Agent Trestle 0.3.0

Added

• Windows is now a supported platform for agent execution, through the sandbox.
  package.json no longer declares "os": ["!win32"], and CI covers
  windows-latest alongside Linux and macOS. dispatch and run refuse to
  run an agent unsandboxed on Windows with exit 3 and SANDBOX_REQUIRED: npm
  installs Copilot CLI there as a .cmd shim that Node will not spawn without
  a shell, and Windows has no process groups to bound a forked helper with.
  fleet and run --isolate continue to fail closed on Windows because
  secure-hold verification needs POSIX ownership.
• Added an opt-in container sandbox for agent execution. --sandbox on
  dispatch and run rewrites the Copilot invocation into a container run, so
  the agent is contained by a mount and network namespace rather than by the
  working directory it happens to be started in. A closed config.sandbox
  block declares the image and limits; declaring it does not enable it, and
  --sandbox without it is a usage error rather than a silent unsandboxed run.
  Defaults deny: no network, --cap-drop ALL, no-new-privileges, a bounded
  pid count, the working directory as the only mount, host environment passed
  by name so values never reach argv, and a read-only Copilot home. Exposed as
  the ./sandbox subpath export.
• Added a CodeQL workflow for JavaScript and TypeScript analysis on pushes,
  pull requests, a weekly schedule, and manual runs.
• Added agent-trestle run --manifest FILE, a closed versioned task-manifest
  schema, manifest validation, a documented example manifest, and new
  ./manifest, ./run, and ./schemas/manifest.json exports.
• Added coverage tooling built on Node's built-in test coverage, enforcing 90%
  line, 78% branch, and 86% function floors over src/ with
  npm run test:coverage and publishing coverage/lcov.info from CI. The floors
  are checked by parsing lcov rather than through Node's --test-coverage-*
  flags, which only exist from v22.8, so the gate also runs on the Node 20 floor.
• Added hermetic test scratch roots that namespace fixtures by label, host, PID,
  and random bytes, purge stale containers, and clean up best-effort on exit and
  termination signals.
• Added runtime audit recording for dispatch, run, review, and fleet commands,
  with per-actor hash-chained segments under .trestle/audit/ and explicit
  --no-audit opt-outs.
• Added optional agent-trestle run --isolate worktree isolation, creating a
  per-task Git worktree and branch under .trestle/worktrees/ or a supplied
  --worktree-root.
• Added a dashboard project data provider that reconstructs runs, tasks,
  reviews, and audit integrity results from .trestle/audit/ when
  agent-trestle dashboard is run without --data.
• Added gated review --merge support that creates a constructed merge commit
  from the exact content reviewed, with ownership checks, audit records, and
  compare-and-swap ref updates.
• Added a closed ownership-policy schema, loader, example policy, and
  ./schemas/ownership.json export for attributing mergeable paths to actors.
• Added a per-export API stability table documenting provisional and
  experimental subpath exports, including the especially unstable ./audit and
  ./scheduler APIs.
• Conformance with the trsdn Repository Quality Standard v1.7.0.
  .github/conformance.yml records the assessment result,
  docs/self-assessment.md holds the per-criterion evidence,
  .github/badges/conformance.svg is generated from the record, and
  .github/workflows/conformance.yml fails the build when the two disagree or
  when the assessment ages past the review cadence.
• A self-hosted repository statistics card, generated on a schedule by
  .github/workflows/stats.yml and committed to the stats branch, so README
  activity is not fetched from a third-party rendering service at read time.
• .github/github-app.yml, an intentional repository-scoped agent
  configuration that delegates to AGENTS.md rather than restating it, and
  disables remote control of sessions.
• README sections declaring the primary language and localization scope, the
  accessibility properties of the CLI and dashboard together with their known
  limitations, and the privacy posture — what is collected (nothing), every
  outbound destination and its purpose, where state and audit records live, and
  what is retained.
• AGENTS.md sections naming the forbidden and high-risk operations (history
  rewriting, force pushes, deletion, destructive filesystem commands,
  releasing, publishing, deployment, repository settings, secret handling), the
  generated and machine-owned paths that must not be hand-edited, and the
  attribution and review expectations for agent-authored changes.
• test/unit/dashboard-accessibility.test.mjs, regression coverage for the
  dashboard's document language, landmarks, skip link, focus affordance,
  accessible names, empty-state announcements, relative text sizing, and the
  rule that status is never conveyed by colour alone.
• AGENTS.md, an orientation file for coding agents. It records the verified
  lint, test and packaging commands, notes that npm ci cannot work in a
  zero-dependency repository with no lockfile, sketches the runtime boundaries,
  and links to CONTRIBUTING.md and docs/architecture.md for the conventions
  and invariants rather than restating them.

