Zeroshot v10.11.0

Changes since v10.10.1.

Features

Add planner-led archived exploration (#1208)

• Keep three independent scouts. A planner chooses the next bounded
  experiment and its incumbent or archived starting artifact; candidates
  can be archived without replacing the incumbent.
• Separate parent staging, experiment, three independent judgments,
  finalization, and disposition audit. The auditor checks the current
  unaudited iteration and permits one bounded repair of recordkeeping.
• Treat durable files as authoritative after a recorder or recovery
  response error only when the independent auditor proves fresh, complete
  records and retained workspace bytes. Experiment execution errors route
  to abort recovery before any judge runs.
• Reset transient controls and output channels between loop rounds while
  preserving state and replay markers, so an old error or audit result
  cannot steer a later iteration.
• Reject a fresh graph start on an unfinished or unaudited ledger; a
  selected checkpoint resumes the original work or audit boundary.
• Give file-writing auditors one execution attempt, so a crash after
  appending an audit cannot retry against its own output; checkpoint
  resume restores the pre-audit files.
• Accept positive options.iterations with a default of 10 and update
  the graph documentation.

Surface subscription rate limits (#1169)

Fixes #40.

Claude's subscription rate_limit_event was dropped before it reached
the
transcript, so a run log never showed the plan utilization or the reset
time.
This surfaces that event as one System transcript line while keeping old
CLIs and API-key accounts unchanged.

Edit runtime models in one draft with a shared model field (#1239)

The Runtime settings dialog is simpler to use. It has Form and JSON
views that edit the same draft,
and nothing changes in the profile until you click Apply changes. If
you close the dialog with
unapplied changes, it asks before discarding them. Opening another
profile closes the dialog, so a
draft is never applied to a different profile.

Model fields are now always one text field with an optional list of
models you chose before:
models other agents in the profile use, then models from profiles you
saved with the same harness
and provider. Before, the field was a text box in a new profile but
turned into a dropdown with a
"Custom model ID…" option once the profile was saved. The hardcoded list
of model IDs is gone.

Most profiles use one model for every agent, so the dialog shows a
single Model field by default.
Per-agent models sit behind Choose per agent, which opens on its own
when agents already use
different models. Fields you change in the dialog are no longer marked
invalid because of errors in
the profile as it was before your changes.

Choose the harness and provider per node in a RuntimePlan (#1197)

Agent nodes can select their own harness and provider through an
optional lane binding. One graph can combine native Codex and Claude
subscriptions with explicit providers such as OpenRouter. The run-level
pair supplies the default, and plans without overrides retain their
existing wire representation.

• Build one adapter per effective lane and route each node's sessions,
  execution and connection requirements through that adapter.
• Require the target's openengine.node-runtime-lanes/v1 marker before
  submitting or storing a lane-bearing plan.
• Preserve effective lanes in model editing, saved suggestions and
  generated review loops. Shared model edits stay within one lane.
• Match native executable lookup, including Windows fallback
  directories. Checkpoint resumes resolve workspace-relative executables
  after restoration under the controller's workspace lease.

Expose contained provider access preparation (#1243)

Expose the existing contained provider-access preparation to hosts so
they can resolve each node's effective provider requirements before
storing profiles or selecting credentials. Production target submission
uses the same helper; authored access declarations remain intact.

Fixes

Recover preflight and scout handoffs (#1211)

• Start the first provisional research iteration only after topology
  preflight, so a fresh run passes its own unfinished-iteration check.
• Keep all three scouts, while allowing the planner to exclude and
  record invalid or missing proposals and choose from independently
  supported valid or archived directions. The planner still aborts when
  integrity, a safe decision basis, or a charter-required complete handoff
  cannot be established.
• Require the finalizer and disposition auditor to preserve missing or
  excluded scout slots and check that the selected direction does not rely
  on their claims. No nodes or operation types were added.

The zonotope run reached its tenth audit, but one iteration was lost
because a single scout disclosed a forbidden read-only Git command. Two
valid scouts had returned concrete directions. A reducer probe now
covers that case and a true scout worker failure, where the mapped
proposal array remains empty and the planner can use durable evidence
without inventing partial outputs.

