v0.27.0 — Orca worker host, one-line agent install, stricter done gates

Orca as a worker host, a one-line agent install, and stricter gates on what counts as done.

New

• Orca terminals as a round worker host. Set round.dispatch: orca to run Claude Code and Codex workers in Orca terminals. Reclaim and reap prove the agent's process tree is gone before closing a slot (#2215).
• Install rota from your agent. Paste one line into Claude Code, Codex or OpenCode and it follows the repo's new install.md: binary, skills, rota doctor, project setup, asking before each command and never answering setup questions for you. An llms.txt indexes the docs for agents (#2221).
• Merge trains that wait to fill. Automatic trains hold until a count or age threshold (round.trainMax, round.trainFillMinutes) (#2199). The landing queue freezes after a red landed base until someone recovers it (#2190).
• Flaky checks retried and recorded. A failed gate sub-check or assertion gets one retry; recoveries go to a per-developer flake ledger, shown by rota test flakes (#2200, #2202, #2214).
• Round insight. rota round summary reports lead time, red-train rate and bounces per merged PR (#2189). A maintainer digest lists the decisions waiting on you (#2201).
• Item templates with create-time warnings and assignment checks (#2163), and one registry for tracker labels (#2166).
• Knowledge and decisions where you edit. Path-scoped knowledge and decisions are injected before edits (#2142); binding decisions go into worker briefs (#2139).

Stricter gates

• Items with unmet acceptance criteria refuse to complete, and workers must mark each met criterion before reporting done (#2147, #2157).
• PRs need ## Assumptions and ## Rulings before they enter the gate (#2165). Vacuous tests are refused in the gate and train (#2149).
• Reviewer workspaces are prepared through fail-closed verbs, and reviewer binary probes run with isolated config (#2148, #2152). Review, QA and gate reports are posted durably on the PR (#2143).
• /rota-work Step 7 stops after three failed fix attempts (#2138).

Fixed

• Autopilot waits for reviews and changed heads before gating, defers merges behind manual landing work, and reports failed heads clearly (#2183, #2197, #2198).
• Codex workers: background terminal waits count as working, and relays delivered after a prompt stall are recognised (#2193, #2186).
• round transfer honours harness and model overrides (#2184); missing-PR drift stays quiet while workers build (#2194); missing verdicts are recovered from current PR reports (#2164).
• rota skills get serves skill-local reference files (#2187); temporary repos stay out of the project registry (#2140); support machines can check for updates (#2168).

Skills and docs

• Every SKILL.md keeps only the happy path inline; edge cases moved to referenced files, and the acceptance-marks rule has one owner file (#2217).
• The README is a short feature list linking the website docs (#2219). New pages cover the support machine, coding-agent mistakes rota enforces against, and one compare page per comparable tool (#2206, #2167, #2113).
• The repo has a real subsystem map under .rota/map/ (#2224).

Internal

• Temp body, brief and log files go through one fsio.WriteTemp seam (#2225); host, port and dependency settings are typed at the worker seam (#2213); bundle-holder lookup has one owner (#2212).

Stats

227 commits, 687 files changed, +35386 −4898 lines

Full changelog: v0.26.0...v0.27.0

v0.26.0 — milestone branches, review lenses, shared knowledge

Milestones get their own integration branches, reviews gain security, perf and UX lenses, and a shared knowledge base can follow you across projects.

Upgrade notes

• Named machine pins. machine:<name> replaces site:support: main is named main, support uses round.support. On main, preview with rota migrate labels, then run rota migrate labels --apply to relabel open issues and retire issues.labels.support (including a custom label value). config fill keeps that key until the migration succeeds.
• Visible claim labels. After upgrading, run rota round reconcile --apply once to backfill claimed:<agent>@<machine> labels for in-flight comment claims. Comment claims stay authoritative. Reverting leaves the claimed:* labels on the tracker; remove them by hand.
• Stale claims can be reclaimed. Status, candidates and doctor mark inactive remote claims stale-claim (round.claimStaleMinutes, default 240; round.claimStaleMinutesMajor, default 480 for Major features; 0 disables). After approval, rota round assign <ID> --reclaim-stale <claim-id> transfers the claim, and the former holder's PR is refused claim-lost at the gate.
• Fewer filed follow-ups. review.fileDeferred now defaults to major: minor deferred findings stay in the verdict record. A PR whose issue is itself a deferred-findings item files none. Set minor for the old behaviour.
• Stale and provenance-fail gates no longer count as bounces. They go back to the worker, and a support machine's worker still gets the review-bounce comment on its PR, but neither counts toward round.maxBounces or parks the item.
• An unresolved base refuses. A git.baseBranch that is set but missing used to fall back to main. Round verbs, round start and worker adopt now refuse and name it, and rota ship passes --base to gh pr create.

