v4.12.1

Episodic Pitfall Scope Hygiene, Polyglot TAP/Exception Diagnostic Windowing, Hybrid Release-Notes Ledger Compiler & Coverage Persistence (Apache 2.0)

Episodic Memory & Pitfall Distillation Hardening (nomos mem, nomos handshake)

• Automatic Dead-Scope Tombstoning & Cross-Folder Habit Consolidation (SUB-1965, SUB-1960): Auto-tombstones stale pitfall scopes whose target directories no longer exist, skips ephemeral test-assertion noise, prioritizes touchedFiles during multi-violation gate trap distillation, and scopes cold-start nomos handshake / task-start recalls in read-only mode so access_count is never artificially inflated.

Polyglot Verification & Release Pipeline Hardening (nomos verify, packaging/render-release-notes.sh)

• Salient Polyglot Toolchain Diagnostic Window (SUB-1962, SUB-1960): Anchors the 400-byte extractSalientToolchainWindow diagnostic excerpt on the first not ok, FAIL, or exception marker across multi-hundred-line Node TAP, Python, Rust, .ts, and .svelte test outputs rather than truncating inside TAP version 13 passing headers.
• Live Statement Coverage Persistence & Test Complexity Ratchet (SUB-1952): Persists .tmp/coverage.out during nomos verify, extracts a testable CLI verification seam, and enforces test cyclomatic complexity alongside local-symbol TDD coupling.
• Hybrid GitHub Release Notes & Commit Ledger Compiler (SUB-1953): Wires .github/workflows/release.yaml to packaging/render-release-notes.sh so curated CHANGELOG.md highlights, automatic vX.Y.0 milestone patch rollups, and the chronological SHA-linked [INT-*] / [SUB-*] commit ledger render together on every GitHub Release.

---

Included v4.12.0 Milestone Features

Zero-Config Brownfield Auto-Detection & Monotonic AST Ratchet, Full 11-Language Polyglot Verification Parity, Switchable nomos.yaml Brownfield Modes, Navigation-First Handshake & Read-Spiral Gyroscope (Apache 2.0)

Zero-Config Brownfield Onboarding & Monotonic AST Ratcheting (nomos init, nomos verify, nomos.yaml)

• Automatic Brownfield Detection (nomos init): Detects non-empty repositories lacking dual-hemisphere intent/ + substrate/ roots, configures strict_mode: false automatically, and discovers active top-level source directories out of the box without Day-1 directory migrations.
• Monotonic AST Merge-Base Ratchet (git merge-base): Under strict_mode: false, ratchets file LOC (>400), function LOC (>60), McCabe cyclomatic complexity V(G) (>15), Cognitive Debt Score (CDS), structural clones, magic-string duplication, forbidden path literals, and unchecked error hygiene strictly against the trunk baseline so legacy God files pass untouched while net complexity or debt regressions fail closed with exact [BASELINE main: ... | delta ...] diagnostics.
• Declaratively Switchable Brownfield Modes (nomos.yaml, nomos.schema.json): Adds granular brownfield switches under governance.quality_gates: verify_scope ("diff" | "repo"), tdd_mode ("off" | "ratchet" | "diff" | "strict"), coverage_mode ("off" | "artifact" | "live"), and tdd_exclude glob patterns.

Full 11-Language Polyglot Verification Parity (nomos verify)

• 11-Language Structural AST, Anti-Shim & Error-Hygiene Parity: Closes all 12 polyglot verification gaps across Go, Rust, C/C++, Python, Ruby, TypeScript, JavaScript, Svelte (.svelte <script> extraction), Java, Kotlin, and C-Sharp, including overloaded-signature baseline metric retention (max(V(G), LOC)) so TypeScript/C++/JVM overloads never mask real complexity growth.
• Zero-Dependency Live & Artifact Statement Coverage: Adds zero-dependency NODE_V8_COVERAGE live statement coverage probes for JS/TS, zero-dependency python3 -m trace fallback alongside coverage.py / LCOV / Cobertura XML, Ruby Coverage / SimpleCov ingestion, and JaCoCo XML / Cobertura report verification for Java, Kotlin, C-Sharp, Rust, and C/C++.