Keep scratch cleanup from blocking run status (#1216)

• Remove read-only copied checkpoint stages from private scratch without
  following symlinks, including legacy stages left by earlier runs.
• Keep disposable scratch collection from blocking durable terminal
  results or status observation after authoritative runtime cleanup has
  succeeded.
• Apply the same rule to hosted/direct failed-run recovery while
  retaining mandatory process cleanup, workspace ownership transfer, and
  durable recovery metadata.
• Preserve force-stop and explicit discard requirements for full
  checkpoint lineage deletion. Add regressions for read-only stages,
  uncollectable scratch, and symlink safety.

The zonotope research run completed its tenth audit, but private
checkpoint staging contained read-only directories. Cleanup failed
before terminal persistence, and the same cleanup failure prevented the
dead-controller observer from opening its ledger. The default
hosted/direct recovery path had a similar dependency on staging
deletion.

Explain invalid profile fields in plain words (#1215)

Saving or validating a profile with missing runtime settings (e.g. a new
profile with no harness chosen) showed a raw parser error. The editor
now says what is missing ("Choose a harness.", "Choose a provider.",
"Choose a model for worker."), highlights that field in Run settings,
and links to it from the validation panel.

Protect shared Rust toolchain permissions (#1221)

Prevent run users from changing the target image's shared Rust
toolchain. Remove group and other write permissions after copying it,
and check ownership and permission bits during runtime smoke tests so
read-only mounts cannot hide writable files. Permission scan failures
also stop the smoke test.

Handle long controller socket paths (#1229)

Local runs on macOS can now start when the configured state directory
makes the controller socket path exceed the operating system's byte
limit. Oversized endpoints automatically use a short, private socket
under /tmp, so users no longer need to shorten ZEROSHOT_STATE_DIR to
start those runs. Durable run data stays in the configured state
directory.

Publish streamed transcript text as whole lines (#1231)

Claude Code streams replies a few tokens at a time, and the Claude
adapter published every delta as its own live output record. Run history
therefore showed one transcript entry per fragment, so a single sentence
such as "Now let's rewrite runtime-controls.test.ts:" was split across
three entries.

The adapter now collects streamed text and publishes whole lines.

Apply theme choices in Safari (#1234)

In Safari, choosing Light or Dark from the UI's theme menu did nothing:
the menu closed and the
theme stayed the same. Clicking the theme button also could not close an
open menu; it closed and
reopened at once. Both now work.

The menu closed whenever it lost focus to anything outside itself, and
it counted "focus went
nowhere" as outside. Safari does not focus a button you click. Pressing
one clears focus instead,
so pressing an option closed the menu before the click reached it.
Chrome focuses the pressed
button, which kept the menu open there.

Run the local controller with a hidden console (#1220)

On Windows, the local run controller was created with
DETACHED_PROCESS, so it had no console at all. A console-less process
makes Windows open a new, visible console window for every console
program it starts. During a local run that meant a CMD window for every
git, gh, restic, cmd.exe-launched npm shim, and provider CLI
invocation, plus everything those programs started in turn. The windows
kept stealing focus and made the PC nearly unusable while a run was
active.

The controller is now created with CREATE_NO_WINDOW instead of
DETACHED_PROCESS. Windows gives it a new console with no window, and
its console descendants share that hidden console instead of each
opening a visible one. It is still a new console in a new process group,
so the invoking terminal's Ctrl-C and close events still do not reach
the controller.

Having a console means the controller can now receive console control
events. Controller mode therefore installs a console control handler
before any controller work:

• It treats CTRL_C_EVENT and CTRL_BREAK_EVENT as handled.
• It leaves close, logoff, and shutdown events to their default
  handling.
• If the handler cannot be installed, controller startup stops with an
  error.

Unix behaviour does not change.

Recover the immutable README naming summary (#1244)

Unblock canonical release notes by recovering the README naming summary
for the exact immutable #1232 squash commit. All other commits still
require a nonempty ## Summary; no historical metadata or runtime code
changes.

Performance

Clone workspace files on APFS (#1230)

On macOS, workspace checkpoints now clone files on APFS instead of
copying every byte before Restic runs. Staging a large workspace (for
example a multi-GB Rust target/) takes milliseconds and almost no
extra disk, as it already does on Linux with FICLONE. Other volume
types, cross-volume staging, and files with BSD flags keep the existing
copy.