Milestone branches

Issues tagged to an active milestone merge into milestone/<id>, which reaches main only through a release PR.

• Branch lifecycle. Activating a milestone cuts and pushes milestone/<id> from origin's base. Archiving keeps it as archive/milestone/<id> or deletes it (--branch), and shipping deletes it.
• Routing. rota round assign branches the worker from the milestone, records it as the slot's base and names it in the brief; the PR, rota git base and rota ship follow. When an issue's milestone changes after assign, rota round reconcile --apply repairs the new base-drift: it retargets the PR and holds the slot until the worker merges the new base.
• Trains sync first. rota worker train --base milestone/<id> merges the project base into the milestone, gates base + milestone + members once and pushes only on green. A sync conflict ends the train merge-failed and pushes nothing.
• Close on merge. PRs merged into a milestone label their issues on-milestone/<id> and close them. rota round candidates and assign flag dependencies on another active milestone (cross-milestone; override with --accept-cross-milestone).
• Release. /rota-release on a milestone with a branch syncs the base, runs the full gate plus e2e, opens a PR to the base and merges it with a merge commit once CI is green. It then removes the labels, deletes the branch and marks the milestone shipped.

New

• Review lenses. review.lenses maps security, perf and ux to path globs and labels. rota review depth --json lists the triggered lenses, /rota-review runs one focused reviewer per lens, and rota worker gate refuses review-missing until each lens has a record at head. Empty by default.
• Gate refuses a blocking finding. rota worker gate and rota worker train refuse a PR whose review record at the merged head carries a blocker or major finding, even under CONCERNS.
• External knowledge base. knowledge.external points at a cloned git repo of markdown topics shared across projects. rota knowledge query|topics|add|amend --external read and write it, and writes land by the repo's own push or PR policy. See external knowledge.
• Surface-aware /rota-qa. first-run offers a check menu per surface (CLI, web, API, library). Strategies can scope pillars with pillar-globs, and ship.qa runs only the pillars the change touches (/rota-qa run --gate).
• Support pull. A support machine fills free slots from its pinned issues, then unpinned issues in round.scope, through the shared claim.
• Merge trains. rota worker train --plan previews the conflict-free subset, and trains accept external PR targets.
• Assign before landing. Train nudges, worker gate and worker train name a ready assignment to run first when a slot is free (--no-assign-check skips it).
• Worker pre-flight. The worker contract and brief carry measured, numeric acceptance checks, and round workers post learnings on their issue before worker done.

Fixed

• herdr panes that move. Reconcile follows a pane moved to another tab (tab-moved drift) and records the pane handle when the tab holds other panes. Kill checks the tab's pane count before it closes anything, so a shared tab is never closed.
• Round watch. Every exit carries the re-arm hint, and the watch wakes on gate release, support PR comments and pushes, and a second done for the same PR.
• Assign races. Two assigns racing on one slot: the later one is refused slot busy and rolls back only its own claim.
• Transfers. A transferred slot stays busy until its own worker reports done.
• Superseded PRs. Reconcile repairs a slot whose recorded PR was closed while another PR heads its branch (pr-superseded).
• Merged PRs. The gate judges the merged head, not the local branch tip, and a merged PR counts as closed for dependencies.
• Builds. Unstamped builds report their version as unknown.

Stats

387 commits, 469 files changed, +22337 −3570 lines

Full changelog: v0.25.0...v0.26.0

v0.25.0 — Config shrinks to 124 keys, a fast grouped status screen, shared dependency dirs

Config shrinks from 142 keys to 124, the round status screen is fast and grouped by issue, and worker slots can share dependency directories.