Navigation-First Brownfield Handshake & Read-Spiral Pacing (nomos handshake, nomos hook post-tool)

• Noise-Filtered Cold-Start Topology Brief (SynthesizeBrownfieldTopology): Emits Governance Mode: BROWNFIELD (scope=diff, tdd=ratchet, cov=live), lowers Core Modules discovery to >= 120 LOC, removes upfront prompt scolding that induced reasoning-model analysis paralysis, and filters _-prefixed demo directories (_examples/), typings/, .test-d.ts, *-test harnesses, and quality_gates.exclude globs from cold-start orientation.
• Worktree Read-Spiral Gyroscope (cmd_hook_pacing.go): Tracks consecutive read/search calls (Read, Grep, Glob, read-only shell searches) inside active EDIT worktrees and emits non-blocking 1-line pacing nudges at 12 and 20 consecutive reads without a source edit, resetting immediately upon any file mutation.

---

Changelog

• 48d828a [SUB-1952] fix(verify): persist .tmp/coverage.out, extract CLI run seam,...
• 6f3a734 [SUB-1953] fix(release): merge CHANGELOG highlights with INT/SUB commit ledger
• 7d8c09d [SUB-1960] fix(mem,verify,cli): harden pitfall scope parity, polyglot...
• 0c2ce30 [SUB-1962] fix(verify): anchor polyglot toolchain failure window on TAP and...
• 7c205fd [SUB-1965] fix(mem): auto-tombstone dead pitfall scopes, expire stale test...
• 6b51618 [SUB-1982] chore(release): prepare v4.12.1 Open-Core milestone release and...

Full Changelog: v4.12.0...v4.12.1

v4.12.0

Zero-Config Brownfield Auto-Detection & Monotonic AST Ratchet, Full 11-Language Polyglot Verification Parity, Switchable nomos.yaml Brownfield Modes, Navigation-First Handshake & Read-Spiral Gyroscope (Apache 2.0)

Zero-Config Brownfield Onboarding & Monotonic AST Ratcheting (nomos init, nomos verify, nomos.yaml)

• Automatic Brownfield Detection (nomos init): Detects non-empty repositories lacking dual-hemisphere intent/ + substrate/ roots, configures strict_mode: false automatically, and discovers active top-level source directories out of the box without Day-1 directory migrations.
• Monotonic AST Merge-Base Ratchet (git merge-base): Under strict_mode: false, ratchets file LOC (>400), function LOC (>60), McCabe cyclomatic complexity V(G) (>15), Cognitive Debt Score (CDS), structural clones, magic-string duplication, forbidden path literals, and unchecked error hygiene strictly against the trunk baseline so legacy God files pass untouched while net complexity or debt regressions fail closed with exact [BASELINE main: ... | delta ...] diagnostics.
• Declaratively Switchable Brownfield Modes (nomos.yaml, nomos.schema.json): Adds granular brownfield switches under governance.quality_gates: verify_scope ("diff" | "repo"), tdd_mode ("off" | "ratchet" | "diff" | "strict"), coverage_mode ("off" | "artifact" | "live"), and tdd_exclude glob patterns.

Full 11-Language Polyglot Verification Parity (nomos verify)

• 11-Language Structural AST, Anti-Shim & Error-Hygiene Parity: Closes all 12 polyglot verification gaps across Go, Rust, C/C++, Python, Ruby, TypeScript, JavaScript, Svelte (.svelte <script> extraction), Java, Kotlin, and C-Sharp, including overloaded-signature baseline metric retention (max(V(G), LOC)) so TypeScript/C++/JVM overloads never mask real complexity growth.
• Zero-Dependency Live & Artifact Statement Coverage: Adds zero-dependency NODE_V8_COVERAGE live statement coverage probes for JS/TS, zero-dependency python3 -m trace fallback alongside coverage.py / LCOV / Cobertura XML, Ruby Coverage / SimpleCov ingestion, and JaCoCo XML / Cobertura report verification for Java, Kotlin, C-Sharp, Rust, and C/C++.

