v1.11.1

Added

• autopilot: @adlc/autopilot — the quota-gated local issue-to-PR loop over the fleet extensions (#913)
• skills: add /issue-lanes — N issues through every ADLC gate in parallel worktrees (#901)
• context-handoff: handoff doctor + writer provenance — dead-end orphaned unbound denies in one command (#946)
• fleet: extensions for the issue autopilot — 15 additive items beside the rails (#908)
• merge-forecast: add semantic graph coupling signal and --graph-coupling flag (#958)
• adlc-gemini: PreInvocation/Stop lifecycle hooks, dual-format output, and prosecution fanout (#939-#944) (#967)
• adlc-pi: P6 pending-acceptance + P7 staleness widget hints (#955)
• tickets: record a signed audit entry for every bypassed store mutation; refuse keyless bypass writes (#577)

Fixed

This release clears four issues that were actively blocking normal use of the toolkit:

• claude-code,codex,pi,opencode: disconnect the context-rot handoff hooks — they were not yet functional and were disrupting every workstream across all four harnesses (#966)
• deny-remediation: fix the remaining #970 scope — CLI dispatch package.json resolution, quoted --output/unspaced sed writes, --write no longer auto-prints in recovery output, adlc init harness registration/config reconciliation, and hook deny-reason messaging (#973, following on from #965)
• copilot: stop denying pathless non-mutating tool calls (adlc_gate, adlc_prosecute, todo_write, fetch) under active rails (#809) (#976)
• cursor: stop denying no-path first-party Cursor tools (todo_write, create_diagram, glob_file_search, fetch_pull_request) under P4 enforcement (#816) (#975)

Also included:

• rails-guard: disclose --sanctioned-add exemptions (#739) (#968)
• fleet: correct gemini/agy/jetski and pi adapter default argv (#866, #867) (#974)
• prosecute: tier-check skip rails of completed tickets (#905) (#972)
• consensus-fix: reject empty-changes no-op candidates (#599) (#969)
• hollow-test: fail closed on a starved selected file (#657) (#971)
• cli,context-handoff: dispatch package.json resolution + read-only shell bypass (#965)
• adlc-opencode: realpath argv[1] in the CLI entry guard (#899) (#951)
• merge-forecast: gate on any high-risk pair scheduled concurrently, not only hard-vetoed pairs (#681) (#952)
• lesson-foundry: --write skips an existing artifact by default instead of clobbering it (#674) (#953)
• adlc-pi: scrub ADLC_MANIFEST_KEY/ADLC_ADMIN_KEY from prosecution lens child processes (#843) (#950)
• hollow-test: diff-derived zero-mutant files fail closed, matching explicit-target behaviour (#658) (#947)
• gate-fuzzing: refuse a clean/exhaustive verdict when no real independence source is configured (#641) (#925)
• review-calibration: add a --min-plants floor so a 1-2-plant commit cannot GATE PASS at 100% recall (#751) (#924)
• tickets: adlc ticket doctor sets a real exit code on ok:false (#793) (#923)
• adlc-herdr: resolve pluginRoot from the plugin's own install location, not env or cwd (#833) (#918)
• adlc-codex: resolve the build-gate-bypass spawn through resolveTrustedBinary and a scrubbed env (#807) (#917)
• adlc-gemini: detect case-insensitive filesystems and deny differently-cased rail writes (#822) (#920)
• adlc-copilot: correctly compare isMain via pathToFileURL so all 7 lifecycle hooks run (#808) (#919)
• spec-lint: coerce and validate --llm vacuous-vote indices; fail closed on unusable payloads (#774) (#912)
• rejection-mining: fence PR comment text in the refinement prompt and stop embedding it in the lens Charter (#745) (#911)
• parallax: fence --context files and ticket bodies as untrusted data in prompts (#707) (#910)
• skill-rot: splice last-verified in place instead of re-serializing frontmatter (#767) (#909)
• mutation-gate: size the hollow-test draw by the measured suite cost — an honest cap, never a timeout (T-01M19V5SCKQYRPYXYZHQ0AEZBT) (#914)
• model-router: reject --floor 0, which silently disabled the P3 rail-density gate (#697) (#906)
• preflight: reject a present-but-empty --test-cmd instead of silently passing (#712) (#904)
• flail-detector: treat an empty/unusable log as could-not-analyze (exit 1), never CLEAN (#622) (#903)
• coldstart: a shape-deviant LLM verdict is exit 1, never zero gaps; accept a bare gaps array (#594) (#902)
• gates: harden Wave 2 gates against false greens (#768, #775, #786, #823) (#879)
• gates: eliminate false-green vulnerabilities across 4 lifecycle gates (#583, #683, #698, #719) (#878)

v1.11.0

Added

• context-handoff: cc supervise wrapper + keyless near-auto fallback (S3, stacked on #532) (#534)
• context-handoff: continuation core — capture, continue, supervised consume (S2) (#532)
• release-audit: add /release-audit — per-artifact production-readiness audit (#524)
• rails-guard: sanction rail-file ADDITION by the declaring ticket's own build PR (#512)
• context-handoff: continuation program S1 — spec amendment + tickets (stacked on #504) (#505)
• tickets: doctor reports orphaned anchors and stale lineage tokens (T-01M01HTKJCNR8D8XTWR0GVC50K) (#516)
• gate-manifest: enforce seq contiguity (+1 from 1) in verifyChain (spec §4.3) (#508)
• rails-guard: rail-freeze root package.json scripts and .npmrc with version-only exemption (#501) (#507)
• context-handoff: enforcing-tier adapters — Codex, OpenCode, Pi (slice 5) (#477)

Changed

• rails-guard: package.json and .npmrc are no longer immutable trust
  roots by default. They were added to DEFAULT_IMMUTABLE_TRUST_ROOTS during
  the 1.11.0 development window (#507) and are removed again before release:
  the set is not opt-out, so freezing two files that every Node repo edits
  routinely denied ordinary work — a third-party dependency bump on the root
  manifest exited 2 with no way for a consuming repo to decline. Trust-root
  behavior for consumers is therefore unchanged from 1.10.0. A repo that wants
  either path frozen declares it with --trust-root; the ADLC repo does exactly
  that in scripts/rails-guard-ci.mjs, so its own posture is unchanged. The
  version-only release-bump exemption (ADR 0012) is untouched and still applies
  wherever package.json is a declared trust root.

