v0.51.12 — Verification Must Never Rewrite Reality

v0.51.12 — Verification Must Never Rewrite Reality

PR #1916 and RFC #1917 closed the hidden-checklist convergence loop: the worker could no longer see the answer key, and rejected results could continue through evaluation and bounded evolution. This release closes the remaining verification boundary.

Machine verification is now monotonic. It may add evidence. It may reject a genuinely failed check. It may never erase a worker failure, manufacture a success, or retry completed work merely because the verifier itself is unavailable.

What's Changed

Monotonic verification

• Separate worker execution facts from machine-verification facts.
• Preserve successful completed work when Bash, command startup, timeout handling, or transcript verification is unavailable; report the result explicitly as unverified instead of rewriting it as failure.
• Keep genuine verify_command failures authoritative when rejecting otherwise successful work.
• Add VerifierStatus.UNAVAILABLE without retry or redispatch authority.

Monotonic evidence

• Keep files_touched, commands_run, and tests_passed obligations even when a verify_command exists.
• Prevent a passing verifier command from recovering a failed worker execution.
• Preserve the Seed authoring warning and explicit verify_exemption_reason for criteria without a machine command.

Trusted verification boundary

• Execute verification only through a resolved, absolute, real Bash implementation across POSIX and Windows Git Bash environments.
• Never substitute cmd.exe, WSL launchers, sh, or shell emulation.
• Strip environment controls capable of bending a verdict, including Bash startup hooks, exported functions, preload hooks, and pytest, Python, and Node controls.
• Contain timed-out and cancelled verifier process trees.

Deliberate simplification

• Remove the shell-free Bash interpreter, constant-verdict proof machinery, workspace baseline probes, verdict tiers, and durable prototype policy.
• Leave sandboxed discrimination research outside the critical ooo run path rather than pretending an unsandboxed verifier can prove more than it observed.

Why this release matters

A convergence loop is trustworthy only if its judge cannot rewrite the work it judges. #1916 and #1917 gave the loop secrecy, independent judgment, and recurrence. #2187 gives that judgment its final invariant: verification can strengthen the record, but never reverse history.

This is the closing movement of that loop-engineering line: not a larger loop, but a harder boundary around truth.

Full Changelog: v0.51.11...v0.51.12

What's Changed

• feat(verify): make AC verification monotonic by @Q00 in #2187

Full Changelog: v0.51.11...v0.51.12

v0.51.11

What's Changed

Features

• Scope advisory lane inputs to findings owned by that lane, exposed as fetchable IDs (#2184)

Documentation

• Add the Korean Goose runtime guide (#2183)
• Add the Korean Hermes runtime guide (#2177)
• Add the Kiro demonstration GIF to the README

Full Changelog: v0.51.10...v0.51.11

What's Changed

• feat(advisory): a lane is offered only its own findings, as ids to fetch by @cohemm in #2184
• docs(ko): add Hermes runtime guide by @CommitTheKermit in #2177
• docs(ko): add Goose runtime guide by @qdaszx in #2183

New Contributors

• @CommitTheKermit made their first contribution in #2177
• @qdaszx made their first contribution in #2183

Full Changelog: v0.51.10...v0.51.11

v0.51.10

What's Changed

• bump: DEFAULT_OPUS_MODEL to claude-opus-5 by @hackertaco in #2166

Full Changelog: v0.51.9...v0.51.10

v0.51.9

What's Changed

Bug Fixes

• Make init start execute the Seed workflow and preserve the invocation project directory (#2186)

Full Changelog: v0.51.8...v0.51.9

What's Changed

• fix(init): make "Start workflow now?" actually run the Seed by @cohemm in #2186

Full Changelog: v0.51.8...v0.51.9

v0.51.8

This patch is mostly about the install path and about runs that tell you the truth when they go sideways.

The DeepSeek Harness integration gets a real installer story: install.sh now installs the dsh plugin when DSH is present, and — after two rounds of hardening — prints profile names you can actually paste back into a shell. The second round matters more than it sounds: the escaping added for terminal-control safety was delegating to printf %q, which on macOS's bash 3.2 escapes only part of a multibyte character. A profile named with an RTL override printed as invalid UTF-8 with the override half-neutralised. It now escapes byte-wise into printable ASCII, byte-identical on bash 3.2 and 5.3, and every quoted word round-trips.