Navigation-First Brownfield Handshake & Read-Spiral Pacing (nomos handshake, nomos hook post-tool)

• Noise-Filtered Cold-Start Topology Brief (SynthesizeBrownfieldTopology): Emits Governance Mode: BROWNFIELD (scope=diff, tdd=ratchet, cov=live), lowers Core Modules discovery to >= 120 LOC, removes upfront prompt scolding that induced reasoning-model analysis paralysis, and filters _-prefixed demo directories (_examples/), typings/, .test-d.ts, *-test harnesses, and quality_gates.exclude globs from cold-start orientation.
• Worktree Read-Spiral Gyroscope (cmd_hook_pacing.go): Tracks consecutive read/search calls (Read, Grep, Glob, read-only shell searches) inside active EDIT worktrees and emits non-blocking 1-line pacing nudges at 12 and 20 consecutive reads without a source edit, resetting immediately upon any file mutation.

---

Changelog

• 0b96dc5 [INT-1913] docs(specs): codify brownfield init auto-detection and baseline...
• 8b356d6 [SUB-1914] feat(cli,verify): auto-detect brownfield repos and ratchet AST...
• b8bc9c0 [SUB-1918] fix(verify): ratchet magic string duplication and forbidden...
• dbf629d [INT-1915] docs(spec): codify full 11-language polyglot parity across 42...
• f12d738 [SUB-1922] fix(verify): close all 12 polyglot parity gaps and wire...
• fda1423 [SUB-1927] fix(handshake): emit lean brownfield topology brief when...
• 06f7569 [SUB-1930] fix(verify): retain max baseline metrics for overloaded...
• af5e7e7 [SUB-1933] fix(verify): scope worktree TDD to diff and add verify_scope and...
• f207be5 [SUB-1934] fix(handshake,hook): make brownfield brief navigation-first and...
• 6bc58b4 [SUB-1938] chore(release): prepare v4.12.0 Open-Core milestone release and...

Full Changelog: v4.11.0...v4.12.0

v4.11.0

Turn-Termination nomos hook stop Gate, Outbound Egress Airlock, Additive nomos hook install, Scratch-Artifact & Trunk-Redirect Guards, GoReleaser v2 Schema Gate & Mermaid Spec Diagrams (Apache 2.0)

Indirect-Control Ambient Hook Suite (nomos hook, nomos.yaml)

• Turn-Termination Anti-Phantom Gate (nomos hook stop): Blocks unverified active EDIT worktree exits until nomos verify clears DirtyUnverifiedEdits, rejects --container-sandbox exits containing syntax errors or protected verifier mutations, and honors stop_hook_active: true for single-pass re-entry safety.
• Additive Multi-Harness Installer (nomos hook install): Non-destructively merges SessionStart, PreToolUse, PostToolUse, and Stop hook bindings across Claude Code (.claude/settings.json), Gemini CLI (.gemini/settings.json), OpenCode (.opencode/plugins/nomos.ts), and Cursor (--global or --project) while preserving existing user configuration.
• Outbound Egress Airlock & Loop Circuit-Breaker (nomos hook pre-tool, nomos hook post-tool): Inspects outbound HTTP/shell calls against cloud metadata SSRF endpoints (169.254.169.254, metadata.google.internal, fd00:ec2::254), inline credential exfiltration tokens, and declarative egress_allowlist domains in nomos.yaml (nomos.schema.json), alongside upgraded loop-signature circuit breaking and additive Git Notes refspec sync.

Hermetic Boundary & Scratch-Artifact Enforcement (nomos verify, nomos init)

• Scratch-Artifact DoD Gate (StagedBoundariesGate): Rejects staged or committed *.tmp, *.bak, *.orig, *.swp, *~, and .DS_Store scratch artifacts outside .tmp/ across both uncommitted index state and active task branch commits (ERR_BOUNDARY), paired with self-healing .gitignore and .git/info/exclude defaults.
• Protected-Trunk Shell Redirect Guard (cmd_hook_trunk_guard.go): Blocks shell redirections (>, >>, tee, sed -i, cp, mv) targeting protected main trunk paths during PreToolUse before filesystem mutation occurs.

Release Pipeline & Canonical Spec Architecture (release.yaml, intent/architecture/specs/)

• Strict GoReleaser v2 Schema Gate & Patch Note Rollup: Enforces yaml.Decoder.KnownFields(true) against GoReleaser v2 config structs in goreleaser_contract_test.go, runs goreleaser check in CI on every push/PR, and rolls parent vX.Y.0 milestone notes into vX.Y.Z patch releases so /releases/latest stays self-contained.
• Machine-Verified Mermaid Architecture Diagrams: Converts ASCII box-drawing architecture diagrams across Open-Core specifications into standard flowchart Mermaid v11 blocks validated against orphan-state and syntax invariants.

