v4.4.0

v4.4.0 - AAC v5 Reliable Antigravity Workflow

Changed

• Compact Always-On Policy: Replaced the oversized procedural AGENTS.md with a behavior-first policy under 600 words.
• Focused Skills: Replaced six broad, duplicated skills with four task-specific skills for quality, verification, security, and architecture.
• Discoverable Custom Agents: Added planner, implementer, reviewer, and security-reviewer agents using the official .agents/agents/*.md format.
• Stack-Aware Verification: Added scripts/verify.py to detect available project commands instead of guessing generic test commands.
• Instruction Budgets: CI now validates and rejects oversized always-on, agent, or skill instructions.

v4.3.5

Workflow hardening

• Added Antigravity CLI compatibility metadata for the tested CLI/docs baseline.
• Added scoped sandbox, command, file, URL, and MCP permission examples.
• Added recovery and structured release validation.
• Removed stale completed plan state.
• Hardened Linux and Windows installers with staged validation, immutable refs, backups, cleanup, and local-state preservation.
• Added Windows PowerShell syntax CI coverage.
• Documented the Antigravity/OpenCode configuration boundary.
• Replaced undocumented native command claims with official Antigravity workflow commands.

Validated by Structural Validation, SAST + Secret Scanning, and Windows Installer Syntax checks in PR #104.

v4.3.4

Antigravity CLI best-practice alignment

• Corrected workspace MCP schema to use .
• Flattened six workspace skills to .
• Added sandbox-first settings baseline.
• Added dependency-free Antigravity contract validation.
• Hardened Linux and Windows installers with immutable release pinning, cleanup, backups, and local-state preservation.
• Added CI contract validation, manual dispatch, least-privilege permissions, and installer syntax checks.
• Tracked the active execution plan and removed stale plan state.

Validated by the structural and SAST CI checks in PR #102.

v4.3.2

Added

• MCP-First Priority Fallback: Established a strict Platform Interaction Priority Fallback (Priority 1: MCP, Priority 2: CLI, Priority 3: Human Report) to maximize AI-native API interactions before falling back to CLI.
• Git Conventional Standards: Enforced Git Conventional formats for all Issue Titles (feat: ..., fix: ...) and required professional, highly detailed Issue Bodies (Description, Acceptance Criteria).
• PR-First Workflow: Prohibited direct merges to main. Enforced gh pr create and gh pr merge as the mandatory integration pathway.

Fixed

• Issue ID Hallucination: Added an explicit Anti-Hallucination Gate prohibiting the agent from guessing or hallucinating Issue IDs. The agent MUST empirically verify or create issues via CLI/MCP.
• Continuous Release Syncing: Ensured every merged PR triggers a mandatory update to CHANGELOG.md and a new version bump / GitHub release.

v4.3.1

Added

• Standard Issue-Driven Git Workflow: Added strict standard flow enforcing: Create Issue -> Create Branch -> Conventional Commit -> Push -> Merge -> Clean Branch.
• Gitea Timetracking Integration: Enforced accurate timetracker updates for every Gitea issue upon completion.
• Single Active Plan Priority: Introduced timestamp-based prioritization for .agents/plans/*.md to eliminate context switching amnesia.

Changed

• Strict Pre-Execution Gates & Token Efficiency: Rewrote AGENTS.md to aggressively enforce pre-execution issue/plan gates (HARD STOP). Compacted the directive to under 60 lines with a strict <= 150 characters per line limit to maximize context token efficiency.
• Clean Markdown Standards: Removed messy inline math formatting from devops-manager/SKILL.md in favor of standard markdown lists.
• Humanized Skill Modules: Completely refactored all internal AI skill modules to replace robotic instructions with a natural, collaborative persona.

Fixed

• Plan File TOCTOU Race Conditions: Fixed state loss vulnerabilities by mandating POSIX Directory Locks for plan files.
• Atomic Backup Safety: Hardened updates by enforcing strict cp shell backups before any plan writes.

