v0.13.6

Agentic Harness v0.13.6

Version 0.13.6 closes verifier and managed-GUI trust-boundary gaps found during
maintainer review with automated, adversarial, and AI-assisted testing. It is
not a claim of an independent security audit or completed external beta.

Verifier boundaries fail closed

• Requires explicit review.assets for npm test, pnpm test, yarn test,
  and bun test, so freezing a package manifest cannot silently trust a
  mutable delegated script.
• Freezes membership for standard Maven and Gradle test trees and repository
  directories named directly in verifier commands.
• Treats dotnet test as an evaluated MSBuild boundary that cannot be inferred
  safely from filenames. It now requires explicit review.assets covering the
  selected test projects, source directories, imported build files, and other
  repository-controlled inputs.
• Adds adversarial regressions for modified package scripts and
  candidate-added test sources.

Managed GUI request integrity

• Keys persisted GUI sessions by the canonical controller documentation root,
  canonical local-goal executable, current OS user, and selected project.
  Stored state with a different identity is rejected.
• Makes task status viewing and WebSocket streaming observation-only. Progress
  remains the responsibility of the configured background supervisor.
• Gives each managed GUI start a cryptographically random request ID and binds
  the objective, route, work area, verification, model profile, and supervision
  selections into the created controller ticket before accepting the start.
• Requires every cloud-build and audit enqueue to return an authoritative queue
  ID, retains that ID as the GUI-owned task identity, and refuses to adopt or
  send guidance to a different active task.
• Rejects model-profile attachment receipts that say only attached: true
  without identifying the run that owns the attachment.
• Uses one credential-preview denylist in both embedded and managed GUI paths,
  including common cloud, OAuth, service-account, vault, Docker, secrets-file,
  and private-key filenames. Permitted text is redacted in native form before
  JSON response serialization, including quoted JSON credential fields.

Compatibility

Custom package-manager checks that previously relied on inferred
package.json coverage must add their delegated verifier files and dependency
directories to review.assets. dotnet test configurations must declare their
evaluated repository input closure explicitly. Existing managed GUI session
files are not loaded across a different controller workspace identity.

v0.13.5

Agentic Harness v0.13.5

Version 0.13.5 fixes a Home-screen state conflict that could make a ready
installation feel stuck on an older completed task.

Ready means a new task can start

• Keeps Home open when installation readiness says a new task can start.
• Stops an older pinned review result from repeatedly pulling the user back to
  Tasks after navigation, refreshes, or live status updates.
• Removes the blocking recovery card for an older result when the installation
  is ready, while retaining that result in Tasks and History.
• Continues to open the current task and block a new start when readiness
  truthfully reports that review or repair is required.

Compatibility

This patch preserves foreground task ownership, readable results, fragment-only
task deep links, route receipts, and the managed-task API. It only changes
whether an older foreground result is treated as a blocker when the global
readiness contract says can_start: true.

v0.13.4

Agentic Harness v0.13.4

Version 0.13.4 turns the guided GUI recovery work into one consistent public
release. It keeps the user's task and readable result in the foreground,
reports the route that actually ran, and stabilizes supervised local starts.

Foreground task ownership

• Keeps the task started by the user pinned while background maintenance and
  qualification work continue separately.
• Restores the pinned task after a refresh and loads its full readable result
  directly in the Tasks view.
• Prevents internal qualification canaries from replacing a completed user
  task or its review actions.
• Supports task deep links through a fragment-only #task=<id> reference,
  avoiding authentication or task identifiers in request query parameters.

Observed route receipts

• Reports the builder, model, reviewer, fallback state, and route identity from
  validated run evidence instead of presenting only the requested route.
• Preserves reviewer evidence across managed continuations and reports a real
  reviewer fallback when an earlier reviewer failed.
• Gives accepted results precedence over older intermediate review state.

Supervised local starts

• Starts GLM advisory supervision only after the local goal exists, eliminating
  the startup gap where the supervisor could exit before seeing the task.
• Rolls back a newly started goal if requested supervision cannot be started
  and verified.
• Preserves explicit route metadata through start, continuation, review, and
  foreground result presentation.

