Claudexor 3.0.2

Claudexor 3.0.2

(2026-07-21) — Linux subscription-quota parity for Claude. The
per-profile quota reader (oauth/usage source) read the access token only
from the macOS keychain item, so on Linux quota --refresh returned a
misleading not_logged_in absence for every logged-in claude account while
runs and doctor were green. Off macOS the reader now uses the vendor's own
store — .credentials.json (mode 0600) inside the profile's config dir —
with the same transient-token discipline (one usage request, never
persisted/logged/in errors). A missing file stays an honest
not_logged_in; an unreadable or unparseable file is a typed
refresh_failed naming only the error class. macOS behavior is unchanged;
Codex quota was already file-store-portable. Also: README badges and an
author section.

Signed, notarized, stapled, SBOM-backed and provenance-attested.

Claudexor 3.0.1

Claudexor 3.0.1

(2026-07-20) — hotfix: every browser-downloaded 3.0.0 DMG crashed
at launch (EXC_BREAKPOINT in applicationDidFinishLaunching). The SwiftPM
Bundle.module accessor fatalErrors when the resource bundle fails to load,
and a quarantined process refuses the plist-less bundle swift build emits.
Fixed twice over: the Dock-icon override (essential for the bare dev
executable, harmlessly re-applied by the packaged app) is now resolved by
plain file path (no Bundle.module, cosmetic degrade instead of crash),
and build-app.sh writes a minimal Info.plist into the resource bundle.
If you downloaded 3.0.0: upgrade to this DMG — that is the fix. Only if
you must stay on 3.0.0, first verify you have an intact app signed by the
official Claudexor Developer ID:
spctl -a -vv /Applications/Claudexor.app must report Notarized Developer ID AND origin=Developer ID Application: Andrei Kaznacheev (N7RDVVZ7LA) — a generic notarization line alone proves only that
some notarized app sits at that path. (Signer identity proves an intact
official build, not byte-identity with the published artifact; for that,
check the downloaded DMG against SHA256SUMS on the release page.) Only
then drop the quarantine flag:
xattr -d com.apple.quarantine /Applications/Claudexor.app.

Signed, notarized, stapled, SBOM-backed and provenance-attested.

Claudexor 3.0.0

Warning

Known issue: the 3.0.0 app crashes at launch when installed from a browser-downloaded (quarantined) DMG. Fixed in v3.0.1 — download that instead.

Claudexor 3.0.0

(2026-07-20) — the chat-first control plane, rebuilt on honest
server truth. This is a breaking major: a fresh ~/.claudexor/v3/ data root
(the old ~/.claudexor/v2/ root is left untouched as the archive; no
migration), wire protocol major 3, and a single chat-first macOS app.
Modes collapse to Ask / Plan / Agent — Orchestrate is gone and delegation is
agent --delegate with a scoped six-tool MCP belt (isolated sub-runs, depth
1, count and budget caps enforced server-side). Plan absorbs Spec: native
vendor plan modes, typed open questions, answer turns, freeze-on-implement
with a hashed ExecutionBrief, and the Council strategy. Continuity is the
flagship: durable per-lane native sessions keyed by (thread, harness,
profile), lane checkpoints, bounded continuation packets with cached LLM
summaries, and a visible typed disclosure when a lane switch carries thread
context. Status is independent axes (lifecycle / checks / review / no-changes
/ typed reason) rendered as Working / Done / Done · not verified / Needs
review / Failed / Cancelled / Interrupted, with a server-owned outcome banner
that model prose can never outrank; unknown cost renders "—", never $0.
Accounts are fully symmetric — every row has an Enabled toggle (participates
in pickers and auto-rotation), the next-up account among the enabled ones is
computed and shown, threads keep their account and access sticky with a
per-thread pin/override, and native CLI login is just a row. The engine
owns every fact; macOS, MCP, and ACP are thin clients that decode, not
derive: a thread-scoped Changes / Artifacts / Evidence workspace with typed
LoadState, a shared ChipMenu, global
text selection, code-first route descriptors feeding the generated operation
catalog, and TS↔Swift fixture round-trips. A runtime-closure update CHECK reads
the release manifest ({version, sha256, minAppVersion, notes}; the signature
field is reserved) and surfaces a newer engine as a bottom-left chip
that links to the GitHub release for a manual download (one-click in-app
auto-install of the engine runtime is deferred to 3.1); a zero-telemetry
install counter reads public npm and GitHub stats.
The immune system guards all of it: staged-field v3, the INV→verify link
gate, the concept gate, reviewer liveness with a typed blocker contract, and
a cumulative findings ledger. The review protocol is a single canonical
cycle (internal critics + the exact triad plus scope reviewer, one
adjudication, one batched fix, one confirmation wave). Upgrade note: v3 boots
on its own data root, so the first launch starts clean; existing v2 state and
run history remain readable only under the archived ~/.claudexor/v2/ path.