v4.3.0

Added

• Task-Driven Execution Protocol (.agents/plans/*.md): Transitioned from volatile state pointers to file-backed micro-task checklists as the Single Source of Truth, enabling zero-amnesia session recovery.
• Humanized Senior Co-Pilot Persona (soul.md): Upgraded agent persona to embody an authentic, warm, senior engineering partner with zero-yes-man technical firmness.
• Zero-Assumption System State Schemas (schema.md): Defined explicit structural data contracts for .agents/plans/<task-slug>.md, .agents/locks/<hash>.lock/owner.json, and .agents/brain/audit.jsonl.
• Session Boot Anti-Amnesia Pre-Checks (AGENTS.md): Hardened memory recovery to run direct filesystem scans and empirical test verification before executing uncompleted micro-tasks.
• Docker / Podman Gitea MCP Integration: Aligned Gitea MCP server setup with gitea.com/gitea/gitea-mcp stdio specification using container runner (gitea/gitea-mcp:latest) with GITEA_HOST and GITEA_ACCESS_TOKEN.
• POSIX Directory-Based Mutex Locks (.agents/locks/): Implemented atomic directory creation (mkdir -p .agents/locks/<md5_hash_of_filepath>.lock) with owner.json metadata and 60-second auto-expiration to resolve TOCTOU race conditions across parallel subagent executions.
• Mandatory Swarm Triggers: Added explicit triggers in AGENTS.md and config.json requiring Orchestrator subagent spawning for multi-file audits ($\ge 3$ files) and multi-domain tasks.
• Decisions & /grill-me Ledger: Introduced mandatory ## 1. Decisions & Architectural Trade-offs section in task plans to freeze user directives, design choices, and /grill-me interview logs directly to disk.
• Strict Pre-Execution Hard-Lock Gate: Prohibited any source code edits until (1) a granular plan file exists in .agents/plans/ AND (2) a dedicated Git branch (task/<slug>) is created.
• Zero-Batching & Empirical Verification Gate: Enforced single micro-task execution per turn with mandatory physical CLI output (exit code 0 from npm test or tsc) before marking tasks - [x].
• Empirical Artifact Pre-Check & Auto-Backup (.bak): Added plan file .bak backup protection and full empirical test checks on existing files during session boot to prevent redundant code execution.
• Git Merge Conflict & Rebase Protocol: Added strict git rebase main requirements in devops-manager prior to testing, prohibiting merge conflict markers (<<<<<<< HEAD) from reaching source code.
• Stale Lock Pruning Protocol: Added automated owner.json timestamp scanning in system-janitor to purge locks older than 60 seconds.

Changed

• Gitea Token & Host Standardization: Renamed legacy GITEA_PAT to official GITEA_TOKEN and added explicit GITEA_HOST across .env, .env.example, mcp_config.json, and env-required.json.
• Optimized Core Directive Length: Refactored AGENTS.md to 153 lines per Google Antigravity Best Practices to maximize LLM attention window performance and eliminate context token bloat.
• Symmetrical Tiered Execution Thresholds: Refactored execution tier criteria to Tier 1 (< 50 lines single file), Tier 2 ($\ge$ 50 lines or multi-file), and Tier 3 (> 100 lines or core architecture refactors).
• Skill Core Version Decoupling: Updated all 6 core domain skills (code-engineer, system-architect, quality-assurance, devops-manager, security-docs-auditor, system-janitor) to require core version >=4.3.0.
• Installer Script Scaffolding: Updated install.sh and install.ps1 to automatically create .agents/locks/ scaffolding during one-line installations and completely purged obsolete state.json reset logic.

Fixed

• Manifest Complete Consistency: Added audit.jsonl, env-required.json, and mcp_config.json explicitly to AGENTS.md Complete Directory Manifest.
• Legacy Interactive Syntax Removal: Replaced deprecated ask_question function calls in devops-manager/SKILL.md with natural agent conversation directives.
• Orphan Scratch Context Leakage: Resolved context confusion across session switches by enforcing autonomous purging of orphan ephemeral files in .agents/scratch/ during Session Boot.
• TOCTOU Race Condition in Parallel Subagents: Fixed file locking race conditions by replacing file-level JSON mutations with atomic POSIX directory creation using MD5 filepath hashing.

Removed

• Legacy state.json Persistence File: Completely eliminated .agents/brain/state.json and its schema references from schema.md, AGENTS.md, and README.md, deprecating volatile state tracking.
• Obsolete Config & Registry Files: Removed deprecated "task_claim_lock" key from config.json and purged duplicate mcp-registry.json file.

