Tao Agent OS v26.09.1

Tao Agent OS v26.09.1

2026-08-17 → 2026-09-05 · 169 commits since v26.08.4

This release makes routine agent work lighter to carry and faster to finish. Claude, Codex, and Antigravity now expose the status that matters while a session is running, and the workflow stops reloading guidance, Git state, and document indexes it already knows.

The largest practical change is visible in repeated work. Against v26.08.4, a representative commit-and-PR task now loads 77% less instruction context, and merged branch/worktree cleanup loads 83% less. The safety decisions remain; the unrelated reading and repeated setup are what disappeared.

Quota and run status at a glance

• Claude draws the remaining quota as fixed-width 5-hour and 7-day gauges, so the bar empties with the budget instead of presenting usage as if it were availability (#89, #90).
• Antigravity/AGY renders the available quota and current Tao run progress in its status line (#91).
• Codex setup enables the native quota status items that the runtime exposes, without replacing existing status-line configuration (#98).
• The shared status renderer also shows the session's starting workspace and Tao run progress. Quota colour follows the terminal palette and is never the only warning signal (#92, #94).

The unified setup owns these runtime integrations. New installations receive the current wiring automatically; existing installations can use the check-and-refresh step under Operator action below.

Measured context reduction

The comparison below uses the exact UTF-8 byte size of the instruction and required-document context selected by v26.08.4 and the current release candidate. Token figures use a transparent engineering estimate of 4 UTF-8 bytes per token; byte counts and percentages are exact, while model-specific billed tokens will differ.

Trigger	v26.08.4	v26.09.1 candidate	Reduction
Commit + pull request	122,858 bytes	28,084 bytes	77.1% · ≈23,694 tokens
Merged branch/worktree cleanup	122,594 bytes	20,668 bytes	83.1% · ≈25,482 tokens
Base AGENTS.md load	55,655 bytes	13,814 bytes	75.2% · ≈10,460 tokens
Graphify entrypoint	40,199 bytes	8,172 bytes	79.7% · ≈8,007 tokens
Repeated route advisory after the first turn	10,262 bytes	160 bytes	98.4% · ≈2,526 tokens per turn

These rows are per-trigger measurements and are not additive. In a 50-turn Claude session, the route-advisory change alone removes about 123,750 estimated tokens after the first turn (#99).

The reduction comes from several separate changes:

• The root agent instructions now keep the rules every task needs and move command mechanics behind the runtime-integration guidance that owns them (#101).
• Commit and PR routing retains its compact contract and adds only the documents named by an extra concern, instead of falling back to unrelated branch and worktree guidance (#125).
• Graphify loads its query contract for architecture and dependency questions, while the full build procedure stays available on demand. It also reads the newest valid graph location instead of rebuilding or ignoring the graph that exists (#106, #110).

Common paths do less work

Merged branch cleanup now has its own route. It keeps ownership, protected-branch, merge, worktree-state, approval, and reporting checks, but no longer enters an implementation lifecycle for an operation that produces no source diff. The fixed cleanup path skips semantic document search and batches the inspection evidence for one target (#116, #118).

Other hot paths now reuse or avoid work instead of making it faster by repetition:

• Git reads are bounded, repository walks prune ignored directories at traversal time, and document graphs are reused between hooks (#30, #37, #47).
• Wikimap refreshes are skipped when the corpus or active concern cannot affect the result (#101, #112).
• VibeGuard audit reuse is keyed to content, and checkout preparation avoids redundant rebuild and audit queries (#124, #127, #128).

Continuation and cross-runtime handoff

Continuation can resume one exact run across concurrent sessions instead of guessing from whichever packet was written last. Checkpoints now preserve the work state a resumed session needs, reject unusable run directories, and distinguish a legitimate no-change task from an abandoned mutation (#28, #40, #41, #115).

