Azdaja v0.1.18

Azdaja v0.1.18

Azdaja v0.1.18 packages the typed judgment API, host-only credential setup, and resumable batch source-review workflow in the official macOS and Linux binaries. The batch workflow saves per-request checkpoints, does not repeat completed work on resume, and refuses automatic retry of ambiguous in-flight requests. Retained source-review output remains evidence for human review, not automatic approval. Ordinary Azdaja workflows remain usable without a TypeSafe key.

Optional judgments

When [judge].enabled is omitted, ordinary exec judgments and fresh batch execution can use a configured TypeSafe key from the named environment variable or a privately attached local credential. An explicit enabled = false continues to disable judgments, including in customized and development configurations. An explicit enabled = true retains the requirement for a usable credential. The default credential name is TYPESAFE_API_KEY.

A configured key does not automatically activate typed judgments in autonomous solo. That experimental path still requires explicit [judge].enabled = true; this release makes no autonomous-solo efficacy or readiness claim. Semantic compaction and general redundant-tool suppression are not features shipped by this release.

This does not call a provider during installation, static capability discovery, or offline batch validation. Only actual judgment execution can send the explicit state and questions to TypeSafe. Batch execution still requires its explicit execution flag and job limits. Existing provider routes do not require TypeSafe.

Official binaries are built with --features typesafe. Cargo's default feature set remains empty, so a default source build does not include TypeSafe transport. To build matching optional support from source, use cargo build --release --locked --features typesafe or add --features typesafe to cargo install --path . --locked.

Installation and upgrades

After publication, the installer at https://azdaja.dev/install selects v0.1.18. Choose only the integrations you want, for example:

curl -fsSL https://azdaja.dev/install | sh -s -- claude

The installer preserves custom configuration and does not turn an explicit opt-out into automatic activation. Published v0.1.17 stock configurations have no [judge] section and naturally use the omitted setting after upgrade. Development configurations containing enabled = false remain disabled until the user changes that setting.

The current third-party notice is verified against the exact locked source dependency inputs, including optional TypeSafe dependencies for all supported release targets. The installer pins this reviewed notice and can migrate the exact previous managed-document generation without accepting altered notices, markers, or foreign files. Existing published release assets remain unchanged.

Release verification

The three official assets are Darwin arm64, Darwin x86_64, and Linux x86_64. They are promoted from reviewed CI candidate bytes with provenance and SHA-256 checksums, then published only after exact main and tag CI gates.

After publication and website deployment, run:

release/verify-published-release.sh 0.1.18

This downloads and verifies all five payloads (three binaries, LICENSE, and THIRD-PARTY-NOTICES.md), their checksum manifest, and provenance across the website, GitHub release, and immutable Git tag. Candidate generation alone is not publication or deployed-channel verification.

Azdaja v0.1.17

Azdaja v0.1.17

Azdaja v0.1.17 fixes the Claude Code hook rejecting the managed wrapper that the installed skill itself dictates.

In v0.1.16, once a session was explicitly opted in with AZDAJA_CLAUDE_ACTIVATION and a prompt asked for exhaustive semantic judgment, Claude loaded the skill and ran the wrapper exactly as SKILL.md renders it, with the managed binary written as one quoted literal path on every line. The claude-hook transaction recognizer only accepted a wrapper that assigns the binary once through AZ= and then references "$AZ", so the dictated wrapper was classified as broad access to the large input and denied. Claude was told to call the skill and retry, which produced the same denial again. Jcode, Codex, Gemini, and OpenCode do not route through this hook and were unaffected.

Claude Code also emits PreToolUse for the Skill tool but no PostToolUse for it, while the hook only marked the skill active on PostToolUse. So even a recognized wrapper had no activation to attach to. The Skill invocation itself now activates routing, and hosts that do emit PostToolUse for Skill keep working.

The recognizer now accepts both wrapper forms. Either form must still name this exact binary as a single safe literal word, keep the fixed lifecycle lines byte-for-byte, load exactly one input, and end with one FINAL(...) inside the quoted heredoc. A wrapper that names another binary, mixes the two forms, or appends any command is still refused. Binary identity also survives a symlinked home or skill directory.