v4.2.1

[4.2.1] - 2026-07-27

Added

• Automated Rollback & Recovery Protocol: Added Section 6.5 to AGENTS.md enforcing automatic hard resets (git reset --hard HEAD / worktree purge) and post-mortem incident generation after 2 consecutive test verification failures.
• Parallel File Locking Protocol (Mutex): Added Section 5.3 to AGENTS.md requiring subagents to claim explicit file-level path locks in state.json -> claimed_tasks to prevent write collisions during parallel execution.
• Framework-Specific Detection & Adaptation: Added Section 3.5 to .agents/common/utils.md for explicit stack rules covering React/Next, Vue/Nuxt, Svelte, Django, FastAPI, Flask, Express, NestJS, Spring Boot, and ASP.NET Core.
• MCP Health Check & Primary Protocol: Formalized MCP health ping on startup and graceful fallback chain (MCP -> Native Git -> User Prompt).

v4.2.0

[4.2.0] - 2026-07-27

Added

• Multi-Agent Execution Topologies: Introduced Parallel Swarm Topology (for independent multi-domain audits) and Sequential Pipeline Topology (stage-gated dependency ordering for architecture, development, and QA).
• Synchronization Barriers & Mutex Task Locking: Guaranteed zero-skipped responses for concurrent subagents via claimed_tasks mutexing and Orchestrator execution freezing until all subagents finish.
• Universal Polyglot & Legacy Framework Detection: Expanded utils.md and code-engineer skill to idiomatically support 14+ language ecosystems (TypeScript, JavaScript, Python, Go, Rust, PHP, Java/Kotlin, C#/.NET, Dart/Flutter, C/C++, Swift, Elixir, and legacy ASP/VB6).
• Human-Centric Engineering Co-Pilot Persona: Overhauled .agents/brain/soul.md to embody a warm, friendly Senior Partner persona who is uncompromisingly firm on code quality and zero "Yes-Man" pushback.
• 5-Dimension Performance Profiling: Upgraded quality-assurance skill to profile CPU execution, File & Network I/O, Database connection pooling, Heap memory leaks, and historical baseline tracking via .agents/brain/perf-baseline.json.

Changed

• 6 Core Domain Skills Consolidation: Streamlined 15 redundant skill directories into 6 high-precision core domain skills (code-engineer, system-architect, quality-assurance, devops-manager, security-docs-auditor, system-janitor), reducing initial token bloat by >60%.
• Google Antigravity Standard Alignment: Formalized AGENTS.md as the supreme workspace directive, defining strict precedence over project-specific GEMINI.md files.

Fixed

• Hardcoded Credential Redaction: Fully remediated hardcoded secrets in .agents/mcp_config.json and .env using environment variable substitution (${GITHUB_PAT}, ${GITEA_PAT}).
• Anti-Snippet Tunnel Vision: Explicitly prohibited inferring data structures from truncated snippets; enforced full symbol definition inspection.

v4.1.4

[4.1.4] - 2026-07-25

Added

• Task Entrypoint SOP: Introduced .agents/TASK_TEMPLATE.md to force agents to explicitly check off pre-flight and execution requirements before coding, addressing behavioral eagerness.

Fixed

• State Initialization Bypass: Injected a CRITICAL ENFORCEMENT rule at the very top of AGENTS.md and created default .agents/brain/state.json and .agents/brain/audit.jsonl files to resolve agents silently skipping the State Management Protocol.
• Full Audit Fixes (Priority 1-4):
  • Added State Lock Protocol and State Recovery Mechanism to prevent corruption.
  • Added Token Budget Management to prevent context window bloat.
  • Added Orchestration Deadlock Detection to prevent infinite recursive loops.
  • Added Prompt Injection Sanitization for ask_question inputs.
  • Added MCP Plugin Verification and Degradation Protocol for service unavailability.
  • Enhanced all 9 skills with audit recommendations (Provenance Verification, Rollback Verification, Memory Leak Protocols, CI Integration, Mobile Accessibility Tests).
• Hermes Protocol & Self-Learning:
  • Implemented the Hermes Protocol in AGENTS.md to distinguish between static rules and dynamic procedural skill generation.
  • Forced agent auto-learning by injecting rules.md loading into TASK_TEMPLATE.md Pre-flight checklist.
  • Generated new branch-janitor skill autonomously to handle cleanup of stale local/remote branches.
  • Generated polyglot-developer and advanced-debugger skills to enforce language-agnostic clean code standards and scientific debugging methods.
  • Generated ci-cd-specialist, data-synthesizer, and context-optimizer to complete the 15-module Elite Enterprise architecture (handling pipelines, mock data, and token bloat compression).

v4.1.3

Fixed

• Supply Chain Security: Pinned GitHub Actions (actions/checkout and gitleaks-action) to full 40-character commit SHAs instead of mutable tags (@v4, @v2) to resolve Semgrep SAST blocking findings.