Upgrade notes

• Removed, merged and renamed config keys. rota migrate config --apply (and rota config fill) moves the values: models.orchestrator to orchestrator.model, round.operatorCommand to orchestrator.command, models.worker to round.tiers.claude.standard (default sonnet; the explicit tier key wins over round.profile), round.workerCommand / round.codexCommand / round.opencodeCommand to round.commands.claude / .codex / .opencode, and round.workerKind to the first entry of round.harnesses. issues.label moves to issues.labels.inProgress when that is unset. The preview lists exactly what --apply writes, and an old key and its new key that disagree in one file stop the migration with exit 4 before anything is written. See Upgrading from the old keys.
• One account list. round.accounts now holds every worker login as {kind, name, dir} objects (kind is claude, codex or opencode). round.codexAccounts and round.opencodeAccounts are gone, and rota migrate config folds them in. A round.accounts in .rota/config.local.json replaces the global list rather than merging with it.
• Dropped keys. ship.secondOpinionRunner (the second-opinion gate always runs the subagent) and gate.smokeShards (use ROTA_SMOKE_SHARDS).
• Fixed constants. These keys are no longer read: orchestrator.stateMaxAgeSeconds (120), handoffMaxAgeSeconds (900), handoffMaxBlocks (2), keepaliveMaxRestarts (10), keepaliveBreaker (3), keepaliveBackoffSeconds (5), limits.resumeMarginSeconds (60), fallbackSleepSeconds (1800), maxResumes (3), issues.retryWaitSeconds (60), issues.bulkPaceMs (1000).
• Invalid tracker settings refuse. An invalid forge.provider or issues.source used to fall back to the default. rota tracker call, rota issues provider, rota issues migrate and the gate's bounce and provenance checks now exit 70 and name the bad value.

New

• Round status screen. rota round status --ui opens at once on the slot registry and loads the host, tracker and quota in the background, so keys keep working while a read is slow. Issues are grouped into Active, PR review, Support queue and Upcoming, and link to their issue and PR.
• Shared dependency directories. round.sharedDirs lists directories such as node_modules or .venv that rota symlinks from the main checkout into each slot worktree, so workers skip the install.
• Support hand-back. A support machine returns an offered issue with rota round support return <ID> --reason-file <path>. Relays travel as issue comments stamped with their machine, PR events post a pointer on the issue, and the watches on both machines wake for them.
• Workers update docs. /rota-docs is no longer manual-only: round workers run its after-work step in their own PR. Scaffold and restructure still follow autonomy.level and go to the maintainer in a round. A lint fails when a skill tells the agent to run a manual-only skill.
• Moved base and ready patches. Workers merge a moved base branch into theirs before the final proof and on every fix push. A review finding can carry a ready patch, which the orchestrator applies as its own commit instead of relaying it, and a deferred finding's patch goes into the filed follow-up item.

Fixed

• The merge gate fails an offer citation it cannot verify because the issue read failed, and refuses relay comments written by a worker.
• rota round review-relay loads round settings once, and a bad key exits 3.
• Credential expiry and the status screen use the injected clock, and the gate's issue trackers use the run's context, so a cancelled run stops them.
• Round settings have one owner (round.Env), and the round tick takes round.Candidate directly (refactors from the architecture review).

Stats

74 commits, 327 files changed, +7771 −2267 lines

Full changelog: v0.24.0...v0.25.0

v0.24.0 — Config keys gain scopes, rounds get a test lock and a support role, and one rule decides the forge

Config keys gain scopes, rounds get a test lock and a support role, and one rule decides the forge.

Upgrade notes

• Config keys now carry a scope. Every key is project, machine or taste scope. rota config set on a machine key writes .rota/config.local.json, not the tracked file; pass --project to pin a key in the repo. rota config show prints the scope. rota config check validates the merged layers, warns about machine keys and default-pinned taste keys in the tracked file, and now fails on unknown keys and on account directories that are not absolute or ~-relative. rota migrate config previews the scope move and --apply writes exactly that preview: read the preview before applying, because deleting a tracked key pinned at its default lets a different global value through.
• Empty account lists inherit the global accounts. A round.accounts, round.codexAccounts or round.opencodeAccounts set to [] in the project or local file no longer forces the ambient account when the global config lists accounts.
• One forge rule. forge.provider wins, then the origin. An origin that names no forge makes writers (worker gate, worker train, ship pr, release host|push|publish, issue writes) refuse with exit 4 blockedBy: forge; readers (doctor, issues provider, issue listing) assume GitHub and say so. Set forge.provider for aliased or enterprise hosts. release host now exits 4 on an unrecognised origin instead of printing none.
• Round config errors have one exit class. An invalid round.* key exits 3 from round candidates, tick, transfer, adopt, review-relay and reap (candidates was 2, the others 70); start, assign, watch, wind-down, status and reconcile keep exit 2, bounce keeps 70 on a bad round.maxBounces. test.fast and test.full must be lists of strings; a malformed list stops the gate instead of being ignored.
• Cross-harness review on big PRs. With round.harnesses set, PRs labelled size:Major or risk:high need a review-cross verdict at HEAD before the gate merges. Refresh the installed skills together with the binary, or exempt an issue with review:none.

