EBO v1.0.1

EBO 1.0.1

Documentation and release-metadata update. Runtime code, schemas, contracts,
and ontology are unchanged from v1.0.0.

• The README and Harbor guide identify Harbor commands as available in EBO
  1.x through npm, with separate host virtualization prerequisites.
• The overview diagram shows human review as an optional evaluation branch.
• Package contents include both the v0.2.10 and v1.x release records.

The v1.0.0 tag was created on the Harbor branch before that branch was merged
into develop and main. The merge retained the same runtime implementation and
reconciled package versions and historical release records. Existing tags and
published artifacts are preserved. This patch is released from the reconciled
main history.

The prior implementation suite passed with 653 tests and 12 opt-in skips.
No implementation tests or release gate were rerun for this documentation-only
patch. See the v1.0.0 support boundary.

v0.2.10

v0.2.10: Pi model identifiers

Pi configuration now accepts nonempty model-condition identifiers containing
slashes, dots and uppercase characters. Native provider and model values remain
separate and unchanged. Empty and non-string identifiers are still rejected.

Other harness native-model validators already accept these identifiers. Legacy
queue slug labels remain separate from native model IDs.

Harbor development and its runtime image remain on PR #46, outside this release.
See the reproducibility manifest and
existing limitations.

EBO v0.2.6

v0.2.6: Contain workspace capture failures

Workspace outcome capture accepts absolute symbolic links that resolve inside
the source workspace. The derived patch or snapshot uses portable relative
links; the source workspace is unchanged. External, dangling, and cyclic links
remain rejected for workspace packaging.

A workspace packaging failure no longer rewrites native completion as an
infrastructure failure. Capture records the missing outcome and retains the
source for recovery. Native semantic evidence can be normalized and analyzed
independently of workspace qualification. Verified task outcomes still require
a verifier bound to the captured workspace. Export safety checks are unchanged.

The run-manifest v1 schema now permits completed observational runs without a
workspace artifact. Consumers must use qualification dimensions when deciding
which evidence supports their analysis, rather than infer completeness from
terminal state.

Regression coverage includes absolute-link patch/snapshot relocation, preserved
source links, invalid-target rejection, cleanup containment, and normalization
with missing workspace evidence. A real retained xhigh trajectory generated 21
structural observations without its workspace artifact and without model calls.

See known limitations, the
reproducibility manifest, and the
evidence guide.

EBO v0.2.5

v0.2.5: Preserve framework files in workspace capture

Workspace capture now preserves contained relative symbolic links, including
framework link chains and links to empty directories. Absolute, escaping,
dangling, and cyclic links remain rejected. Copies retain the original link
text, and patches that cannot reproduce the tree fall back to a snapshot.

On macOS, snapshot verification uses native pax to preserve genuine AppleDouble
files that macOS tar otherwise consumes as metadata. Snapshots remain tar.gz
archives. No runtime dependencies, pins, or serialized artifact formats change.

Verification

Regression tests cover link preservation, invalid targets, empty target
directories, AppleDouble bytes, and long paths. A completed model attempt's
retained workspace was recovered as a 695,459,840-byte snapshot with a verified
extracted tree digest, without another model call or rewriting original evidence.
The recovery qualified with an explicit missing-telemetry-receipt gap; it records
the later capture time rather than claiming an exact end-of-turn snapshot.

Run npm ci and npm run acceptance on Node 24.19.0 for tests, documentation
and package checks, and two byte-identical package builds. See
known limitations, the
reproducibility manifest, and the
workspace inspection guide.

v0.2.4: Stream large workspace snapshots

v0.2.4: Stream large workspace snapshots

Workspace snapshot capture no longer buffers the compressed archive in child
process stdout. Archives stream to disk, pass extraction and tree-digest checks,
and publish atomically. Qualification verifies snapshot integrity in chunks.

The compressed snapshot limit increases from 128 MiB to 1 GiB. Output above
that limit fails explicitly and retains partial evidence. The 64 MiB patch
limit, capture exclusions, archive format, and portable-export policy are
unchanged. No runtime pins or dependencies change.

Verification

Regression tests cover a 129 MiB incompressible snapshot, streamed-write failure
cleanup, no-clobber publication, and bounded integrity checks. A retained real
workspace that failed on v0.2.3 was captured separately as a 605,143,040-byte
snapshot, with its extracted tree digest verified. Original evidence was not
rewritten.

Run npm ci and npm run acceptance on Node 24.19.0 for the full suite,
documentation and package checks, and two byte-identical package builds.
See known limitations and the
reproducibility manifest.

