Task-Spec 3.10.0 RC 1 — Integrated toolkit

Release candidate, not a qualified release. TaskSpec 3.10.0 RC 1 carries the integrated-toolkit candidate. It is marked Latest so the newest source is visible, but it has not passed release qualification. v3.9.0 is the most recent qualified release. Release qualification is still open: chat-behavior coverage is 19 of 20 cases and the comparative pilot has not run. See the 3.10.0 checklist.

What is new since 3.9.0

• Native decomposition. taskspec decompose init / prepare / review / compile / status / impact / import turns intent and evidence into seams, swimlanes, capability legs, and atomic leaves. Topology review is HMAC-signed and separate from task authorization.
• Lineage. Every materialized leaf carries its plan snapshot. decompose impact shows which leaves need re-authorization after a replan.
• Execution recipes. Five pinned strategies (direct, test-first, plan-execute-verify, diagnose-repair-verify, research-synthesize-verify) resolve into the task before it is sealed.
• Managed repair rounds. TaskMesh runs bounded executor-plus-eval rounds with a persistent budget and deadline. It parks an attempt when Claude or Codex reports a permission denial.
• Attested OMP rounds. Each round gets signed sandbox evidence and a fresh, revoked-after-use credential.
• Operations and discovery. receipt operational, taskspec guide, taskspec example, and a private Python runtime installed with install.sh --toolkit.
• Fixes since the candidate was cut. backlog_dir is read from .taskspec/config (#26), and a spec outside the backlog now reports containment instead of a stale handoff (#27).

Install this candidate

The repository is private. You need an account with access and an authenticated gh client.

release_dir="$(mktemp -d)"
gh release download v3.10.0-rc.1 --repo luanmorenommaciel/task-spec \
  --pattern 'task-spec-3.10.0.tar.gz*' --dir "$release_dir"
(cd "$release_dir" && shasum -a 256 -c task-spec-3.10.0.tar.gz.sha256)
tar -xzf "$release_dir/task-spec-3.10.0.tar.gz" -C "$release_dir"
bash "$release_dir/task-spec-3.10.0/install.sh" --global --copy --toolkit
taskspec doctor && taskspec demo

--toolkit needs Python 3.11+ and Go 1.25+ because it builds the Mesh helper from source.

Verification

• Source commit 0a50aae. Hosted make check passed on Ubuntu and macOS.
• The source archive is reproducible. Its sha256 is 9187a50dec1390798504cce48f67a4c2cd5a7bcfff46628445de88d0e91965d1, byte-identical when built on macOS and Ubuntu 24.04.
• The release workflow attaches the archive, checksums, SPDX SBOM, Mesh helpers, and signed provenance after this page is published.
• Not covered: the TaskMesh autonomous isolation job runs only on manual dispatch and did not run for this commit.

Known open items

• Chat qualification: the Claude planning case is held. The latest bounded retry stopped on a permission denial and was retained as failed evidence.
• The comparative pilot is not registered or run.
• The candidate is also published as the private GitHub Packages npm version @luanmorenommaciel/task-spec@3.10.0-rc.1 on the next dist-tag. It is not on the public npm registry.

Changes: CHANGELOG.md · v3.9.0...v3.10.0-rc.1

Task-Spec 3.9.0 — TaskMesh

TaskSpec 3.9.0 adds TaskMesh, the optional portable execution control plane for already-authorized atomic tasks. TaskSpec stays the canonical authority and acceptance layer; TaskMesh schedules, leases, isolates, and recovers the work.

Highlights

• Deterministic graph-aware routing, leasing, fencing, recovery, and integration branches
• Native Codex, Claude Code, and Grok Build adapters, plus optional OMP RPC execution
• Supervised worktree execution and fail-closed autonomous Docker/Podman isolation
• Durable cross-cockpit observation through the local daemon and an MCP facade
• Checksummed optional --with-mesh installation for macOS and Linux
• Retained 97/100 quality baseline, hosted macOS/Linux gates, live isolation proof, authenticated private installs, SPDX SBOM, and signed DSSE/in-toto provenance

Install

The repository and this release are private. You need an account with access and an authenticated gh client.

release_dir="$(mktemp -d)"
gh release download v3.9.0 --repo luanmorenommaciel/task-spec \
  --pattern 'task-spec-3.9.0.tar.gz*' --pattern 'taskspec-meshd-*' \
  --dir "$release_dir"
(cd "$release_dir" && shasum -a 256 -c task-spec-3.9.0.tar.gz.sha256)
tar -xzf "$release_dir/task-spec-3.9.0.tar.gz" -C "$release_dir"
bash "$release_dir/task-spec-3.9.0/install.sh" --global --copy --with-mesh

Then prove the lifecycle in a disposable repository:

taskspec doctor
taskspec demo        # ends with DEMO=READY
taskspec mesh doctor

Omit --with-mesh for a core-only install.