Codex, Claude, and Antigravity can also pass a bounded, project-bound brief through the local mailbox. The mailbox stores no daemon or external service and does not wake an idle runtime; the target receives the brief on its next normal task (#73).

Gates report what actually happened

The protected-checkout and lifecycle gates were tightened around the decisions they make:

• Claude shell inspection asks only for the dangerous cases, preserves worktree isolation without recurring prompt noise, and fails closed for operator shapes, Git option abbreviations, environment injection, computed text, and hidden targets (#70, #71, #100).
• Review can attest committed ranges, repository hygiene, ignored local configuration, and final Graphify artifacts instead of treating every result as a dirty working tree (#31, #123).
• Mutation checks judge the process exit code, and run/lesson maintenance keeps bounded evidence with explicit dry-run and apply modes (#68).
• Gate failures now name the rejected command, path, phrase, or repair loop rather than reporting a nearby implementation detail (#111, #114, #120, #129).

Learning and documentation

The retrospective path now reports queued, staged, completed, and uncurated skill-learning work without making an unrelated historical backlog block the current run. It also refuses to claim a retrospective for skills the run never loaded and labels retained observations as history rather than unfinished curation (#130, #132, #133).

The public workflow guide now includes bilingual flowcharts for analysis, change, commit, and cleanup, with decision branches and bounded retry paths (#131). Documentation also gained a concrete evidence ladder for technical explanations and Android feature-UI ownership rules (#87, #88).

Compatibility and operator action

• No database migration, dependency update, or intentional public API break is included.

• Protected-checkout users may see a newly denied command or a targeted approval prompt for ambiguous shell forms that were previously misclassified. This is intentional fail-closed hardening.

• New installations get the current Claude, Codex, and Antigravity integration through the unified setup. For an existing installation, run:

  <TAO_LAUNCHER> setup-agent-hooks --check
  <TAO_LAUNCHER> setup-agent-hooks
  

  Run the second command only when the check reports missing or stale managed setup. Existing user-owned status-line configuration is preserved.

• No data rollback is required. A source rollback should use an immutable prior release revision and then rerun the setup check; prior release tags must not be moved.

Verification

The current tree at f0304ee4 passes python3 -m unittest discover tests — 2,383 tests, OK, with 1 skipped. python3 scripts/workflow.py validate also passes all 177 workflow references, 365 Markdown frontmatter/link checks, and 27 route contracts. The final VibeGuard audit reports no findings.

Full Changelog: v26.08.4...v26.09.1

Tao Agent OS v26.08.4

2026-08-13 → 2026-08-17 · 20 commits since v26.08.3

This release is about the runtime gates being honest: the Bash gate now judges a command by what it runs and where it writes, rather than by whichever part of the command line it happened to parse, and a run is never recorded as settled on a checkout nobody re-read.

Nine review rounds went into it. Every finding was reproduced against the decision functions before it was accepted, and every fix was proven by reverting its own guard and watching only that guard's test fail.

The Bash gate

Each gap ran the same way: something the shell would do was invisible, so the command was judged by what remained and allowed.

• Operators. The lexer clusters metacharacters, so an operator the module did not model arrived as an ordinary word — >|, &>, <> and >& all wrote through it, and <(...) ran a program with no token of its own. Operators are now recognised by shape, so an unlisted one fails closed. 2>&1 is the exception, and only when its operand is a descriptor: it opens nothing, and refusing it blocked reading any command's stderr.
• Git options. Git accepts unambiguous prefixes, so an exact denylist missed --ext-dif. -c set any config for the run, including an external differ, and --upload-pack named a binary to execute through an otherwise-allowed fetch.
• Environment. An assignment prefix was stripped by name shape, so LD_PRELOAD=evil.so cat was judged as cat. Only inert names — locale, timezone, terminal — are stripped now.
• Targets. Only tokens beginning with a slash were read, so an option value, an operand assignment, an interpreter's quoted script, a relative spelling, a runtime variable, an escaped space and adjacent quotes each named a protected checkout invisibly. path_arguments existed for exactly this and was never called. A crafted long path raised past the decision into the fail-open handler, turning an error into consent.
• Computed text. Where the shell builds the text, no reading of it locates the command, so that case is judged against the session's own project. The rule is stated positively — ${NAME} resolves, anything else in braces does not — because the denylist it replaced had already missed ${!REF}.

