v0.2.14 — Loop write-detection alignment (safety fix)

Fixed — durable-loop write detection aligned with the executor. The interactive loop's approval gate (is_write_step) used a narrower verb set than the executor's intent parser (_parse_agent_intent), so a free-text step phrased with a synonym verb (remove/clear/set/modify/rename/purge/…) was a read to the gate but a write to the executor — and could inline-execute in an interactive loop with no approval pause.

Root-cause fix: a single shared classify_intent_type (in sequential_dispatch.py) that both the gate and the executor use, so they can never disagree. is_write_step is now an additive union — nothing that previously gated stops gating; the change only closes the hole. Reads keep priority, so a genuine read is never over-gated.

Surfaced by the R15 (scheduled tasks, v0.2.13) pre-ship review, which had already guarded scheduled runs against the same divergence.

+21 tests; full suite 1288 passed, 1 skipped on Python 3.12. CI green.

v0.2.13 — Scheduled / recurring tasks (R15)

Scheduled / recurring tasks (R15). Register a recurring job — a concrete tool-path plan plus a cron expression — that an external OS timer (launchd/cron) replays with hubspot schedule run-due. No always-on daemon.

A scheduled run executes reads unattended and stages every write as a pending preview — nothing mutates on its own. You approve the queued batch later; each write re-verifies with per-record compare-and-set (drift → skip), so a deferred approval never clobbers a since-changed record.

• hubspot schedule add|list|remove|run-due|install-timer
• _drive_loop stage-and-continue mode; interactive loop unchanged (still pauses at every write)
• Non-concrete (free-text) plans are refused so cron can replay deterministically with no run-time LLM
• Overlap gate skips while a batch is unreviewed and un-freezes when resolved; unreviewed batches expire after schedule_queue_ttl_days (default 7)
• New in-house cron.py + per-portal schedule_store.py

Adversarial review before ship caught and fixed an unattended-mutation hole (free-text steps), a freeze-until-TTL bug, and a reaper/TTL mismatch.

Full suite 1267 passed, 1 skipped on Python 3.12. CI (pytest + plugin validate + artifact allowlist) green.

v0.2.12 — pattern approval (divergence-safe)

Revives the roadmap-killed pattern-approval mode, made divergence-safe.

Approve one transformation rule, then scale it across the matched set with per-record compare-and-set: a record is updated only if its current value still equals the value you approved, so records that drifted since preview are skipped — never overwritten. This resolves the exact divergence risk the feature was originally killed for (by exact per-record verification, not statistical inference).

• Reversible, non-sensitive property updates only — destructive/merge and sensitive-field writes fall back to the normal per-op gate.
• Matched sets over pattern_confirm_threshold (default 100) require the typed count; otherwise one count-free approval. Never auto-applies.
• Continue-through: a drifted/failed record never aborts the batch; the run reports applied / skipped-drifted / failed, and every applied record is undoable (one hubspot undo).

Full suite green on Python 3.12 (1182 passed). PRD §2 reversal + R14; README + CHANGELOG updated. See #26.

v0.2.11 — loop back-pressure (Phase 3 PR-B)

Robustness for the unattended durable loop (Phase 3, back-pressure track) — completes the pattern-audit roadmap.

• Per-step retry with backoff: transient read/preview errors (rate-limit, HubSpot 5xx, network/transport, retryable handler errors) retry up to 3 attempts with exponential backoff, honoring Retry-After (cap 60s), instead of killing the loop on the first blip.
• Proactive pacing: the loop reads HubSpot's X-HubSpot-RateLimit-* headers, persists rate state, and paces before the next step when remaining is low.
• Writes are never auto-retried — retry wraps read/preview only; the write pauses at awaiting_approval as before.

Full suite green on Python 3.12 (1168 passed). See #23.

v0.2.10 — loop proxy budget (Phase 3 PR-A)

Runaway guard for the unattended durable loop (Phase 3, cost-governance track).

• Proxy budget over countable signals (a real dollar cap isn't observable inside the loop — it makes no LLM calls): plan-configurable max_steps (50) and max_api_calls (1000), plus error_budget/verification_plateau surfaced as plan fields.
• Enforced per-step in _drive_loop — a runaway loop is stopped mid-run (status="stopped" + budget_exhausted event), not only at post-write verify checkpoints.
• Retired the inert HUBSPOT_LOOP_COST/$0.50 ceiling. Counters persist across resume.