---

Changelog

• d1bc1fb [SUB-1865] fix(release): enforce strict GoReleaser v2 schema gate in...
• a29e1ff [INT-953] docs(specs): codify hook stop, egress airlock, hook install,...
• e58459c [SUB-1890] feat(cli,config): ship hook stop, egress airlock, hook install,...
• 1c8b807 [SUB-1892] chore(schema): remove stray nomos.schema.json.tmp from root
• e95c8d4 [INT-954] docs(specs): codify scratch artifact DoD gate, trunk redirect...
• bd2b35c [SUB-1894] feat(verify,cli): enforce scratch artifact gate and trunk...
• aa6da66 [INT-956] docs(specs): convert ASCII architecture diagrams in Open-Core...
• abcd2b3 [SUB-1902] chore(release): prepare v4.11.0 Open-Core milestone release and...

Full Changelog: v4.10.1...v4.11.0

v4.10.1

GoReleaser v2 AUR Schema Alignment & Precompiled Multi-Arch Release Artifacts (Apache 2.0)

Release Pipeline Hardening (.goreleaser.yaml, release.yaml)

• GoReleaser v2 config.AUR Schema Parity: Removes unsupported options array from .goreleaser.yaml aurs: (relying on GoReleaser v2's native !strip PKGBUILD template) and guards AUR_KEY lookup via index .Env "AUR_KEY" so GitHub Release tarballs, checksums.txt, and rendered AUR PKGBUILD artifacts build deterministically whether or not secrets.AUR_KEY is configured.

---

Included v4.10.0 Milestone Features

Ambient OpenCode Plugin Hooks, First-Class Rails 8 Minitest Runner, Arch/Omarchy nomos-bin AUR Packaging, Pure NixOS Zero-FHS Hooks & Tree-Hash Toolchain Receipt Caching (Apache 2.0)

Ambient OpenCode Plugin Hook Scaffolding (nomos init, nomos hook)

• Zero-Touch .opencode/plugins/nomos.ts Scaffolding: Scaffolds a zero-dependency TypeScript OpenCode plugin during nomos init with idempotent NOMOS_OPENCODE_PLUGIN_START/END markers that preserve existing user plugins.
• Sub-5ms OpenCode Payload Normalization: Normalizes OpenCode tool.execute.before and tool.execute.after payloads across bash, write, edit, apply_patch (*** Update File: / *** Add File: / *** Delete File: target extraction), read, list, glob, grep, and lsp.

First-Class Rails 8 Minitest Suite Runner (nomos verify)

• Automatic bin/rails test & bundle exec rake test Execution: Detects test/**/*_test.rb Minitest suites alongside Ruby InstructionSequence bytecode compilation, executes bin/rails test (or bundle exec rake test under RAILS_ENV=test), and rejects both failing assertions and non-zero Minitest skip counts (Ruby(compile+minitest)).

Arch Linux & Omarchy Distribution, Container Portability & Receipt Caching

• Arch Linux / Omarchy nomos-bin AUR Target: Adds packaging/aur/PKGBUILD (x86_64 and aarch64 static CGO_ENABLED=0 binaries with Apache-2.0 license staging) and automated GoReleaser aurs: publishing.
• Zero-FHS NixOS Hooks & Static Auto-Recompilation: Removes external sed dependencies from .git/hooks/commit-msg via pure Bash parameter expansion for minimal NixOS sandboxes, and enforces CGO_ENABLED=0 (-trimpath -ldflags="-s -w", zero ELF PT_INTERP dynamic linker leakage) during nomos task sync binary recompilation.
• Content-Addressed Tree-Hash Receipt Cache (nomos-toolchain-receipt-v2): Canonicalizes relative and absolute worktree paths and hashes live Git blob OIDs (ls-tree + working-tree overlay + polyglot stack results) so nomos verify, pre-commit, nomos task sync, and fast-forward trunk checks share cryptographic toolchain receipts without redundant test suite runs.

---

Changelog

• 329aa59 [SUB-1858] fix(release): align GoReleaser v2 AUR config schema and prepare...

