v2026.10.20

Audit-log secret redaction. Rotate any token you passed to cleo service connect on an earlier build: older builds wrote it to the synced audit log (fixed in this release, T13855/T13857). Audit tables now redact secrets on write, and each store scrubs older rows once on open. Cross-device sync itself (Stage C) stays off on stable.

Added

• cleo goal install --harness opencode --dry-run previews the change through cleo-goal; criterion by/detail may be null (provenance: T13869, T13870)
• the Stop dispatcher passes CLEO_HOOK_PROVIDER (claude-code or codex) to the goal tick (provenance: T13884)

Fixed

• docs fetch now returns the merged head after concurrent edits, not the last writer's raw input (provenance: T13842)
• the first push over a format-2 parent prunes only the local rows in that parent's own snapshot, so a lost synced row is refused instead of hidden (provenance: T13816)
• the audit retention prune now runs by itself at session end, at most once a day per project (provenance: T13828)
• ci: looks past a later main run that skipped the test jobs to the next one where they ran (provenance: T13846)
• cloud pull no longer refuses a store whose only changes since its last sync are what memory reads wrote (retrieval log, citation counters) (provenance: T13850)
• cloud verify and cloud status no longer write the device heartbeat or project encounter before comparing, so the device that just pushed verifies match instead of ahead (provenance: T13852)
• a fresh device's first cloud pull --scope global no longer needs --force: the device's own heartbeat row is not counted as unsynced local data (provenance: T13853)
• audit tables scrub secrets on write, local and pulled: secret-named params, a value whose sibling key/name names a secret, credential shapes, Authorization: token, URL passwords and --token flags become [REDACTED] in tasks_audit_log, audit_log and nexus_audit_log; path-shaped text such as process.env or .env.example is kept, and a re-delivered redacted row is no conflict (provenance: T13855, T13859, T13860, T13861)
• store open scrubs secrets written to audit rows before T13855, once per store, with capture suspended so nothing syncs; legacy audit_log rows drained later land redacted; Authorization: Basic credentials are redacted with the label kept (provenance: T13857, T13863, T13864)
• cleo cloud sync exits 1 with E_SYNC_STREAM_FAILED when any stream ends failed, naming each stream and reason, with every stream's result in the error details (provenance: T13865)
• sync conflict lists agree on both devices after a rebase under an unframed writer, and memory-read bookkeeping is no conflict (inert on stable until Stage C) (provenance: T13866)

Also in this release (listed by hand)

Merged since v2026.10.19 and reviewed, with green PR CI; their tasks were still open at planning time:

• T13834 #2344: cleo session end no longer loads the core barrel, so a Claude Code Stop costs about 0.7 s instead of 1.7 s.
• T13857 #2352: the one-time scrub of audit secrets written before T13855 (its notes entry is under Fixed above).
• T13881 (1ec71e4): no in-process writer can land on the shared database handle during a docs merge preview.