Documentation

Use the stable Discord community URL (#1198)

Point the README, documentation social link and LLM index at
https://theopenengine.com/discord, so replacing an invite no longer
requires editing every published entry point. The redirect is deployed
and verified as a non-cacheable 302 to the existing valid, non-expiring
company invite.

Validation: all 65 repository tooling tests, lint and Cargo formatting
passed. No direct Discord invite links remain in the tracked working
tree. Opcore accepted the documentation change; Opcore Zero does not
cover Markdown/YAML/text-only edits. Earlier PR CI passed every lane;
the final documentation correction is being checked again.

---

Co-authored-by: Eivind Meyer eivind@theopenengine.com

Point contributors at #contributors on Discord (#1200)

CONTRIBUTING.md opened with the toolchain. New contributors now get a
short "start here" paragraph first: the #contributors channel on
Discord, where the pinned post covers claiming an issue, talking before
building anything large, and how the Contributor role is earned. It also
links the good-first-issue and help-wanted queries. The rest of the file
is unchanged apart from dropping the stale "v8" from the first sentence.

Stop advertising Zeroshot Cloud in the READMEs (#1212)

We are not advertising Zeroshot Cloud yet. This removes the "Zeroshot
Cloud: close the laptop" section, the Cloud pricing pointer and the
Cloud docs links from README.md, and the Cloud docs line from the npm
README. The docs site is unchanged.

🤖 Generated with Claude Code

Co-authored-by: Eivind eivindcovibes.ai@Eivinds-MacBook-Pro-2.local
Co-authored-by: Claude Opus 5.5 noreply@anthropic.com

Make zeroshot.sh/docs the canonical documentation URL (#1214)

The documentation's canonical address is now
https://zeroshot.sh/docs/. zeroshot.sh serves the same GitHub Pages
site under /docs/ (the-open-engine/zero-cloud#385), so canonical links
and the docs sitemap now credit zeroshot.sh. The README, npm README,
Python package metadata and llms.txt link there too. Existing
the-open-engine.github.io/zeroshot/ URLs keep working.

Point minor-version canonical links at Current on zeroshot.sh (#1217)

Older documentation versions now send search credit to Current on
zeroshot.sh. Every page in a published minor version (v10.0 through
v10.10) declares the same page under https://zeroshot.sh/docs/current/
as its canonical URL, instead of its own
https://the-open-engine.github.io/zeroshot/vX.Y/... URL. A page that
Current no longer has would point at its own
https://zeroshot.sh/docs/vX.Y/... URL instead; none exist today. Minor
sitemaps list zeroshot.sh URLs.

Follow-up to #1214, which fixed site_url for Current but left the
published minors on github.io until rebuilt. Rebuilding them from their
release tags would not have helped, since those tags carry the old
site_url.

Restyle the documentation site to match zeroshot.sh (#1222)

The documentation site now looks like zeroshot.sh. It gets the landing
page's paper masthead with the crow and the product name in marker pen,
marker-pen page and section headings, mono uppercase labels, hairline
rules, rounded code blocks, paper grain, and warnings drawn as post-its.
The dark scheme keeps the same structure on dark paper.

The overview's "Choose where it runs" cards render as cards again. They
showed as empty boxes with their text outside.

Draw the overview graph by hand, with a phone layout (#1223)

The documentation overview now shows the hand-drawn Zeroshot workflow
graph instead of a stock Mermaid flowchart. It is the drawing the README
already uses, in the same style as zeroshot.sh, and it follows the light
or dark scheme. On phones the page shows a new tall layout of the same
graph, so the labels stay readable.

Show when each page last changed (#1224)

Every documentation page now ends with "Last updated" and a date, so
readers can tell how current it is. The date is the last commit that
changed that page's source.

Scope README review guarantees to the built-in workflow (#1226)

Scope the README’s independent review and repair guarantees to the
built-in software-change workflow. Explain that Git delivery waits for
both reviewers to accept, while preserving custom-graph support and the
existing coding-agent integrations.

Explain review graphs and local or Cloud setup (#1225)

Explain that a skill leaves review decisions to the agent, while
Zeroshot follows the configured review and repair graph mechanically.
Add a Cloud setup shortcut before local installation and a separate
Cloud section so readers can find both execution options.

