v0.22.0 — every gate names what it cannot verify

An adversarial confrontation against the field survey on code-as-harness (arXiv 2605.18747) produced one candidate ADR in the morning, its sizing note in the afternoon, and this release in the evening. The deterministic, zero-network gate is unchanged — it now travels with its declared blind zone.

• Per-rule non-scope declaration (ADR-0040) — GATE_NON_SCOPE stated once (rules --json, explain, ISO readiness draft banner): an assessor reading green also reads what green does not prove. Per-rule nonScope: where narrower; four rules seeded. Gate path, manifest and lint untouched.
• Survey-grounded docs pass, skeptic-audited — third guardrail talking point (SWE-bench solved-correctly), ADR-0006 change-contract amendment, distillation-surface fence in regulated-adoption, the AHE frame in the ROADMAP.
• actions/attest migration — first live proof is this very release run.

Full changelog: CHANGELOG.md

v0.21.1 — the three tiers, named

A maintainer dogfooding pass (operating runward from a well-kept coding harness) surfaced that the verification architecture was fully built but never named — and that everything beyond it belongs to the operator, not the CLI. This release names the boundary and locks it by ADR. The deterministic, zero-network gate is unchanged; no CLI change.

• The operator layer stays outside the CLI (ADR-0039). Adoption audits over harness transcripts, operator-side cost telemetry and machine-wide instruction files are the operator's own tooling — never the MIT CLI, which reads the mission repo and nothing else ("local with no data flow", ADR-0031). A voluntary satellite is deferred behind an explicit demand trigger (the ADR-0028 channel-signal watch).
• The three-tier verification doctrine, named. Tier 1 — the deterministic gate (unforgeable, decides phases); Tier 2 — the operator's mechanical hooks (inform and correct, never gate); Tier 3 — advisory review (findings in, operator decides). One partition question: must this check be unforgeable? → runward.dev/docs/concepts/three-tiers
• "Wire your harness" — an operating guide in the honest per-channel format, nothing auto-wired (ADR-0012 holds in full) → runward.dev/docs/operating/wire-your-harness
• Roadmap groomed at v0.21.1; Later gains the official plugin-directory submission; Someday parks the operator-layer satellite behind the demand trigger.

Full changelog: CHANGELOG.md

v0.21.0 — one command, the whole chain green

A launch-review pass (multi-agent, adversarially verified) found the first-contact story promised more than one command delivered. The fix is in the product, not the copy: the demo path now is one command.

• init --example ends by running the gate itself. After scaffolding the filled request-triage reference, init --example chains check --strict on the fresh mission — the whole chain goes green in front of you, in one command, exactly as advertised. Deterministic, zero-network, skipped under --dry-run. The example's next-steps now point at the guard demo (cd code && npm install && npm run demo — req-005 carries a fabricated account reference the deterministic guard refuses, fail-closed) instead of asking you to run a check that already ran.
• README accuracy pass (the HN landing). The hand-over uniqueness claim is aligned with the project's own sourced comparison (Spec Kitty does carry the mission past tested code; runward's difference is a plain-code succession check and standardized OSCAL evidence, not bespoke YAML). "FDE" is expanded on first use (Forward Deployed Engineer), the Why section leads with what runward does, and the sourced comparison + dropyour case study are linked from the Documentation list.
• Example docs. The reference floor's README now counts all five demo requests, including the guard-refused fabrication.

Full changelog: CHANGELOG.md

v0.20.0 — regulated-adoption evidence, current OSCAL, audit-hardened

Regulated-adoption evidence + SBOM/provenance (ADR-0031), OSCAL 1.2.2 proven by a third-party tool (ADR-0032), security-audit hardening, TypeScript 7 forward-compat, docs/README. Full changelog: https://github.com/stranxik/runward/blob/main/CHANGELOG.md

v0.19.0 — agent-operable baseline + runward wire

Making "an AI agent can discover, install and operate runward with no human at the keyboard" true — without leaning on a detection layer that can only ever be partial (ADR-0030).