Signed, notarized, stapled, SBOM-backed and provenance-attested.

Claudexor 2.1.3

Claudexor 2.1.3

(2026-07-18) — account and large-run reliability finish.
Accounts now have one shared Manage surface with Back/Done navigation,
manual thread pinning, auto-balance, and safe deletion. Claude native
subscription auth works in scoped runs without mutating ~/.claude.
Large run details are single-flight and progressive: bounded primary output,
metadata-only diagnostics, tab-demand diffs, bounded transcripts, and
restart-safe Spec interviews. Best-of-N now uses file-backed synthesis,
preserves winner screenshots, reports honest candidate/tool failures, and
separates native subscription valuation from API-key cash (including mixed
reviewer panels). Plan review is typed as plan review; exhausted account
rotation, zero configured gates, and candidate errors are explicit evidence.
Upgrade note: Claude's default native store moved from ordinary ~/.claude
to Claudexor-owned state, so existing users complete Login once in Accounts
(or Settings → Harnesses → Claude → Manage); ordinary Claude Code remains
untouched.

Signed, notarized, stapled, SBOM-backed and provenance-attested.

Claudexor 2.1.2

Claudexor 2.1.2

(2026-07-18) — the credential-profiles release, published as
2.1.2 after two npm-infrastructure burns: the v2.1.0 flight died on npm's
post-publish indexing lag (the publisher's exposure window was too small),
and the v2.1.1 flight on two more npm realities — the attestation endpoint
lags like the version listing, and package builds are not byte-reproducible
across CI runs, so retries demanding local byte-identity could never pass.
Both partial version sets are orphaned on the registry (npm forbids
re-publishing a version); nothing user-visible shipped as 2.1.0 or 2.1.1.
The publisher now waits out both npm endpoints (bounded 10-minute polls)
and anchors retry skips on npm's signed SLSA provenance (same repo/
workflow/tag/candidate commit + published-bytes digest) instead of
impossible byte-identity. On top of the 2.1.0 scope below, this release
adds account deletion
end-to-end (DELETE /v2/credential-profiles/:harness/:id with a
delete-grade confinement fence and disclosed cleanup, claudexor profiles remove, delete on account rows) and ONE shared accounts surface
(AccountsSurface) reused by the bottom-left popover and the Settings
Harness Doctor's Manage sheet, plus the owner-review release protocol
constitutionalized as INV-125.

The 2.1.0 scope: credential profiles (INV-135) and the honest-UI
finish of the 2.x cycle. Multiple subscriptions per harness: durable
non-secret credential_profiles registry, isolated vendor config dirs
(claudexor profiles login), namespaced secret slots, strict per-turn /
thread-sticky selection, profile-isolated native-session resume, and
per-profile doctor probes (GET /v2/credential-profiles). Subscription
quota is now read proactively per profile from the vendor oauth/usage
endpoint (token transient-only, never persisted or logged) with per-profile
chips in the quota footer, plus the live-verified codex
rateLimitResetCredits balance. One typed profile_policy per harness
(fail|ask|rotate): preflight headroom breaches and typed vendor-limit
rejections rotate with full provenance — never on plain network errors,
never mid-spawn, each profile at most once per attempt. Also in 2.0.1/2.0.2
(unpublished patch steps folded into this release): the honest-engine pass
(shutdown state-machine with an uncancellable drain sweep, daemon-owned
retention with tombstones, typed final-answer assembly, harness-stream
reference + manifest-declared stream conformance) and the simple-UI pass
(messenger chat cards, flat one-row-per-tool transcripts, RunFacts SSOT,
daemon-normalized readiness rows, cause-driven single-CTA auth sheet,
typed budget.cash disclosure; INV-134 presentation discipline). Claude
api_retry error prose now classifies onto the documented retry categories.

