pawbot v0.4.0

pawbot 0.4.0 release notes

This feature release adds a deterministic Agent Harness, task-level result
checks, and human approval before high-risk tools create side effects. It also
records enough version and environment provenance to explain which code and
platform produced a regression result.

Added

• Added pawbot harness list and pawbot harness run with seven deterministic
  scenarios covering normal Tool use, Tool failure recovery, Provider errors,
  model timeouts, cancellation, turn-budget boundaries, and approval-gated
  side effects.
• Added task contracts that report final-result checks separately from
  trajectory checks. A stable execution path is no longer presented as proof
  that the task itself succeeded.
• Added ToolApprovalManager and fail-closed approval callbacks. In restricted
  WebUI workspace access, write, execute, and network-capable Tools wait for a
  decision before starting; the native TUI uses the same gateway protocol.
• Added experiment provenance to Harness reports and Record & Replay metadata,
  including Pawbot version, Git revision, platform, architecture, experiment ID,
  and working-tree state without copying credentials or local paths.
• Added scripts/quality_gate.py to combine whitespace checks, Ruff,
  basedpyright, Harness, approval/evaluation contract tests, and public replay
  Fixture checks into one non-zero-exit quality gate.

Changed

• Pending approval requests are restored through the WebUI outbound projection
  after reconnect, while the WebSocket transport remains a thin delegation
  layer.
• The public CI quality gate now installs all channel dependencies before
  static type checking, so optional channel imports are checked in the same
  environment as the full Python jobs.

Verification

• Python 3.11 and 3.13 CI jobs passed with channel dependencies installed.
• WebUI lint, tests, and production build passed.
• Native TUI type check, tests, and Linux asset build passed.
• Installer smoke tests passed on Ubuntu, macOS, and Windows.
• Record & Replay Fixture and Agent quality gate passed.

Upgrade

Existing installations can update without repeating Provider or API Key setup:

pawbot update

The command keeps existing Provider credentials, sessions, recordings, and
workspaces. Source/editable installations should continue to use their normal
Git checkout workflow.