On the run side, dirty worktrees no longer bleed into each other and observer handoffs survive; the CLI now asks the question its own ambiguity score implies rather than a generic one; and disposable artifacts moved into SQLite instead of loose files.

Features

• Store disposable artifacts in SQLite (#2171)
• Install the dsh plugin when DeepSeek Harness is present (#2165)
• Let an advisory lane answer from what was recently found here (#2154)

Bug Fixes

• Quote dsh profile names without bash 3.2's broken printf %q — macOS emitted invalid UTF-8 and only half-escaped RTL overrides
• Isolate dirty runs and preserve observer handoffs (#2178)
• Ask the question the ambiguity score implies (#2176)
• Preserve DSH profile names in recovery output (#2170)
• Say the advisory findings body is a list, because it is (#2162)

Documentation

• Source tour mapping three mechanisms to file:line coordinates (#2173)
• Document both DeepSeek integration directions and the dsh backend contract (#2161)

---

What's Changed

• feat(advisory): let a lane answer from what was recently found here by @cohemm in #2154
• docs(deepseek): document both integration directions and the dsh backend contract by @Q00 in #2161
• fix(advisory): say the findings body is a list, because it is by @cohemm in #2162
• feat(install): install the dsh plugin when DeepSeek Harness is present by @Q00 in #2165
• fix(install): preserve DSH profile names in recovery output by @sergiobuilds in #2170
• docs: add source tour mapping three mechanisms to file:line coordinates by @Q00 in #2173
• fix(cli): ask the question the ambiguity score implies by @cohemm in #2176
• fix(ouroboros): isolate dirty runs and preserve observer handoffs by @Q00 in #2178
• feat(artifacts): store disposable artifacts in SQLite by @cohemm in #2171

Full Changelog: v0.51.7...v0.51.8

v0.51.7

Ouroboros now installs into DeepSeek Harness in one command

Ouroboros already spoke to DeepSeek in one direction: --llm-backend dsh points the interview/Seed/QA pipeline at DeepSeek's own models. This release answers the other direction — how a DeepSeek Harness user mounts Ouroboros — and replaces the hand-copied --patch overlay with a real, installable bundle:

dsh plugin --profile <your-profile> add "github:Q00/ouroboros#main&path:integrations/dsh-plugin"

Type ooo interview <goal> or ooo auto <goal> in a dsh chat afterward and the model finds the matching tool on its own — all 36 Ouroboros MCP tools register as mcp__ouroboros__*. The bundle ships no plugin code: it is one @deepseek-ai/dsh-mcp-client row spawning uvx --from 'ouroboros-ai[mcp]' ouroboros mcp serve over stdio, so uv on PATH is the only prerequisite.

Three boundary facts the bundle gets right, each traced into a running dsh rather than assumed:

• Credentials do not travel implicitly. dsh scrubs every credential-shaped name (/KEY|PASSWORD|SECRET|TOKEN/i) out of a child process by design, and a plugin's explicit env layer merges after that scrub. The bundle names a short allowlist (ANTHROPIC_API_KEY, DEEPSEEK_API_KEY) instead of a wildcard passthrough, and documents how to forward one more from your own profile.
• OUROBOROS_LLM_BACKEND=dsh is not a one-variable switch. Ouroboros spawns its own dsh-acp-demo child, which fails closed unless OUROBOROS_DSH_CONFIG_PATH names an absolute composition. Both prerequisites now reach the child, and the full procedure is documented rather than implied.
• Startup recovery is honest. A machine without uv still boots dsh with every other plugin working — but the published mcp-client has no reconnect loop, and the current one gives up after a bounded attempt budget, so the README says "reload the plugin or restart dsh" instead of promising backoff.

ooo update refreshes both hosts together

--runtime all upgrades the Ouroboros Codex marketplace and refreshes the Claude plugin in one pass, then runs ouroboros setup refresh for the installed artifacts. Your configured execution backend is preserved rather than silently reassigned to whichever host was refreshed last. The restart contract is documented too: Claude reloads plugins in place, while an active Codex session has to restart.

What's Changed

• feat(update): refresh Claude and Codex integrations together by @dj-wishket in #2112
• feat(integrations): add installable dsh plugin for Ouroboros by @Q00 in #2158

Full Changelog: v0.51.6...v0.51.7

v0.51.6

v0.51.6

Four tracks moved in this release. One opens a market, one was carried almost entirely by people outside the core, one gave the team back its afternoons, and one continued the long work of making the loop stop overstating what it finished.

