v2026.10.9

Upgrading: from 2026.10.7 or later, cleo self-update is safe. This release contains a breaking change to evidence writes (see BREAKING CHANGES): run typed gates with cleo verify <id> --run before recording evidence. Cross-device journal sync, automatic sync and project hooks ship inert: sync stays off until the Stage C exit gate releases its flags, and hooks-v1 stays off on stable builds until its promotion.

Note: T13342, T12915, T13324, T13455, T13543 and T13548 shipped code in this release, but their CLEO tasks stay open: merge-commit CI was red in a flaky-quarantine window, a scheduled run failed, or the PR delivered only part of the task. They are listed here by PR, not in the release plan's task set.

Added

• Brain tables keyed by an autoincrement id get row uids; their local id never travels (provenance: T12896)

• Memory trees are recomputed per device; brain task-observation links sync with natural row uids (provenance: T12896)

• Add independent numbered canary releases and require validated hook pilot evidence for explicitly scoped hooks-v1 stable promotion. (provenance: T13350)

• cleo cloud activity --journal shows what each device changed and when, from this store's sync journal (provenance: T13369, T13393)

• The main brain syncs end to end on home:, and cloud status reports the home stream's cut, unsent ops and pull position (provenance: T13370)

• a project-stream pull confirms replica retires from the server's project replica listing (provenance: T13391)

• Sync re-mints a colliding display id (T####, D####, SN-###) when the origin settles a uid collision (provenance: T13405)

• cleo doctor system reports every agent session with its project, harness, age, terminal idle time and RSS: the owner's close list (provenance: T13438)

• Sync: a store that never synced with a journal stream joins it and keeps its own rows (provenance: T13466, T13503, T13504, T13507, T13508)

• Automatic main-brain sync at session end and while the sentient daemon runs (provenance: T13468)

• cloud activity --devices shows, per device, its presence, its newest journal change and its newest server event (provenance: T13482)

• Normal commands in a linked project start a detached cloud sync at most once per window, with no daemon (provenance: T13553)

• evidence.runtimePaths: tracked files a harness rewrites during a run stay out of the evidence tree hash, so the run cannot stale its own receipt (provenance: T13554)

• Unified opt-in project hooks across Git, coding agents and worktree setup, with explicit activation and ownership diagnostics. Inert on stable builds until the hooks-v1 promotion (T13557) (provenance: T13342, #2008; task still open, see note)

• Sync: the global agent registry gets row identity; derived and local-only skill/capability rows are rebuilt from the agent row (provenance: T12915, #2092; task still open, see note)

Changed

• Spawn's atomicity pre-check records no duplicate dispatch trace; the preflight install documents why its stdio stays piped (provenance: T13510, T13493)
• The 13 session-binding and admission tests that failed on macOS locally (green in CI) now pass under any shell (provenance: T13517)

Fixed

• Sync: only canonical store opens run the sync open pass; copies, backups and exodus handles stay off (provenance: T13336, T12753)

• a global pull survives a failed home replica listing; no retire is confirmed that round (provenance: T13395)

• cloud activity --journal names every device, including signed-out and revoked ones, and shows each device's last presence (provenance: T13465)

• orchestrate spawn refuses with a hand-off instead of handing a child the session a live worker is using (provenance: T13491)

• orchestrate spawn refuses an atomicity violation before allocating a session, claiming the task or provisioning a worktree (provenance: T13510)

• Worker worktrees install the git shim they advertise, block pushes to main, and say unavailable when the shim cannot be installed (provenance: T13522)

• Read-only nexus impact/context no longer starts an unbounded in-process refresh; --no-refresh and CLEO_NEXUS_AUTO_REFRESH opt out (provenance: T13523)

• Worktree dependency installs go through the machine-wide heavy queue or are deferred to the worker; orchestrate spawn --no-install skips them (provenance: T13524)

• cleo release plan records the newest reachable v* tag as previousTag/previousVersion, not a stale releases-table row (provenance: T13536)

• A graph query's inline nexus refresh runs in an owned, heap-limited child process, so it can never abort the CLI at its heap cap, and stopping it releases every database lock (provenance: T13537, T13548)

• The nexus refresh worker cannot hang a read query: it resolves on its result and a hard timer ends a stall (provenance: T13539)

• Worktree installs always use the worktree's own pnpm store, a tracked .npmrc gets a --store-dir hint, and info/exclude no longer hides .npmrc in the main checkout (provenance: T13541)

• A store open no longer fails with another operation's expired deadline (provenance: T13552)

• Project hooks stay inert on stable builds until the hooks-v1 promotion (provenance: T13557)

• A vault restore settles the reconcile record against the restored bare tables (bare accounts carried) (provenance: T13324, #1982; task still open, see note)

• A twin-collapse retry that fails again restores the read shadows (provenance: T13455, #2070; task still open, see note)

• cleo release plan considers only version-shaped tags below the planned version for previousTag, and compares prerelease numbers numerically (provenance: T13543, #2116; task still open, see note)

BREAKING CHANGES

• evidence writes, cleo done, cleo verify --auto and cleo complete no longer execute typed gates; they read passes cached by cleo verify --run, and --run-typed opts a write back into executing (provenance: T13521)

  Migration:

  Run typed gates with cleo verify --run (or --run --req ) before recording evidence; a write that links a typed gate with no cached pass now refuses with E_GATE_NOT_CACHED. To keep executing typed gates during a write, cleo done or cleo verify --auto, add --run-typed. Projects with evidence.allowCachedGates false must pass --run-typed on writes for tasks with typed gates.