Compatibility

This patch release preserves the existing GoalSpec, evidence-v2, assurance,
and managed local-goal contracts. The route receipt remains additive, and the
fragment deep link only affects optional browser navigation.

v0.13.3

Agentic Harness v0.13.3

Version 0.13.3 makes managed model routing explicit and makes the GUI
understandable without a separate expert explaining the harness lifecycle.

Managed model routing

• Adds canonical route identities for local build, Turnstone GLM plus local
  build, cloud GLM build, and direct GLM read-only audit.
• Rejects stale or mismatched route identities before external dispatch.
• Adds optional GLM-5.2 advisory supervision for local builds, including live
  start/status verification and rollback when task start fails.
• Enables the distinct GLM read-only audit contract while keeping direct GLM
  implementation blocked.
• Preserves MiniMax as the generic cloud automation default and Kimi as its
  bounded fallback; explicit GLM routes remain separately pinned.

Guided task lifecycle

• Adds an in-app guide that translates starting, working, checking, review, and
  attention states into plain language and a single recommended next step.
• Makes quiet background execution explicit so a temporarily still screen does
  not look like a stopped worker.
• Presents needs_review as Your result is ready and explains that the
  assistant stopped safely rather than crashed.
• Shows the worker's result summary and evidence counts before asking the user
  to make a decision.
• Replaces harness-oriented decisions with Review result, Ask for
  changes, Approve and finish, and Stop without approving.
• Describes the interactive worker as “the assistant” instead of assuming that
  a new user knows which coding application is underneath the managed route.

Honest completion expectations

• Warns before starting audits, assessments, ratings, reports, and other
  judgment tasks that the user will review the result.
• Describes other tasks as using automatic checks when possible, while retaining
  fail-closed human review when no reliable verifier can be established.
• Keeps the guide deterministic: it can explain a worker result, but it cannot
  approve that result or weaken independent verification.

Compatibility

This release does not change GoalSpec, evidence-v2, assurance-mode, amendment,
or managed local-goal contracts. Existing API consumers receive one additive
guide object and clearer labels on the existing action identifiers.

v0.13.2

Agentic Harness v0.13.2

Version 0.13.2 is a security and crash-consistency update for Verified Best-of-N.

Security and correctness fixes

• Freezes verifier-sensitive paths that were absent before candidate execution,
  preventing candidate-added pytest.py, pytest.ini, conftest.py, runner
  definitions, and equivalent ecosystem files from weakening acceptance.
• Freezes protected directory membership so new test definitions, build files,
  or symlinks cannot enter the verifier boundary unnoticed.
• Starts Python -m pytest and -m unittest checks in safe-path mode to prevent
  repository-root module shadowing at interpreter startup.
• Requires repository-local custom verifiers to declare review_assets; declared
  directories freeze both their contents and membership.
• Reconciles a durably verified tournament after GUI restart only when the
  GoalSpec, final review, commit, and applied workspace fingerprint all match.
  Divergent state remains blocked.

Managed GUI recovery

• Preserves the managed runtime's needs_attention state instead of flattening
  it into a generic blocker.
• Shows clear Continue, Stop safely, and Open current task decisions when an
  interrupted task prevents new work from starting.
• Keeps recovery scoped to the task. The browser does not receive authority to
  start or enable host background services.
• Retains the supervised OpenCode conversation and independent verification
  boundary while the user guides or resumes work. Conversation state follows a
  managed continuation only when its bounded, no-follow ticket explicitly
  names the prior sibling run; unrelated runs fail closed without inheriting
  task guidance.
• Binds a successful local GUI start to the exact harness ticket and requested
  completion criterion. If another client wins the local-lane race, the GUI
  rejects the start instead of attaching the pending objective or guidance to
  that other task.
• Forwards every Mode 1 completion check to quick-start as a preregistered
  verification command, so the independent reviewer receives the same frozen
  checks the user configured in the GUI. The requested objective is also the
  managed ticket title and done criterion, keeping evidence mapping bound to
  the user's task instead of a generic placeholder.
• Stores the managed GUI conversation and ownership ledger under the operator's
  state directory (XDG_STATE_HOME, or ~/.local/state) instead of inside the
  worker-controlled project. Existing in-project GUI session metadata is not
  imported automatically; set AGENTIC_HARNESS_GUI_SESSION_PATH explicitly
  only when a legacy state file is trusted and migration is intentional.