The installed profile is now tested end to end against captured Claude Code 2.1.273 events: the suite installs the Claude skill into a temporary home, extracts the wrapper from the installed SKILL.md, substitutes only the input path and the Python cell, replays the exact captured event sequence and field shapes through the registered hook command, really executes the wrapper against the installed binary, and checks that both success and failure release the prompt. Those tests fail against v0.1.16 and pass here, so the skill text, the hook, and the host contract can no longer drift apart silently.

Installation and integrations

The public installer at https://azdaja.dev/install selects v0.1.17. To update only Claude Code, run:

curl -fsSL https://azdaja.dev/install | sh -s -- claude

This manages the Claude Code integration and the command-line binary while preserving existing user-owned configuration. The installer never calls a model provider and never sets Claude activation automatically. Restart Claude Code after installing so the updated hook binary is loaded.

Choose integrations independently. curl -fsSL https://azdaja.dev/install | sh -s -- claude updates Claude Code only; az install jcode updates the Jcode integration only. Selecting one does not implicitly select or mutate the other. Use az install all only when every supported integration is wanted. After installation, run the exact az doctor command printed by the installer before reloading the selected tool.

After publication, release/verify-published-release.sh 0.1.17 will download and verify the five platform and notice payloads plus checksums and provenance across the published channels. Historical release assets and provenance remain unchanged.

Azdaja v0.1.16

Azdaja v0.1.16

Azdaja v0.1.16 makes Claude Code integration explicitly opt-in and nonblocking. Skill discovery, loading, mentions, and ordinary Claude work do not activate routing or restrict native tools; the Claude hook acts only when the host explicitly sets AZDAJA_CLAUDE_ACTIVATION to request, session, or repository.

Success and failure clear the current managed transaction. Every new user prompt resets stale activation and lease markers, so interrupted work is recovered on the next prompt rather than by an automatic timeout. Safe ordinary operations, including literal file copies, remain available while an opted-in transaction is active.

Claude's registered hook invokes the supported subcommand directly, with the event JSON on standard input:

printf '%s\n' "$CLAUDE_HOOK_EVENT_JSON" | "$CLAUDE_PLUGIN_ROOT/azdaja" claude-hook

The hook is nonblocking for ordinary follow-up work. It does not require unsupported hook arguments or a recognized retry wrapper to recover after a failed transaction.

Installation and integrations

The public installer at https://azdaja.dev/install selects v0.1.16. To update only Claude Code, run:

curl -fsSL https://azdaja.dev/install | sh -s -- claude

This manages the Claude Code integration and the command-line binary while preserving existing user-owned configuration. The installer never calls a model provider and never sets Claude activation automatically.

Choose integrations independently. curl -fsSL https://azdaja.dev/install | sh -s -- claude updates Claude Code only; az install jcode updates the Jcode integration only. Selecting one does not implicitly select or mutate the other. Use az install all only when every supported integration is wanted. After installation, run the exact az doctor command printed by the installer before reloading the selected tool.

After publication, release/verify-published-release.sh 0.1.16 will download and verify the five platform and notice payloads plus checksums and provenance across the published channels. Historical release assets and provenance remain unchanged.

Azdaja v0.1.15

Azdaja v0.1.15

Azdaja v0.1.15 fixes the cooperative Jcode hook gate so explicit activation is required before routing or restricting tool calls, while preserving bounded shell reads under a pending challenge and sharing the narrow-read budget correctly.

This release is published only after exact-head CI and source-install integrity validation, reviewed standalone asset promotion, immutable tag checks, and published-byte verification.

Installation and activation

The public installer at https://azdaja.dev/install selects v0.1.15. Running it again upgrades the selected managed integrations as well as the command-line binary. Existing user-owned Jcode configuration is preserved.

Hooks are inactive unless the host process explicitly sets AZDAJA_JCODE_ACTIVATION to request, session, or repository. Loading a skill or mentioning Azdaja does not activate routing. With explicit activation, bounded reads retain their shared budget even when a broad-read challenge is pending. Reviewed locked Cargo packaging, install, and release-build commands remain available.

After publication, release/verify-published-release.sh 0.1.15 downloads and verifies all five payloads plus checksums and provenance across the published channels. No unreleased repo-memory features are included in this patch.