The classifier is split by the question each part answers: reading a command line, reading the paths it names, and the Git option vocabulary. The two halves failed differently, which is why they are now audited separately.

The gate is opt-in. A repository without .agents/shared/worktree-policy.json is unaffected.

Cancellation

A transfer cancellation vouches for a clean checkout, and git status and the registry write can never be simultaneous — the subprocess has already returned by the time its result is read. Two earlier shapes of the fix were wrong in opposite ways: reverting after a second check tore on a crash, and a single write froze a claim that might already be false.

The gap is not closable by ordering. What is choosable is what the write landing in it asserts, so the run is staged as reconcile_required, read again, and only then settled. An unfinished cancellation is exactly a run that needs reconciling, so that staged state is true whatever follows — an interruption anywhere leaves the run non-terminal and owing work, and a rerun completes it.

The checkout state the decision rested on is recorded and compared on a rerun, and the cancellation record lives in the registry, so losing the receipt file no longer loses the outcome.

Work-surface resolution

Task guidance is selected after the code boundary that owns a change is verified, not from words in the prompt. Literal technology shortcuts are removed from routing and kept as test fixtures; request and dirty paths remain candidates until ownership is proven; a code route requires an owner-proof gate carrying a bounded evidence chain and the nearest check that would fail if the claim were wrong.

Review and lifecycle

• Commit-range, repo-hygiene and local-config review subjects, and a review scope that attests a committed range rather than only a dirty tree.
• Boundary-plan evidence must state a runtime structure decision.
• Envelopes bind to the whole request intake, so one minted for a terse follow-up cannot be replayed when only the continuation scope changed.
• A mutation baseline attributes a change to the boundary that declared it, so a deletion inside a declared directory is covered by declaring it.
• Finish no longer reports a review gate that its own revalidation rejected.

Rejected findings

Three reported bypasses do not stand, each because the command cannot reach the protected checkout — confirmed by resolving the path or by running bash, not by argument.

Residual limits

A target built from a variable this process cannot see stays literal and yields no path. The cancellation's remaining race is not removable by ordering; it is recorded through a verified worktree signature and read back on a rerun.

Verification

The tree at this tag passes python3 -m unittest discover tests — 1680 tests, OK.

Tao Agent OS v26.08.3

2026-08-09 → 2026-08-13 · 17 commits since v26.08.2

This release is mostly about the lifecycle runtime holding its shape across a session boundary: a resumed run now reuses what it already proved, and a session that leaks a run no longer blocks its own edits. A new Figma handoff pipeline and the remaining fork backports land alongside it.

Session continuation

• Resumed runs reuse proven evidence instead of rebuilding it. The resume brief carries the reuse decision, required-document status, bounded inspected scope, accepted-decision ids, and successful-verification ids, so a continuation stops re-running identical checks merely to rebuild context. (e0e0662)
• A leaked run no longer denies its own session's edits. The exact-session resolver returns an evidence path only when exactly one active run matches, so every run an agent started and abandoned made the next edit gate deny — the agent blocked itself, and the stale sweep could not help because it deliberately protects a run whose owning process is still alive. A start now settles the earlier active claims bound to its own runtime session, as a registry compare-and-set on evidence key, run id, active state, resume generation, and run-instance start time. A run that finished, was rebound, or had its terminal id adopted between selection and write keeps its newer state. Other runtime sessions and isolated workers are never superseded. (0aea31d)
• Clean-head drift restarts from fresh evidence rather than failing the run. (eae0f40)
• Codex gets a managed stop gate and session binding, matching the Claude adapter. (93dbe58)

Known residual: two concurrent starts in one session that both register before either settles will cancel each other, leaving no active run. It self-heals on the next start and needs a custom evidence path to reach; there is no data loss.

