Agentflow v0.0.12

Added

• Measure the exact outbound package in handoff preflight: handoff, manifest,
  context, and pinned skill files, with file count, total and duplicate bytes,
  and a package digest. Owners can declare byte limits per task class and
  provider in package_limits. Agentflow ships none, so an undeclared limit is
  reported as uncalibrated. A package over its declared limit fails preflight
  unless an owner approves that exact digest with --package-exception and
  --decision-ref. See #67.

• Require an explicit review verdict from external review handoffs. The
  authenticated result must carry approve or changes-requested, bound to the
  reviewed base and the exact handoff. A missing, malformed, stale, or
  mismatched verdict is rejected as unavailable; a clean exit is never
  approval. External review handoffs created earlier must be regenerated. See
  #67.

• Add --allowance-credits, --actual-credits, and --estimated-credits to
  usage record. Actual usage requires a provider-authoritative source, and
  allowance overshoot is computed only from actual usage, never from an
  estimate. See #67.

• Pass hosted-runtime and architecture-specific acceptance rows only when
  acceptance set --evidence-lane names the same lane. Mark rows that need
  end-to-end proof with acceptance create --whole-chain. Those rows pass only
  with --evidence-scope whole-chain. New matrices record
  evidence_boundary, so validation, root completion, and native acceptance
  reject a hand-edited cross-lane pass. Older matrices keep validating. The
  planning and diagnosis skills now state that a settings API response or
  component receipt is not executable readiness. See
  #69.

• Add agentflow budget freeze|revise|approach|status. A root can freeze its
  approved graph size and launch cap at execution approval, so added tasks,
  retries, and context rotation cannot raise the cap. Reaching the cap blocks
  dispatch until an approved revision is appended. Earlier caps and the
  consumption at each revision are kept. A named approach stops after two
  recorded failures, including on replacement tasks, until an owner decision is
  recorded. Roots without a frozen baseline are unchanged. See
  #65.

• Add a conditional controller-observed native-return lane with visibility
  reporting, claim-bound session observations, and acceptance on a separate
  owner-approved task. It does not authenticate managed results or grant
  publication authority. See #59.

• Audit root completion in controller status. Every task under the root,
  including CI gates, is read from one complete listing. Open work or
  unaccepted CI results keep the root incomplete. ci supersede records that a
  passing CI result on a newer commit replaces a failed gate without rewriting
  the original evidence. controller rotate writes a terminal packet with
  nothing to continue once a closed root's audit is complete. See
  #57.

• Add agentflow ci watch-commit for read-only, paginated observation of an
  explicit workflow set on one exact commit SHA. It reports missing, pending,
  failed, duplicate, drifted, unavailable, and deadline states without writing
  Beads state or rerunning workflows. See
  #63.

Changed

• Run macOS CI on the pinned macos-15 ARM64 runner image because GitHub
  retires macos-14 on November 2, 2026. Coverage stays at Python 3.10 and
  3.14 plus the pull-request Beads smoke test. The required check names become
  Unit (macos-15, Python 3.10) and Unit (macos-15, Python 3.14). See
  #55.

Fixed

• Reconcile CI gate closure after a lost acknowledgement using one bounded
  read-back of the exact gate and immutable check receipt. Repeated observations
  reuse closed failure-triage tasks and never rerun workflows. Pending,
  malformed, mismatched or unavailable evidence returns exit 2; exact
  passed-and-closed replay returns 0. See #52.

• Bind task authority to protected native claim-event identities. Reclaiming and
  regranting to the same actor fences stale launches and authenticated results,
  including a generation change during renewal. Existing unsealed executions
  require operator recovery. Automatic reclamation and HTTP remain disabled.

• Reconcile resolved provider identities and active execution budgets after an
  authenticated controller resume rotates its fencing epoch. Preserve the
  original signed launch, deadline and attempt ledger while rejecting foreign
  controller continuity, future or malformed epochs, and changed claims.

Full Changelog: v0.0.11...v0.0.12