@osstack/skills@0.23.0

Patch Changes

• Updated dependencies [95534c7]
• Updated dependencies [12de1f7]
• Updated dependencies [85e19da]
• Updated dependencies [eb35fbb]
• Updated dependencies [5b3400e]
• Updated dependencies [0d9dca7]
• Updated dependencies [b5f2f93]
• Updated dependencies [7939a10]
  • @osstack/core@0.23.0

@osstack/skill-registry@0.23.0

Minor Changes

• 936aced: Add bounded offline inspection of pinned Git source objects through the opt-in source-snapshot entry. Results bind content hashes and explicit incomplete-dependency and caller-asserted identity markers; they do not activate skills or authorize execution.

Patch Changes

• 43db3e1: Wait for Git output streams to close before interpreting tracked skill refs. Preserve command deadlines while output is still pending so a valid delayed ref is not misclassified as missing.
• 2f9d33a: Move the generic source contracts (SourcePin, SourceSnapshot, sourceSnapshotDigest) and canonical JSON out of protocol/joint into the new opt-in @osstack/protocol/source subpath. @osstack/protocol/joint re-exports the same objects and keeps its error codes and digest domain registry, so its behavior is unchanged. Skill-registry source inspection and adoption now import from the neutral subpath.
• 2389dcd: Assemble bounded, explicitly declared source component candidates from retained inspections. Recheck component identity, dependency closure and digests without installation or activation.
• 52d7730: Preserve an explicitly registered Git subtree and independent package version in source manifests. Reject unknown fields instead of silently dropping misspelled pins. Registration does not activate a subtree or change update adoption.
• Updated dependencies [95534c7]
• Updated dependencies [12de1f7]
• Updated dependencies [1372ecd]
• Updated dependencies [85e19da]
• Updated dependencies [eb35fbb]
• Updated dependencies [5b3400e]
• Updated dependencies [0d9dca7]
• Updated dependencies [936aced]
• Updated dependencies [2f9d33a]
• Updated dependencies [13bfb45]
• Updated dependencies [b5f2f93]
• Updated dependencies [7939a10]
  • @osstack/core@0.23.0
  • @osstack/protocol@0.23.0

@osstack/protocol@0.23.0

Minor Changes

• 1372ecd: Add strict versioned behavior declarations, source snapshot manifests, qualification records and delivery projections. Bind evidence bundles to the candidate and limitations, and restrict identity tokens. These records do not enable runtime behavior or grant execution authority.
• 936aced: Add bounded offline inspection of pinned Git source objects through the opt-in source-snapshot entry. Results bind content hashes and explicit incomplete-dependency and caller-asserted identity markers; they do not activate skills or authorize execution.
• 2f9d33a: Move the generic source contracts (SourcePin, SourceSnapshot, sourceSnapshotDigest) and canonical JSON out of protocol/joint into the new opt-in @osstack/protocol/source subpath. @osstack/protocol/joint re-exports the same objects and keeps its error codes and digest domain registry, so its behavior is unchanged. Skill-registry source inspection and adoption now import from the neutral subpath.
• 13bfb45: Add strict request schemas for opt-in Session adoption, decision receipts, independent cancellation, and observation reconciliation.

@osstack/plugins@0.23.0

Patch Changes

• Updated dependencies [95534c7]
• Updated dependencies [12de1f7]
• Updated dependencies [85e19da]
• Updated dependencies [eb35fbb]
• Updated dependencies [5b3400e]
• Updated dependencies [0d9dca7]
• Updated dependencies [b5f2f93]
• Updated dependencies [7939a10]
  • @osstack/core@0.23.0

@osstack/loop@0.23.0

Minor Changes

• f740da8: Behavior change — Loop no longer lands isolated-worktree work locally by default (D7), and never loses executor-made commits (D6).

  • osstack loop run --worktree and osstack deliver --worktree used to fast-forward whatever branch the main checkout had checked out after a successful task. They now commit the verified tree on the kept osstack/loop/... task branch and report it (loop.worktree.preserved, reason local_landing_disabled; worktree_commit and worktree_branch_preserved: true in the completed task). Nothing in the main checkout changes, which keeps unattended/factory runs on controlled PR delivery (humans merge main).
  • Local landing is an explicit, attended opt-in: --land-branch <B> (requires --worktree; deliver only with --autonomy legacy) or LoopRunOptions.localLanding = { targetBranch }. It lands only the accepted commit and is refused unless the main checkout has <B> checked out. Daemon-managed loops (loop start, loop run --daemon) do not offer it. A CandidatePolicy implies its own branch as the target. To keep the old behavior, add --land-branch <current branch>.
  • --govern combined with --worktree now requires --land-branch, because legacy governance scans the main checkout and would otherwise pass without seeing the candidate.
  • mergeWorktree(handle, { expectedCommit, targetBranch }) now requires both options and also refuses when the accepted commit is not the single commit on top of the worktree's recorded start.
  • createWorktree records startCommit. When the executor ran git commit itself, commitWorktreeChanges reports executorCommitted (with the branch tip as commit on a clean tree); the Loop preserves that branch (reason executor_commits) and refuses to land it, because review evidence was collected against the worktree HEAD. cleanupWorktree returns { branchRemoved } and never deletes a branch whose tip is not the start commit or already contained in HEAD or another ref, including during orphan cleanup.
  • Reports and proof packs accept the new preserved worktree status (a commit is required).
  • --goal combined with --worktree (and LoopRunOptions.goalCommand with useWorktree) now requires local landing (WORKTREE_GOAL_REQUIRES_LOCAL_LANDING), because the goal command runs in the main checkout and would never observe work kept on the task branch. Daemon-managed loop start --worktree --goal sessions are refused for the same reason.

