v3.0.0

v3.0.0

Released 2026-07-06.

A verifiability release. Every major surface in this line ships its primary
artifact as a proof: a signed lineage receipt, an HMAC-chained journal entry, a
content-addressed record, or a deterministic projection that two operators can
recompute to the same bytes. The features are not "capability plus an audit
log" bolted together; the audit substrate is the shape of the capability. Strip
the chain and the feature loses its meaning, not just its logging.

Substrate

• Lineage is now a single, always-on chained record. Every artifact-producing
  step folds into one Ed25519-signed lineage spine instead of the previous
  optional per-subsystem records; bernstein lineage verify <run_id> walks the
  whole chain. (#2292)
• Deterministic replay records by default. The step journal is a Merkle chain
  where each entry hashes its predecessor, inputs, model, prompt, tool call, and
  tool result, so non-determinism surfaces as hash divergence rather than a
  flaky rerun. bernstein replay --from-step N rebuilds state by walking it.
  (#2293)

Governance and review

• Maker-checker and judge-panel gates whose verdict is an adjudication receipt
  anchored to the audit chain; the decision, its inputs, and the panel identity
  are all recoverable after the fact. (#2294)
• Attested pull-request review and autofix: the PR carries a receipt linking the
  originating issue, the plan, every tool call, and the diff, so a reviewer can
  verify the change was generated from the ticket without operator override.
  (#2296)
• RBAC, budgets, and seat attribution as verifiable projections: an authorization
  or spend decision is a governance-decision journal entry, not a mutable
  in-memory grant. (#2309)
• Verifiable spending mandates recorded as journal-anchored records, so a spend
  limit and its consumption are independently auditable. (#2306)

Interoperability

• Stateless MCP protocol core with owned cross-request identity, so a session
  spanning stateless calls stays attributable. (#2307)
• Bernstein exposed as an audited execution node with signed webhook receipts:
  every inbound trigger is a receipt in the chain. (#2310)
• Outbound agent HTTP requests are signed and each signature chains to the audit
  log, so a receiver can prove which install identity issued a call. (#2305)
• Native subagent delegation for fan-out execution, each delegation recorded as
  a chain entry. (#2308)

Modality and observability

• Skill installs produce lineage receipts and catalog provenance, so a skill's
  usage history is attested rather than asserted by a registry. (#2301)
• Fork-from-step using git worktree commits as the snapshot boundary: a fork is
  a real commit, isolated per worktree, not a soft copy. (#2295)
• OpenTelemetry GenAI spans emitted as a signed projection of the audit chain,
  so an exported trace and the executed actions verify against each other.
  (#2300)
• C2PA content credentials emitted as a deterministic projection: attached and
  produced media carry content-address-anchored provenance. (#2303)
• Cross-session memory rebuilt as a tamper-evident, content-addressed store;
  a memory write is a chained receipt keyed by content hash. (#2298)
• TUI reads the existing event stream instead of polling, so the interface is a
  projection of the same journal the run records. (#2297)
• Recurring goals as deterministic projections onto a canonical task graph: two
  operators with identical state fire the byte-identical graph at time T. (#2302)
• Stuck-worker escalation as a signed, forensically-reconstructable receipt
  carrying the last audit entries and a deterministic recommended action, so a
  stall can be handed to a postmortem with cryptographic certainty about the
  failure window. (#2299)

Federation and activity model

• A2A federation where every inbound and outbound message is a signed lineage
  receipt anchored to the install identity, so a peer can verify a received
  message chains back to us. (#2304)
• A typed activity boundary so any agent modality, not only coding CLIs, runs
  under the deterministic scheduler and is journaled identically, letting replay
  verify across modalities. (#2311)