Explain custom agent nodes in README (#1228)

Explain custom agent nodes alongside the README’s skill-versus-graph
comparison. Show security review, test-writing bugfinders and browser
checks as examples, then describe per-node models and instructions,
parallel execution and repair routing.

Drop the v8 cutover notice from the README (#1181)

Remove the outdated v8 interface-cutover notice from the README and the
obsolete tooling assertion that required that notice. Preserve the
current README's local and Cloud setup instructions.

Write the name as zeroshot and open with the QA process (#1232)

Write the README name as zeroshot and introduce its customizable QA graph with existing coding agents.

Position zeroshot as a customizable software factory (#1236)

Introduce zeroshot as a customizable open-source software factory: take
a task to a reviewed pull request, choose the agents and models, and
control review gates and repair paths. Keep the CI analogy and existing
harness integrations, and bring the workflow illustration ahead of
installation so readers can see the process immediately.

Frame narrowing the open-model/frontier gap as an exploration, and
distinguish the free MIT CLI from the available execution options.

Use a legible portrait banner on mobile (#1237)

Show a portrait zeroshot banner on README viewports up to 640px so the
main sentence and review diagram remain readable on phones. Keep the
existing desktop light/dark banners above that breakpoint. Document the
mobile asset and its provenance.

Enlarge desktop banner typography (#1238)

Make the desktop README banners easier to read: increase the main
sentence from 37px to 44px, enlarge the diagram labels and sticky-note
text, and slightly increase the wordmark, company signature and URL.
Re-render both light and dark PNGs from their existing HTML/CSS sources.

Maintenance

Describe Zeroshot and add search keywords to the npm package (#1213)

The npm package page now describes what Zeroshot does and lists search
keywords, so it can be found by searches like claude-code, codex,
code-review and multi-agent.

• npm/zeroshot/package.json: the description now describes the product
  (the GitHub repository description, naming GitHub Copilot in full)
  instead of "Verified prebuilt binary installer for the standalone
  Zeroshot engine". Added keywords. homepage stays
  https://zeroshot.sh.
• The release workflow packs this file as-is (it only stamps the
  version), so the change reaches npm with the next release. Nothing is
  published here.

Checks: npm test (66 pass), prettier --check, npm run distribution:check, and npm pack --dry-run all pass.

🤖 Generated with Claude Code

---

Co-authored-by: Eivind eivindcovibes.ai@Eivinds-MacBook-Pro-2.local
Co-authored-by: Claude Opus 5.5 noreply@anthropic.com

Tighten prompt guidance (#1218)

• Tighten auto-research scout, planner, judge, finalizer, and auditor
  instructions while keeping the graph topology unchanged.
• Have agents follow relevant ledger evidence selectively, ground
  planner-added adoption vetoes and stop decisions in the task, and keep
  charter requirements binding.
• Align the durable nextIterationNumber state field across prompts and
  clarify unfinished-iteration preflight behavior.

Bump prettier to 3.9.9 (#1167)

Update development-only Prettier from 3.9.8 to 3.9.9 to fix Markdown
formatting around dollar signs.

Read npm 12 pack output (#1240)

The npm package install test now reads npm pack --json output from
both npm 11 and npm 12, so npm run check and the husky
pre-commit/pre-push hooks pass on machines with npm 12.

Reuse one worker for software-change repairs (#1242)

The built-in software-change graph now sends implementation, review
repairs, and Git/CI repairs through one worker node. CLI uniform
configurations with no explicit session scope and new UI templates
retain that worker's session; acceptance and code reviewers keep their
existing prompts and start fresh each pass.

All delivery modes and both review gates remain. Review and delivery
repairs share the existing ten-round budget, and the last rejected round
stops without starting an extra repair that cannot be reviewed.
Graph-owned phase state identifies the current feedback source.
Deterministic empty-array state initialization lets an empty map
continue a repair round without adding a model call or changing caller
input.

Saved graphs and explicitly authored session scopes retain their
behavior. Exact runtime configurations used with the updated template
need only worker, acceptance, and code agent bindings; the
documentation and fixtures reflect that layout.

Upgrade

npm install -g @the-open-engine-company/zeroshot@10.11.0