v0.13.1 — reproducible external MCP hosting

Agent Harness Core v0.13.1

This reliability release makes third-party MCP availability reproducible across
generated Codex configuration and fresh backend startup, while strengthening
long-running worker, cron, backup, progress, and process-containment behavior.

Highlights

• Preserves operator-managed mcp_servers and supported extension-owned config
  through deterministic, transactional materialization. Malformed, ambiguous,
  unsupported, or permission-unsafe input fails before partial mutation.
• Requires a fresh app-server connection to prove required MCP authentication,
  optional server identity/version, and declared tool-schema digests before a
  turn is admitted. Optional capabilities degrade with a bounded warning.
• Isolates Codex homes by exact agent and provider and rejects stale cached
  readiness as evidence for a newly started backend.
• Publishes preparing immediately after interactive lease acquisition, bounds
  prompt-memory preparation under one monotonic budget, and records causal
  preparation and delivery stages without exposing prompt or identity data.
• Keeps long-running worker authority renewable and generation-fenced, contains
  descendant processes on Windows and Unix, rejects superseded results, and
  reconciles linked cron state after restart.
• Makes backup progress and deadlines operation-specific and transactional,
  hardens complete-store admission and supervisor mutations, and publishes
  explicit Discord online presence with fresh readiness evidence.

Verification and limits

The accepted candidate passed fresh Windows source and scenario verification,
focused native-Linux compatibility checks, a fresh Codex 0.145.0 app-server
capability probe, independent review, guarded Windows promotion, and natural
Telegram and Discord delivery.

The Windows deployment used the accepted implementation before release metadata
and this tag were finalized; it is not claimed to run the exact v0.13.1 tag or
binary. Native macOS execution, a fully green historical Linux suite,
first-time named-consumer MCP mounting, and broad remote-transport support
remain separate work.

v0.13.0 — restart-safe Goals and direct service ownership

Highlights

• Unfinished Goals can continue in bounded, restart-safe slices under exact lane, session, generation, and ownership authority. New same-lane user input takes priority before an unleased continuation.
• Windows supervision now supports the intended thin topology: one operating-system launch adapter, one Rust supervisor-master, and directly owned configured service children. The prior reconcile keeper and per-service supervisors remain available for migration and rollback.
• Queue/app-server process cleanup, lease release, terminal-control handling, ingress recovery, final delivery, and source ownership are hardened across crash and restart boundaries.
• Reconcile-managed operations derive stop, status, and start targets from configured topology, including overrides and multiple Telegram accounts, while legacy Scheduled Task plans remain compatible. This completes issue #17.
• Agent-created skill changes retain proposal, lint, guard, checksum, backup, receipt, quarantine, and rollback gates while supporting guarded autonomous apply. The public roadmap now prioritizes outcome attribution, shadow routing, one reversible serving cohort, and one measurable learning loop.

Verification

• full serial Rust workspace/all-target suite: 1,681 passed, 0 failed, 1 ignored;
• Windows direct-owner lifecycle suite: 13/13 passed;
• ops-control acceptance/fail-closed suite: 15/15 passed;
• Discord gateway tests: 7/7 passed;
• workspace all-target check, formatting, catalog readback, generated topology readback, and tracked-tree public hygiene passed;
• a guarded Windows release-candidate cutover passed independent review, stopped-state migration, one-master/direct-child process and health readback, rollback readiness, and exact-lane Telegram and Discord delivery.

Evidence boundaries

This source release does not claim that the exact tagged artifact has been promoted to the live deployment, that a long-duration endurance soak has completed, or that Linux and macOS have direct-owner containment and host-recovery parity. Linux currently has native process identity and ownership leases; direct ownership still fails before mutation on unsupported hosts.

v0.12.0 — Governed active-goal closure and runtime recovery

Highlights

• Active goals now resolve each source turn through one durable outcome: an exact-lane continuation, a visible parked blocker, or typed non-delivery. A denied continuation can no longer appear as silent success.
• AppX PowerShell replacement is distinguished from ordinary shell failures. Eligible exact-authority work can recover once in a fresh runtime; ambiguous, repeated, or observation-only cases park visibly.
• Parent runtime receipts include bounded child lifecycle summaries without copying child prompts, prose, channel identities, complete commands, or secrets.
• trace accepts the canonical --queue-id selector while retaining the legacy --id spelling. Supplying both fails closed.
• Worker status now excludes durable parked rows from open downstream work, matching runtime scheduling and health semantics. Parked work remains visible through runtime waiting state and trace, and becomes actionable again after a durable retry or resolution.