Full Changelog: v4.10.0...v4.10.1

v4.10.0

Ambient OpenCode Plugin Hooks, First-Class Rails 8 Minitest Runner, Arch/Omarchy nomos-bin AUR Packaging, Pure NixOS Zero-FHS Hooks & Tree-Hash Toolchain Receipt Caching (Apache 2.0)

Ambient OpenCode Plugin Hook Scaffolding (nomos init, nomos hook)

• Zero-Touch .opencode/plugins/nomos.ts Scaffolding: Scaffolds a zero-dependency TypeScript OpenCode plugin during nomos init with idempotent NOMOS_OPENCODE_PLUGIN_START/END markers that preserve existing user plugins.
• Sub-5ms OpenCode Payload Normalization: Normalizes OpenCode tool.execute.before and tool.execute.after payloads across bash, write, edit, apply_patch (*** Update File: / *** Add File: / *** Delete File: target extraction), read, list, glob, grep, and lsp.

First-Class Rails 8 Minitest Suite Runner (nomos verify)

• Automatic bin/rails test & bundle exec rake test Execution: Detects test/**/*_test.rb Minitest suites alongside Ruby InstructionSequence bytecode compilation, executes bin/rails test (or bundle exec rake test under RAILS_ENV=test), and rejects both failing assertions and non-zero Minitest skip counts (Ruby(compile+minitest)).

Arch Linux & Omarchy Distribution, Container Portability & Receipt Caching

• Arch Linux / Omarchy nomos-bin AUR Target: Adds packaging/aur/PKGBUILD (x86_64 and aarch64 static CGO_ENABLED=0 binaries with Apache-2.0 license staging) and automated GoReleaser aurs: publishing.
• Zero-FHS NixOS Hooks & Static Auto-Recompilation: Removes external sed dependencies from .git/hooks/commit-msg via pure Bash parameter expansion for minimal NixOS sandboxes, and enforces CGO_ENABLED=0 (-trimpath -ldflags="-s -w", zero ELF PT_INTERP dynamic linker leakage) during nomos task sync binary recompilation.
• Content-Addressed Tree-Hash Receipt Cache (nomos-toolchain-receipt-v2): Canonicalizes relative and absolute worktree paths and hashes live Git blob OIDs (ls-tree + working-tree overlay + polyglot stack results) so nomos verify, pre-commit, nomos task sync, and fast-forward trunk checks share cryptographic toolchain receipts without redundant test suite runs.

---

Changelog

• 62f039b [SUB-1831] fix(ci): expand runner.temp in GoReleaser args and support tag...
• cc82f7b [SUB-1832] chore(ci): upgrade workflows to Node 24 actions and...
• 7eed6c7 [INT-950] docs(specs): codify offline-first diagnostic report and sync...
• 198d395 [SUB-1840] feat(cli): enforce offline-first nomos issue, branch redaction,...
• df3397f [INT-944] docs(specs): codify OpenCode ambient plugin hook contract in...
• 8102f09 [SUB-1823] feat(cli): scaffold .opencode/plugins/nomos.ts ambient hook in...
• fff8ffe [INT-945] docs(specs): codify Rails 8 bin/rails test Minitest auto-runner...
• 3401606 [SUB-1824] feat(verify): auto-run Rails 8 bin/rails test Minitest suites in...
• 07e8b7b [INT-946] docs(specs): codify Omarchy and Arch Linux nomos-bin AUR...
• 88d67c7 [SUB-1825] feat(release): add Arch/Omarchy nomos-bin PKGBUILD and...
• 0188bbc [SUB-1847] fix(workspace): remove sed dependency from commit-msg hook for...
• 202b6ac [SUB-1853] fix(cli,verify): enforce static CGO_ENABLED=0 recompile,...