New

• Test lock. rota test run, rota proof record and the gate take a slot of a per-repo lock (test.slots, default 1, machine scope); a busy lock waits and says who holds it. Proofs run niced. rota test lock -- <cmd> runs any command under a slot. The gate sizes its smoke shards to the machine.
• Support machines. rota setup asks the machine role first; --set round.role=support takes the support path, which writes only .rota/config.local.json, refuses a clone whose main never enabled support, and ends with the doctor. rota round support enable|disable <name> on main manages the tracked key. rota round assign and worker dispatch refuse a slot account at its usage limit (blockedBy: limited) and fall back to the installed worker contract when the checkout has none.
• Codex workers. round assign to a Codex slot verifies the session took the brief and exits 5 blockedBy: dispatch with the leftover steps when it did not; worker dispatch --task rebuilds the same brief, branch and model; the commits-not-on-main check compares against origin/<base>.
• Harness quota fallback. A worker whose harness runs out of quota falls back to the next configured harness for the next assignment.
• Setup signals. rota setup suggests git.baseBranch, issues.source, test.fast, test.full, round.workerKind, work.isolation and round.dispatch from the project, with the evidence shown; a saved global value beats the signal.

Fixed

• The autopilot and the orchestrator no longer race on one slot, bundle members keep their claims, and rota config check reads the local layer.
• The worker wait test no longer hangs under load; the proof-record nice test passes when the suite itself runs niced.
• rota setup from a subdirectory of a support clone no longer writes tracked files.
• Review-kind, lease-check and round-config-exit rules each have one owner (three refactor findings from the architecture review).
• rota test run passes the lock mark to its tier commands, so a tier that re-enters the lock (bash test/gate.sh) no longer fails at one slot.

Stats

146 commits, 323 files changed, +10855 −2645 lines

Full changelog: v0.23.0...v0.24.0

v0.23.0 — support orchestrator, milestone item lists, gate closing refs

A second machine can build issues for the same repo while one machine keeps every merge, file-mode milestone files list their items, and the gate now checks what GitHub will close.

New

• Support orchestrator (#1598). A second machine builds issues for the same repo and tracker while one machine keeps every merge; the tracker is the only shared state. round.support names the support machine, round.role: support goes in its config.local.json, and both need an issue tracker. Main offers issues with rota round support offer <ID>..., each side assigns only its own, and support slots and branches carry the machine name as a prefix. Main's round reconcile --apply adopts a support PR once its issue is needs-review, bounce counts live on the issue so both machines read one cap, and main's bounces reach the support worker through the PR. Learnings travel the same way: a support machine posts learning comments, rota knowledge harvest [--mark <commentId>] lists and marks them on main, and /rota-learn folds them. Only comments by authors with write access count; round start refuses round.support on a forge that cannot say who may write.
• Milestone files list their items (#1586). On the file backend a milestone file carries a generated ## Items section: open items first, then completed ones with their closure reason, each linked to its detail file. Every verb that writes an item's milestone regenerates it, as does rota milestone check (itemsRegenerated). On the tracker backend a milestone's tracking issue lists its child issues the same way (#1585).
• The gate reads closing references (#1616). rota worker gate and worker train ask GitHub what merging a PR closes and refuse, with exit 4 and blockedBy: closes, a PR that would close any partial-slice issue, its own or another. --final-slice (repeatable on train) exempts the last slice. A forge that cannot answer, or errors, skips the check with one CLOSING-REFS-UNKNOWN note per member.
• rota item comment add|list --kind learning|harvested; rota knowledge harvest is classified in the support fence (listing allowed, --mark refused).