Azdaja v0.1.14

Azdaja v0.1.14

Reviewed standalone promotion invariant

The standalone binaries and the asset/tag commit are intentionally different commits:

1. A successful manual CI run builds the three binaries from clean source commit A. Each downloaded artifact contains only its raw binary and candidate-receipt.json. The receipt binds the exact source SHA, workflow run ID and attempt, target, release asset name, byte count, SHA-256, version, and architecture validation. It always records publication_authorized=false. A candidate is not a release and must never be copied directly into site/releases or selected by site/install.
2. A reviewer downloads exactly those three artifact directories and runs release/promote-standalone-assets.sh from clean commit A, passing A and the successful run ID and attempt explicitly. The script rejects malformed or substituted inputs and atomically creates the reviewed release directory, including deterministic PROVENANCE.json with status REVIEWED_FOR_PUBLICATION.
3. Asset-only promotion commit B adds the reviewed directory and is tagged v0.1.14. Runtime source is unchanged between A and B. PROVENANCE.json records A as source_commit plus the complete allowed A-to-B promotion delta. It does not claim that the binaries were built from B.

The tag and all publication channels must expose byte-identical PROVENANCE.json, SHA256SUMS, three binaries, LICENSE, and THIRD-PARTY-NOTICES.md. SHA256SUMS continues to contain exactly five payload entries. The post-publication verifier checks that A is an ancestor of B when the commits are locally available. Otherwise, the immutable tag's byte-identical provenance is the explicit binding to A.

Azdaja v0.1.14 is a distribution and evidence patch over v0.1.13. It puts the agent-marketplace manifests, public skill, receipts leaderboard, launch saga, and listing ledger inside one immutable release tag. It does not claim a new benchmark score.

Gallery-eligible distribution

• The repository-root gemini-extension.json is included in the release tag and matches version 0.1.14.
• The public repository carries the gemini-cli-extension topic used by the official daily gallery crawler.
• .claude-plugin/plugin.json, .claude-plugin/marketplace.json, skills/azdaja/SKILL.md, Cargo metadata, and both public installers carry the same version.
• The static skill continues to reject an Azure CLI az collision unless the executable identifies itself as Azdaja.

Gallery eligibility is not presented as a completed gallery listing. The public gallery must resolve Azdaja after its crawler processes the tag before that claim is made.

Public evidence surfaces

• BENCHMARKS.md separates product acceptance, the qualified fixed-199 single-arm diagnostic, and same-answer efficiency receipts.
• docs/listings.md records real install acceptance, public pull-request receipts, and human-authenticated submission boundaries.
• site/saga.html publishes the grep-disease failure story with the 68.6% diagnostic explicitly qualified.
• The README and site lead with the bounded local-evaluator contract rather than a capacity number or unmeasured score.

External workflow status

• Public Claude marketplace installation, official Gemini CLI linking, and the public skills.sh installation path were exercised provider-free.
• Listing pull requests were opened for the active OpenCode and Claude-plugin lists.
• Human-only directory forms, email submission, Lobsters access, and community launch posts remain unsubmitted unless separately authorized and authenticated.

Validation

Release promotion provenance is committed in site/releases/v0.1.14/PROVENANCE.json. The receipt binds
the exact workflow_dispatch source commit, run ID, run attempt, artifact names, byte sizes, and
SHA-256 digests used to assemble the public payloads. The distribution commit necessarily differs
from that source commit because it adds the reviewed payloads and receipt; the immutable
v0.1.14 tag binds both together after final exact-head CI passes.

Before tagging, require:

cargo fmt --all --check
cargo clippy --all-targets --all-features --locked -- -D warnings
cargo test --all --locked -- --test-threads=1
cargo build --release --locked
AZDAJA_PRODUCT_BINARY=target/release/azdaja \
  cargo test --release --locked --test product_50mb \
  offline_scripted_harness_answers_three_real_world_50_mib_files_without_a_death \
  -- --ignored --exact --test-threads=1

After publication, release/verify-published-release.sh downloads and verifies all five payloads plus SHA256SUMS from the site, GitHub release, and immutable tag before accepting the release.

release/verify-published-release.sh 0.1.14

Azdaja v0.1.13

Azdaja v0.1.13

Azdaja v0.1.13 hardens the product core for large semantic workloads and makes record-level results independently auditable. It also completes the documented standalone target set and closes several managed-harness escape and false-positive paths.