EBO v0.2.3

v0.2.3: Workspace capture error diagnostics

The shared run-bundle assembler now preserves workspace packaging exceptions
in capture reports as workspace-capture-error missing-evidence entries.
Previously, a harness could finalize a partial bundle with only a generic
missing-workspace report, losing the exception needed to diagnose the failure.

Capture still rejects failures and preserves the source workspace through the
existing harness retention paths. A successful explicit capture retry clears
the prior diagnostic. No automatic retry, weaker validation, dependency update,
runtime-pin change, or artifact-schema change is introduced.

This release fixes diagnostic loss. It does not claim to eliminate every
workspace packaging failure. Existing immutable bundles are not rewritten.

Verification

Run npm ci and npm run acceptance on Node 24.19.0. Regression coverage checks
retention of the original capture error, successful retry clearing, and valid
partial manifests. Acceptance also runs the full suite, checks documentation
and package contents, and compares two independently built package archives.

See known limitations, the
reproducibility manifest, and
recovery guidance.

EBO v0.2.2

Codex tool networking

Workspace-write runs now enable outbound tool network access by default. Set networkAccess: false in the frozen native tool policy for offline runs. EBO propagates the setting to thread and turn policy and retains the applied policy in native evidence.

Filesystem restrictions, noninteractive approvals, authentication isolation, and read-only judging are unchanged. No dependency or runtime-pin changes.

Historical bundles remain unchanged. Compile a new queue with an explicit network boolean when reproducing older offline conditions.

Installation

npm install -g engineering-behavior-observatory@0.2.2

Verification

• 602 tests passed; 8 opt-in tests skipped.
• 25 fixture digests verified; documentation and packaged links checked.
• Repeated package builds were byte-identical; clean tarball installation and CLI help passed.
• Package SHA-256: bbe2588f717e612fd4bd7092d7f8235169f19da5f6dc711255ec50b9b98e029a.

Codex configuration · Known limitations · npm package

EBO v0.2.1

Documentation redesign, Apache-2.0 licensing, and public npm package metadata. The package name is engineering-behavior-observatory; the executable remains ebo.

Release acceptance: 597 passed, 8 opt-in skipped, zero failures; fixture, documentation, privacy, and reproducible-package checks passed. Acceptance records develop commit b25634b; the release merge has an identical source tree.

Runtime and dependency pins are unchanged. Existing Cursor dependency audit findings remain disclosed in release/0.2.1/KNOWN_LIMITATIONS.md. npm publication is a separate operation from this GitHub release.

EBO v0.2.0 — Pi and Cursor SDK integrations

Adds pinned Pi and Cursor TypeScript SDK adapters with frozen-queue execution, native evidence capture, workspace outcomes, sanitized exports, and retained behavioral evaluation/Atlas integration.

Validation: 605 tests, 597 passed, 8 opt-in skipped, 0 failed; 25 fixture digests, documentation links, package-content scanning, and byte-identical repeat packaging passed on Node 24.19.0. The acceptance result identifies the tested develop commit; the release merge has the identical source tree.

Known limitations: Cursor Enterprise OTLP export is not connected/correlation-qualified. The pinned Cursor dependency chain has two moderate and one high npm audit entries with no compatible fix offered; see the release limitations before deployment.

Release notes · Known limitations

EBO v0.1.0

Engineering Behavior Observatory 0.1.0 connects software-engineering agent outcomes to the native trajectories that produced them.

This release includes:

• Native capture through Claude Agent SDK, Codex app-server, OpenHands Agent Server, and the official DeepSeek Harness JSON-RPC client.
• Frozen task inputs, observational runs, retained workspace outcomes, capture qualification, sanitized export, and portable corpus bundles.
• Native-linked uniform events, structural observations, Claude/Codex semantic judges, human review and adjudication, and comparisons with explicit denominators.
• A local Behavior Atlas with Grafana dashboards, evidence drilldown, and HTML/print reports.
• Operator and extension guides, deterministic acceptance, and reproducible npm-format packaging.

Live checks on September 9 verified Agent SDK capture/export, Codex capture and abstention judging, and both OpenHands 1.46.0 and DeepSeek Harness 0.1.1-rc.2 with Z.ai glm-5.3-flash. The DeepSeek run also exposed and verified a fix for large native source-reference sets. Codex metrics were missing in the short live run; DeepSeek telemetry was disabled; OpenHands used its supported subprocess terminal after a local tmux initialization failure. See release/0.1.0/KNOWN_LIMITATIONS.md for the full support matrix.

Download the runtime package and SHA256SUMS, then run shasum -a 256 -c SHA256SUMS. acceptance-result.json binds validation to the tagged source commit. To reproduce from source with Node 24.19.0: npm ci && npm run acceptance.

The runtime archive excludes restricted trajectories, credentials, test fixtures, and private orchestration state. Human calibration and study conclusions are separate from software acceptance.