Release tree at source commit 9682c951. Thirteen paths move; the rest are byte identical to v13.4. The published tree object is the same sha1 as the source repository's own oss/release tree — 6f2f920886df24376eb4a80bcec24a026e684164 — so bytes and modes match by construction rather than by inspection.
./install.sh works on a clone now
All fourteen shebanged files in this release ship 100755. They shipped 100644 in every release before this one, so ./install.sh was permission denied on the first command every document names, and only bash install.sh worked. RELEASING.md step 3 has recorded that failure since v4.2: "every check took the bash route, which structurally cannot observe the mode."
It was never neglect. It was inexpressibility — the generator emitted those files executable on every single build, wrote the correction to a bucket, and no layer of the stack could apply what the generator itself produced.
A file mode is expressible, end to end
buildTree took no mode parameter, so nothing above it could have one. That is closed now at every layer: the tree builder, the whole-file write, the scoped HTTP release route, and the unified-diff applier — including the pure chmod git emits with no ---/+++ headers and no @@ hunks at all.
Omitting a mode leaves it alone everywhere, so rewriting an executable does not quietly disarm it, and a copy carries its source's mode. 100644 and 100755 are the only accepted values; anything else is refused by name, because a symlink and a submodule are different kinds of tree entry rather than modes of a file.
Closing a work item costs a commit the server resolves
An agent reported six review items complete, with detailed per-item "Actions Taken", and none of it had happened — no commit, no document changed, all six still pending. A human caught it by hand. Nothing objected, because opening an item already demanded cited evidence and closing one demanded nothing.
complete_work_item now requires an evidence_oid that the server resolves against its own object store, on both the tool surface and the console chat's table — a gate on one of two doors is not a gate. The agent cannot forge it because the agent does not perform the lookup. Not a reviewer: a reviewer is handed strings the agent composes, and an agent that fabricates a completion fabricates its evidence too. evidence_oid:"none" with a reason of substance remains for measurements and negative results, recorded on the item and named in the journal.
The advisor can verify what it is told
Prompt caching now marks the system block and the tool schemas, where the stable tokens actually are; the breakpoint had been sitting on the second-to-last message, which resolves to nothing for a single-message caller. Measured on the deployed revision: cache_read=21912 per round against a flat zero before.
That paid for the round budget, 1 → 6. At one round the advisor spent everything it had establishing identity and reading one item, and opened its answer with "I could not verify the claim itself — I made no repository read." An advisor that cannot check what it is handed is not cheap, it is decorative.
The release tree stops being thrown away
The pipeline regenerated this tree on every build for months and never committed it. The build now commits it through the one scoped route that can move a branch, sending only the files that differ, under its own attested identity.
Cut deterministically: gen.py run twice into separate directories, diff -r reports zero. Bus gate 0 (negative control 4/4); passkey gate 0 (negative control 7/7, four asserted allowances). check-apis, check-python-names, check-no-embedded-assets and bash -n on all three scripts green against the emitted tree, not the source.
leak-baseline.json is gone from the release — it is a repository input the generator reads for its leak ceilings and never emits, and it had been riding along from an older cut.
Apache-2.0. Your project, your bill, your key.