---

Track 1 — DeepSeek Harness (dsh): the door to a market we could not previously enter

There is a version of this project's history in which Ouroboros only ever spoke one vendor's language. It would have been easier, and it would have quietly decided on the user's behalf which models were allowed to think.

dsh — alias deepseek_harness — is now a first-class completion backend (#2143). It drives DeepSeek Harness's automation ACP server for the entire in-process completion path: interview, seed, QA, evaluate. Everything the Socratic loop needs to converge a specification can run on DeepSeek.

This is a go-to-market change, not only an integration. A developer working where DeepSeek is the practical default — where Anthropic and OpenAI endpoints are not a realistic dependency — can now run the full specification-first loop end to end on infrastructure they already have, and pay for it in a currency they already use. Specification-first development should not require a particular passport.

What landed:

• DshAcpClient subclasses the existing ourocode ACP client through three narrow launch seams. dsh speaks the same ACP wire Ouroboros already implements, so this reuses proven machinery instead of growing a second protocol stack — the ourocode suite passes byte-identically.
• dsh's session/new indexes params.mcpServers.length unconditionally and rejects a non-empty list, so the client always sends mcpServers: []. Documented, not papered over.
• DshLLMAdapter reports an honest dsh-composition sentinel rather than fabricating a model id in audit metadata. The ACP wire carries no model parameter — dsh's Cordis composition file owns provider and model selection — and an audit trail that invents a value it cannot observe is worse than one that admits the gap.
• Security. OUROBOROS_DSH_CLI_PATH and OUROBOROS_DSH_CONFIG_PATH both join the untrusted .env denylist. The config path selects which Cordis composition a spawned Node process loads, and composition rows execute arbitrary plugin code — so it gets the treatment an executable path gets, not the lesser treatment a "config file" would normally receive.
• Verified against the real binary. A from-source build of deepseek-harness completed spawn → initialize → session/new → session/prompt dispatch into dsh's LLM layer, failing only at the expected terminal point: no API key on the verification machine. Everything short of the paid model call is proven, and we are stating that limit plainly rather than rounding it up.
• The full adoption analysis — what dsh has, what is worth borrowing, how to collaborate upstream — is in docs/research/deepseek-harness-adoption.md.

---

Track 2 — Contributors

Six people outside the release author shipped into this version, and between them they closed most of the gap between "Ouroboros is installed" and "Ouroboros is actually going to work on your machine."

@tmdgusya — zcode model-config readiness (#2147, closes #2148). setup and status health used to report every check green on a machine where the first workflow step would then fail mid-execution, because the ZCode CLI resolves its model from a config file the desktop app never writes. The new probe mirrors the CLI's own acceptance rules and names the exact gap — including the case where an object-form model.main is silently dropped by the CLI's parser, which is how an apparently complete config keeps failing.

@lee3Q — installation surface doctor (#2034). ouroboros doctor install reports every active surface: Python package, Codex plugin and cache, Claude Code plugin and cache, user-level MCP config, ZCode bridge. It repairs nothing, by design. ooo --version was never proof that every client integration was current, and now there is a read-only command that says so with paths and versions instead of vibes.

@sumin220 — update nudge reachability (closes #2066), and the legacy identity seam (#1899). The plugin MCP descriptor is now version-pinned and synced by the same release-prep pass as plugin.json, so a plugin update deterministically changes the uvx cache key; the SessionStart notice moved to stdout, the channel that actually enters agent context; and mcp serve appends the cached notice to its server instructions, so Codex, OpenCode, Kiro and every other MCP host finally receives it. The notice reads only the local cache, never the network, and can never delay or fail server startup. Separately, #1899 moved the pre-anchor project-identity path behind one observable seam with a finite, dated support window — sessions started before the Project Map anchor keep their resume authority, one decision point emits a structured local event when the legacy path activates, and removing the seam after the window requires a documented breaking change naming the last identity-compatible release. Log absence never authorizes deletion.