• Neutral baseline by default. init with no explicit --tools writes only the vendor-neutral core (AGENTS.md + .agents/skills/); --yes no longer defaults to the claude profile and the wizard pre-checks nothing. No harness is privileged — a channel is an opt-in the operator adds afterward. Closes a standing vendor-neutrality breach.
• runward wire — best-effort harness detection. Detects the AI harness running the command via a verified runtime signal (CLAUDECODE for Claude Code and Cowork, GEMINI_CLI, CURSOR_AGENT), falling back to a config-file marker, then undetermined. It recommends the matching auto-trigger channel and points at the inert sample — it never wires anything (wires:false invariant, ADR-0012) and never prompts, so an agent run never hangs. On undetermined, the doctrine (AGENTS.md + the plugin SKILL.md) tells the agent to ask the operator which tool they use rather than guess.
• check --json — a machine contract. A stable, deterministic JSON verdict (current gate, deliverable states, conformance gaps) so an agent drives on data, not scraped text. Hook output is routed to stderr under --json so a subprocess can't corrupt the object.
• Hardened non-interactivity. isNonInteractive() also returns true when stdin is not a TTY or CI is set — an autonomous run never hangs on a prompt it cannot answer.
• Guards. New unit tests for detection (signal precedence, per-family config detection, undetermined, the wires:false invariant) and smoke assertions for wire --json and check --json[ --strict]. Self-gate strict green; 65 unit tests.

v0.18.1 — pre-marketplace hardening (a 5-agent audit, closed)

A five-agent adversarial audit before public marketplace submission (security, compliance, code coherence, packagings, architecture). The verdict was sound — self-gate honestly green, no cited-not-applied, architecture faithful to its own doctrine — with two real security holes to close and some polish. All fixed.

• Seal traversal closed (security). The seal writer confined paths (v0.17), the verifier did not — a forged evidence-lock.json with a ../ or absolute key made check --strict read/hash a file outside the project (arbitrary-file-read oracle + DoS). The verifier now contains lock keys like the writer.
• Command injection closed in the GitHub Action (CWE-78). Inputs are passed through the environment (not interpolated into run:) and version is allowlisted — a malicious input can't inject shell.
• ReDoS screen bypass closed. A nested quantifier hidden in a character class (([^()]+)+) slipped past the screen and hung V8. Character classes are normalized first; ([^()]+)+ and ([a-z]+)* are now caught, real signatures stay safe.
• runward rules no longer mislabels the gated hand-over rules (one CRITICAL) as advisory — the gated phases derive from GATED_DELIVERABLES now.
• Packaging polish before submission: 4 manifests bumped off 0.17.0; the Codex marketplace.json rewritten to the documented schema; the Cursor tier corrected to advisory stop; the npx --yes supply-chain posture documented with how to pin.
• Guards: unit tests for the seal-traversal rejection, the ReDoS screen, and a packaging version/hook check that would have caught the version drift. ADR count harmonized to 28.

Full detail: CHANGELOG

v0.18.0 — install runward from where you already work

Turning the lead into distribution. A July 2026 channel benchmark confirmed the "install channel + deterministic gate" pattern is not proprietary to Claude Code — it's replicated across at least four harnesses, plus the canonical CI channel. So runward now publishes a family of distributable packagings (ADR-0028), each honestly tiered by how hard its gate can block. Same one line everywhere: runward check --strict.

• GitHub Action — the hard governance gate. action.yml at the repo root: uses: stranxik/runward@<sha> as a required status check blocks the merge on a gap. Open, no secrets, aligned 1:1 with governance.
• Claude Code plugin + marketplace. /plugin marketplace add stranxik/runward → /plugin install runward-gate@runward.
• Siblings for every hard-Stop harness (packaging/): Gemini CLI (AfterAgent), OpenAI Codex (Stop), GitHub Copilot / VS Code Agent hooks (Claude-compatible) — the same one line at turn end.
• Soft-gate packagings, labelled soft. Cursor and a Kiro Power bundle a per-tool hook, documented as per-tool, not end-of-turn, because those harnesses' end-of-turn hooks can't hard-block. No operator misled.
• MCP descriptor — discovery only. packaging/mcp/server.json, with a README that hammers it: an MCP tool is model-controlled — findable, never obeyed. Read-only surfaces at most. Calling runward-as-MCP a gate would be the exact "soft judge dressed as hard" the product rejects.
• One honest map: docs/distribution.md tiers every channel — hard-at-merge (CI), hard-at-turn-end (client hooks), soft-per-tool (Cursor/Kiro), discovery-only (MCP).

