v0.21.0

[0.21.0] - 2026-06-15

Added

• Added conceptual config mappings (config-mapping.md) documenting the five
  tested configuration profiles and their resolution to shipped mode IDs,
  aliases, or fixture packages.
• Added config-swap behavior tests proving graph-only, recovery-policy-only,
  and required-extension declarations change runtime behavior without Python
  source edits.
• Added absence and maintenance guardrail tests proving minimal fixture configs
  do not load undeclared Recon, Blueprint, closure, or Learning domain behavior.
• Added structural AST guardrails that forbid family-ID branch tables, forbidden
  domain string literals as active-kernel control flow, and kernel-direct domain
  imports outside documented compatibility facades.

Changed

• Restored the optional millrace-web sidecar package and synchronized
  release/CI smoke paths so v0.21.0 publishes both millrace-ai and the
  read-only local dashboard while keeping web dependencies out of the base
  runtime package.
• Tightened Arbiter closure freshness discipline: Arbiter prompts now require
  reading the runtime-authored freshness window before old verdict/report
  artifacts, per-criterion evidence provenance, and runtime-owned closure
  remediation enqueueing. Shipped closure-capable modes now assign Arbiter via
  an explicit high-depth model alias so missing or downgraded assignment is
  visible in compile diagnostics.
• Made the pure graph-authority cleanup explicit as a breaking pre-1.0
  contract: runtime decisions require compiled graph, extension, policy,
  lifecycle, runtime-effect, queue-family, and artifact-contract metadata.
  Missing compiled policy now fails as an authority error instead of falling
  back to shipped defaults; stale workspaces may need managed asset refresh or
  reinitialization.
• Cleaned up legacy graph-authority authority paths: per-plane routing wrappers
  are now compatibility-only facades, route-time max-cycle recovery knobs are
  removed, and fallback route reasons/classes derive from compiled node_id
  rather than source_stage.value.
• Bounded routine runtime-event reads and idle-event growth: status, closure,
  and inspection surfaces now use streaming/recent/latest event helpers for normal
  operation, while durable no-work idle events are transition and heartbeat
  records instead of one append per idle tick. The default durable idle-event
  heartbeat is 6 hours, with explicit shorter operator configuration still
  supported.
• Removed the fixed Recon terminal-operation whitelist; Recon routing now
  resolves through compiled terminal-action runtime_operation_id metadata.
• Reworked stage_metadata.py to derive shipped stage legality from JSON
  stage-kind registry assets instead of hard-coded enums; fixture stage kinds
  remain discoverable without entering the shipped-stage facade.
• Route caller-level family-ID branching in active-kernel claim, lifecycle,
  status, and counter code through compiled policy and the generic
  QueueFamilyInterpreter.
• Updated shipped mode required_extensions declarations to list only the
  built-in extensions each mode actually uses; compile validation rejects
  undeclared domain vocabulary.
• Moved neutral router decision contracts to millrace_ai.contracts.router;
  millrace_ai.router remains importable only as a contract facade, and active
  runtime dispatch no longer imports it.

Fixed

• Fixed compiled-plan currentness so persisted plans missing scheduler or
  selected recovery-policy authority are treated as stale and recompiled
  instead of being reused as incomplete modern plans.
• Fixed installed-wheel smoke failures by declaring packaging>=24,<27 as a
  runtime dependency for extension validation's packaging.version import.
• Fixed daemon reconciliation so a lane's persisted active-run ownership is not
  replaced while the supervisor still owns a live or pending-completion worker
  for that same lane, and occupied-lane deferrals now emit an auditable
  runtime_reconciliation_deferred diagnostic decision.
• Fixed runtime recovery-counter reads so generic counter_id records are
  authoritative (including explicit 0 values) with no legacy fixed-field
  compatibility projection.
• Bounded basic terminal monitor run/display state so long daemon monitor
  sessions do not retain unbounded completed-run handles while active run
  handles remain stable.

Documentation

• Reframed public documentation around Millrace as a loop
  engineering/runtime framework. LAD is now described as one shipped
  code-development loop family, with lad_codex, lad_pi,
  learning_lad_codex, efficient_learning_lad_mixed,
  learning_lad_pi, lad_codex_integrated,
  learning_lad_codex_integrated, blueprint_lad_codex, and
  blueprint_learning_lad_codex as the recommended mode names.
• Updated graph and mode documentation to use execution.lad,
  execution.lad_integrator, and planning.lad as canonical loop IDs while
  documenting the former execution.standard, execution.with_integrator,
  planning.standard, default_*, old unqualified learning_*,
  efficient_learning_mixed, and conceptual standard_* names as
  compatibility aliases.
• Documented closure freshness windows, historical versus current Arbiter
  evidence, runtime-owned remediation incidents, repeated-remediation guard
  interpretation, and operator diagnosis for closure_repeated_remediation_blocked.
• Updated README.md, ROADMAP.md, graph docs, runtime docs, source package
  map, and maintenance registers to accurately describe the generic engine
  boundary, extension-backed domains, compatibility-only surfaces, fixture
  mode limitations, and unsupported topologies (arbitrary plane IDs and
  arbitrary runtime stages remain deferred).
• Clarified the public README and runner docs comparison with Claude Code and
  other coding harnesses: Millrace does not claim those harnesses lack hooks,
  skills, subagents, memory, or workflow helpers; the distinction is that
  Millrace owns the external compiled-plan, queue, daemon, recovery, and
  closure layer around bounded harness invocations.
• Documented the runtime idle/event-log memory-bounds contract: durable idle
  suppression is in-memory only and separate from live terminal monitor idle
  output throttling; read_runtime_events() is reserved for explicit
  full-history audit/debug use.

Compatibility Notes

• Package-root compatibility facades (router.py, compiler.py,
  queue_store.py, runner.py, paths.py, state_store.py,
  stage_kinds.py, loop_graphs.py) remain importable; active runtime
  authority derives from the compiled plan and compiled workflow primitives.
• Blueprint remains available through blueprint_lad_codex and
  blueprint_learning_lad_codex, but it is extension-backed graph configuration.
  Generic packages do not export Blueprint compatibility APIs; old Python
  imports of retired Blueprint facades such as
  millrace_ai.contracts.blueprint, millrace_ai.cli.status.blueprint,
  millrace_ai.runtime.context.blueprint, and
  millrace_ai.workspace.blueprint_state may now raise ImportError.
• standard_plain, standard_millrace, and learning_enabled_millrace remain
  compatibility aliases that resolve to lad_codex, lad_pi, and
  learning_lad_pi respectively.