Verification

• Independent review returned PASS for the exact release commit and staged binary.
• Fresh serial workspace tests passed: 135 CLI tests, 1,301 core tests, and integration suites of 5, 1, 4, 9, 1, 5, and 4 tests, with no failures.
• Formatting, workspace all-target checks, clippy, schema and invariant catalogs, scenario catalog, and public hygiene checks passed. Clippy reports only pre-existing repository warnings.
• Guarded live deployment verified the exact staged binary hash, ready/live health, nine fresh supervised services, no open runtime, cron, or worker work, idle Telegram and Discord outboxes, and a ready cutover receipt.
• A controlled provider-visible Discord replay produced one visible authority-conflict park, one delivered parent message, no continuation child or intent, no duplicate delivery after restart, and a terminal trace with no diagnostics.

Compatibility and limits

• Goal autonomy remains observation-only unless an exact reviewed lane is explicitly activated. Authority conflicts intentionally require operator reconciliation.
• Existing trace --id callers remain compatible; new automation should use trace --queue-id.
• Rollback binary, configuration, and non-secret state artifacts were retained during deployment.

Agent Harness Core v0.11.0

Highlights

• Adds bounded productive deadline renewal for explicitly enabled ordinary interactive turns while preserving queue lease fencing, hard caps, stop/new handling, fairness, and external-effect boundaries.
• Makes bounded yield a harness-owned outcome boundary. Optional model steer and disposition data are advisory and can no longer replace the primary timeout or decide continuation authority.
• Preserves absolute timeouts when final output or a disposition marker is incomplete, with one restart-safe commit-before-enqueue recovery child where policy permits.
• Prevents streamed goal projections from blocking renewal for work whose prepared authority remains an ordinary task; goal campaigns, workers, external-effect operations, and unknown authority stay outside this path.
• Hardens runtime shutdown, supervisor process-generation fencing, Windows backend-auth child cleanup, and long Telegram/Discord final preservation.

Compatibility

Productive deadline renewal is default-off and agent-cohorted. Existing hard caps and authority boundaries remain in force.

Verification

The release passed the complete serial core suite (1,243 unit tests plus integration and documentation tests), the full CLI suite (126 tests), workspace checks, sanitized scenario/replay coverage, candidate contract checks, and public-export hygiene. A guarded live deployment completed with readiness healthy, all nine configured supervisors running, and no open runtime, worker, or provider-outbox work.

The bounded-yield behavior was verified at scenario/replay altitude. The live cutover did not inject a synthetic provider-visible long-running turn.

Agent Harness v0.10.0 — reliable continuity and safe connector actions

Highlights

Agent Harness v0.10.0 makes long-running channel work and connector actions safer and easier to understand.

• Queued follow-ups remain visibly queued until they actually start.
• Timeout and continuation handoffs retain one logical task and one final-reply owner across restarts.
• Temporary provider overloads use durable bounded retry timing and do not blindly replay attempts that may have changed external state.
• Unfinished OperationPlan work can continue from a versioned checkpoint only while the same conversation and active plan item still authorize it.
• Connector approval requests pause as Waiting for approval, with expiring approve/deny capabilities and connector-specific readback before an ambiguous write can be retried.
• Provider error diagnostics no longer retain absolute request URLs or credentials.

Compatibility and configuration

The connector approval policy defaults to needs-user; optional connector/action rules can select denial or explicit action-token approval. New state schemas are additive. The runtime normalizes the one supported legacy duplicate-account continuation shape and quarantines other identity mismatches instead of guessing.

The deployment-owned Codex CLI remains pinned to version 0.144.5. Existing operators should retain their normal binary-and-state rollback pair when upgrading.

Verification

The release passed 119 CLI tests, 1,211 core tests, all integration targets and documentation tests, cross-platform continuity and connector-effect replays, formatting, all-target compilation, fixture integrity, and an exact-commit public-export hygiene scan. A guarded live rollout was followed by ten consecutive healthy observations with no runnable runtime, cron, or worker work and no retryable provider delivery.

See the changelog for the complete user-facing change summary.

Agent Harness v0.9.0

Agent Harness v0.9.0

This release integrates the Codex 0.144.5 app-server contract and hardens long-running agent continuity across authentication, context compaction, virtual sessions, durable goals, and skill evidence.