Assets

Asset	Purpose
task-spec-3.9.0.tar.gz and .sha256	Source archive and its checksum
taskspec-meshd-{darwin,linux}-{amd64,arm64} and .sha256	TaskMesh daemon helpers; the CLI requires an exact version match
task-spec-3.9.0-checksums.txt, taskmesh-checksums.txt	Checksum manifests
task-spec-3.9.0.spdx.json	SPDX software bill of materials
task-spec-3.9.0.provenance.dsse.json, taskmesh-binaries.provenance.dsse.json	Signed DSSE/in-toto provenance
task-spec-3.9.0-release-provenance.pub.pem	Public key for provenance verification
task-spec-3.9.0-release-evidence.json, -quality-scorecard.json, -mesh-release-evidence.json, -reviewer-report.json, -evidence.tar.gz	Retained release evidence behind the claims above
taskmesh-binaries.json	Helper build manifest

Trust boundary

TaskMesh cannot widen task authority, rewrite dependencies, or merge the target branch. mesh finish prints a human integration route and never merges or pushes. A passing supervised eval waits for supervisor acceptance.

What comes next

main carries the 3.10.0 integrated-toolkit candidate: native decomposition, signed execution recipes, and managed repair rounds. It is not published while harness qualification and the comparative pilot are incomplete.

Full changelog: CHANGELOG.md · v3.8.1...v3.9.0

Task-Spec 3.9.0 RC 2 — TaskMesh

Private TaskMesh release candidate with the npm installation boundary fixed. Promotion requires deterministic archives, four platform helpers, authenticated archive and npm installs on macOS/Linux, SPDX SBOM, and independently verified DSSE/in-toto provenance.

Task-Spec 3.9.0 RC 1 — TaskMesh

Private release candidate for TaskMesh, the optional portable execution control plane. This RC validates deterministic archives, four platform helpers, authenticated private installs, SBOM generation, and signed DSSE/in-toto provenance before the final v3.9.0 tag.

Task-Spec 3.8.1

Evidence-backed private release.

• generated quality score: 97/100
• HMAC v3, revision-bound handoff and acceptance
• official A2A and MCP SDK conformance
• real Codex and Claude benchmark evidence
• externally signed sandbox evidence
• authenticated private installation on Ubuntu and macOS
• Ed25519-signed DSSE/in-toto release provenance

The repository and release assets remain private and require an authorized GitHub identity.

Task-Spec 3.8.1 RC 3

Private release candidate validating:

• authenticated checksum-backed installation on Ubuntu and macOS
• authenticated npm/GitHub installation
• Ed25519-signed DSSE/in-toto provenance for the source archive and SPDX SBOM
• retained 97/100 evidence gate before the final private v3.8.1 tag

Task-Spec 3.8.0

Task-Spec 3.8.0 is the revision-bound trust, graph, recovery, and developer-experience release.

Highlights:

• deterministic TaskPlan/v1 materialization with TaskMaterializationReceipt/v1
• nested workspaces and custom backlog/acceptance roots
• TaskAuthorization/v3, TaskHandoff/v3, and attempt-bound acceptance records
• deterministic graph, status, readiness, conflict, and recovery projections
• portable macOS/Linux CLI, installation, and reference consumers

Release gates:

• CHECK=READY
• CONFORMANCE=L2
• hosted Ubuntu and macOS green on the exact merge commit
• checksum-backed authenticated release installation and npm/GitHub installation green on Ubuntu and macOS: https://github.com/luanmorenommaciel/task-spec/actions/runs/31957477869

Private-repository installation:

• authenticate with GitHub CLI before downloading the release archive or installing the Git tag
• anonymous raw-file and release-asset URLs are unavailable while the repository remains private

Immutable source commit: 0e6180c
Archive SHA-256: df39d94985353d7e59aedfe2b0bc07f6e0010be4d03cdc9259b82d400c5f7915

Task-Spec 3.8.1 RC 2

Second evidence-backed release candidate.

RC 2 separates three externally verifiable gates so each reports independently:

• immutable release assets
• GitHub build/SBOM attestations
• Ubuntu/macOS pinned curl and GitHub/npm installations

The repository remains private. GitHub attestations and unauthenticated public install doors are therefore expected to fail closed until visibility or the approved provenance contract changes.

Task-Spec 3.8.1 RC 1

Evidence-backed release candidate for Task-Spec 3.8.1.

This RC exists to collect the remaining immutable publication evidence:

• checksummed source and evidence archives
• SPDX SBOM
• GitHub artifact and SBOM attestations
• pinned curl installation on Ubuntu and macOS
• GitHub/npm installation on Ubuntu and macOS

The final v3.8.1 tag remains blocked until the generated quality score reaches at least 97/100.