Changed

• rota knowledge harvest without --mark is read-only, so a refusal exits 1 with blockedBy: backend|forge; --mark keeps exit 4. rota item comment add --kind harvested is refused on a support machine (#1631).
• Invalid-value config errors show strings quoted with their printable runes intact and numbers, lists and objects as compact JSON; the Python-repr emulation is gone (#1622, #1648). An invalid round.scope reports the schema's choices; config set round.scopeOverlap refuses a non-choice at set time (#1621, #1703).
• rota milestone check is a write verb in file mode and leaves the support machine's read list; its contract documents itemsRegenerated (#1623). A milestone sync that fails after an item write is a warning, not a failed verb, and one bad milestone file no longer stops the others (#1624, #1625).
• The stale-binary warning ignores .go files under testdata/ (#1699). The train prints each gate note once per member rather than once per stage (#1668).

Fixed

• rota doctor names the effective Codex tier models when round.tiers.codex is unset (#1602). config save-global reports changed (#1603). The doc lint's stamp fixtures no longer inherit ROTA_DOC_STAMPS (#1604).
• A gate step that reads the forge no longer breaks every gate when the forge cannot answer (#1616).

Internal

• The threshold architecture review ran twice and its refactors landed: one owner each for the partial-or-failed outcome rule, the slot-state sets (with a source guard), verdict follow-up filing, label and retry defaults, footprint overlap matching and the worker-done finish rules; round.scopeOverlap and round.scope are typed at load; test seams left the shipped binary (ROTA_TEST_* reads, fsio.SetTempNameForTest), and ps, clock, home and cwd reads go through seams. Behaviour-neutral by review; old-vs-new tables are in the PRs.
• Bundles (round assign --bundle) carried most of this round's follow-ups. Contract docs restamped; knowledge from rounds 33 and 34.

Stats

107 commits, 218 files changed, +6899 −1116 lines

Full changelog: v0.22.0...v0.23.0

v0.22.0 — bundles, one follow-up per PR, concept-doc milestones

Bundles of small issues for one worker, one follow-up item per PR for deferred review findings, and milestones seeded from a concept doc.

New

• Bundles. rota round assign <lead> --bundle <id>,<id> hands one slot a lead issue plus up to round.bundleMax (default 3) related issues. They ship in one branch and one PR. worker done, review depth and the gate's closes check cover every issue in the bundle, and a bounce counts once on the lead. round status shows the bundle as 1559 (+#1563, +#1564). A member leaves the bundle by transfer to the human or by closing (#1592).
• One follow-up per PR. rota verdict add --file-deferred now collects a PR's deferred findings in one item, "Review follow-ups from PR #N". Later verdicts on the same PR add to it, under a per-PR lock. The new review.fileDeferred key (minor by default, or major or off) sets which findings get filed (#1599).
• Concept docs seed milestones. /rota-vision finds a concept or brief document in the repo and splits it into milestones. Each seeded milestone carries a Source: <path>#<heading> line, so later runs know which parts are covered (#1587).
• Deferred follow-up items wait until their source PR merges or is closed, so they never reach a worker ahead of the code they review.

Changed

• File-mode proof rows move to a gitignored .rota/<kind>/<ID>.proof sidecar, so rota proof record no longer dirties the worktree. Run rota init again to add the ignore rule (#1547).
• rota item create --milestone and item field set --name milestone refuse an unknown milestone with exit 3 on the file backend too. This used to be a silent write (#1588).
• rota worker done refuses a dirty or unpushed branch and reports done only after the PR exists.
• The train nudge leaves out merged PRs, bounced PRs and PRs with blocking findings. review depth reports when the depth rose after the last review, and verdict add says when that leaves a verdict missing.
• verdict add JSON: skipped is gone, and filed, appended and filedWhy describe the follow-up item.

Fixed

• A gate verdict's request receipt is settled, so a same-id retry replays the verdict instead of hanging pending. Retry hints no longer suggest a retry that would be refused.
• config set (and the TUI config screen) report an autonomy rewrite even when the set after it fails.
• Contradiction timestamps, design, spike, plan and knowledge-hit stamps all come from one clock.

Internal

• Config is read through injected seams in round, escalation, gate, knowledge, agents and postgate. The pane classifier moved out of worker/poll.go. Contributor contract docs were re-verified against the code and restamped.
• A new smoke section covers bundles end to end.

Stats

98 commits, 163 files changed, +6123 −2293 lines

Full changelog: v0.21.0...v0.22.0

v0.21.0 — three autonomy levels, rota bug reports, gate-safe rounds

Three autonomy levels replace the old on/off switch, rota records its own mistakes and offers to file them upstream, and rounds stop switching worktrees under a running gate.

