v2026.10.7

Upgrading from 2026.10.6 or older: run cleo self-update --no-auto-upgrade, then cleo upgrade. Older binaries run their own post-update maintenance in-process, which can rewrite tracked project files. From 2026.10.7 on, cleo self-update is safe.

Added

• cleo req replace swaps a typed gate's definition in place (same AC row, ordinal and REQ-ID, superseded gate kept in history), and cleo verify --run --req runs and caches only the selected gates (provenance: T12988, T13486)
• qaPassed accepts qa-run receipts (a native typecheck or lint run, bound to the change like test-run), and a single-package project's done --plan asks for them instead of a fresh whole-project typecheck (provenance: T13427)

Fixed

• self-update runs post-update maintenance in the new CLI; upgrade never writes machine paths into tracked files or re-detects project-context.json (provenance: T13489)
• @cleocode/adapters ships dist/heavy-command-hook.js again, so the heavy-command hook installs (provenance: T13490)
• A queued cleo run --wait or cleo verify keeps its own session's task claims alive (provenance: T13492)
• orchestrate spawn names the agent identity, persona and role separately: data.agentId now matches the session and worktree agent id (provenance: T13494)
• a tree-pinned scoped testsPassed (targeted test-run or affected tool run) still stands after the merge when the change's files are byte-identical at the merge commit; otherwise done --plan and complete say why it does not carry (provenance: T13495)
• a research task's planned files atom now names the attachment-store file that cleo docs fetch resolves, falling back to the blob store (provenance: T13496)
• cleo done --plan no longer reads a typed gate pass bound to an older criterion or gate definition as a pass; it reads not-run, as cleo complete refuses it (provenance: T13501)
• pr: evidence lets the latest run of a re-run check decide, so a PR re-run to green can be proven (provenance: T13506)
• a typed test gate with expect pass no longer fails a passing node --test run on its own fail 0 summary line (provenance: T13511)
• cleo verify --no-run needs cached passes only for the typed gates the write links, and cleo verify --run reports per gate whether its pass was cached and under which HEAD (provenance: T13512)
• cleo complete never executes a typed gate command: its merged-CI auto-record write is cache-only (noRun) (provenance: T13515)