Figma handoff

• The standalone figma-handoff CLI and its skill cards are now part of the repository. (06f845a)
• Handoffs route through toolkit-neutral guidance rather than one vendor's shape. (56ff7cb)
• The handoff pipeline is split by responsibility, and its comments and docs are in English. (4e9732f, b7b99b4)

Review and commit gates

• Structural failures now hint the reviewed-limit invocation, so the correct bounded override is visible at the point of failure. (56c1ef3)
• Structural overrides stay out of repair hints, so a budget override cannot read as a repair. (30df5f5)
• The commit card requires conditional structure evidence; a route's startup summary lists universally required evidence only and never exempts it. (4ecc802)

Skills and platform guidance

• React Native provider commits are pinned, with a remote provenance check. (12e086c)
• Skill candidates order by a candidate-local counter. (014e87d)
• The Android feature UI module is an optional promotion, not a default. (7dd5db7)
• Android module splits document four hazards seen while performing a split, as opposed to deciding one: dedupe before widening visibility, treat relocation and rewrite as one unit, key extracted blocks by position rather than declaration name, and treat convention-bound and aliased imports as used. (228f4b2)

Workflow

• The remaining fork enhancement streams are ported. (680b2b1)
• A user-approval compatibility alias is accepted. (43b4c09)

Verification

The tree at this tag passes python3 -m unittest discover tests — 1550 tests, OK. The supersession change was additionally proven by mutation testing each of its five guards and by a live two-start lifecycle reproduction.

Tao Agent OS v26.08.2

Highlights

• Integrated the React Native, Python web-service, and combined-stack guidance originally proposed in PR #16 through PR #18.
• Hardened request, search-facet, required-document, and path routing so single-runtime requests do not load unrelated platform guidance.
• Added explicit React Native Android native-module routing while keeping ordinary React Native work free of Android-only docs.
• Completed coverage of the newer React/React Native source snapshot in PR #19: 41 SKILL.md surfaces, comprising 32 installable skills and 9 nested subskills across Vercel, Expo, Callstack, and Software Mansion.
• Added provider-qualified provenance, SHA-256 source hashes, distilled/source-only ownership, a deterministic manifest checker, and collision-resistant workflow routing.

Verification

• 1,264 unit tests passed; 1 intentional skip.
• Workflow validation passed: 164 references, 343 Markdown frontmatter/link checks, and 26 route contracts.
• The external React/RN manifest matched all 41 source SKILL.md files and hashes.
• Strict VibeGuard audit passed with no findings.
• The release tag resolves to merged main commit 98233d0.

Compatibility and operations

• No breaking changes.
• No dependency, migration, credential, package-registry, or operator action is required.
• Release range: v26.08.1...v26.08.2.

Merged changes: PR #18, PR #19.

Tao Agent OS v26.08.1

The first August release makes Tao's agent workflow authority and completion evidence more explicit: the runtime states intent, route/tool policy sets the effect floor, approvals stay separately bound, and review/run provenance is revalidated instead of trusted as caller prose.

Runtime authority and review provenance

• Add a current, session-bound intent envelope and verify the union of runtime claim, route minimum effect, and actual tool effect.
• Thread a separate approval record bound to request fingerprint, target, route, and effect ceiling through route, classify, dispatch, preflight, and start.
• Make the review gate hook-owned with run-bound worktree and staging attestation.
• Bind gate-ledger writes to a real, owned, unsettled run claim and keep recovery states writable without reopening settled runs.
• Make the single repair cycle reachable and align required-document drift recovery with executable validation.