Signed, notarized, stapled, SBOM-backed and provenance-attested.

Claudexor 1.0.1

Claudexor 1.0.1

(2026-07-09) — the macOS app is now SIGNED (Developer ID +
hardened runtime), NOTARIZED, and stapled: no Gatekeeper bypass needed.
Fixed the v1.0.0 app's self-contained daemon, which crashed at load in
the single-file bundle (createRequire(import.meta.url) is undefined in
CJS bundles; the generated-schema loads are now static JSON imports and
the build runs a boot smoke on the freshly built bundle, so a load-crash
can never ship again). The bundled Node runtime is signed with the JIT
entitlements hardened runtime requires. Release automation: signing is
data-driven off repository secrets (secret-less builds still produce
honest -unsigned artifacts), re-packaging a published release no
longer demotes it to draft, and npm publishing completes the package
set. CLI: spec --answers now refuses grounding-only flags
(--harness/--n/--web/--effort/--max-usd/--reviewer-*) instead of
silently ignoring them, and the spec grounding run honors
--effort/--max-usd cost controls.

Built by GitHub Actions from tag v1.0.1 at commit df815cf.
The macOS app is Developer ID-signed, notarized, and stapled; macOS 26 or newer is required.
Verify downloads with the attached SHA256 files.

Claudexor 1.0.0

Claudexor 1.0.0

(2026-07-09) — the first public release. Three programs land
on top of v0.15: PUBLICATION HYGIENE — provenance sweep of the whole tree
(private paths, internal codenames, decision-register markers), sanitized
recorded fixtures with enforced provenance, a community trust pack
(SECURITY.md, issue/PR templates, Dependabot, no-telemetry Privacy and
uninstall/data maps), and supply-chain pinning (pnpm allowBuilds, no
dependency install scripts). AGENT CONTRACT — the CLI surface has ONE
typed owner (command-registry.ts) that renders claudexor help, the
machine-readable help --json, plugin instruction texts, and the
docs/parity gates; a derived AgentCapabilityCatalog answers "what can
this install do right now" identically over claudexor capabilities --json, GET /agent-capabilities, and the MCP claudexor_capabilities
tool; MCP tools declare outputSchema + structuredContent + behavior
annotations and gained read-only recovery tools (claudexor_runs,
claudexor_inspect, claudexor_apply_check); every run result carries a
derived applyEligibility verdict (one producer: the delivery gate);
every Zod schema ships field-level .describe() docs and
docs/reference/endpoints.json maps the control API with schema refs;
docs/AGENT_ONBOARDING.md orients external agents. NAMING AND SAFETY —
BREAKING: the run verb is now agent and race is best-of
(old spellings hard-error with the new name; the MCP race tool is
claudexor_best_of); secret-like values inside prompts are HARD-BLOCKED
at every ingress (CLI, control API, thread turns, MCP, ACP, daemon
socket, and the engine boundary itself) with a typed
inline_secret_rejected error and no bypass; the feature-status ledger
was emptied (26 fixes landed; deliberate boundaries moved to Design
constraints in ARCHITECTURE/INTEGRATIONS); strictness upgrades:
out-of-scope flags now hard-error per verb (e.g. explore --swarm,
spec --model), --access-default requires a value, and unknown verbs
return the {ok:false} JSON envelope under --json. The npm publish
pipeline (provenance, lockstep parity, claudexor bin wrapper over
@claudexor/cli) ships in this release and is armed by the operator
once the registry namespace is provisioned; this release's install
paths are the DMG below and building from source.

Built by GitHub Actions from tag v1.0.0 at commit d605e1d.
The macOS app, DMG, and ZIP are unsigned and not notarized; macOS 26 or newer is required.
Verify downloads with the attached SHA256 files.