Compatibility

Verified Best-of-N configurations that use a repository-local custom verifier
must declare the complete repository-controlled dependency boundary with
review.assets or top-level review_assets. Built-in supported ecosystem
commands continue to infer their standard verifier boundary automatically.

v0.13.1

Agentic Harness v0.13.1

Version 0.13.1 is a security and correctness update for Verified Best-of-N.
Version 0.13.0 should not be used for unattended tournament acceptance because
repository-controlled verifier inputs could be omitted from its frozen asset
boundary.

Acceptance-integrity fixes

The enforced invariants and non-goals are recorded in the
verified tournament threat model.

• Freezes repository-local executables in command argument zero, including
  direct checks such as ./verify.sh.
• Freezes verifier definitions for Go, Maven, Gradle, .NET, and RSpec in
  addition to the existing Python, JavaScript, and Rust definitions.
• Adds review.assets / review_assets for custom verifier dependency
  boundaries and refuses a tournament when the boundary cannot be inferred.
• Rejects lexical verifier symlinks, symlinked parents, and Windows reparse
  points before resolution and repeats those checks in every candidate.
• Runs final verification in a fresh worktree, fingerprints the full tracked
  and non-ignored project state, and blocks if verification changes that state.
• Records a verified-staged and applying-verified transaction phase before
  touching the original workspace. GUI recovery restores the clean preimage
  after an interrupted application when the recorded state still matches.
• Publishes deep-copied progress snapshots so presentation callbacks cannot
  mutate tournament decisions.

Configuration safety

• CLI init, quickstart, and init-agent writes reject symlinked or
  reparse-point project configuration paths, including dangling links and
  --force replacement.
• Configuration files are written through an owner-only temporary file and
  atomically replaced only after the destination is confirmed as a regular
  file.

Compatibility

• GoalSpec, evidence-v2, assurance-mode, and amendment schemas are unchanged.
• Known test runners continue to work without additional configuration.
• Custom or opaque verifier runners must declare review.assets; this is an
  intentional fail-closed requirement for Verified Best-of-N only.

v0.13.0

Agentic Harness v0.13.0

Version 0.13.0 adds fail-closed, verified multi-approach execution and an
official Grok Build worker profile without weakening the v0.12 assurance
contracts.

Verified Best-of-N

• Adds agentic-harness best-of-n and the equivalent
  verified-best-of-n alias for two to ten concurrent candidates.
• Runs every candidate from the same commit, immutable GoalSpec, and frozen
  verification command set in an isolated Git worktree.
• Hashes pre-existing verifier inputs and disqualifies candidates that alter
  them, even when the altered check exits successfully.
• Selects only from independently verified non-empty patches, applies the
  smallest verified patch deterministically, and runs the same checks again in
  the original workspace.
• Rolls back the applied patch and reports blocked if final verification fails,
  errors, or cannot be preserved durably.
• Stores private, checksummed candidate patches and a versioned tournament
  receipt under .agentic-harness/tournaments/.

GUI

• Adds a plain-language Implementation approaches choice to the embedded
  GUI: one approach for speed or three verified approaches for stronger search.
• Runs tournaments in the existing background task lifecycle with cooperative
  stop behavior, durable progress, recovery that fails closed after an
  interrupted process, and a final result backed by the tournament verifier.
• Shows the number of approaches and winning candidate in public task evidence;
  managed external routes remain single-approach unless their own contract
  explicitly supports tournaments.

