v0.19.0

Added

• A gate the skill asks only sometimes waits only then (#309). A
  hitl_gate can carry when: <node>.output.<field>, a boolean an earlier
  node computes. True, the gate waits as before. False, it is skipped and
  its result is null, so the node after it carries on without asking. Any
  other value fails the run naming the gate. It works on the five workflow
  runtimes that run gates and on the compiled skill, and the compile-time prefix run applies
  the same rule. The structure pass decides it from the skill's words and
  a verbatim quote; a condition that does not check is dropped, the gate
  asks every run, and an Open question says so. Before this, both of a
  meeting-recap skill's conditional questions paused every run.

Fixed

• A change the compile agent proposes and rote does not apply is a review
  gap (#310). System-1 never applies a proposal from
  system1/proposals.yaml, since that would let a model override a
  decision. But the proposal reached only the report's Open questions, so a
  compile that turned a required rendering-tool call into plain text
  verified with nothing unresolved. Each proposal is now an
  unapplied_proposal finding. One repair turn, once per proposal, asks
  the agent to meet the skill without the change or keep the proposal for
  a person. One that survives is listed as a warning in the compile output,
  compile-report.md, and --json and the progress summary, which now carry
  every review gap (review_gaps). Exit stays 0.
• A Codex compile repairs what verification finds (#308). CodexDriver
  took no repair callback, so every --agent codex compile ended at "0 repair
  round(s)" with its findings unfixed. It now resumes the same thread with
  codex exec resume <thread id> for each round, under the same bounded
  policy as the claude and api drivers, and counts the rounds. A run with a
  repairer is no longer --ephemeral, because resuming needs the session on
  disk. Usage is the thread's running total, checked to be non-decreasing and
  summed per round otherwise.
• A Codex compile no longer hangs under an agent's shell. codex exec
  appends a piped stdin to its prompt and waits for it to close. The driver
  inherited its caller's stdin, so a compile started from a shell whose stdin
  never closes wrote nothing and never returned. The child's stdin is now
  /dev/null.
• Gate keys and input fields read through a helper are checked (#291).
  The boundary checks saw only value["key"] and value.get("key") on the
  parameter itself. They now follow a call into a function of the same module
  with the key as a literal argument (payload(value, "key")), which is how
  the 0.18.0 recompile of #291's skill read all three wrong gate keys. The
  findings also name the System-1 fix: read the gate's declared key, and add
  a missing input field through system1/input_fields.yaml.
• The structure-pass summary names "the lane's default model" instead of a
  blank when Codex runs its configured default.