Retrospective and classifier correctness

• Hold finish when a recurring skill-learning candidate reaches its review threshold.
• Clarify that no_change remains terminal only while its completed record is retained; new distinct observations can recur after pruning.
• Replace example-tuned correction and Korean release-negation matching with grammar-based decisions.
• Strengthen structure-review evidence isolation and staged-index invalidation coverage.

Portable shared guidance

• Add reusable branch cleanup, Git history investigation, and bulk-change verification cards.
• Expand shared review, multi-agent, Android, state, migration, error, testing, release, and documentation guidance while keeping source-specific details out.
• Add a reviewed per-file addition-limit override for genuinely indivisible source artifacts.

Included pull requests

• #12 — reviewed per-file addition-limit override
• #13 — gate provenance, run ownership, runtime edit-gate, classifier, and repair hardening
• #14 — portable shared skill guidance
• #15 — runtime intent-envelope authority
• #17 — approval transport, review regressions, and retention semantics

Verification

• 1244 unit tests passed; 1 environment-gated test skipped
• workflow validation: 157 references, 334 frontmatter/link checks, 26 route contracts
• strict VibeGuard audit: Ready, no findings
• annotated tag peels to 50ce0bb65c89203350aa6c8aa556581349df07e6
• release range: v26.07.11..v26.08.1

No breaking changes, migrations, binary/package artifacts, credential changes, or operator action are required.

Tao Agent OS v26.07.11

Two products can configure the same runtime, and neither owns the file. This
release makes the installer edit only what it can prove it wrote, and writes the
rule down so the next path cannot quietly drift off it.

Installer ownership

A hook command carries its own provenance — the Tao alias sits inside the
command string — so the hook predicates could already tell Tao's entries apart
from a neighbouring tool's. Every one of them was re-checked against the real
installed commands of three other tools, and none was claimed.

An environment entry carries no provenance. The value is the same string
whoever set it, and one path removed it on that value alone, triggered by a
helper file being missing. That trigger is weaker than the companion tool being
uninstalled: a moved, renamed, or restructured install looks identical.

The installer now records the keys it actually writes and removes only those.
Installs predating the record keep their keys — a stale entry left behind costs
less than a live one deleted.

What the boundary now says

docs/skills/agent-runtime-integration separates the two signals:

Signal	Verdict
a unique alias inside the command the installer generated	ownership
a marker block the installer emitted	ownership
a matching timeout, event, or install directory	resemblance
an environment value another product also sets	resemblance
the absence of another product's file	not proof that product is gone

With two corollaries that are easy to get wrong quietly: removal must filter
within a group rather than drop it, and a synchronous lifecycle hook must be
bounded — a timeout names the lifecycle event, not the command that overran.

Release numbering

AGENTS.md now states the half the shared versioning card always deferred to
this repository: the tag is the deployment unit, N counts tags in the month
and restarts at 1 when the month changes, release notes are optional, and a
range is measured from the previous tag rather than the previous tag that
happened to carry notes.

Also

Structure ownership guidance now covers making file-private intent visible to
the executable review before coding.

Verification

1149 tests pass with and without a runtime session id present, on a clean
checkout of the released commit; workflow validate passes there too. Ten
regression tests hold the installer boundary, each backed by a negative control
that removes the guarantee and fires.

Two pull requests and five commits since v26.07.10.

Tao Agent OS v26.07.10

Work now survives the process doing it.

A closed terminal or a killed agent used to take the task with it: the
conversation was recoverable, the work state was not — what the task was, what
was decided, what changed, what verification passed, and what remains. This
release persists that once, in the shared library, so a runtime adapter supplies
only the content its agent already knows.

Verified through the real CLI rather than unit tests alone: an orphaned session
leader ran start and a gate, was SIGKILLed and confirmed gone, and a separate
process resumed to ready at its first unfinished checkpoint — in a fresh
checkout that was never set up by hand.

