v2.4.0

[2.4.0] — 2026-08-06

Added

• Commit generated harness/skill-registry.md (and template copies) so installs resolve
  <paths.engine>/skill-registry.md; sync skill-registry.mjs into the create-midas template.

Changed

• Delegator means path-readability, not Skill-tool invocation: Phase-7 procedures
  (midas-progress, midas-verify, midas-qa, midas-lean-review, midas-explore, …) are
  Delegator: yes so parents may path-pass their SKILL.md for workers to read.
  disable-model-invocation still blocks auto slash / Skill-tool invoke. orchestrator-only
  stays phase gates, install/sync, and high-stakes audits (~13 yes / ~19 orchestrator-only).
• Docs + midas-{orchestrator,builder,scout} contracts spell out path-pass ≠ Skill invoke.

Fixed

• Operator heuristics: catch Publish draft release, Deploy staging, push/create git tag,
  and smoke-test installer without reintroducing code-task false positives.
• Fail-closed hook coverage for MIDAS_AUTONOMY_AUTHZ_KEY env deny.

---