v1.12.0 — review panel, ontology gate, model classes, host independence

Marketplace: 1.9.0 → 1.12.0 · engineer: 0.16.0 → 0.21.0 · atdd: 0.8.2 → 0.8.3

Covers everything since v1.9.0 — three engineer releases that shipped to master without a tag, plus this one.

Review panel — standing adversarial review at the artifact gates

The adviser + devil's-advocate pattern had been hand-rebuilt four times across four projects, each a fresh ~800-word prompt rediscovering the same lessons. It is now a standing pair, wired into discover-acs (CP2 exit) and plan (CP4 exit), autonomy-keyed.

• adviser (frontier class) — constructive: what's missing, underspecified, would bite later.
• advocate (inherit) — adversarial: assume a confident claim is false, find it.

Findings land as panel_findings[] in the handoff — accepted or rejected, both recorded, so the next agent doesn't re-litigate. An unaddressed error-severity finding blocks the checkpoint at autonomy medium/high.

Those manual runs had found an AC set fencing the wrong perimeter, a plan whose central factual claim was false, and an unfalsifiable AC. See engineer/references/review-panel.md.

Ontology gate — constraints at the ledger, not in prose

consistency-check's rule table was English evaluated by an LLM, and ran once in 121 skill invocations. A constraint that only holds when someone remembers to ask isn't a constraint.

The mechanical rows are now scripts/dae_ontology.py, run at every checkpoint exit. Constraint vocabulary borrowed from OWL, because naming a check precisely makes the missing ones obvious:

Kind	Catches
enumeration	status: probably-shipped — invented values
functional	two features claiming one branch; ac_count ≠ actual
inverse	parent_feature ↔ child_features disagreement
transitive	parent chains that cycle
disjoint	Principle 7 — the verifier is the implementer
closure	an AC with no covering @AC-N scenario

The judgment rows stay with the skill. No RDF, no triple store, no SPARQL — a set difference suffices at ten entity types.

First run found real defects: a CP8 handoff verified by the same agent that implemented CP5 (a shipped Principle 7 violation), uncovered ACs in two repos, six child_features naming features that don't exist, and a renamed feature with a stale back-reference.

Model classes — no product names to deprecate

Skills now say economy / inherit / frontier, never sonnet/opus/fable. Resolution rule: read the host's live model enum at dispatch time — the only model list that cannot go stale. inherit means omit the field, never name the parent's model.

Measured driver: 98% of input tokens are cache reads, so the lever is which class carries the long-context loop, not prompt length. The top class took 23% of spend for 4% of output — right for a bounded one-shot adviser, wrong for anything that loops.

Host independence

DAE is a methodology, not host features wearing a methodology's name. engineer/references/host-capabilities.md holds the seam: 3 required capabilities (dispatch, filesystem, script execution), 8 optional ones each with a specified degradation. Host tool names in skill prose are bindings, not the contract; porting is editing that table's binding column.

Adds an optional render capability — rendered boards for the roadmap view, next survey, panel findings, and ontology report, always alongside and never instead of the terminal text.

"Where are we" — roadmap breadcrumb

The breadcrumb answered which checkpoint but never is this done, what's next, where does this sit on the roadmap — and only rendered on entry, never at the boundary where that question actually gets asked. Now carries a ROADMAP line from feature.md frontmatter, and renders on checkpoint exit too.

Also in this release

• session-summary auto-invokes from post-merge, plus an optional PreCompact hook example. Deliberately not per-checkpoint — that would spam session-log.md.
• Release tooling fix: dae_release.py never synced marketplace.json, so engineer advertised 0.18.0 while 0.21.0 was live. Now synced and verified.
• Earlier, untagged: roadmap support (0.19.0), the parallelism reflex + session-mining fixes (0.20.0), test-introversion scanning (0.18.0).
• README reworked — host-neutral, 4548 → 3299 words, table of contents, stale facts corrected.

489 tests pass.