v1.4.0

This release fixes the eight issues and one hardening point an external audit of v1.3.1 found (F1-F8, H1). The common thread: acceptance: accepted could claim more than its evidence showed, and two runs could share one checkout.

Highlights

• Accepted means the delivered commit was checked. run-checks reports tracked_before and tracked_after (the git status --porcelain --untracked-files=no lines before the first command and after the last). Checks that ran on uncommitted or staged tracked changes, checks that changed a tracked file, and a verify result without those lists now give the reason checks_unclean, so the run is unverified, never accepted. Untracked build output stays a warning. (F1)
• One run per checkout. In git mode scripts/setup takes a checkout lock (checkout-<st_dev>-<st_ino>.lock, keyed by the file identity of the checkout's top level, so another spelling or a subdirectory of the same checkout is the same lock). A second run on the same checkout is refused with exit 4 before any branch switch. A lock whose run has no launch lock is taken over; runs in separate worktrees of one repo are not blocked. (F4)
• Only the owner releases a lock. active-run release RUN_ID STATUS|--remove --owner TOKEN needs the owner token and refuses another token with exit 4. Acquire, takeover, release and remove run under a per-run mutex directory (PL_MUTEX_WAIT seconds, default 10). (H1)
• A schedule pre-flight cannot meet stops the run. Pre-flight reports undeclared dependencies on another task's real code as code_deps. One the run order cannot meet stops the run before any task, in both autonomy modes and without an adjudicator: status preflight_conflicts with preflight.schedule entries naming the move (for example move T2 to join, or into T1's lane after it). A dependency the order already meets only adds context. (F8)
• The final review is bound to one commit. The result records final.lens_heads. When a lens reports a head that is not a commit sha, or the lenses report different commits, final.review_problem says so and acceptance adds review_unbound. (F2)

What changed

• Final verify includes lane checks: one inventory (finalChecks: global checks, then the checks lane overrides add) drives the dry run's Verify entry, the verify prompt (with each lane's setup override) and acceptance, so a lane-only test runs at the delivered commit. (F3)
• Final findings need an accounted fix: a finding with no disposition stays open, and a disposition or re-review result with empty or whitespace-only evidence leaves it open. (F7)
• Shadow repos keep exact bytes: a new shadow writes info/attributes (* -text -eol -filter -ident -working-tree-encoding), which outranks the project's .gitattributes and the user's core.attributesFile, so an untouched CRLF file under text=auto is no longer a false conflict and writeback keeps bytes. Conflict detection hashes with the shadow's attributes. (F5)
• Ids: task ids and lane ids that differ only in letter case, and task, lane or run ids that are Windows device names (CON, NUL, COM1, ...), are rejected. (F6)
• Test suite: the Python snippets in tests/io.test.mjs and tests/platform.test.mjs no longer leave scripts/__pycache__, which made the next suite run in the same checkout fail with EISDIR. CI now fails when the suite leaves the checkout changed.
• Docs: SKILL.md passes --owner <token> to every release and covers preflight.schedule and a refused checkout; reference.md documents the new fields, reasons and locks; README gets troubleshooting rows. Superpowers 7.0.0 ships the same prompts parallel-lanes uses as 6.4.2.

Testing

• node --test tests/: 754 tests, 0 failures everywhere. CI: Ubuntu (Node 22 and 24) 752 pass, 2 skipped; macOS 753 pass, 1 skipped; Windows 742 pass, 12 skipped; every job also checks that the suite leaves the checkout unchanged. Locally on native Windows 11 (Git Bash) the suite ran twice in a row in one checkout with git status --porcelain empty after each run.
• The new tests fail against the 1.3.1 code (1.4.0 tests/ over the v1.3.1 sources): the acceptance, active-run and run-checks cases, 8 checkout-lock cases in setup-script, 6 attribute cases in shadow, 20 cases in run (lens heads, lane checks, pre-flight schedule, findings), and validate (the new helpers do not exist there).
• Built by a parallel-lanes run (r140, on 1.3.1) that ended accepted: 11 tasks, each approved at its first review with no fix rounds; integration with no conflicts; 13 minor final findings, all fixed and re-reviewed; 32 agents, no adjudications. Two follow-up commits after the run fix the bytecode cache found during it.

Compatibility

• Manifests and ledgers from 1.3.x keep working, except a manifest with case-only duplicate ids or Windows device names, which now fails validation.
• active-run release needs --owner <token> (exit 2 without it). The token is what active-run acquire printed; a resume acquires again. A lock left by a session that ended is still taken over with --takeover.
• Shadow mode: a shadow made before 1.4.0 keeps its old representation (no attributes override), which is right for resuming its run; a new run gets a new shadow.
• The active-run directory now also holds checkout-*.lock files while git-mode runs are set up.

Upgrade

In your clone:

git pull && bash install.sh

Then restart Claude Code, or run /clear, so the hooks reload.