v0.23.0

v0.23.0

v0.23.0 stable lands after the pre-release series, gated on a token-clawback pass that brought the first-officer and ensign contract back toward its v0.22.0 byte baseline. The result: more capability than v0.22.0 — Pi runtime support, new workflow verbs, a self-enforcing launcher invariant, and hardened dispatch reliability — at close to the same per-session boot and dispatch token cost.

Token clawback — more capability, near-flat boot cost. The FO/ensign contract was clawed back toward its v0.22.0 byte baseline by collapsing call sites onto capability bodies, trimming the dispatch/merge cores to «fn» binding lines, and restructuring the ensign runtime adapters into compact host-specific binding blocks (#426, #428, #423, #419). Nine of the ten tracked contract files ship at or under baseline; a late gate-on-end-value addition (#441) re-grew first-officer-shared-core modestly, with the trim continuing in follow-ups.

Resident launcher, race-free signal forwarding. The spacedock <host> launcher stays resident — spawning the host as a child instead of exec'ing away (#442) — and a follow-up closes a data race in that resident launcher's terminal-signal forwarding by starting the forwarder after the child's process handle is published (#444).

FO launcher invariant. The first-officer contract pins one resolved launcher per session (${SPACEDOCK_BIN:-spacedock}); a CI lint fails on any bare spacedock helper invocation in the contract docs, preventing mid-session drift to a different binary on PATH (#433).

Skill↔binary compatibility. The contract version is bumped to 2, so a v0.23.0 plugin running on an out-of-date (v0.22.0) binary gets a clean "upgrade your binary" message instead of a cryptic missing-subcommand failure — and vice versa (#443).

Pi runtime. Spacedock now runs on Pi: front-door --safehouse-* sandboxing at parity with Claude/Codex, shipped as an install-managed Pi package, --plugin-dir/SPACEDOCK_REPO_ROOT dev overrides, and back-channel dispatch (#409, #407, #408, #406, #416, #421, #405).

Workflow verbs. spacedock state commit/ready/sweep (concurrency-safe split-root state, rebase-HALT enforced by the verb), spacedock merge guard <slug> (owns the full merge:pr terminal lifecycle — auto-arm, fail-closed finalize-on-sentinel, atomic path-scoped archive), and spacedock status --read structured modes for gate prep (#399, #400, #415, #397).

Edge channel installs end-to-end. Codex edge install now resolves via a channel-specific marketplace source (spacedock-dev/marketplace@edge, marketplace named spacedock-edge), fixing the name mismatch that broke codex plugin add spacedock@spacedock-edge; the edge Homebrew cask installs the spacedock command and conflicts with the stable cask (#424, #431, #420).

Release machinery hardening. The cut is self-protecting: a CI-enforced manifest-tag-gate blocks any stable tag whose semver disagrees with the plugin manifest version (the v0.20.0 inversion class), the stable channel ref advances to the exact tagged commit SHA rather than main HEAD, and docs/releasing.md documents the stamp→green→tag procedure that yields an e2e-gate-accepted commit (#432).

FO behavioral reliability. Headless no-conn gate-discipline (a quotable conn grant is required to resolve a gate), a tightened zero-discover boot guard, a gate-on-the-entity-end-value AC cross-check re-anchor (#441), and rejection-flow / 3-cycle-escalation / codex-addressable-worker robustness fixes (#430, #425, #427, #429).

• #444 — Keep the launcher resident: close the signal-forwarding data race (start forwardHostSignals after cmd.Start())
• #443 — Bump skill↔binary contract version to 2 — 0.23.0 rejects an out-of-date binary
• #442 — Keep the spacedock launcher resident — spawn the host instead of exec'ing away
• #441 — Gate on the entity end-value — AC cross-check re-anchor + begin-with-the-end gate posture
• #433 — FO binary launcher invariant — pin one resolved launcher + CI-enforce it
• #432 — Reconcile docs/releasing.md to the live release machinery (one consolidated pass)
• #431 — fix(install): channel-specific marketplace source — edge adds @edge branch
• #430 — Harden headless no-conn FO gate-discipline — falsifiable conn grant + zero-discover guard
• #429 — fix(ensigncycle): robust codex addressable-worker absent detection
• #428 — Trim dispatch/merge core prose into capability bindings
• #427 — feedback-3-cycle-escalation: grade the escalation BEHAVIOR, not the exact marker token
• #426 — FO contract token-clawback — collapse call sites onto capability bodies (under v0.22.0 baseline)
• #425 — Make opus rejection-flow live lane deterministic — body-aware reviewer-reuse assertion
• #424 — Codex edge channel install — marketplace-name channels, programmatic install, source override
• #423 — ensign: restructure codex/pi runtime adapters to binding blocks
• #421 — pi: load Spacedock extension+skills in dev-override path (--plugin-dir)
• #420 — fix(release): edge cask installs spacedock command, conflicts_with stable
• #419 — Trim state commit contract prose
• #417 — pi runtime: apply runtime-support.md principles (positive bindings + negative-contrast guard)
• #416 — pi: resolve fnm multishell race + workspace-rooted safehouse grant (env-forwarding)
• #415 — merge guard owns the full merge:pr lifecycle — auto-arm + finalize-from-detected-merged
• #414 — Codex multi_agent_v2 runtime dispatch support
• #412 — spacedock claude exports CLAUDE_CODE_EXPERIMENTAL_AGENT_TEAMS=1 for the worker back-channel
• #411 — Premise spike — can a Haiku FO hold the mechanical dispatch loop (no tier/L3)?
• #410 — migration-check: compare RAW scalar text, not yaml auto-typed values
• #409 — pi-back-channel-dispatch (capstone): harden dispatch core to 7 named capabilities + wire Pi back-channel
• #408 — pi: honor --plugin-dir/SPACEDOCK_REPO_ROOT dev override in package-OK gate
• #407 — pi front door: register --safehouse-* flags + safehouse wrapping (parity with claude/codex)
• #406 — pi: install-managed skill placement — ship Spacedock as a pi package
• #405 — pi-fo-runtime: stamp parent live model on null dispatch + declare Pi model space
• #404 — fo-contract: make shipped state/merge verbs the operative path + accurate «merge.guard»
• #403 — strip deferred-72 tier vocabulary from «gate.assemble-verdict» (pre-cut fix)
• #402 — prose-function restructure: re-express the FO cores as «fn» invocations
• #401 — restore core/adapter + core/mod layering in the FO dispatch contract
• #400 — merge-guard verb: spacedock merge guard (atomic mod-block set→invoke→clear→terminalize)
• #399 — state-repo verbs: spacedock state commit / ready / sweep (rebase-HALT enforced by the verb)
• #398 — Trim trailing shell separator from bootPathArgs path tokens
• #397 — gate-extract verbs: structured status --read modes for FO gate prep