v0.4.3 — rigs that survive

OpenRig v0.4.3

Summary — "rigs that survive"

OpenRig v0.4.3 makes rigs actually survive. Crash the daemon or the whole
machine — turn the power off, not a graceful stop — and on reboot the
seats come back to their original sessions, with their pre-crash
markers recalled, zero fresh-prime. The proof is a real hard power-off
capstone (Tart stop --timeout 0 → reboot → rig start → both Claude
and Codex seats resumed to their originating conversations). This is the
load-bearing "rigs that survive" claim.

Alongside the survival backbone, the release ships the deny-by-default
rig send reversal: needs_input (an actual interactive picker) is
now the only hard send-refuse; unknown / stale / missing / busy all
advise-and-send. The 0.4.1 3-layer guard was too strict in practice —
0.4.2 hotfixed the daemon-status probe, and 0.4.3 corrects the send-guard
posture so peer coordination no longer needs a --dangerously-interact
bridge for routine sends. The genuine prompt block still stands.

Wave-2 UI lands rig-status + launch-control on the workspace, a
switch-client view-retarget, and a real theming system (Vellum Dark
opt-in; light stays byte-identical). Seat-handover full-cycle + seat-
forking closeout complete the recovery story. Doctrine ships too:
mission-slice-sop skill.

Existing v0.4.2 databases upgrade by running rig daemon start on the
new daemon. Migrations 045, 046, and 047 are additive.

Survival — the load-bearing set

• Crash-restore resume-token ledger (FR-3 → FR-7) — the seat's
  resume marker is captured on adoption (FR-3), refreshed on snapshot
  (FR-4), pinned to a restore target (FR-5), freshness-gated with a
  1-hour advisory threshold + --fresh re-verify (FR-6 + FR-6.1
  periodic re-stamp), and — critically — the restore path never
  silently fresh-primes a seat that had a resume marker (FR-7). Prior
  to FR-7, a restore that couldn't reach the token would degrade to a
  fresh-prime, losing the original session identity; that silent
  degrade is now eliminated.
• Fixture-home isolation guard — a fresh-prime that would have
  clobbered a live rig's home dir is refused loudly, not silently
  swallowed.
• Liveness PID-verify — the daemon distinguishes a live seat from a
  dead-PID ghost by verifying the process actually exists before
  labeling the seat running.
• Daemon event-loop health + terminal broker resilience — the
  daemon publishes an event-loop-latency health signal; the
  TerminalSessionBroker recovers cleanly across daemon restarts.
• Startup-proof — a seat proves it actually read its orientation
  material rather than skipping past it; a challenge-verified read
  path.
• Seat-handover full-cycle — an outgoing seat can hand its captured
  context to a fresh successor; the resume marker carries automatically
  via FR-3; the loud-unwind path fires on both lanes when handoff
  fails.
• Seat-forking closeout — the fork lifecycle terminates cleanly on
  the shared checkpoint; predecessors and successors are named + wired.

The deny-by-default reversal (rig send)

The 0.4.1 3-layer guard was too aggressive at the fleet level: unknown /
stale / missing / busy activity signals all default-blocked, which
required constant --dangerously-interact --reason "..." overrides for
routine peer coordination. 0.4.3 corrects this:

• needs_input (a real interactive picker rendered on the target
  pane) is the only hard send-refuse. The guard here is unchanged
  behavior at the actual footgun-point.
• Unknown / stale / missing / busy now advise-and-send rather
  than block. Peer sends land; the operator sees the advisory in the
  send output.
• --dangerously-interact --reason "..." override still exists for
  intentionally driving a prompted seat, unchanged.

Also improved: Codex activity-signal hardening — an idle Codex seat
now takes normal sends; the genuine prompt block still holds; hook-trust
autoclear lands as a fast-follow so a restored Codex seat clears its
attention-gate on restore.

rig send unified targeting

rig send grows explicit multi-recipient targeting — a recipient list +
--pod + --rig — reusing the existing broadcast fan-out + per-
recipient guard. Backward-compatible: single-recipient send is
unchanged.