Changed

• Wrapped exhausted Windows delete-pending open retries in PathSecurityError,
  so Node 20 on Windows fails closed instead of leaking raw EPERM/EBADF/
  EBUSY errors from secure opens.
• Replaced every direct O_NOFOLLOW open with openSymlinkSafe, which keeps
  the kernel refusal wherever the platform provides one and reconstructs the
  same property from an lstat/open/identity sequence where it does not. POSIX
  behaviour is unchanged, including the raw ELOOP/EEXIST codes callers
  branch on. This removes the single largest Windows blocker: 197 failing
  assertions across 26 files became 129 across 20, and init, validate and a
  sandboxed dispatch now complete on Windows. The platform is still refused at
  install time — the state lock protocol assumes POSIX unlink semantics and has
  not been characterised on Windows yet.
• Documented WSL2 as the supported way to run from a Windows host, including
  the requirement to keep the checkout off /mnt/c: DrvFs synthesizes Linux
  ownership and mode instead of translating NTFS ACLs, so secure-hold
  verification either refuses it for the wrong reason or, with the metadata
  mount option, can be made to pass without the guarantee being true.
• Documented why Windows is unsupported in terms of the actual constraints
  rather than the worktree fleet alone: the package refuses to install there
  ("os": ["!win32"], EBADPLATFORM), audit and state writes need
  O_NOFOLLOW, secure-hold verification needs POSIX ownership, and
  process-group termination has no Windows equivalent and would degrade open.
  Added a Platform support section to the security model and pointed the
  README, CONTRIBUTING.md, and AGENTS.md requirement notes at it.
• Renamed test/helpers/scratch to test/helpers/scratch.mjs and gave every
  importer the explicit extension. The extensionless file resolved, but relied
  on the loader inferring a module type it had no extension to declare.
• Pinned the release and CodeQL workflows to action commit SHAs, matching the
  CI workflow, so no workflow in the repository still trusts a mutable tag.
• Wired manifest execution through the scheduler so task graphs run in
  dependency order, respect --concurrency, support stop-condition convergence,
  and fail invalid graphs before spawning any agent.
• Propagated abort signals through dispatch and Copilot process execution so
  interrupted manifest runs tear down child process trees through the existing
  supervision path.
• Extended the dependency-free lint pass with JavaScript quote-style checking
  and normalized project strings to the double-quote convention where doing so
  does not introduce extra escapes.
• Declared the platform constraint in package.json with "os": ["!win32"],
  matching the POSIX ownership requirement documented in the README.
• Pinned GitHub Actions by commit SHA in CI and CodeQL workflows, added a
  coverage job, and enabled required status checks for the default branch.
• Documented the continuous-integration action-pinning policy in
  CONTRIBUTING.md, including SHA resolution, Dependabot comments, and
  least-privilege workflow permissions.
• Strengthened the zero-dependency contribution policy to cover runtime,
  development, and optional npm dependencies, and to cite both linting and
  coverage as Node built-in implementations.
• Bound isolated worktree lifetime to task outcomes: completed tasks remove
  their worktrees, failed tasks retain them for inspection, and interrupted runs
  clean up registered worktrees before returning.
• Kept dashboard --data FILE for offline inspection while making project audit
  records the default live dashboard source and reporting the selected source in
  command output.
• Updated merge-related security posture documentation so the CLI merge path is
  described as explicit opt-in rather than unavailable.
• Rewrote the security reporting policy with a direct private advisory link,
  supported-version statement, response expectations, coordinated-disclosure
  policy, and scoped threat model.
• Refreshed the provenance audit with the current tracked-file inventory, the
  delta since the original baseline, and explicit limits on what can be verified
  without access to the private predecessor project.
• The README badge block now follows the standard's order — license, runtime,
  CI, release, conformance — and every badge derives its value from an
  authoritative source instead of restating a hand-maintained one. The status
  note no longer repeats the version number, whic...

Agent Trestle 0.2.1

This release ships no code changes. It is the first version published to npm
through the automated pipeline, so unlike 0.2.0 it carries a provenance
attestation that ties the published artifact to the workflow run that built it.

Added

• npm publishing in the release workflow, using npm trusted publishing (OIDC),
  so no registry token is stored in the repository and every published version
  carries a provenance attestation. Pre-release versions go to the next
  dist-tag, everything else to latest, and re-running a release for an
  already published version is a no-op. The job stays dormant until the
  repository variable NPM_PUBLISH is set to enabled.
• A release check that fails the run when a version it just published carries
  no provenance attestation. Trusted publisher configuration lives on npmjs.com
  and npm exposes no API to read it back, so a missing or mismatched publisher
  would otherwise degrade silently into an unattested release.

Changed

• agent-trestle installs from npm: npm install -g agent-trestle. The clone
  route is retained for working on Agent Trestle itself and the release tarball
  for installing without a registry.

Fixed

• The name-clearance release gate claimed that the npm name had been reserved
  by publishing 0.1.0. No version was ever published at that point. The gate
  now records the reservation that 0.2.0 actually made, matching the
  availability table in the same document.

Agent Trestle 0.2.0

Added

• Release automation: pushing a vX.Y.Z tag runs .github/workflows/release.yml,
  which checks that the tag, package.json version, and changelog section
  agree, runs lint and tests, packs the tarball, smoke-tests it in a clean
  install, and publishes a GitHub release carrying the changelog notes and the
  tarball as an asset. The workflow can also be dispatched for an existing tag.
• scripts/release.mjs, a dependency-free verify and notes helper used by
  the release workflow, covered by test/unit/release-metadata.test.mjs.
• A Coverage CI job and npm run test:coverage, enforcing line, branch, and
  function thresholds through the Node built-in coverage reporter. The job
  closes a gap where Coverage was a required status check that no workflow
  produced, which left every pull request waiting forever.

Changed

• --help now states the version and links the repository and issue tracker,
  and --version --json additionally reports repository, bugs, and
  license. Plain --version still prints only the version string.
• SECURITY.md now documents supported versions, the private advisory
  reporting path, response targets, reporting scope, and disclosure
  expectations, replacing the placeholder that pointed at a channel to be
  configured "after publication".