Full Changelog: v4.9.0...v4.10.0

v4.9.0

First-Class Ruby & Rails Polyglot AST Gating, Shell-Segment Sentinel Tokenizer, Mneme Locality Boost, RLVR/DPO Session Export & Flat 39-Spec Blueprint (Apache 2.0)

First-Class Ruby & Rails Polyglot AST Verification (nomos verify)

• Embedded ruby.scm & Structural Ruby Scanner: Adds first-class .rb and .rake verification covering def, singleton def self.*, predicate/bang/setter methods, Ruby 3 endless methods (def valid? = ...), SQL/HTML heredoc (<<~SQL) and =begin/=end stripping, modifier if/unless/while/until disambiguation, cyclomatic complexity, and raise NotImplementedError / empty-block anti-shim rejection.
• RSpec/Minitest Skip Guards & Rails Impact Mapping: Rejects skipped test declarations (xit, xdescribe, xcontext, Minitest skip), maps Rails app/<layer>/<name>.rb edits directly to paired spec/ and test/ suites, and validates syntax via RubyVM::InstructionSequence.compile_file.

Sentinel Shell-Segment Tokenizer, Mneme Locality & Session Export (nomos hook, nomos mem, nomos session)

• Shell-Segment-Aware evalHermeticWorktree: Tokenizes chained shell segments (&&, ;, ||, |, \n), tracks sequential cd <dir> state and git -C <dir> targets when ambient working directory metadata is absent, and ignores quoted git commit strings inside read-only search commands.
• Mneme Repo-Locality Boost & Global Axiom Cap: Applies a 1.25x ranking boost to exact repo_id matches during scoped recall and caps unscoped global axiom slots at max(1, limit/3) with sparse backfill.
• Joined nomos session export & Churn Advisories: Synthesizes RLVR/DPO-ready trajectory datasets joined with refs/notes/nomos/releases receipts and adds PostToolUse slow-step timeout plus high-churn worktree checkpoint advisories.

Canonical Intent Blueprint, Mermaid Guards & GoReleaser Changelog Pipeline (IntentSteelmanGate)

• Flat 39-Spec Steel-Man Singularity: Consolidates all 39 canonical specifications under intent/architecture/specs/*_spec.md on a single 1-indexed NCTE-100 blueprint with compiled Go SSoT contracts, TC-* verification vectors, Mermaid syntax validation, and orphan-state guards.
• Automated CHANGELOG.md Release Pipeline: Bundles root CHANGELOG.md into release archives and extracts matching ## [vX.Y.Z] sections directly into GoReleaser GitHub Releases (release.yaml), failing closed if release notes are missing.

---

Changelog

• c259b52 [INT-931] docs(intent): standardize all 40 intent docs to strict steel-man...
• a9bef5c [SUB-1795] feat(verify): enforce strict frontmatter, spec anatomy, and...
• a908e19 [INT-932] docs(intent): flatten specs, remove orphan handbook, and...
• 030c2cd [SUB-1797] feat(verify): enforce canonical spec blueprint and flat specs...
• 3cf368f [INT-935] docs(intent): align README badges/metrics, migrate internal...
• be678c8 [SUB-1801] feat(verify): enforce Mermaid syntax and orphan-state guards in...
• d507932 [INT-938] docs(intent): codify sentinel shell parsing, mneme locality,...
• 20ba446 [SUB-1810] chore(release): add canonical CHANGELOG.md and GoReleaser notes...
• f9029f3 [SUB-1806] feat(session,mem,hook): harden sentinel shell parser, mneme...
• 379a6ef [INT-942] docs(specs): codify Ruby Tree-sitter AST query, heredoc...
• 416e176 [SUB-1819] feat(verify): add Ruby Tree-sitter AST query, Rails...
• f09c00b [SUB-1829] chore(release): v4.9.0 - Ruby AST Gating, Shell Tokenizer & Flat...

Full Changelog: v4.8.0...v4.9.0

v4.8.0

Verified Host/Tool-Health Snapshots, Receipt-Trace Parity, Configurable Model-Profile Advisories & Terminal-Bench 2.0 Harbor Results (Apache 2.0)

Verified Host-Health Snapshots & Receipt-Trace Parity (nomos hook, nomos task sync)

• Session-Start Host & Toolchain Snapshot: Captures deterministic host and language-toolchain health diagnostics on SessionStart without external network probes or global state mutation.
• Graceful 2PC Receipt-Trace Parity: Seals hook-trace provenance into refs/notes/nomos/releases receipts during nomos task sync with deterministic fallback when tasks execute outside ambient hook wrappers.

Configurable Model-Profile Advisory Thresholds (nomos hook post-tool, nomos.yaml)

• Per-Model Turn & Churn Calibration: Adds configurable model-profile advisory thresholds in nomos.yaml and nomos.schema.json so high-autonomy frontier reasoning models and local MoE models receive calibrated checkpoint guidance without false-positive interruptions.