@bokjk — native Windows Codex Desktop HTTP task persistence RFC (#2101). Backed by preflight evidence gathered on real Windows 11 rather than assumed from documentation: RestartOnFailure did not relaunch on exit code 7 or on 0xC0000005, while RegistrationTrigger with one-minute repetition did. The RFC therefore promises evidence-backed periodic launch attempts instead of claiming failure-aware restart — and replaces HKCU Run with one explicit opt-in, least-privilege Scheduled Task contract.

@dj-wishket and John — hooks fail-open and trust boundaries (#2111 and follow-ups). Hooks now fail open when the plugin cache root disappears, align Codex development fail-open behavior, and reject untrusted packaged fallback roots. A hook that hard-fails on a missing cache directory blocks the user from working; a hook that trusts an arbitrary fallback root is worse. Both edges are now closed.

---

Track 3 — Test and CI performance

The suite had grown expensive in a way that taxes every contributor on every push. Eleven changes went after it, and none of them weakened a contract: every retry count, every degradation path, every ratio assertion still holds. What was removed was waiting.

CI shape (#2142). Every PR previously ran the full suite three times — 3.12, 3.13, 3.14 — with coverage instrumentation, roughly 15 minutes and three runners per PR. PRs now gate on the 3.12 floor without coverage; pushes to main keep the full matrix, the litellm-free dependency profile, and Codecov upload. PR gate ~15 min → ~4–6 min, three runners → one. Version-specific regressions move from PR-time to merge-time detection, still strictly before release.

Wall-clock in the suite itself:

• install.sh runtime-selection tests were the largest CPU sink at ~80s, because macOS charges a ~0.3s system scan on the first exec of every newly created executable and the harness wrote fresh stubs per test. Caching the stubs took the worst test 7.59s → 0.64s and the file ~80s → ~33s (#2134).
• The codex help-probe contract tests stalled a real 5s each on the probe budget; injecting HELP_PROBE_TIMEOUT_SECONDS took 5.01s + 5.01s + 3.02s → all sub-second, with the production default unchanged. The contract under test was that an overrun means uncertainty, not how long the overrun lasts (#2136).
• Retry-ladder tests slept through the real production backoff. Mocking only those sleeps took each affected test ~3.0s → ~0.01s while still asserting the retry attempt counts (#2137).
• The picker projection budget benchmark — the single largest time block in the unit suite, two parametrizations alone at 16.6s and 15.9s — halved its bulk event count to 50k. It asserts ratios, not absolutes (#2133).
• Fingerprint tests stub git identity and version probes (#2138); conftest renders logged exceptions with plain tracebacks instead of rich ones (#2132); api_retry backoff is overridable for shell tests (#2135).

And tests that stopped breaking for the wrong reason. Documentation contract tests now assert durable anchors — section headings, command and tool invocation strings — instead of verbatim prose, some of which had been pinned to specific line-wrap positions (#2131). Removing a documented command still fails the suite; rewording around it no longer does. test_detached_auto_docs.py shrank 969 → 518 lines while keeping every behavioral test. Copy-paste variants in the orchestrator and auto suites were folded into parametrized tables (#2139, #2140, #2141), and the install one-liner test now checks every documented one-liner rather than only the first (#2130).

---

Track 4 — auto stops overstating what it finished

The loop's account of its own work is load-bearing. Four changes made it more honest.

• The Seed QA gate is advisory rather than a dead end (#2119), and now carries a bounded, normalized transport diagnostic in the durable advisory event so a transient evaluator failure leaves evidence instead of silence (#2144).
• Retired persisted phases explain their migration path before the production watchdog can rewrite the result as a generic timeout (#2145). A migration notice reported as "timed out" sends the operator to the wrong problem.
• run successors are delegated to the run job's own chain (#2120), and auto no longer calls a Seed complete when it never ran a verified product (#2127).