Changed

• autonomy.level takes three values, off, roundtrip and auto, for solo skills and rounds alike (#1101). roundtrip runs one item from brainstorm to ship without process questions. auto continues with the next ready item and turns on the round autopilot. Manual gates, ship.mergeApproval, /rota-decide and the human-only calls (product behavior, public names, breaking changes, scope cuts) stop every level.
• round.autopilot is retired (#1101). rota round tick and rota round watch --autopilot exit 4 unless autonomy.level is auto. rota config fill deletes the key, and rota config check names it under REMOVED in config.json or config.local.json (#1520).
• One-time migration: rota config fill (also run by rota init and rota update) rewrites an auto in a config stamped older than 0.21.0 to roundtrip, because the old auto meant one hop. A global auto gets the same rewrite, guarded by a config.version stamp file beside the global config. Setting autonomy.level on any layer stamps that layer, so an auto set after upgrading stays. config set, config save-global and rota setup report or follow the rewrite too (#1511, #1512). To keep running until the queue is empty, run rota config set autonomy.level auto once after upgrading.
• rota round assign and rota round transfer refuse with gate-running while a gate or train holds the land lock (#1480).
• Round assign skips accounts with no usable login and names the login problem when none is left.
• rota verdict add --sha binds a verdict to the commit the review package diffed, not the local branch ref.

New

• /rota-bugreport and rota bugreport (#1175): a verb that fails with exit 70 records the mistake in .rota/bugreports.jsonl, agents can add one by hand, and the skill drafts a redacted report, checks for a duplicate and files it on the rota repo only after you say yes.
• rota knowledge rm deletes a knowledge bullet and its tier entry.
• rota item section set replaces one section of an issue body.
• rota migrate milestone-files moves milestone files left from file mode into the archive, and doctor warns while they remain.

Fixed

• Knowledge hits are buffered in a gitignored file and folded by rota knowledge tier fold, so recording a hit no longer dirties the tree during a gate.
• GitHub issue edits go over REST and are verified by reading them back.
• A receipt rerun points at the pending call it duplicates. The smoke runner refuses foreign sections and runs without .git.

Refactors with no intended behaviour change: worktree containment, the Claude settings layout, machine secrets and the projects config dir each have one owner, and the CLI's git and pane-host reads go through injected dependencies.

Stats

281 commits, 347 files changed, +10129 −1479 lines

Full changelog: v0.20.0...v0.21.0

v0.20.0 — It's a Plan source, global config layer, dialog-only pane detection

It's a Plan becomes an issue source, the global config becomes a real runtime layer with its own XDG dirs, and pane detection stops misreading quoted text as a limit or logout.

New

• It's a Plan as an issue source (#1100): connection and doctor check, read and write verbs, claims, assign and close on merge, and rota migrate from a file backlog.
• The global config is a runtime layer under the project config (#1179), no longer only a seed for new projects. rota config show/set/edit --global and an inherit toggle in the config screen (#1180). rota setup offers to save its answers as global defaults (#1181). ROTA_CONFIG_DIR overrides the global config dir (#1186).
• Decision items: research findings, grilling refusals and a decision log, taught to vision, brainstorm and spike (#967).
• /rota-docs takes over docs maintenance from /rota-ship --docs, which is now a deprecated alias (#1098). rota round accept completes an architecture review that opens no PR (#1091).
• Bare rota run in HOME is a launcher, and init/setup refuse to run there (#1183). Stub skill installs are the default (#1099).

Changed

• XDG layout: the project registry moves to the state dir (#1184) and the secrets fallback file to the data dir, forced to 0600 (#1185, #1221). A symlinked legacy file is copied, and a non-file one is left alone (#1220, #1253, #1254). Doctor reports both dirs.
• Round-only config keys move from work.* to round.*; rota migrate config --apply moves them, and round start uses exactly the configured slot count (#1097).
• Worker slots with no round.accounts entry inherit the orchestrator's CLAUDE_CONFIG_DIR, and doctor warns on a mismatch (#1171). The account check reads macOS Keychain credentials when the credentials file is missing or expired (#1176).
• A corrupt global config refuses every write with exit 70 and skips the save offer (#1180, #1223).
• The overlap check compares an open PR's changed files and names directory pointers as the cause (#1094, #1170).
• Refactors with no intended behaviour change: one body-file reader for the CLI (#1106), typed gate refusals (#1108), and single owners for merge-approval policy and escalation (#1105, #1263), review kinds and depth (#1230), worker env and config reads (#1225, #1228, #1229), the PASS-at-HEAD proof rule (#1149), the keepalive marker (#1150) and the stale-binary state (#1109).