Invariants preserved: the operator installs (runward auto-wires nothing); never a runtime (each packaging is a thin shell around the exit-code port); vendor-neutral (a family published together, no agent privileged — the canonical surface stays AGENTS.md + .agents/skills). Publishing to the marketplaces is the maintainer's outward-facing gesture, like the npm publish.

Full detail: CHANGELOG · ADR-0028 in docs/adr/

v0.17.0 — a second audit, honestly closed; the gate reaches into BMAD

We ran our own method on ourselves again: an adversarial internal audit plus a fresh code-level competitive benchmark. It confirmed the four grounds nobody else pairs — a rule-level gate with verified evidence, signed-and-sealed evidence, a gated hand-over, and a deterministic OSCAL mapping — and it broke five things shipped in v0.15/v0.16. Closing your own defects in daylight is the doctrine.

• Path traversal closed. file:/etc/hosts and file:../../etc/hosts passed the gate green, contradicting ADR-0019. Resolution is now confined to the three project bases: absolute paths rejected, ../ cannot climb out. Evidence must be in your project.
• ReDoS closed. A nested-quantifier signature ((a+)+) hung the gate on adversarial content. A deterministic screen rejects the dangerous shape before compiling the regex — fails fast, never hangs.
• OSCAL reconciled with its own spec. renderOscal took the first manifest row, so a multi-phase rule's implementation-status depended on deliverable order. It now aggregates every row (spec §3), order-independent; the readiness link is regime-derived (no dangling href); the "implementable independently, byte-for-byte" promise holds off the nominal path.
• The seal's scope stated plainly (ADR-0021, spec §6): content-addressed, it detects drift and deletion — not falsification by a writer who recomputes the hash. The trust anchor is the signed git history; a zero-secret gate holds no signing key by design.
• RUNWARD_NOW validated; doctor adapter count fixed; doc regressions fixed (five wizard prompts, current counts, README lists Kiro + execution-topology).
• EU AI Act date corrected (2 Aug 2026 → 2 Dec 2027). The Digital Omnibus on AI postponed the Annex III/IV high-risk obligations; our regime data printed the stale date in the OSCAL readiness draft. The 2 Aug 2026 milestone stays real for Article 50 transparency, governance and GPAI. positioning.md swaps the stale deadline for two durable talking points: FedRAMP RFC-0024 forbidding GenAI-produced evidence, and the Delve affair — both validating the zero-LLM gate.
• The gate reaches into BMAD (ADR-0027). templates/adapters/bmad-review-layer.toml adds runward's deterministic gate as a review layer beside BMAD's LLM reviewers (their seam explicitly allows "an external reviewer via bash") — a complement on their distribution, same inert exit-code port (adapters 5 → 6), no orchestrator privileged.

Full detail: CHANGELOG · the OSCAL mapping spec: docs/spec/runward-oscal-mapping.md

v0.16.0 — the hand-over is gated, the mapping is citable

The whitespace phase: the three grounds the audit named as ours to own, shipped as product.

