocol types: GoalContract with per-criterion proves, GoalTaskLink and GoalOutcome (provenance: T13792)
• cleo done <id> --commit <sha> closes work that landed on main with no citing PR or branch; a REQ-only task closes through cleo done (provenance: T13799)
• One Stop entry per provider: cleo hook stop runs goal tick, then ask-enforce, then session end, so they no longer fight (provenance: T13796)
• cleo goal close sets a completion commit only when it has landed on origin's default branch; the Stop dispatcher's goal tick runs only inside a goal workspace bounded to the git/.cleo root (#2312).

Project hooks

• cleo hook sync delivers the Codex project hook where Codex reads it for a linked git worktree, so it fires in worktrees; the other v2026.10.17 Codex limits (T13773–T13775) remain (provenance: T13772)
• Project hooks (hooks-v1) are released in source, so every build runs them without a release stamp (provenance: T13776)

Evidence

• Unrelated commits on main no longer stale a test-run, and a parent task closes on its done children's PRs instead of pr-ambiguous (provenance: T13784, T13785)
• A moved test-run compares only the owning package's test-style setup files (provenance: T13784)
• Evidence and typed-gate git reads use the resolved tree, never an inherited GIT_DIR or GIT_WORK_TREE (provenance: T13695, T13697)
• A test-run or qa-run is refused when its worktree cannot be opened by git, and a stale verdict names the reflog it read (provenance: T13703, T13702)
• A qa-run lint or typecheck receipt only owes coverage for the files its tool reads (provenance: T13698)
• Typed test gates take their verdict from structured counts; minCount reads a wrapper's last-line count JSON; a change outside every workspace package can pass testsPassed with a targeted run (provenance: T13752, T13753, T13754)
• cleo run charges a non-heavy command light and a scoped build half a heavy run, so independent builds stop serializing the machine (provenance: T13452, T13759)

Stuck closures

• ci:<pr> evidence treats a merge-commit run red only on the flaky-quarantine budget as no test failure, looks past later runs red for that reason or cancelled, and refuses a quarantine-budget log whose last vitest summary follows unprefixed child output (provenance: T13809)

Cross-device sync groundwork (sync itself stays off on stable until Stage C)

• Live on stable: every command now writes its audit row to tasks_audit_log (existing audit_log rows are copied over on open); audit pruning by logging.auditRetentionDays now also removes task-mutation history, keeping receipts, with a 30-day floor; a second handoff for the same session is refused; cleo release cancel removes a release's child rows first; migrations add row-uid columns on upgrade (provenance: T13777, T12914)
• Releases, lifecycle stages, PRs and commits get row uids and sync (16 tables) (provenance: T12914)
• Token usage, session handoffs and the Nexus audit log travel in the change journal; the dispatch audit moves into tasks_audit_log, and the audit prune keeps receipts with a 30-day floor (provenance: T13777)
• The vault manifest leaves out rows that stay on their device, so a store holding them pushes and verifies in sync (provenance: T13808, T13777)

Also in this release

• ct-lean review and audit workflows on CLEO's code graph, and cleo lean gain, the measured ct-lean scoreboard (provenance: T13665, T13669)

Not in this release

• #2302 (targeted evidence for config edits, merged changes, redirected reports, generated clients) and #2303 (declared seed/data globs owe dependents a typecheck) are not included; they are planned for a later release.