Fixed

• Pane classification: limit and logged-out phrases count only inside the harness dialog region, so a phrase quoted in a reply, diff or tool listing no longer marks a slot limited (#1212, #1246). Only "Login expired" and the bare "Not logged in" status line count as logged out (#1209, #1255). A footer with running shells or monitors reads as busy (#1156), and a relay clears an answered ROTA-BLOCKED (#1096).
• Gate and round: the bounce cap holds under concurrent writes (#1226). A second gate on one PR is refused with the real cause (#1095), and a gate marker whose pid was reused is replaced (#1126). The gate waits for the forge PR head before failing on a SHA mismatch (#1168). A retried assign resumes under its existing claim id (#1172), assign adopts the open PR of a done slot (#1090), and transfer and reconcile free a blocked slot whose PR merged (#1093).
• Process ancestry falls back to ps where /proc is missing (#1167). Orphaned .extract-* dirs older than an hour are reaped (#1120). Depends on is read from the issue body only (#1139). --file-deferred no longer copies the finding title into AC-1 (#1092).
• Smoke: a shard that dies without a summary is reported with its exit code and last output, and section 148 no longer dies silently (#1242). Worker wait tests no longer depend on wall-clock timing (#1266).
• Knowledge: lessons from round 29.

Stats

132 commits, 476 files changed, +14746 −3442 lines

Full changelog: v0.19.0...v0.20.0

v0.19.0 — OpenCode workers, Try it in the gate, merge train by default

OpenCode joins Claude and Codex as a worker kind, the gate runs an issue's Try it steps, and the merge train becomes the default when several reviewed PRs wait.

New

• OpenCode as a third worker kind (#584). Pane classification covers the boot footer, busy, limits and bad-model states; briefs are pasted raw; the slot's account env passes through; rota doctor checks the install. Default Codex and OpenCode tier models ship for round.tiers.* (#1009); the OpenCode defaults need the built-in Zen provider, otherwise override all three tiers.
• Try it steps run in the merge gate after verify (#913), and again for each train member before landing (#1012). They run only for collaborators' edits, with an empty HOME and a scrubbed environment; untrusted steps are withheld from the worker brief. New behaviour verdict kind and rota verdict add --transcript.
• Typed worker outcomes (#1007). rota worker done --outcome done|partial|failed --summary-file <f> records three summary lines; the gate refuses a partial or failed slot until a relay or transfer. Stale completions are fenced with an attempt id (#982), and workers get a durable inbox that worker done must drain (#1013).
• Round pacing and cost controls: round.batch caps open assignments (#1016); round.profile fills the tiers from a named model profile (#973); round.freshAt transfers to a fresh slot instead of relaying again (#981); plan.criticHarness runs the level-4 plan critic on another harness (#1001).
• Merge train as the default (#1048). round wait and round watch print a train nudge naming the PRs when two or more reviewed PRs wait, after every autopilot tick (#1064), and a nudge to assign a done slot before gating (#1075).
• Review gets sharper. A review verdict finding carries blocking, only blocking findings count as a bounce, and rota verdict add --file-deferred files the rest as items (#999, #1020). Review depth lifts on a one-way door, scope drift or a risky path (#909). light depth now runs the Spec reviewer (#916).
• New skills and modes: /rota-answer puts pending decisions to the maintainer one by one (#995); /rota-capture --triage handles issues filed by others (#994); /rota-init suggests config values from the project (#1034); /rota-qa uat and ship.uat add human acceptance (#991); /rota-refactor --map warns when the map is stale (#1008); /rota-pause --report writes a session summary (#970).
• Session guards: work.contextGuard warns or pauses a /rota-work session before its context fills (#988); research.packageCheck screens new dependencies against the registry (#990); brainstorm.edgeProbe adds an edge and prohibition probe (#985); rota plan check warns on oversized plans (#987) and checks that tasks honor the item's decision comments (#998).
• rota receipt show answers whether a lost write applied (#984). rota milestone status --to shipped exits 4 while the milestone has open items or unticked criteria, unless --force (#972).