Session continuation

• The packet records goal, decisions, changed scope, verification, and next
  step, bounded and project-local. It never leaves the machine, and nine
  outbound boundaries deny it by construction rather than by instruction.
• Checkpoints are written while working — initial, before and after each bounded
  mutation, at material decisions, and at lifecycle transitions. A shutdown-time
  write cannot describe a shutdown that never runs.
• Resume refuses on any HEAD, worktree, rules, or required-doc drift, and names
  what moved. Reasoning reached against other bytes is not progress.
• Takeover reuses the existing owner rule: proven death releases immediately, a
  live owner holds, and only one resume generation wins.

Claude adapter

Claude session and tool events map onto that contract — mutations bracketed,
resume offered at session start. Storage, drift, and takeover stay shared,
because an adapter that reimplements them is how one resume semantics per IDE
begins.

Blocking a mutation is how the protocol keeps a tool from running against a
checkpoint that would misdescribe it, so it applies only where such a checkpoint
can exist. Storage the packet cannot live in, a missing module, an edit outside
the project, a pending whose tool never wrote, and NotebookEdit naming its
target notebook_path all produce nothing to be wrong about. The post-mutation
side never blocks at all: it runs after the bytes landed.

Lifecycle and safety

• Run evidence is bound to the runtime session, so concurrent agents no longer
  overwrite one another's preflight, and every run can reach its own packet.
• Run claims, review parsing, and routing bypasses hardened; parallel workers
  with overlapping scopes are isolated in real git worktrees.
• The read-only lifecycle and repair evidence are verified rather than asserted.
• Guarantees are verified by falsification: a green run that never fails when
  the property is broken is not evidence.

Verification

1139 tests pass with and without a runtime session id present — the suite used
to be green only where the feature was inert. workflow validate passes on a
clean checkout of the released commit.

Since v26.07.9: seven pull requests and 34 commits.

Tao Agent OS v26.07.8

Renamed from AgentPlaybook to Tao Agent OS, and fixed three gate defects that made recovery impossible.

AgentPlaybook에서 Tao Agent OS로 이름을 바꾸고, 복구가 불가능했던 게이트 결함 3건을 고쳤습니다.

---

Breaking / 주의

Was	Now
AgentPlaybook	Tao Agent OS
taehwandev/AgentPlaybook	taehwandev/tao-agent-os
~/.agentplaybook/	~/.tao/
agentplaybook-hook	tao-hook
AGENTPLAYBOOK_*	TAO_*
.agentplaybook/ (per project)	.tao/
agentplaybook.thdev.app	tao.thdev.app

EN — Existing installs do not migrate themselves. Close every agent session first, then follow the host-side steps in docs/migration/tao-agent-os-rename.md. Step 4 uses git mv where a project tracks its state directory, because a plain mv leaves the repository dirty.

KO — 기존 설치는 자동으로 옮겨지지 않습니다. 먼저 모든 에이전트 세션을 닫고 docs/migration/tao-agent-os-rename.md의 호스트 절차를 따르세요. 상태 디렉터리를 추적하는 프로젝트에서는 4단계가 git mv를 씁니다. 일반 mv를 쓰면 저장소가 dirty 상태로 남습니다.

---

Fixed / 수정

Three failures, all the same shape: a gate demanded proof the situation made impossible, so the caller could neither pass nor recover.

게이트가 상황상 만들 수 없는 증거를 요구해 통과도 복구도 못 하게 만들던 결함 3건입니다.

1. review crashed before reporting anything
The call site read args.structure_review_evidence.strip() while every sibling argument used (args.X or "").strip(), so omitting the optional flag raised AttributeError instead of listing the missing evidence.

선택 인자를 생략하면 누락 증거를 알려주는 대신 AttributeError로 죽었습니다.

2. Git evidence was demanded outside any repository
A workspace root such as $HOME or ~/git holds repositories without being one, so git status fails there structurally. A status failure inside a repository still fails — only the absence of a repository is treated as unavailable evidence.