Empirical Benchmark Publication (Terminal-Bench 2.0)

• 89-Task Harbor Cleanroom A/B Evaluation: Publishes full containerized A/B benchmark artifacts (42.7% -> 51.7%, +9.0 pp, 38 -> 46 solved tasks, zero regressions across 38 baseline passes).

---

Changelog

• 8a18449 [SUB-1771] fix(verify,mneme): anchor Go test fail window and dedup paired...
• 98357d7 [INT-929] docs(specs): codify hook host-health snapshots and sync...
• d3e0cfd [SUB-1776] feat(hook): add verified host-health snapshots and sync...
• 7763d71 [SUB-1781] docs(readme): publish Terminal-Bench 2.0 89-task Harbor A/B...
• 9750ff3 [INT-930] docs(specs): codify configurable model-profile advisory...
• e94e91e [SUB-1790] feat(hook): add configurable model-profile advisory thresholds
• 653cd01 [SUB-1791] chore(release): v4.8.0 - Verified Host Health, Receipt-Trace...

Full Changelog: v4.7.0...v4.8.0

v4.7.0

Self-Cleaning Nomos Mneme, Binary Context Guard, Interactive Hang Guard & Session Budget Radar (Apache 2.0)

Self-Cleaning Nomos Mneme & Recurrence-Aware Graduation (nomos mem, nomos handshake)

• Per-Task Reinforcement Deduplication & Read-Only Recall: Deduplicates active task handshake reinforcement to at most +1 per (task_id, memory_id), marks interactive nomos mem recall read-only, and gates built-in Tier-C AST graduation candidates on true cross-task topic recurrence (>= 2).
• Symbol-Delta Fixes, Unscoped Cooling & Active-Default nomos mem list: Prepends refactored file and verified symbol inventories into distilled Verified Fix entries, cools single-occurrence pitfalls older than 14 days out of unscoped handshakes, and defaults nomos mem list to active records with --status.

Execution Hygiene & Context Protection (nomos hook pre-tool, nomos hook post-tool)

• Binary Read Guard & Interactive Hang Guard: Blocks accidental full-file reads of binary/archive/sqlite blobs before context saturation and intercepts unflagged interactive CLI prompts (apt-get install without -y, unpaged git log, interactive editors) before session hangs.
• Session Budget Radar: Surfaces deterministic step-budget consumption advisories in PostToolUse before lease exhaustion.

---

Changelog

• 5654bc6 [INT-925] docs(specs): codify binary read guard, hang guard, and budget radar
• 50ca77e [SUB-1764] feat(cli): add binary read guard, hang guard, and session budget...
• f7fc0af [SUB-1765] chore(release): v4.6.0 - Binary Context Guard, Hang Guard &...
• 217605d [INT-926] docs(mneme): codify per-task reinforcement deduplication and...
• 4c9913f [SUB-1766] fix(mneme): deduplicate per-task reinforcement and synthesize...
• f4269ea [INT-927] docs(mneme): codify unscoped pitfall cooling and active-default...
• f8a3fa9 [SUB-1768] fix(mneme): cool stale unscoped one-off pitfalls and default mem...
• eec6a3f [SUB-1769] chore(release): v4.7.0 - Self-Cleaning Mneme, Binary Context...

Full Changelog: v4.5.2...v4.7.0

v4.5.2

Legal Notice Packaging, SecretGate Cache Pruning & 42-Gate CI Release Pre-Flight (Apache 2.0)

Legal Notices & Distribution Hygiene

• Statutory Apache-2.0 Packaging: Bundles NOTICE, THIRD_PARTY_NOTICES.md, and the verbatim SPDX Apache-2.0 appendix across GoReleaser archives and updates uninstall.sh for clean NOMOS_HOME removal.
• SecretGate & Release Pre-Flight Hardening: Prunes gitignored framework build caches during secret scans, enforces word-bounded credential regexes, aligns Cell 2.3 deterministic gate proofs, and runs full 42-gate CI pre-flight verification prior to release cuts.