Patch Changes

• c310d51: Preserve exact file paths in Git diff discovery so long paths resolve to the changed file. Keep line-count priorities and skip binary records.
• 41a1b0a: Pin isolated-worktree landing to the accepted commit. mergeWorktree accepts { expectedCommit } (a full commit id), refuses when the task branch no longer points at it, and fast-forwards that exact object instead of the movable branch name. The loop passes the commit it made from the verified tree, so commits added to the task branch after acceptance cannot land.
• e93d640: Keep an isolated loop worktree when Git cannot commit its verified changes. A Git error while staging or committing is now treated as an unavailable proof rather than "no changes": the run still fails, but cleanup no longer force-removes the only copy of the verified work.
• Updated dependencies [95534c7]
• Updated dependencies [12de1f7]
• Updated dependencies [1372ecd]
• Updated dependencies [85e19da]
• Updated dependencies [eb35fbb]
• Updated dependencies [9d54cfd]
• Updated dependencies [540cd7a]
• Updated dependencies [1e6eeb9]
• Updated dependencies [ca24452]
• Updated dependencies [d5eea3e]
• Updated dependencies [3a5d523]
• Updated dependencies [5b3400e]
• Updated dependencies [0d9dca7]
• Updated dependencies [6a3e760]
• Updated dependencies [b103f62]
• Updated dependencies [e6d316e]
• Updated dependencies [936aced]
• Updated dependencies [bda3942]
• Updated dependencies [f740da8]
• Updated dependencies [d26c920]
• Updated dependencies [41a1b0a]
• Updated dependencies [2f9d33a]
• Updated dependencies [13bfb45]
• Updated dependencies [b5f2f93]
• Updated dependencies [7939a10]
  • @osstack/core@0.23.0
  • @osstack/protocol@0.23.0
  • @osstack/github@0.23.0
  • @osstack/agents@0.23.0
  • @osstack/governance@0.23.0
  • @osstack/autonomy@0.23.0
  • @osstack/hermes-adapter@0.23.0

@osstack/hermes-adapter@0.23.0

Patch Changes

• Updated dependencies [95534c7]
• Updated dependencies [12de1f7]
• Updated dependencies [85e19da]
• Updated dependencies [eb35fbb]
• Updated dependencies [5b3400e]
• Updated dependencies [0d9dca7]
• Updated dependencies [b5f2f93]
• Updated dependencies [7939a10]
  • @osstack/core@0.23.0

@osstack/graph@0.23.0

Patch Changes

• Updated dependencies [1372ecd]
• Updated dependencies [936aced]
• Updated dependencies [2f9d33a]
• Updated dependencies [13bfb45]
  • @osstack/protocol@0.23.0

@osstack/governance@0.23.0

Minor Changes

• b103f62: Add the contained Mission patch classifier as pure functions: classifyMissionPatch parses a bounded unified diff and returns rejected, T2, T1 or T0 with stable, ordered reason codes, using a digested protected set and cumulative caps that a spec may only tighten. scanForSecrets and redactSecrets scan and redact any executor output channel (patch, final message, stdout, stderr) without ever returning the secret value.

Patch Changes

• 0d9dca7: Add the contained Mission runner. It advances one step at a time from workspace creation through qualification, a proxy executor turn, patch classification, exact host-side patch application and plumbing commit, to verification and repair cycles. Every executor channel is secret-scanned and redacted before anything is recorded, and decisions follow the W11 decision table.

  Patch changes to the runner, patch applier, mission RPC and CLI now escalate to T2 in the Mission patch classifier.

  The contained ledger now opens a stop obligation on entering verifying and requires container stop evidence before a verification result is recorded.

• d26c920: Protect the contained Mission path's own code in the Mission patch classifier. Changes to the shared contained verification, the verification image build, host workspace writes, the Codex proxy executor, the contained ledger and the upgrade holds now escalate to T2.