Highlights

• Pins and verifies Codex 0.144.5 through a deployment-owned canonical executable with version, package-integrity, path, and SHA-256 provenance.
• Adds provider-scoped backend authentication lifecycle management with operator-only login/logout flows, restart reconciliation, and credential-safe diagnostics.
• Preserves live modelContextWindow observations, performs ratio-first compact decisions, serializes resume/compact correlation, and rolls over safely after bounded recovery.
• Adds exact-lane virtual-session and goal lineage authority, unified transitions, exactly-once continuation intent, and final-outbox gating.
• Selects Codex built-in web search explicitly: cached by default, live for freshness intent, and disabled for sensitive/offline/replay contexts.
• Adds zero-serving-side-effect skill router shadow receipts, virtual skill manifest observation, joined episode/outcome evidence, and proposal-only improvement artifacts.
• Refreshes topology, invariants, schema registry, configuration, feature parity, roadmap, and public release documentation.

Verification

• Full workspace: 1,284 passed, 0 failed.
• Integrated T3 skill/virtual-session replay pack: 15 passed, 0 failed.
• Formatting, all-target compilation, diff hygiene, public-export hygiene, candidate health, and Codex provenance passed.
• Live cutover completed with rollback and backup evidence; post-cutover health, queues, outboxes, supervisor owners, auth doctor, and lineage doctor converged.

Goal autonomy and skill observation/serving/rebaseline activation remain separately gated so that later T4 evidence retains clear attribution.

v0.8.1 - Skill lifecycle and agent isolation hotpatch

This hotpatch tightens the v0.8 skill-selection boundary and keeps the Windows recovery suite deterministic.

Fixed

• Retired and historically retired skills are excluded from automatic and explicit selection.
• Skill frontmatter now enforces agent allowlists and separate model/user invocation controls before scoring.
• Skill discovery and usage-prior scoring are scoped to the selected agent, preventing cross-agent workspace and prior leakage.
• Windows timeout-recovery fixtures use more reliable command wrappers and bounded timing for slower hosts.

Verification

• cargo fmt --all -- --check
• cargo check --workspace
• cargo test --workspace --all-targets — 1,174 passed, 0 failed
• git diff --check
• Tracked-file public export hygiene — passed with no forbidden hits

v0.8.0 - GPT-5.6 orchestration and bounded runtime histories

Highlights

• Added exact-route GPT-5.6-family capability discovery and unified /think / /reasoning behavior, including exact max support and fail-closed rejection of exact ultra.
• Added exact-lane prompt manifests, immutable heterogeneous child execution policies, exact-owner result mailboxes, lease-safe coordinator resume, and master-only user-facing completion ownership.
• Added bounded source-authoritative receipt histories, derived indexes, and an isolated ledger maintenance loop for runtime, progress, virtual-session, and delivery evidence.
• Hardened deterministic cron retries, timezone-aware scheduling, process-tree timeout cleanup, terminal receipt trust, and supervisor preservation of configured secondary Telegram loops.

Verification

• cargo fmt --all -- --check
• Full workspace all-target suite: 1,170 tests passed.
• Exact-current-session coordinator replay and controlled live cutover checks passed the master-owned continuation/final and child-suppression invariants.
• git diff --check and tracked-file agent-harness public-hygiene passed with no forbidden hits.

Compatibility

This is a pre-1.0 Rust source boundary. The v0.8 reader retains documented legacy artifact readers, but older binaries must not be assumed to read V2 state written by v0.8. See the 0.7 to 0.8 migration guide.

See the changelog for the complete release summary.

v0.5.0

Changed

• Hardened terminal-control lifecycle handling so durable stop, skip,
  quarantine, restart, cron-freshness, and sender-source controls are consulted
  before runtime execution, progress delivery, restart completion, or
  sender-class cron notification.
• Added Dream Director freshness checks that suppress stale source packets,
  normalize relative-home source paths, and expose deterministic freshness and
  catch-up decisions for queued notification work.
• Added loop diagnostics and readback surfaces for resource-exhaustion and
  restart-control troubleshooting.
• Made cron-canon status parsing tolerate UTF-8 BOM JSON receipts and expanded
  cron freshness monitoring so stale cron state is reported as actionable
  status/health evidence instead of parser noise.
• Repaired progress/final ordering for channel transports by using queue-local
  wake freshness, preserving first progress sends, reclaiming same-queue orphan
  progress surfaces, and waiting for the source final delivery before terminal
  progress closure.
• Repaired final-outbox ownership for configured non-main channel agents:
  completed turns now write a final reply when the run agent matches the
  lane-owning agent, while owner-mismatched runs remain internal evidence.
• Hardened interrupted long-task recovery so terminal tool-timeout and
  no-final-answer interruption classes can roll to bounded virtual-session
  continuation when recovery gates allow it, while provider-outage-shaped
  failures stay out of the continuation predicate.
• Expanded the scenario matrix and topology documentation with
  terminal-control, restart-control-plane, cron-freshness, progress-ordering,
  non-main final-owner, and interrupted-task recovery gates.

