Collomia v0.3.0

Collomia v0.3.0

Adds Orchestrated Goal, an opt-in execution mode for evidence-gated durable
execution, and closes an integration permission gap that affects everyone.

Standard mode remains the default and always will be — that is a recorded
decision, not a staging state.

---

⚠️ Read this first

One change affects you even if you never use the new mode.

Delegate integration is now authorized against the same resolved path the write
tools are judged against. This sits in the shared apply helper, so /agents apply and the delegate integration tool are covered.

On a workspace reached through a symlink — on macOS anything under /tmp or
/var, and generally any symlinked checkout — a scoped deny rule written in
the resolved form the configuration documents stopped write_file but did
not match at integration. Publishing a delegate's candidate was a way around
a rule that had already been obeyed.

If you have such a rule and a symlinked workspace, an integration that
previously succeeded is now refused, and the refusal names the rule. That is the
defect being fixed. With no symlink in your workspace path, nothing changes.

---

Orchestrated Goal

The model proposes a bounded dependency graph; the runtime owns readiness,
attempts, evidence freshness, recovery, budgets, and the terminal outcome. You
select it per session — it is never entered on your behalf.

Two shapes, with different maturity:

• End-to-end graphs with governed read fan-out — supported. At most two
  read-only workers run for independently ready nodes before the serial primary
  lane. Measured: roughly half the critical path on substantive independent
  reads, for about twice the tokens.
• Isolated-writer candidate waves — still experimental. Writers work in
  separate Git worktrees, each candidate is verified in its own tree, and the
  run stops with your workspace byte-for-byte unchanged until you publish a
  candidate yourself.

New commands:

/orchestrate [goal | approve | status [node] | pause | resume | retry <node> |
              extend | integrate <node> | verify | waive <reason> |
              reconcile | discard <node> [confirm] | cancel]
/restore integration [<id> [keep]]

The user guide covers when to reach for it and when not to — every case it
names cites the evaluation that measured it. In short: it buys containment and a
review boundary, and pays for them in repeated verification and in steps you take
yourself. A good trade when a change might be wrong; a bad one when it probably
is not, and a bad one for steps that touch the same files.

Also added

• Evidence-gated goal completion in Standard mode: a tool-free response is
  checked against the active plan, terminal-step evidence, successful
  conventional verification after tracked writes, and unresolved tool failures.
• First launch continues into a verified session rather than ending at setup.
• A provider is no longer assumed as a built-in default. A fresh install enters
  verified provider setup instead of presuming a local Ollama is running.

Fixed

Most of these are ways a run could report something untrue about its own result.
A completion message is what you act on, so they are treated as defects.

• A graph that had integrated a candidate could not be reopened after a
  restart. Two evidence statuses were missing from the snapshot validator, so
  resuming or archiving such a session reported it as structurally false. Any
  session left in that state can now be read again with no action from you.
• A completed graph no longer claims every required node passed its acceptance
  gates when that is not what happened — it says so when a revision retired an
  unfinished node, when nodes finished on your written waiver rather than
  machine-observed verification, and when an earlier node's passing checks were
  superseded by later work.
• A candidate wave that could not take every approved node reports which ones it
  never started, says they are waiting on your review rather than blocked, and
  warns that releasing the graph would abandon them. It previously called itself
  finished.
• Blocked nodes name the check that failed rather than reporting an exit code.
• A candidate rejected because the workspace or its Git base moved names which of
  the two changed, and says the candidate survived and where — it previously read
  as though the work had been lost.
• Integration refused because its retained worktree no longer exists says so,
  rather than reusing the wording for a genuine path mismatch.
• Integration, verification, and waiver all refuse while an earlier publication
  into the workspace never recorded an outcome, naming the checkpoint and both
  ways to resolve it.

Notes for upgraders

• Orchestrated Goal persists under graph schema 1 with additive fields only.
  Sessions written by earlier versions load unchanged.
• The candidate wave runs your repository's detected verification set once per
  candidate worktree and again over the combined result — three rounds against
  one. That cost scales with your suite, not with the size of the change.
• Full changelog: v0.2.2...v0.3.0