Wave-2 UI + theming

• Rig-status + launch-control UI — the workspace surface for
  starting / stopping / recovering a rig lands. Combines the topology
  view with a launch modal for mixed-plan rigs.
• Switch-client view-retarget — clicking through a switch-client
  action lands the operator on the correct target view without a stale
  breadcrumb.
• Dashboard theming — Vellum Dark opt-in — a real theming
  primitive: light is the existing :root theme (byte-identical),
  dark is the first shipped alternate, and the substrate scales to
  N themes via the token-block + registry entry. Uses Tailwind
  darkMode: 'selector'. Light is unchanged.

Recovery + operator-UX

• Idle-gate watchdog — an idle seat holding a claimable gate qitem
  gets woken with a bounded skip-recording so the queue doesn't back up
  behind a dormant seat.
• Session-admin mutation auth-guard — the admin mutation surface is
  no longer reachable without the correct auth posture.
• rig queue show bounded body preview — long queue-item bodies
  are truncated in the show view; the full body remains inspectable via
  the queue-item drawer.
• Manual configurable compaction trigger + same-seat guard —
  Claude Code seats can be prompted to compact from outside the seat;
  the trigger refuses a same-seat mutation.
• Secret-boundary B1 hardening (rig auth) — the rig auth
  secret boundary now opens the fd first + operates on the fd never
  re-resolving the path, closing the check-then-use gap for
  interruption / concurrent-legitimate-rig-process scenarios (the
  TOCTOU class is closed as a consequence). The rig auth file is a
  real credential; leak-hunt is real security, not theater.

Doctrine + fast-follow

• mission-slice-sop skill ships — the per-file rules for
  PROGRESS.md / PROOF.md / MISSION_NOTES.md / MISSION_BRIEF.md /
  README.md, the SCAFFOLD/POPULATE/PROJECT/VERIFY lifecycle,
  hot-potato queue handoffs, and the rig scope audit backstop.
• Hook-trust autoclear (fast-follow) — a restored Codex seat that
  hits its attention_required VM-local hook-trust gate now auto-clears
  the attention on the restore path, mirroring slice-10, for
  fully-unattended Codex restore.

Behavior + Compatibility

• Migrations — additive only. 045_resume_verification,
  046_seat_identity_verdicts, 047_events_node_type_index land in
  this release. Existing v0.4.2 databases upgrade by running
  rig daemon start on the new daemon.
• rig send default posture change — unknown / stale / missing /
  busy activity signals no longer default-block; only needs_input
  does. If you were relying on the 0.4.1 default-block posture, add an
  explicit guard on your call sites; the intent-signaling for peer
  coordination now lives in the fleet-standard advise-and-send path.
• rig send grammar — multi-recipient list + --pod + --rig
  are additive; single-recipient calls are unchanged.
• Cosmetic Project surface — Dashboard theming is opt-in via the
  UI toggle; light theme is byte-identical.

Known Follow-ons

• Slice-04 real-provider handover VM-marker — code proven at
  runtime (unit + integration + loud-unwind both lanes); the real-
  provider end-to-end VM-round-trip is a fast-follow proof capture
  (VM-env limitation on prior provider auth). Not a claim gap; the
  load-bearing survival proof is the crash-restore capstone.
• rig ps consolidated-default + progressive disclosure — captured
  for 0.4.4 (token-efficient-defaults family evolution).
• Deploy-identity: git SHA via /healthz + rig --version — the
  version-truth-vs-commit-truth observability gap (captured for 0.4.4
  Discovery).
• Managed-hooks-via-requirements.toml — the robust structural
  hook-trust re-arch (later fast-follow).
• Skill-layer cut depth (slice-25) — awaits a decision on the
  load-bearing skill set; deferred.
• Dashboard glyph swap (slice-24) — awaits icon pick; deferred.

See Also

• CHANGELOG.md — the standard changelog entry for 0.4.3.
• docs/releases/v0.4.2.md — the prior release (daemon-status hotfix).
• docs/releases/v0.4.1.md — the workspace observability overhaul.