Semantic classification hardening

• Classification answers are admitted only after semantic-manifest evidence, not merely any incidental model call.
• Label-literal grep programs, grep-after-subcall programs, and degenerate zero aggregates are rejected through typed, bounded repair paths.
• Classification planning uses a bounded three-call strategy probe and can repair after limited incidental spend without consuming the semantic evidence budget.
• jcode_repair_model is now a validated configuration field for benchmark and managed-repair flows.
• Runtime traces distinguish semantic evidence calls from other external calls.

These changes are intentionally not presented as a new benchmark score. The successor fixed-199 campaign remains unauthorized until a separate measured run is completed.

Adaptive semantic capacity

• Semantic manifests are packed by serialized prompt bytes rather than a fixed 39-item ceiling.
• Short records can share larger shards while long and UTF-8-heavy records split before the prompt envelope is exceeded.
• Source order, duplicate occurrences, adjudication reserves, and fail-closed oversized-record behavior remain host-enforced.
• The final end-to-end suite exercises both 100,000-row and 102,158-row workloads.

Authoritative record inputs and receipts

• azdaja solo accepts authoritative JSONL and CSV records from files or standard input.
• CSV handling preserves multiline rows, duplicate records, raw hashes, bounded header expansion, and source order.
• Invocation-bound schema-v3 receipts bind source identity, ordinal, payload, label, cardinality, uniqueness, and complete semantic coverage.
• Omission, reordering, tampering, replay, unknown records, malformed inputs, and receipt overwrite attempts fail closed without publishing partial artifacts.
• Receipt publication is atomic and non-overwriting under concurrent writers.

Typed FINAL values

• Callers can provide a strict supported JSON Schema subset for the final value.
• Nested required objects, arrays, enums, strings, booleans, numbers, and integral numbers are validated before protocol output.
• Invalid shapes receive one bounded repair only before semantic evidence spend.
• Valid typed output is emitted as compact JSON and is never truncated into invalid JSON.
• Existing non-schema text output remains compatible.

Managed Jcode gate safety

• Bounded head, tail, numeric sed, and fixed-string grep scans over small regular files are admitted and charged to the narrow-read budget.
• Symlinks, oversized files, external paths, shell expansion, control operators, and unrecognized extraction commands remain blocked.
• A repository-memory handoff does not unlock shell extraction or reset an exhausted read budget.
• Ordinary bounded Read calls remain available while an active handoff blocks bounded shell extraction.

Standalone targets and Windows safety

The documented standalone release contains:

• macOS arm64;
• macOS x86_64;
• Linux x86_64 with glibc 2.35 or newer.

The Intel macOS binary is a genuine x86_64-apple-darwin executable and is included in the release checksum manifest. Windows now has a passing native MSVC candidate workflow plus a fail-closed PowerShell installer contract with checksum, PE architecture, atomic-publication, and tamper-refusal coverage. Windows is not yet listed in the five-payload public standalone manifest, so this release does not advertise it as a supported public standalone target.

Release integrity

• Release assembly requires all three documented platform binaries before producing the five-payload checksum manifest.
• The installer, GitHub Release, immutable tag, and azdaja.dev release directory are verified against the same SHA256SUMS file.
• The read-only Verify published release workflow downloads and verifies all five payloads from every public channel.

Validation

The final product-core state passed:

• 31 Jcode gate tests;
• 180 executed library tests, with one intentional release-only stress test ignored in debug mode;
• 137 end-to-end tests;
• strict native Clippy with warnings denied;
• strict x86_64-pc-windows-msvc Clippy with warnings denied;
• a locked release build;
• direct shipped-binary gate acceptance covering allow, block, active-handoff isolation, and narrow-read continuation.

After publication, verify all public channels with:

release/verify-published-release.sh 0.1.13

Azdaja v0.1.12

v0.1.12

Recent scope labels stay display-only

The bare interactive recent-project overview now documents its real scope contract more honestly:

• the canonical working-directory hash remains the durable scope identity;
• the final basename may appear only as a local display label next to the short token;
• full paths are never stored or displayed;
• unsafe or legacy labels fall back to the token alone.