Changed

• Defaults that move: work.herdrGroupSlots is on (#920), the round tier keys for Codex and OpenCode have values (#1009), a bad round.* key exits 2 on status, reconcile, assign, start, architecture, wind-down and watch (#980), and round escalate send requires options and a recommendation (#1000).
• Gate and review rules tightened: a FAIL verdict blocks, a merged PR drops out of review whatever the verdict (#1042), needs-info issues are not ready in round candidates (#1043), and a PR carrying a superseded attempt's commits is gated without misfiring during a transfer (#997).
• Autopilot tick policy moved from cli into roundtick, and the tier walk, issue-branch name, recorded-review lookup, registry slot decode and round config load each have one owner (#1059, #1074, #1049, #1047, #1003, #980). No behaviour change intended.
• Knowledge: lessons from rounds 22 to 28; entries store a commit sha beside the date (#971).

Fixed

• Watch and relay: round watch no longer reports stale or placeholder done lines (#1025); a ROTA-DONE that predates the last relay is ignored (#874); an unseen relay gets a fallback window when stall detection is off (#1035); herdr dispatch waits out agent_pane_busy before failing (#1033); the gate counts a done by event seq, not a stamp (#1056).
• Limit detection skips echoed orchestrator blocks (#887), reads phrases per slot kind (#882), and the limits feed no longer resubscribes after a stop or times out before the first pass (#996).
• install.sh installs its cleanup traps before mktemp, so no temp dir leaks (#1024); KNOWLEDGE.md edits are locked (#896); round bounce --slot refuses names outside the pool (#886).

Documentation

• Round 28 train default, nudges and the idle table; the plain-orchestrator comparison re-judged and published in the user docs (#1021); OpenCode workers; triage, deferred findings and Try it runs; the KNOWLEDGE.md lock; the unknown-slot bounce exit 4; limit detection and the release milestone-check line.

Stats

339 commits, 462 files changed, +19496 −2321 lines

Full changelog: v0.18.0...v0.19.0

v0.18.0 — Milestone breakdown shape, typed worker events, receipts

Milestone breakdowns get a shape and a check, workers report through typed events with an unverifiable state, and the round verbs carry request ids and receipts.

New

• Milestone breakdown shape (#853). A milestone lists its ## Capabilities and checkbox ## Acceptance criteria; a child issue declares ## Change (ADDED|MODIFIED|REMOVED|RENAMED <capability>, Serves: M08 AC-2, Reason and Migration on REMOVED) and copies the capability names into ## Touches, so siblings on one capability clash in round candidates. rota milestone check <MNN> [--strict] names every gap; rota migrate milestones converts old bodies. skills/references/breakdown.md owns the shape for /rota-plan, /rota-vision and /rota-capture.
• Typed worker events (#819) and an unverifiable slot state (#820). Workers push done, blocked, question and heartbeat events to a durable record that the orchestrator reads before the pane; a newer event outranks a stale pane. Contact loss is unverifiable, distinct from dead, with a bounded herdr wait, a forced reclaim and a loud outage path.
• Request ids and receipts on the state-writing round verbs (#822). A retried assign or transfer after a flaky forge call replays its receipt instead of acting twice; inputs are fingerprinted by content, a corrupt receipts file is refused, and the store is capped.
• rota skills get and list, with an opt-in stub install (#821), so installed skill copies stop drifting from the binary after rota update.
• rota item create --batch-file files a JSON array in order and reports the ids already filed when a record fails part-way; placeholder titles are refused on every create path (#838).
• herdr slots open as linked worktree workspaces behind work.herdrGroupSlots, and a Claude Code dialog on the prompt line is read as a dialog, not a draft.

Changed

• Kind switches moved behind the Harness interface (#584) and the autopilot tick mappings into roundtick; tracker close reasons, worker event kinds, the registry timestamp and the Linear read-versus-write split each have one owner.
• Knowledge: lessons from rounds 19 to 21 and from #853 (gate hygiene, stale verdicts, sidecar briefs); the orchestration and Smoke testing topics are split into facets.

Documentation

• Worker events, skills get, the stub install, unverifiable slots, batch item create, dialog-aware dispatch, the breakdown shape and the two new milestone verbs; the --force caveat and the hedged orca read.

Stats

87 commits, 209 files changed, +7807 −1056 lines

Full changelog: v0.17.0...v0.18.0