Zeroshot v14.0.0

Changes since v13.1.0.

Breaking changes

Specify forge adapter target reconciliation (#1492)

Describe the current forge adapter reconciliation contract. Forge
adapter authors should review the target reconciliation
contract.

Fixes

Tolerate empty git alternates (#1483)

Recent versions of Claude Code will leave an empty
.git/objects/info/alternates file as a side effect of the harness
sandbox. Current versions of zeroshot will refuse to work with such a
git repository to ensure code -workspace checkpoints are complete.

Observed error:

zeroshot: run finished unsuccessfully: runtime_failed
Failure:
  Runtime failed: workspace checkpoint is unavailable: external Git object alternates are unsupported by workspace snapshots (log v2:3)
Full run log: zeroshot logs 01a1c482-6801-77c1-bc6b-8ea9b559c4bc

Defer integration to confirmed GitHub queues (#1484)

Publish reviewed candidates unchanged when GitHub confirms a merge queue
for the exact repository and target branch. Refresh policy before
admission and require ordinary reconciliation and review after queue
removal, preserving provenance and existing safeguards.

Remove leftover store temporaries after interrupted saves (#1488)

zeroshot connection delete and connection set now remove any copy of
the connection store left behind by an earlier save that was killed
part-way through (OOM kill, closed terminal, kill -9, power loss). A
deleted or rotated secret no longer survives in a
connections.<uuid>.tmp file next to connections.json. Profile
changes do the same for leftover profiles.<uuid>.tmp files. Target
registry access does the same for leftover targets.tmp-<hex> files,
which can hold hosted device tokens.

Integrate the advanced target when a merge request needs a rebase (#1491)

On GitLab projects that use fast-forward or semi-linear merges
(merge_method ff or rebase_merge), any commit to the target branch
after the MR opens makes GitLab report need_rebase, even without
conflicts. --ship then stopped with a false "workspace has no
deliverable mutation relative to the requested base revision"
diagnostic, never integrated the new target, and sent that diagnostic to
a repair round. The cause: integrate_rebase used the MR head as the
integration base, so a clean workspace whose HEAD is the MR head
always had "no mutation" and the target merge never ran.

• transport::integrate_review_target (new, crate-private, used only by
  GitLab's need_rebase path) fetches the exact current target once,
  requires the workspace to still descend from the MR head (the provenance
  guard the old base enforced), and runs the existing
  integrate/merge_target code with the MR head's fork point (git merge-base <MR head> <target>) as its base. A clean workspace is now
  merged with the advanced target, and the candidate returns through the
  existing repair/review re-check with a diagnostic naming the integrated
  target revision.
• When GitLab still reports need_rebase although the candidate already
  contains the target, the refusal now names the project's merge method,
  the target branch and the target revision, for example GitLab merge method ff requires rebasing onto main revision <sha>, but the candidate already contains that revision; the merge request requires manual resolution. It is still a refusal, so it is neither retried nor routed
  to repair.
• docs/guides/forge-delivery.md and AGENTS.md describe the
  behaviour.

Related issue: #1395

Documentation

Scope plugin and MCP maintenance guidance (#1485)

Put shared skill and remote plugin maintenance rules in
plugins/AGENTS.md, with a two-line root pointer requiring MCP impact
checks. Cover generation ownership, shared content versioning, backend
compatibility and publication.

Keep private service records out of public guidance (#1486)

Keep public guidance focused on CLI, MCP and embedding contracts.
Replace mixed historical records with short public overviews and remove
private service, issue and host-evidence references. Preserve the
original records separately and add a concise boundary rule.

Link the research blog and community everywhere; X is x.com/OpenEngineHQ (#1489)

The README and docs site now link the Research blog, Discord, GitHub,
both websites and the company socials. X points at the active
x.com/OpenEngineHQ account instead of the retired OpenEngineCo.

Upgrade

npm install -g @the-open-engine-company/zeroshot@14.0.0

Versions 10.4.0 through 10.8.0 cannot update themselves: zeroshot update fails with release archive contains unexpected entry restic (restic.exe on Windows). Upgrade those installations once with the npm command above.