Grok Build

• Adds agentic-harness init-agent grok and a Grok Build Settings option.
• Uses Grok Build's documented headless grok -p interface with plain output,
  bounded turns, automatic updates disabled, and its OS-enforced workspace
  sandbox.
• Denies git push and sudo shell commands in the starter profile. Grok
  still owns its credentials and provider traffic, and headless edits require
  bypass permissions inside the bounded workspace; this is not a local-only
  execution path.

Compatibility and assurance

• No GoalSpec, evidence-v2, assurance-mode, or amendment schema changes.
• Existing single-worker CLI and GUI paths retain their prior behavior.
• High-assurance tournament specification approval remains explicitly blocked
  rather than silently downgraded.
• Git worktrees isolate candidate changes but are not a general security
  boundary for arbitrary external agents. Use each agent's supported OS sandbox
  and review its tool policy.

v0.12.0

Agentic Harness v0.12.0

v0.12 makes completion conditions a harness-owned, immutable contract rather
than a worker-owned interpretation.

Assurance contract

• Derives stable completion conditions from explicit lists, sentence boundaries,
  and imperative action series before the first worker cycle.
• Preserves ambiguous objectives intact instead of guessing at a decomposition.
• Keeps check-gated, specification-frozen, and high-assurance guarantees separate
  from Quick, Standard, and Thorough execution effort.
• Requires typed, current-run evidence with predeclared requirement coverage.
• Resolves covers: ["*"] to concrete frozen IDs before issuing evidence.
• Lets high-assurance operators review or edit conditions before execution.
• Supports operator-approved mid-run amendments as immutable revisions with new
  hashes and explicit invalidation of evidence tied to the previous revision.
• Reconstructs task-event evidence from harness-owned fields. A coding worker
  cannot promote a workspace event to verified, change its issuer, or grant it
  requirement coverage by editing serialized event JSON.
• Makes omitted review coverage fail closed. Project files must declare
  review_covers; generated starter profiles and the GUI write an explicit
  covers: ["*"] only when the user chooses an all-condition project check.

Product and reliability

• Adds an editable plain-language approval dialog for initial and amended
  high-assurance specifications.
• Removes URL credential ingestion, supports environment-referenced GitHub
  credentials, and keeps browser session credentials in memory only.
• Adds frontend checks to CI and preserves cross-origin JSON errors on Windows.
• Binds each GUI specification approval to the reviewed goal ID, GoalSpec hash,
  and revision, preventing a stale dialog from approving a replacement task.
• Rejects cross-origin requests before reading their bodies and closes the
  connection, so partial request bodies cannot occupy handler threads.
• Makes GitHub Actions wait mode require a dispatch response containing a run
  ID or run URL. It no longer guesses from a concurrently changing workflow list.
• Tolerates files that disappear during concurrent workspace snapshots.
• Splits assurance UI, specification amendment, CLI assurance, reporting,
  autonomy support, and GUI authentication responsibilities into focused modules.

Verification target

The release gate runs the complete Python suite, Ruff, strict mypy, Python
compilation, frontend syntax and behavior checks, package build/install smoke,
and the GitHub matrix on Linux, Windows, and macOS with Python 3.11 through 3.14.

Compatibility

• LocalLLMAdapter remains importable but deprecated. New integrations should
  use the structured model_agent worker.
• github_token remains readable only as a legacy migration path. New and
  updated configuration should use github_token_env; the GUI does not offer a
  plaintext GitHub-token field.
• GoalSpec v1, evidence v2, assurance-mode names, and amendment contracts are
  unchanged by these correctness fixes.

v0.11.0

Agentic Harness v0.11.0

v0.11 turns the browser interface into a clearer product for first-time users
without changing its fail-closed execution contract.

Product clarity

• Home uses plain-language task starters, work-area and completion-check labels,
  and friendly execution names. Backend mode identifiers remain available in
  Advanced details and diagnostics.
• The execution summary never invents a fallback. Unavailable local, mixed, or
  cloud routes remain disabled with a concrete reason.
• Tasks retain the trusted Outcome, What changed, and Independent verification
  hierarchy. History adds status and route filters plus evidence-oriented cards.