This release note matches the current behavior and test updates for recent overview parsing and privacy assertions. It does not change non-TTY output, explicit commands, or global inspection behavior.

Manual memory ledger and entropy scope

This release also documents the implemented memory and uncertainty boundary:

• implemented a manual, bounded, local memory ledger;
• implemented az memory list --kind disagreement, with the fixed caveat that it lists manually recorded local records, not independent agent disagreement receipts;
• implemented byte entropy only.

Explicitly not implemented: automatic wisdom-of-agents, independent agent disagreement receipts, semantic entropy, calibrated confidence, or automatic memory retrieval/injection.

Research context already tracked in the repo: collective-intelligence and disagreement work such as self-consistency, mirror-consistency, and multi-agent debate can motivate review signals, but shared errors remain possible; semantic entropy requires repeated answers and meaning-equivalence classes; long-term memory work such as MemGPT and Generative Agents motivates bounded external memory, not automatic prompt injection for this release.

Acceptance evidence

Validated with:

• cargo fmt
• cargo test --test recent_overview -- --nocapture
• cargo test recent_scope -- --nocapture
• cargo check
• cargo clippy --all-targets --all-features -- -D warnings

Supported standalone binaries

• macOS arm64
• macOS x86_64
• Linux x86_64

Azdaja v0.1.11

v0.1.11

Bare interactive recent-project overview

Bare interactive az keeps current-folder detail primary and may show up to three other recently active scopes. Candidates are merged from local memory and observability state, ordered by activity, exclude the current scope, and use only stable short hash tokens. Memory-record and source-summary counts are bounded. Raw and basename paths are not exposed. Missing state omits the section, and unsafe, corrupt, or oversized state degrades optional metrics.

Non-TTY and explicit list, map, global, and machine-readable behavior are unchanged. The overview is not a confidence or quality score and does not change evaluators or gates.

Acceptance evidence

• Bare-dashboard public acceptance: 2 PTY and non-TTY integration tests passed. The TTY path shows at most three other scopes in recency order with 8-character opaque identifiers and bounded aggregate counts. Non-TTY and explicit commands preserve their prior output and create no state.
• Recent-scope hardening: 9 focused tests passed for current-scope exclusion, deterministic ties, merge behavior, the 1,024-candidate and 3-result bounds, missing state, corruption, oversized files, symlinks, unsafe directory modes, and path-free identifiers.
• Core regression coverage: 152 library tests passed with 1 intentional release-only ignore, and the complete 119-test optimized end-to-end suite passed. The release-only three-file 50 MiB workflow also passed against the optimized binary.
• Installer and packaging coverage: the complete 51-test site-installer and immutable-asset suite passed, together with all 4 package, notice, license, and standalone-asset contract tests.
• Cross-platform checks: strict native and Windows-target compilation and Clippy passed with warnings denied. The exact-commit Windows GitHub job passed formatting, Clippy, all library and binary tests, and its release build.
• Release artifacts: the Apple Silicon Mach-O candidate reports azdaja 0.1.11 (monty 0.0.21) and exposes provider-free Jcode config staging without writing to the isolated home. The Linux x86-64 ELF candidate reports the same version when executed on Ubuntu 22.04 with glibc 2.35. Archive receipts, archive digests, and every payload checksum were verified before immutable site binding.
• Source installation: exact-commit GitHub workflows installed checked-out source and exercised the local HTTP installer successfully on Ubuntu 22.04 and Apple Silicon macOS.

Supported standalone binaries

• Apple Silicon macOS 11+
• x86-64 Linux with glibc 2.35+

Azdaja v0.1.10

Azdaja v0.1.10

Azdaja v0.1.10 hardens the installed Jcode, Claude Code, Codex, and OpenCode integrations found through real host runs. The evaluator and semantic gate core remain unchanged.