---

Included v4.5.0 Milestone Features

Container Sandbox Anti-Reward-Hacking Hooks, Configurable Intent Twin Mode & Zero-Footprint Telemetry (Apache 2.0)

Container Sandbox Benchmark Mode (nomos hook --container-sandbox)

• Runtime Anti-Reward-Hacking Guard: Physically blocks reads, writes, and shell commands targeting protected benchmark verifier and oracle paths (/logs/verifier, /solution, /tests) while permitting full-container OS sysadmin operations (/etc, /tmp, /var, sqlite3).
• Zero-Footprint Container Execution: Skips global SQLite telemetry initialization during nomos hook and nomos version invocations so disposable evaluation containers remain 100% free of global state.

Configurable Bilateral Intent Twin Enforcement (intent_twin_mode)

• Opt-In Spec-vs-Code Twin Policy: Adds intent_twin_mode (off, feat, strict) to nomos.yaml and nomos.schema.json, defaulting to off for friction-free solo adoption while enabling feat or strict bilateral INT-*/SUB-* pairing on team and regulated repositories.

---

Changelog

• 5118e3d [INT-917] docs(spec): align Cell 2.3 with deterministic mathematical gate proof
• 8ca8395 [SUB-1728] refactor(verify): align cell_2_3 and REVIEW directives with...
• a23f783 [SUB-1735] fix(verify): skip gitignored build dirs and bound secret regexes
• 2f5fed0 [INT-920] docs(intent): harden open-core legal notices, DCO provenance, and...
• 23ce0b1 [SUB-1741] feat(legal,cli): harden open-core legal notices, DCO, and clean...
• 4667e50 [INT-922] docs(specs): purge sovereign UI spec bleed and link arXiv:2610.32285
• 0fbf732 [SUB-1744] fix(ci,cli): resolve release, uninstall, module, and boundary...
• b22cc32 [SUB-1753] chore(release): v4.5.2 - Legal Notices, SecretGate & Release...

Full Changelog: v4.5.1...v4.5.2

v4.5.1

Native Gemini CLI (BeforeTool / AfterTool) Hook Protocol Parity for Harbor Benchmarks (Apache 2.0)

Multi-Agent Hook Protocol Normalization (nomos hook pre-tool, nomos hook post-tool)

• Native @google/gemini-cli Hook Parity: Distinguishes Gemini CLI BeforeTool and AfterTool JSON hook payloads from Claude Code PreToolUse / PostToolUse events, emitting canonical {"decision":"allow"|"deny","reason":"..."} responses on BeforeTool and {"hookSpecificOutput":{"additionalContext":"..."}} diagnostics on AfterTool.
• Directory & Search Path Target Extraction: Inspects dir_path arguments across list_directory, glob, and search_file_content so directory scans targeting protected Harbor verifier or oracle paths (/logs/verifier, /solution, /tests) are deterministically blocked in --container-sandbox mode.

---

Included v4.5.0 Milestone Features

Container Sandbox Anti-Reward-Hacking Hooks, Configurable Intent Twin Mode & Zero-Footprint Telemetry (Apache 2.0)

Container Sandbox Benchmark Mode (nomos hook --container-sandbox)

• Runtime Anti-Reward-Hacking Guard: Physically blocks reads, writes, and shell commands targeting protected benchmark verifier and oracle paths (/logs/verifier, /solution, /tests) while permitting full-container OS sysadmin operations (/etc, /tmp, /var, sqlite3).
• Zero-Footprint Container Execution: Skips global SQLite telemetry initialization during nomos hook and nomos version invocations so disposable evaluation containers remain 100% free of global state.

Configurable Bilateral Intent Twin Enforcement (intent_twin_mode)

• Opt-In Spec-vs-Code Twin Policy: Adds intent_twin_mode (off, feat, strict) to nomos.yaml and nomos.schema.json, defaulting to off for friction-free solo adoption while enabling feat or strict bilateral INT-*/SUB-* pairing on team and regulated repositories.

---

Changelog

• 47f1489 [INT-914] feat(cli): add native Gemini CLI BeforeTool and AfterTool hook...
• 1d04838 [SUB-1720] feat(cli): add native Gemini CLI BeforeTool and AfterTool hook...
• c1dc139 [SUB-1723] chore(release): v4.5.1 - Native Gemini CLI Hook Parity for Harbor

Full Changelog: v4.5.0...v4.5.1