Writes still pause at every write; the loop stays resumable. Full suite green on Python 3.12 (1151 passed). See #22.

v0.2.9 — partial-capture hardening (Bounded Autonomy)

Safety hardening for the Phase 2 risk-tiered approval feature.

• Partial-capture guard: an interactive update that captured fewer original values than the records it targets (some per-record preview GETs failed) is only partially undoable, so it now downgrades AUTO → CONFIRM and keeps a human checkpoint instead of auto-applying. Fully-captured updates and creates are unaffected.
• auto_apply_max_records default reaffirmed at 100 (bounded by undo, audit, and this guard).

Full suite green on Python 3.12 (1145 passed). See #21.

v0.2.8 — Bounded Autonomy (risk-tiered approval)

Risk-tiered write approval (Bounded Autonomy). Provably-safe, reversible, low-risk writes auto-apply with a report + undo command; destructive, non-reversible, over-ceiling, sensitive-field, and side-effectful (workflow) writes keep the human gate.

• Tiers AUTO / CONFIRM / FULL_GATE via classify_write; config in approval_policy.json (shipped default + global + per-portal, union-merged safety lists): auto_apply_max_records (100), sensitive_properties, sensitive_property_action (confirm|full_gate), never_auto_tools (the 5 workflow writes).
• Interactive-only; the durable loop still pauses at every write. Every AUTO write still records an undo snapshot + audit entry.
• Full suite green on Python 3.12 (1143 passed). Passed adversarial code review.

See #20.

v0.2.7 — quiet mode: no step narration, hardened HITL carve-out

What changed

/hubspot now reports final results only — no step-by-step narration — in three stackable layers:

• Baseline: SKILL.md "Output rules" block scoped to the /hubspot skill
• Opt-in: hubspot-terse output style (/config → output styles) for session-wide terseness; never forced
• Sub-agents: terse output block injected into all 44 specialist prompts via build_agent_prompt

Safety

The HITL contract is untouched and the carve-out is hardened: every write still surfaces the full preview — action_id, affected records with exact field changes (current → proposed values), and the destructive-op count — and stops for approval. Adversarial review found and fixed a wording loophole that let a terse agent legally omit the proposed payload.

Housekeeping

• Shipping allowlist gate now admits output-styles/
• Version synced across pyproject.toml, plugin.json, marketplace.json

Full suite: 1122 passed, 1 skipped. PR #18.

v0.2.6 — routing accuracy & speed hardening

Full-coverage keyword routing (all 44 agents), word-boundary scoring, 429 read-retry with capped Retry-After, dual dependency-system collapse, corpus re-label to correct outputs, and Phase C review fixes.

Tests: 1121 passed, 1 skipped. claude plugin validate ok. Allowlist ok.

v0.2.5 — fail-closed snapshot + preview warning on snapshot-fetch failure

What's new

Prophylactic hardening for a latent silent-failure gap (flagged in the 2026-07-15 demo-rehearsal bug report at handlers.py:220-221).

A total snapshot-fetch failure (every per-record GET raising at preview time) previously persisted a hollow undoable=True snapshot with empty original_values — the operator only discovered undo was unavailable after approving. Now:

• Fail-closed snapshot (snapshot.py): an UPDATE with no captured originals is marked undoable=False. CREATE stays undoable (its undo deletes via created_ids).
• Preview-time warning (handlers.py): when an UPDATE attempted fetches but captured nothing, a warning surfaces in the preview so approval is informed.
• New regression test: test_bulk_update_snapshot_fetch_failure_warns_and_marks_non_undoable (TDD).

Note on BUG 11/12 from the 2026-07-15 report

Verified live on portal 148408595 against the actual 0.2.4 runtime: BUG 11 (count gate) and BUG 12 (bulk no snapshot) were not reproducible — they were artifacts of a stale venv-0.2.2-backup serving 0.2.2 code. BUG 9 and BUG 10 remain fixed. This release is hardening, not a regression fix.

Validation

• claude plugin validate ./ — clean
• bash scripts/check-artifact-allowlist.sh — 257 files within allowlist
• pytest -q — 1080 passed, 3 skipped