$HOME이나 ~/git처럼 저장소를 담고 있을 뿐 자신은 저장소가 아닌 경로에서 git 증거를 요구했습니다. 저장소 안에서 난 실패는 여전히 실패로 처리합니다.

3. A rejected invocation was sent into a repair cycle it could never finish
argparse exits before any gate runs, so nothing reaches the ledger — yet the failure emitted the standard recovery request. repair-verify builds its receipt from a recorded failed checkpoint, and there was none, so checkpoint_not_failed repeated forever. The anti-fabrication guard in create_repair_receipt is deliberately unchanged; an invocation error is now separated from a gate failure.

잘못된 호출은 게이트가 돌기 전에 거부되어 원장에 실패가 기록되지 않는데도 복구 사이클을 요구했습니다. 위조 방지 가드는 그대로 두고, 호출 계약 오류와 게이트 실패를 구분했습니다.

---

Also / 그 외

• playbook removed from identifiers, serialized keys, and prose (playbook_root → tao_root). Generic English such as "external playbooks or rule libraries" is kept — it is an ordinary noun, not this product's name.

• Korean particles corrected. 플레이북 ends in a ㄱ batchim and takes 은/이/을; "Tao Agent OS" reads as 오에스 and takes 는/가/를. A plain text replacement had produced "Tao Agent OS은".

• Light theme for the site; README and index condensed.

• 식별자·직렬화 키·산문에서 playbook 제거. "external playbooks or rule libraries" 같은 일반 명사는 제품명이 아니므로 유지했습니다.

• 한국어 조사 교정. 일괄 치환이 만든 "Tao Agent OS은" 같은 비문을 바로잡았습니다.

• 사이트 라이트 테마 적용, README·index 정리.

---

Verified / 검증

• 604 unit tests
• Workflow validation: 148 references, 315 markdown blocks, 26 route contracts
• VibeGuard: Ready

Full changelog: v26.07.7...v26.07.8

v26.07.6

2026-07-17

이번 릴리즈는 AgentPlaybook을 공유 규칙 모음에서 실행 수명주기와 상태를 관리하는 AgentPlaybook OS로 확장하는 기반을 정리했습니다.

주요 변경
실행 상태 레지스트리, 스케줄러, IPC, 관측성 계층을 연결했습니다.
병렬 워커의 상태 기록을 프로세스 간 락으로 보호하고 stale run/task 복구와 보존 정리 경로를 추가했습니다.
retry 대상 지정 claim, 동시 실행 중 run 전환 식별, context snapshot 갱신을 원자화하고 멀티프로세스 회귀 테스트를 추가했습니다.
lifecycle hook을 안정적인 agentplaybook-hook 런처로 통일했습니다.
사이트와 README의 제품 명칭을 AgentPlaybook OS로 정리하고, 시작 프롬프트가 현재 런처와 로컬 규칙 우선 원칙을 안내하도록 갱신했습니다.
검증
전체 테스트 421개 통과
VibeGuard 정적 감사 통과
동시 context snapshot/start 스트레스 검증 통과
이 릴리즈는 특정 AI 제공자에 종속되지 않는 실행 기반을 제공하며, 실제 운영 정책과 프로젝트 규칙은 각 저장소의 로컬 지침이 계속 소유합니다.

AgentPlaybook v26.05.3

Changes

• Clarifies that VibeGuard's website is a human reference, not an agent runtime dependency.
• Tells agents to continue with the published VibeGuard package command when a browsing/fetch tool cannot read the site.
• Updates README, bootstrap/runtime docs, templates, and the site quick prompt.

Verification

• python3 scripts/workflow.py validate
• npx --yes @taehwandev/vibeguard audit . --rules . --lang ko
• curl -I https://vibeguard.thdev.app/

Notes

VibeGuard reported only the known repository-name review warning: local folder agent vs remote AgentPlaybook.