---

Toward 1.0.0

The remaining distance is not measured in features. It is measured in how many claims this system makes that it cannot back — and this release retired several: in the install surface, in the healt...

v0.51.5

What's Changed

Features

• Persistent default execution policy for fresh starts (#2104)

Documentation

• Add mcp-name ownership marker to README for MCP registry publication (#2115)

Full Changelog: v0.51.4...v0.51.5

What's Changed

• docs(readme): add mcp-name marker for MCP registry ownership check by @Q00 in #2115
• feat(config): persistent default execution policy for fresh starts by @sumin220 in #2104

Full Changelog: v0.51.4...v0.51.5

v0.51.4

What's Changed

• feat: add activation and workflow recovery telemetry by @Q00 in #2106

Full Changelog: v0.51.3...v0.51.4

v0.51.3

What's Changed

Features

• Optional channel attribution via OUROBOROS_INSTALL_REF (#2067)
• Add loop-engineering discovery keywords to plugin manifests (#2076)

Bug Fixes

• Refuse unbound regex evidence as grounds to overturn an agent FAIL (#2065)
• Normalize legacy shipped defaults on Claude backends (#2089)
• Scope pyproject.toml description to the worker's contract (#2088)
• Normalize CLI JSON output fail-closed (#2043)

Documentation

• Reframe README hero around the loop, not the contract mechanics (#2092)
• Reposition llms.txt/llms-full.txt away from spec-first framing (#2086)
• Reposition README hero away from crowded spec-first framing (#2084)
• Add Homebrew tap install instructions to READMEs (#2081)
• Add naming-collision notes distinguishing us from razzant/ouroboros (#2074, #2080)
• Attach OUROBOROS_INSTALL_REF to install one-liners (#2072)
• State both ways past the ambiguity gate (#2060)
• Show all four hosts as one grid (#2063)
• Link the guide site from the nav row (#2062)
• Show the interview running inside a host, not just the CLI (#2058)
• Drop the universal-quantifier claim in the summary (#2051)
• Move the interview recording above the fold (#2055)
• Add loop-engineering keyword to PyPI metadata (#2053)
• Show the TUI monitor in cli-reference (#2096)
• Hero claims replayable, not reproducible (ko) (#2099)
• One description for both manifests (plugin.json/marketplace.json) (#2040)
• Clean up README.ko.md/README.zh-CN.md

Maintenance

• Add MiniMax-M2.7 model metadata (#2100)
• Add agentic-loop and loop-engineering keywords to pyproject.toml (#2054)

Full Changelog: v0.51.2...v0.51.3

What's Changed

• docs(pypi): add loop-engineering keyword by @Q00 in #2053
• docs(readme): move the interview recording above the fold by @Q00 in #2055
• chore(pyproject): add agentic-loop and loop-engineering keywords by @Q00 in #2054
• docs(pyproject): drop the universal-quantifier claim in the summary by @Q00 in #2051
• fix(claude): normalize CLI JSON output fail-closed by @Q00 in #2043
• docs(readme): show the interview running inside a host, not just the CLI by @Q00 in #2058
• docs(readme): link the guide site from the nav row by @Q00 in #2062
• docs(readme): show all four hosts as one grid by @Q00 in #2063
• docs(plugin): one description for both manifests, saying what the directory does not already have by @Q00 in #2040
• docs(readme): state both ways past the ambiguity gate by @Q00 in #2060
• feat(install): optional channel attribution via OUROBOROS_INSTALL_REF by @Q00 in #2067
• docs: attach OUROBOROS_INSTALL_REF to install one-liners by @Q00 in #2072
• docs: add naming-collision note distinguishing us from razzant/ouroboros by @Q00 in #2074
• feat(plugin): add loop-engineering discovery keywords to manifests by @Q00 in #2076
• docs(plugin): sync marketplace.json descriptions to plugin.json's text by @Q00 in #2078
• docs: add naming-collision note to llms-full.txt by @Q00 in #2080
• docs: add Homebrew tap install instructions to READMEs by @Q00 in #2081
• fix: scope pyproject.toml description to the worker's contract by @Q00 in #2088
• docs: reposition README hero away from crowded spec-first framing by @Q00 in #2084
• docs: reposition llms.txt/llms-full.txt away from spec-first framing by @Q00 in #2086
• fix(config): normalize legacy shipped defaults on Claude backends by @sumin220 in #2089
• docs: reframe README hero around the loop, not the contract mechanics by @Q00 in #2092
• docs: show the TUI monitor in cli-reference by @Q00 in #2096
• docs(ko): hero claims replayable, not reproducible by @Q00 in #2099
• Add MiniMax-M2.7 model metadata by @octo-patch in #2100
• fix(verification): refuse unbound regex evidence as grounds to overturn an agent FAIL by @Q00 in #2065

New Contributors

• @octo-patch made their first contribution in #2100

Full Changelog: v0.51.2...v0.51.3