Guided setup

• Settings now presents a visible Choose, Connect, Verify journey.
• Fixed-loopback discovery still supports Ollama, LM Studio, vLLM, and llama.cpp,
  including multiple-model selection and a required structured-action test.
• Setup and recovery states use specific guidance while invalid or symlinked
  configuration remains read-only and fail-closed.

Refined workbench identity

• The linked-workflow mark remains the product identity with a normalized SVG
  control-icon family.
• Three build-time img2img illustrations cover local connection, recoverable
  setup, and verified evidence/archive states. They are optimized, packaged,
  self-contained WebP assets with recorded provenance.
• No image generation, external font, CDN, or art service is used at runtime.

Compatibility and correctness

• Managed route keys, backend IDs, legacy aliases, and safety checks are
  unchanged. /api/modes gains additive friendly-name, purpose, location,
  availability, capability, and advanced-detail metadata.
• Managed model profiles expose capability evidence and only report runtime
  context, concurrency, MTP, and quantization facts when the backend supplies
  them.
• agentic-harness selftest uses the running interpreter for its internal
  worker and review processes, so an absolute virtual-environment executable
  works even when its bin directory is absent from the parent PATH.
• The embedded model worker accepts planning context emitted either beside or
  inside report_outcome.arguments, and normalizes plain completed-plan steps
  from structured-output models. The strict completion audit still requires a
  complete claim, verified evidence references, and independent review.

v0.10.0

Agentic Harness v0.10.0

This release turns the self-hosted GUI into a clearer product for new users
while preserving the fail-closed execution, verification, and local/cloud
boundaries required by advanced managed installations.

Predictable product flow

• Home, Tasks, History, and Settings now provide a familiar navigation model
  around one plain-language task field.
• Task effort, execution route, and model profile are separate decisions
  instead of being mixed into one technical mode selector.
• The What to expect summary explains the assistant, execution location,
  change boundary, setup state, and current route availability before work can
  start.
• Local model setup can detect Ollama, LM Studio, vLLM, and llama.cpp on fixed
  loopback endpoints, while discovery remains distinct from a successful
  structured-action connection test.
• Desktop and narrow mobile layouts include clearer unavailable-route reasons,
  keyboard-focus preservation, and updated public screenshots.

Truthful managed routes

• Mode 1 is the selectable local implementation route.
• Mode 2 remains visible as a supervision policy and cannot masquerade as an
  independent start command.
• Mode 3A requires explicit scope plus verified registry, lane, worker, and
  adapter readiness.
• Mode 4 stays unavailable until the backend advertises a distinct audit-only
  dispatch contract.
• Mode 4B and the retired experimental alias cannot reactivate a disabled
  implementation canary.
• Legacy aliases pass through the same current safety checks, and local choices
  cannot silently fall back to a cloud route.

Model-profile and session safety

• Managed Qwen and Ornith starts are serialized across profile inspection,
  activation or restoration, goal start, and run attachment.
• Ornith attachment is checked against the exact started run; uncertain
  attachment or recovery state requires reconciliation instead of inviting a
  duplicate start.
• Managed GUI labels and history survive restarts only when bound to the exact
  durable run identity.
• Persisted GUI state is size-limited, recursively redacted, atomically written,
  hardened to POSIX mode 0600, and rejects unsafe symlink or reparse paths.
• Session credentials remain out of URLs, storage, responses, exports, and
  persisted task state.

Portable setup and verification

• Invalid or unsafe existing configuration fails closed without overwriting
  the user's bytes.
• Automatic project-check detection covers common Python, JavaScript, Rust,
  Go, Java, .NET, and Ruby projects while retaining a technical override.
• Model connections must pass the same structured report_outcome contract
  used by real execution before the workspace becomes ready.
• Release smoke now installs and exercises wheel and source distributions in
  isolated environments without inheriting misleading parent PYTHONPATH
  dependencies.

Release verification

The release gate includes the complete Python suite, frontend race tests,
Ruff, mypy, compile checks, wheel and source-distribution smoke tests, and the
desktop/mobile browser journey defined in docs/RELEASE_CHECKLIST.md.