v2026.8.3

Added

Changed

• Set the default Pi driver to openai-codex/gpt-5.6-luna with max reasoning while retaining Sol, Terra, and Luna in the model selector (#700).
• Release every push to main or master only after validation, using retry-safe UTC CalVer reservations, immutable CalVer/sha-<full-SHA> GHCR tags, canonical-branch digest promotion for latest, gated CLI publication, and post-image GitHub Release finalization (#689).
• Expose the supported GPT-5.6 variants in Pi's model selector (#684).
• Expand Advisor planning with a designer lens and make implementation/PR prompts explicitly finish with delegated audits and retrospectives (#680).

Fixed

• Stop the cron reaper from reading a git status failure as evidence of uncommitted work. inspectFallbackWorktree returned dirty: true whenever git status --porcelain exited non-zero, so a worktree directory whose .git/worktrees/<name> admin entry had vanished was preserved as "needs manual salvage" on every single fire — 15 consecutive days for cron-prompt-miner-0718-0500, which also eroded WORKTREE_DIRTY's value as a triage signal by burying any real one under identical noise. Adds a distinct WORKTREE_ORPHANED outcome that removes the directory (git worktree remove fails once the admin entry is gone, and git worktree prune handles only the inverse case). The orphan is identified structurally — a .git file whose gitdir: target no longer exists — rather than by matching git status stderr, which is locale-dependent; every other status failure still preserves the worktree, since it cannot be shown that there is nothing to salvage (#694).
• Resolve the prompt-miner daily-log write root to the main worktree instead of the ephemeral one. render-log-entry.sh used git rev-parse --show-toplevel, which under the cron's worktree: true returns the linked worktree — so every Step 5 log entry was written into .oh/worktrees/cron/<session>/ and destroyed when the runtime reaped it (fired 07-10, 07-14, 07-19, hand-recovered each time). Adopts the AUTOPILOT_LOG_ROOT → CRON_WORKTREE → toplevel resolution already proven at .oh/crons/prompt-miner.md:102 and documented at .oh/crons/README.md:120, preserving precedence for callers that do export the variable. Guarded by prompt-miner-log-root-worktree.sh, which builds a real linked worktree and asserts the entry lands in the main one — a fixture test cannot catch this class of bug (#693).
• Make prompt-miner able to mine a marker at all, and stop it mining a wrong one. Three changes: (1) withinWindow now admits a session whose activity span overlaps the window instead of one that starts inside it — events are merged across resumed files by sessionId, so a long-lived session kept its original firstTs and vanished from a windowed query despite being worked in continuously; (2) subagent (isSidechain) turns are excluded from every signal — they carry the parent's sessionId and role: "user", so a delegate briefing was counted as a human turn, and at 45,167 sidechain vs 42,679 non-sidechain lines this corrupted correctionDensity/turnBloat/toolErrorRate for precisely the delegating sessions most worth mining; (3) the daily cron's window is decoupled from its cadence (--hours 24 → --hours 336), because the marker gate needs ≥10 sessions in one stratum and a 24h corpus cannot supply that. Largest stratum by window, measured live: 24h → 4, 168h → 6, 336h → 18. The engine's hardcoded single project directory is deliberately not changed — the 23 directories it would add are this cron's own worktree sessions, whose first prompts have one distinct length and two distinct hashes, so they would cross the corpus floor while being incapable of producing a marker (#692).
• Make the prompt-miner engine run when invoked through the .claude/skills directory symlink that SKILL.md Step 1 and the daily cron both prescribe. Node resolves symlinks for import.meta.url but not for process.argv[1], so the old entrypoint guard silently no-opped — exit 0, zero stdout, nothing written — and both existing prompt-miner probes hardcode the real .oh/ path, leaving them structurally blind to it. Swaps in the symlink-safe basename guard already used by rlm and weigh, and adds prompt-miner-symlink-entrypoint.sh, which invokes the engine through a real symlink and rejects the comparison — in either operand order — on any executable line under .oh/skills/**/*.mjs. Does not change the NO-CORPUS outcome — see #692 (#663).
• Index .oh/docs/rfcs/rfc-runtime-support.md from .oh/docs/README.md, which had left a quarter of the RFC/ADR corpus unreachable from the index humans enter through, and repoint the dangling .claude/rules/ context bullet in the critic and implementer agents at .oh/context/IDENTITY.md — that directory was removed by the B-state M4 rules collapse (#686).
• Make Slack bridge admin commands discoverable and functional by declaring /help, /trusted, /channels, /enable, /disable, /revoke, and /toggletools in .pi/install/slack-manifest.json, pinning bridge-side Socket Mode command handlers, and separating Slack commands from Pi's /msg-bridge surface in docs (#354).

Removed

Deprecated

Security