Verification

• Added checked-in replay coverage for sanitized ghost-queue suppression,
  restart-control staging closure, and cron-outage stale-source
  suppression/catch-up.
• Added focused regressions for queue skip/sticky terminal control, scoped stop
  suppression, lease reconciliation, terminal-control progress closure,
  queue-local progress ordering, final delivery before terminal progress,
  non-main final-owner routing, owner-mismatch suppression, and interrupted
  virtual-session continuation.
• Refreshed the schema registry, scenario matrix, release checklist, topology
  contract, invariants, configuration docs, and generated topology explorer for
  the new lifecycle and recovery gates.

v0.4.0

v0.4.0 - 2026-07-03

Difference from v0.3.0

v0.3.0 introduced rich presentation delivery and the first public continuity
release gates. v0.4.0 promotes two broader runtime surfaces: bounded virtual
session working context for long tasks, and policy-gated non-text media handling
for Telegram and Discord. It also includes the follow-up rich-final bridge and
stream-resilience hardening that landed after v0.3.0.

Changed

• Added a resolver-backed agent-harness.virtual-session-working-context.v1
  prompt section keyed by exact platform/channel/user/agent/session axes. The
  section is bounded, pointer-only, and can surface same-lane anchors when reply
  metadata is absent.
• Hardened virtual-session lifecycle: /new closes the prior virtual-session
  record and starts a clean task boundary, Codex completion capture can backfill
  thread ids, maxContinuationDepth is separated from compact-count thresholds,
  stream-unstable continuation thresholds are configurable, and max-depth
  terminal cases mark the virtual session terminal-failed.
• Added the virtual-session rollover scenario catalog covering Telegram and
  Discord same-agent continuation, non-main isolation, /new boundaries, and
  max-depth exact-lane evidence.
• Added outbound media directive parsing v2: protected-span masking, quoted
  paths, [[as_document]], [[audio_as_voice]], shared deliverable extension
  mapping, and loud rejection for invalid directives.
• Added media_delivery_policy: local attachment paths and harness artifact
  refs are checked before provider upload, accepted/rejected decisions are
  recorded as agent-harness.outbound-media-policy.v1, and media-delivery lint
  receipts can warn or fail closed by config.
• Expanded provider media delivery: Telegram can send photo albums, documents,
  audio, voice, and video with caption handling; Discord can batch multipart
  file attachments in one delivery.
• Expanded inbound and referenced media handling: Telegram documents, voice,
  audio, video, static stickers, and reply media are stored as prompt-safe
  artifacts; Discord referenced-message attachments are fetched with provenance.
• Added visual-readiness reporting and config-gated native image input. Native
  image input ships default-off pending staged live enablement.
• Rich final presentation now covers ordinary successful agent replies by
  converting final-only text into trusted semantic blocks after MEDIA:
  extraction. Plain text remains the fallback and progress-panel narration is
  excluded.
• Repeated retryable stream disconnects on high-usage media turns can guardedly
  requeue a continuation during RetryPending, and internal worker progress
  events are summarized instead of exposing raw worker final text.
• Updated public topology, invariant, schema registry, feature parity, README,
  and generated topology explorer surfaces to track invariants I15/I16 and the
  new media and virtual-session promotion gates.

Verification

• Focused virtual-session resolver, prompt, lifecycle, config, runtime, Codex
  backfill, and scenario-catalog tests passed before release closeout.
• Serial agent-harness-core --lib, agent-harness-core --test memory_pack,
  full agent-harness-cli, workspace check, schema registry, invariants,
  release checklist, scenario matrix, config validation, and scoped public
  hygiene gates passed in the release validation set.
• Channel media validation covered parser/policy/lint fixtures, artifact-ref
  resolution, Telegram media kind mapping, Discord multipart batching, inbound
  media provenance, native-image bloat preflight, and generated schema/topology
  surfaces.
• End-to-end channel readback confirmed the virtual-session working-context
  prompt section was model-visible, a real /new task boundary started
  cleanly, and Discord media attachment delivery passed with policy
  accept/reject receipts.
• Release closeout ran git diff --check, scoped public/private hygiene, and an
  independent release-note/hygiene review.

Still gated / not included

• Full promotion of the virtual-session continuity gap still waits for broader
  live soak and final-delivery trace evidence across real Telegram/Discord
  turns.
• Telegram provider media smoke for photo + document + album remains a manual
  post-release smoke check.
• media.nativeImageInput and media lint fail-closed mode remain default-off
  pending staged enablement and soak.
• Telegram inline callback buttons, Discord component buttons, clicked-action
  ingress re-entry, and live preview integration remain separate phases.