v0.9.0

Changelog

Added

• With review.mode: critic, the review-thread leg asks the critic once per pull
  request head to sort the unresolved bot threads. It answers and resolves those it
  calls invalid, duplicate or out of scope, quoting the critic's evidence.

• The threads the critic would apply become one round, judged by the touched modules'
  paired tests and the type checker.

• Under review.mode: critic an attempt runs one to three candidates, by the unit's
  size, each in its own worktree. The critic reviews the green ones in a fixed order
  until one passes, and torve why and night show list the candidates.

• A dsh seat's candidate whose battery convicted three tests or fewer, or only mypy,
  gets one more turn in its own session with the gate output before it is judged.

• Each unit that ran through selection writes a unit.closed telemetry record.

• unit: document in a document's phasing.yaml mints one contract for the whole
  document, and is the default for three phases or fewer; unit: phase keeps one
  contract per entry. A whole-document contract's landing completes every phase.

• An agent profile's finish command runs in the sandbox after the agent stops and
  before its tree is judged, for example a formatter's fixes. Its exit status never
  fails the attempt.

• torve abort --claim … --evidence … [--row <id>] stops a task from inside its attempt
  when the rows, the intent and the tests cannot all hold. A halt on a LOCKED row goes
  to the owner; any other goes back to the author as underspecified.

• review.mode: critic reviews a gate-green candidate with the critic: a frozen prompt
  over the diff, the base tree and what the engine measured. The engine blocks on its
  located findings and violated rows, never its stated verdict. classic stays default.

• A gate pass the critic will read writes .torve/review/evidence.yaml: changed tests
  run on the base and the head, a status per owned row, unrun acceptance, edits to
  existing tests, and flags for gaming or text aimed at a reviewer.

• torve review corpus --mode classic|critic replays the corpus through either seat and
  reports whether each case would have blocked. Three cases join: a weak test, a test
  edited to pass, and code that special-cases PYTEST_CURRENT_TEST.

• Upgrade: upgrade every host that shares a store together: a contract 0.9.0 mints
  is version 3, and a night it closes on --passes names a reason 0.8.0 does not know.

• Upgrade: torve init refreshes .torve/schemas/ for version 3 contracts, a phasing
  file's unit, a profile's finish and review.mode. A seat whose harness image names
  {torve} runs the 0.9.0 images the tag's publish workflow builds.

Changed

• A contract row's check runs only when its document completes, on the document branch
  or at the local landing that completes it, never on an attempt or a rebase. Standing
  invariants' checks no longer run in the lane, and a gate manifest's rows key is
  ignored with a warning.

• A task contract's scope is now files, tests, fence and contingent. Only an
  edit inside the fence fails the scope gate or meets the pre-write hook; one outside the
  files and their tests is listed as evidence. Version 2 contracts load for this release.

• torve plan licenses each scoped module's existing paired tests in the contract,
  fences the manifest's scope.deny and the engine's own .torve paths the phase does
  not own, and adds up to ten LOCKED rows of other documents the scope touches.

• The dsh image moves to dsh 0.2.1-rc.5. It now shuts out project instruction files
  and the default skill roots, gives a shell command up to 900 s in the foreground,
  and reports usage and tool calls from dsh's v4 session log.

• A dsh seat's attempt runs as a session the engine drives through dsh's --json
  events, which give its tool calls, their results and each step's usage. A turn past
  the seat's timeout is now killed inside the sandbox instead of left running.

• The context pack carries the files a task changes and their paired tests first and
  whole, in the contract's order, and names its contingent files without carrying them.
  A neighbour that sorted first can no longer push the task's own files out of the
  prompt.

• The context pack no longer carries gates.json, contended.json or coverage counts,
  and a retry is handed only the reds that blocked.

• An attempt is no longer asked for attestation entries: torve log divergence refuses
  decided and resolved, the prompt and AGENTS.md sections name no owed entry, and
  the finish hook runs only the acceptance. Logs written before still read.

• torve log divergence without --attempt files its entries under the attempt the
  engine pinned in the worktree, not attempt 1.

• A review no longer sees what earlier reviews of the same task found: touched.json
  drops prior_reviews, which anchored each review to the last one's reading.

Removed

• torve log owed is gone.

• torve eval and torve shadow are gone, with the eval arms and shadow replays they
  launched. A dispatch no longer refuses an image digest no eval verdict measured.

• torve fleet is gone. Serve each repository with its own torve manager serve; a
  report's default partition is now the configuration's scm.repo, and
  ~/.config/torve/fleet.yaml is no longer read.

• torve serve, the web dashboard and the serve extra are gone.

• torve survey is gone.

• The verify role is gone: torve plan mints no verify tasks, and the torve:verifier
  skill no longer ships. Finish any document planned with the verify pilot on before
  upgrading: its verify tasks no longer load, and the tasks waiting on them never start.

• The mutation, held-out, verify-tests, decisions-reported, self-audit,
  user-facing-text, source-layout, red-on-base and evidence gates are gone. A
  gate manifest entry naming one loads with a warning and is ignored.

• A document's pull request no longer shows the Tests, Check, Survivors and Findings
  columns in its decisions table.

• Standing jobs under .torve/standing/ no longer run, and escalations are no longer
  sent to a webhook.

• The OpenSandbox runtime and the opensandbox extra are gone; runtime.adapter takes
  docker only.

• The mimo, codex and opencode sandbox images are no longer defined or published.

• The configuration keys notify, verify, unmeasured_images, runtime.opensandbox
  and loop.standing_max_per_tick, and a seat on the mimo, codex or opencode harness,
  still load in this release: torve ignores them and warns.

Fixed

• torve why counted only blocker findings as a review's blockers, so a review that
  blocked a candidate on a major finding under review.blocks_at: major read as having
  none.

• The dsh seat's door against AGENTS.md, CLAUDE.md and the default skill roots had
  no effect: it patched keys dsh does not read, so those files reached every attempt.

Security

• The gates read the gate manifest committed at the attempt's merge base, and the
  contract from the root or the store, never from the attempt's worktree. An attempt
  could previously edit both and change which gates judged it. A root edit after the
  cut no longer moves an attempt in flight.

• The gate battery, the lane's included, mounts a cache volume of its own
  (<cache_volume>-<slot>-gates) and a nested Docker daemon's state volume of its
  own. Code a gate ran could previously leave files or images there for the next
  attempt to read.