@osstack/github@0.23.0

Minor Changes

• 9d54cfd: Add a bounded read-only pull request candidate snapshot API with head/base checks, paginated check and review observations, and explicit incomplete-state reporting. The snapshot never authorizes or performs a merge.
• 540cd7a: Add a bounded one-time report for one to three explicitly ordered PR candidates. Retain each candidate's observations, unknowns and raw evidence; only pass a stable observed merged prefix when selecting the unresolved frontier. Branch relations are observations rather than ancestry proof, and reports never authorize merge.

Patch Changes

• d5eea3e: Prevent PR stack ingestion from treating anomalous CheckRun outcomes as successful. Classify ACTION_REQUIRED, STALE and STARTUP_FAILURE as failures, and require explicit COMPLETED status with SUCCESS, NEUTRAL or SKIPPED to report success. Missing, unknown and waiting states are reported as pending; preserve existing StatusContext handling and failure precedence.
• e6d316e: Request all untracked files explicitly when deciding whether an isolated loop worktree has work to commit and whether a GitHub delivery candidate is clean. Repository config such as status.showUntrackedFiles=no no longer makes untracked-only work look clean, so it is committed instead of being discarded with the worktree, and delivery refuses instead of publishing a PR that omits it.
• bda3942: Preserve legacy GitHub StatusContext success and failure outcomes during PR stack ingestion instead of reporting them as pending. Keep existing CheckRun aggregation and conservative handling of missing or unknown context states.

@osstack/core@0.23.0

Minor Changes

• 95534c7: Add opt-in reminders for overdue open Attention decisions (migration 48). With OSSTACK_ATTENTION_REMINDERS=1, supervision queues at most one reminder per pass for the oldest decision left open past OSSTACK_ATTENTION_REMINDER_OVERDUE_SECS (default 1800), repeating with doubling intervals capped at OSSTACK_ATTENTION_REMINDER_BACKOFF_MAX_SECS (default 14400). Schedules survive restarts, quiet scopes neither schedule nor reset, and resolving a decision stops its reminders. Reminders reuse the local notification drain under their own delivery IDs and grant no authority. Invalid enabled settings refuse daemon startup. Managed upgrade and the read-only Attention status view now qualify schema 48.
• 12de1f7: Add the Attention return brief (migration 49). Postures now record when they were entered; re-asserting the current posture keeps its start. Leaving away for attended (attention.posture / osstack attention posture) returns a bounded, read-only brief for the away interval: every decision still waiting on you (oldest first, with age and reminder count, always with total and omitted counts), decisions opened and resolved while away, and first notices or reminders that dead-lettered in the interval (plus undated pre-49 dead letters). osstack attention return-brief --scope ID --actor NAME [--since MS] [--limit N] previews it without changing posture. Decision settlements and dead letters are recorded with their time in two new local ledgers. The brief is information only and grants no authority. Managed upgrade and the read-only Attention status view now qualify schema 49.
• eb35fbb: Add a bounded behavior registry evaluator for caller-supplied build pins, clock, policy and trust context. It checks source membership, qualification signatures, evidence and dependencies relative to those inputs. It does not authenticate the trust context, verify the operations-root signature, persist a revocation epoch or grant execution authority. It is not wired into daemon routing.
• 5b3400e: Add migration 50 with an additive contained-Mission ledger: Missions, append-only events and workspace claims, behind a ContainedMissionStore that enforces the W11 state machine, candidate binding, repair-cycle limits and stop evidence. Managed upgrade and the attention read model qualify schema 50, and in-flight contained work counts as an upgrade hold.
• 7939a10: Add schema 47 Mission and Wait storage, atomic answer reservations, cancellation proofs, and conservative recovery. Existing attention actions remain the sole dispatch authority.

Patch Changes

• 85e19da: Reject unknown behavior trust and policy fields, cache failed artifact reads and manifest parses, and normalize malformed context echoes. Preserve the frozen Behavior V1 signing format while keeping corrupt data within the evidence work budget.

• 0d9dca7: Add the contained Mission runner. It advances one step at a time from workspace creation through qualification, a proxy executor turn, patch classification, exact host-side patch application and plumbing commit, to verification and repair cycles. Every executor channel is secret-scanned and redacted before anything is recorded, and decisions follow the W11 decision table.

  Patch changes to the runner, patch applier, mission RPC and CLI now escalate to T2 in the Mission patch classifier.

  The contained ledger now opens a stop obligation on entering verifying and requires container stop evidence before a verification result is recorded.

• b5f2f93: Keep adopted Session identity faults fenced after cleared waits and source restoration. Prevent daemon drain from reporting success while execution leases remain held after asynchronous or failed cleanup.

• Updated dependencies [1372ecd]

• Updated dependencies [936aced]

• Updated dependencies [2f9d33a]

• Updated dependencies [13bfb45]

  • @osstack/protocol@0.23.0