Host fixes

• Jcode's pre-tool hook now accepts the exact challenged AZDAJA_JCODE_CHALLENGE=… azdaja solo "…" --repo . command it emits, including quoted task text containing shell metacharacters, while altered paths, tokens, scope, redirects, pipelines, expansions, and appended commands still fail closed.
• Claude Code's standard lane uses one bounded ordered semantic batch, preserves occurrence identity, rejects heuristic label substitution, and never probes or reruns a whole transaction after a child-model call.
• Codex's explicit $azdaja lane now has a one-command tool budget, copies the managed lifecycle literally, uses an OS-managed private temporary AZDAJA_HOME so the default workspace sandbox does not need the persistent user state, and uses chr(10) rather than transport-fragile Python newline escapes.
• OpenCode sets a 300-second Bash timeout before execution, preserves supplied IDs, stores shard cardinality while packing, avoids unsupported Monty generator expressions, and reports a failed lifecycle instead of retrying or fabricating a complete answer.
• Strict blind A/B profiles skip adjudication when both views fully agree. Adjudication is reserved for actual disagreements.
• Installers tell already-open tools to reload or restart, including the exact Jcode skill_manage reload_all path.

Research boundary

This release does not turn entropy, agreement, or memory into a generic quality score. Byte entropy remains a local source-distribution measurement, not semantic uncertainty or calibrated correctness. Agent agreement can share a common error. Disagreement is therefore preserved as an explicit review or abstention signal, while project-scoped memory remains bounded, linked, user-authored, path-free in serialized scope keys, and never injected into a model automatically.

Acceptance evidence

• Jcode: a real GPT-5.6 Luna run accepted the exact challenged command containing id|statement and returned the exact 240-record reduction, 120 PASS / 120 FAIL, with IDs r000 and r239.
• Claude Code: a real GPT-5.6 Luna run used one start / load / exec / final / kill lifecycle and one llm_batch, returning exactly 120 POSITIVE / 120 NEGATIVE for 240 records with IDs s000 and s239.
• OpenCode: a real GPT-5.6 Luna run used one lifecycle, one semantic batch, timeout 300000, no imports, no generator expressions, and returned exactly 120 POSITIVE / 120 NEGATIVE. A separate final-profile run received unusable child output and stopped without retry or fabricated labels, exercising the fail-closed path.
• Codex: the explicit $azdaja run used one policy-accepted lifecycle with private temporary state, chr(10) prompt construction, and one llm_batch. The child path did not publish FINAL; Codex stopped after that one command and disclosed failure without a repair lifecycle or fabricated classification. Earlier runs exposed and drove fixes for default-sandbox state access, command-substitution whitespace, transport-corrupted newline escapes, and forbidden whole-transaction retry.
• Regression gates cover quote-aware challenge parsing, shell-smuggling rejection, scoped observability, bounded linked memory, non-UTF8 scope keys, corrupt and unsafe ledgers, installer rollback, symlink and hardlink defenses, debug and optimized lifecycle paths, packaging, and full end-to-end workflows.

Supported standalone binaries

• Apple Silicon macOS 11+
• x86-64 Linux with glibc 2.35+

Azdaja v0.1.9

Azdaja v0.1.9

Azdaja v0.1.9 adds working-directory scoped observability, explicit local memory, and session custody while keeping the stabilized evaluator and gate core unchanged.

Highlights

• Bare az, az list, and az map now report the canonical current working directory by default.
• az --global, az list --global, and az map --global provide explicit user-global views.
• New sessions persist their canonical working directory. load, exec, final, and kill fail closed when called from another directory.
• Legacy sessions remain usable but are excluded from current-folder dashboards and complete into global history only.
• Scoped aggregate histories use path-free hash-derived keys and preserve separation for non-UTF-8 Unix directory names.
• Corrupt foreign metadata and observability sidecars degrade optional metrics without blocking authoritative session operations.
• The console and documentation distinguish exact byte-distribution entropy from semantic uncertainty, confidence, and answer quality.
• az memory adds a bounded, user-authored, scope-first JSONL ledger for decisions, observations, failures, hypotheses, and disagreements, with typed tags, explicit links, provenance, backlinks, corruption fail-closed behavior, and a separate explicit --global ledger.

Validation

• Complete optimized E2E suite: 119 passed.
• CLI UX suite: 8 passed, including scoped memory, linked records, backlinks, and explicit global storage.
• Library suite: 142 passed, including 300-writer bounded memory stress and corruption/symlink checks.
• Scoped-history privacy and non-UTF-8 scope-key checks passed.
• Strict formatting, clippy, release build, package validation, installer paths, and release asset checks passed.

Supported standalone binaries

• Apple Silicon macOS 11+
• x86-64 Linux with glibc 2.35+