• Hand-over becomes a gated conformance phase (ADR-0026). "The hand-over is proven by a real task redone without you" was Definition-of-Done prose no gate verified. Now runward/handover.md is a gated deliverable — the kit index, the redone-task proof record, the named succession, the provider-swap drill — verified by four new handover rules (handover-redone-task-proof CRITICAL, handover-runbook-executable, handover-agents-charter-final, handover-succession-named). Rules 60 → 64; a fifth phase skill surfaces the craft at the point of succession. The reference mission ships a filled note and its finalized AGENTS.md (init --example lays down the leave-behind charter, not the scaffold). The repo's own mission records the honest state: no succession has occurred, the redone-task row is a reasoned n/a with the mechanical half (pristine CI reproducing build, tests and the strict gate) pointed at, and the flip condition named.
• The OSCAL mapping is a published, citable mini-spec (ADR-0025). docs/spec/runward-oscal-mapping.md v1.0, implementation-independent: the decision → ADR → manifest → OSCAL chain, the status-derivation rules (paper coverage never upgrades the status), the deterministic UUID seed grammar, the regime-lens stamp, byte-identity conditions, the evidence-lock v1 format, and conformance criteria for independent implementations. The golden fixture is the normative example; CITATION.cff makes citing mechanical.
• Kiro joins the adapter family (ADR-0018 amended). --tools kiro mirrors the phase skills as steering files (.kiro/steering/, inclusion: auto — the same relevance semantics as the SKILL.md trigger; AGENTS.md is read natively), and templates/adapters/kiro-hooks.json ships the turn-end gate (Stop trigger, the same inert one line as the Claude Code hook; adapters 5 → 6). Traced decisions inform in-session enforcement in one more harness — a complement riding the harness's own seams, never a runtime of ours.

Full detail: CHANGELOG · ADR-0025/0026 in docs/adr/

v0.15.0 — the gate verifies the evidence, and runward gates itself

A factual multi-agent audit confirmed the one honest gap the ADRs had already named: the gate proved a decision was traced, never that the trace pointed at anything real — a pointer at an existing-but-empty file passed green. v0.15.0 executes the tightenings the ADRs pre-authorized (ADR-0001 trigger b, ADR-0004's promotion trigger). Still bytes, never judgment; zero-LLM, zero-network, never a runtime.

• Typed evidence pointers, verified (ADR-0019). file:PATH[:LINE][#SYMBOL], test:PATH[::NAME], adr:NNNN — check --strict verifies resolution, non-empty content, line count, symbol/test-name presence. For every applied row, typed or prose, a resolvable path must point at a non-empty file: the hollow-evidence pass is closed. Free prose stays valid — it is the operator's judgment.
• Rule signatures (ADR-0020). A rule can declare a signature: regex its applied evidence must contain. frontier-deterministic-boundary ships signed: the founding cited-not-applied incident is now caught deterministically end to end.
• Drift blocks; a green gate can be sealed (ADR-0021). A stale applied pointer now fails --strict. runward check --freeze seals a green gate (SHA-256 of every resolvable evidence file into runward/evidence-lock.json); a sealed file that changes or disappears fails the gate until re-verified and re-sealed. Refuses to seal a red gate.
• runward manifest --sync (ADR-0023). Scaffolds the form, never the content: missing rows appended with an empty status the gate refuses, renamed slugs migrated with status and evidence preserved, nothing deleted.
• runward rules --json and runward explain <rule> (ADR-0024). The rule set as a stable, versioned machine contract; a rule's why and full text one command away.
• Regime mappings as versioned data (ADR-0022). ISO 42001 / NIST AI RMF / EU AI Act structure moves to regimes/<regime>@<version>.json; compliance --regime-version pins the lens and every draft plus the OSCAL stamp which mapping produced them. Real-ingest testing evaluated and honestly declined — no credible maintained OSS OSCAL ingester today (dated rejections + manual GRC procedure in docs/compliance/oscal-ingest.md).
• The verify pass leaves a trace (ADR-0007, amended). The advisory cite-vs-apply workflow writes runward/governance/verify-findings.md; a green check --strict reports its presence and freshness — never parsing a verdict, never blocking.
• runward gates itself. The repository carries its own strict-green runward/ mission (32 conformance rows, typed pointers into runward's own source, zero deviated), and CI requires runward check --strict green on runward — including under network isolation (unshare -n).
• A real unit harness. 50 node:test unit tests (zero new dependencies) over the gate core, seeded fuzz of the manifest parser (never crashes, never false-passes), and a golden byte-identical OSCAL test: the byte-for-byte promise is now tested, not asserted.
• Also: ADR-0017 closed for real (shared-bricks re-scoped as the reference grid; the example mission gains ADR-0003 port placement and sovereignty, first of the infra ADR family); a GitLab CI gate adapter (adapters 4 → 5); init --example ships the reference code/ so the example is green because its typed evidence actually resolves.

Full detail: CHANGELOG · ADR-0019…0024 in docs/adr/