Fixed

• build-gate / adlc-codex: the tool-call depth signal now recognizes the
  real Codex rollout record shape. countToolCalls matched only Anthropic
  "type":"tool_use" blocks, so every Codex session — including ones with
  over a thousand genuine tool calls — measured depth 0. Because
  observeHandoffSignals populates depth and nothing else, that left the
  enforcing-tier context-handoff deny unable to fire on Codex at all, and
  reduced the fitness-to-build gate to its byte ceiling alone. The counter now
  also matches Codex response_item call records — function_call,
  custom_tool_call, web_search_call, tool_search_call and
  image_generation_call, which a scan of all 407 rollouts on disk (codex-cli
  0.118.0 through 0.149.0) established as the complete set. Counting is exact
  in both directions: the _output result half of a call/output pair is not a
  second call, and the event_msg mirrors (patch_apply_end,
  exec_command_end, mcp_tool_call_end, web_search_end,
  image_generation_end) are not counted again on top of the response_item
  that already recorded the call — while omitting any genuine call type would
  let a session sit one call under the inclusive threshold and mutate anyway.
  The fix is propagated to all three in-plugin copies of the counter
  (adlc-codex, adlc-copilot, adlc-claude-code).

  This also makes the earlier byte-threshold recalibration safe. Raising the
  hook's DEFAULT_BYTES_THRESHOLD from 256 KiB to 8 MiB was correct on its own
  terms — a fresh session with several plugins loaded routinely passes 256 KiB
  on turn zero — but while depth was permanently 0 on Codex it left the gate
  with one usable signal set two orders of magnitude above the old one. Depth
  bands are the primary signal again; the 8 MiB byte count is the secondary
  ceiling behind them.

• rails-guard: anchor the ticket-store add-vs-alter comparison to the merge-base (#506 pattern) (#571)

• claude-code: an import-time failure in the wrapper's bin detection denies, never crashes fail-open (#565)

• cli: resolve npx beside the node executable so adlc review is reachable on Windows (#233) (#556)

• core: --help prints synthesized usage for parseArgs configs without usage (#107) (#555)

• ticket-prune: exclude completed tickets from the Active listing (#311) (#553)

• opencode: restore the v1.10.0 deny for absent dotted paths on the ungated branch (#498) (#552)

• pi: handoff gate contained to real ADLC repos; a recovery path that actually works (#545)

• opencode: handoff gate fires only in ADLC repos and writes a resumable, diagnosable deny (#540)

• runner: print the own-chain identityError instead of counting it as a malformed manifest line (#546)

• spec-lint: doc-claim scan reads only git-tracked docs (#539)

• context-handoff: canonicalize the continue harness temp root (#532) (#537)

• tickets: doctor tolerates an honest legacy unsigned prefix, binds only to signed entries (#536)

• tickets,spec-lint: skip nested git checkouts when walking the repo (#535)

• fleet: contain the model plane — bound worker writes, withhold operator-local paths (#395) (#530)

• mutation: repair the off-by-one tuning mask — segments, counts, quoted keys, comment bypass (#372) (#529)

• plugins: tell the operator the handoff gate's missing-export deny means upgrade the CLI (#528)

• spec-lint exit-code docs (#525) and the adlc-codex handoff lockout (#526) (#527)

• docs: Cleanup the home page (#523)

• context-handoff: Phase 0 hotfix for the context-rot false-lockout (T-01M03J291182MXD1KEKM2PRKTS) (#522)

• runner: make 'adlc run p4' satisfiable — flail-check + p4-build (#106) (#393)

• gate: P5 consumers read a causal chain, not forest array position (T-01M01HTKD290FQQB4NDCV60Q24) (#515)

• core: simulate the glob automaton instead of compiling a backtracking regex (T-01KZY8WXD86J1B2JJWARBZC9HD) (#511)

• claude-code: deny (exit 2) on enforcing-hook timeout/kill (seam 6) (#497)

• spec-lint: fail closed on zero acceptance criteria (seam 7) (#494)

• prosecute: anchor trust-root tiering and the change-set identity to the merge-base, not the base tip (#506)

• opencode: the frozen rail set must outrank a caller's claim about a target (T-01KZY120SZP96QKEEXDKZEZJR5) (#502)

• opencode: the ungated-tool spoof defense must see target-keyed arguments (T-01KZW2DQKN5C1BANMMTTMPK8TS) (#490)

• prosecute: record-cross-model fails closed on a ticket id absent from the store (T-01KZW6ENFHCJJX873C5J35835Q) (#495)

• release-profile: verify re-polls propagation before failing, and records the trusted-publisher confirmation (T-01KZGT282PR1YQ7N31JB199B99) (#491)

Documentation

• docs: the package reference now lists every shipped artifact. Twelve
  published packages were absent from docs/package-reference.md — six under
  packages/* (context-handoff, fleet, init, quartermaster,
  ticket-sync, tickets) and six of the seven harness plugins — so they
  were installable but not discoverable from the project's own docs. README's
  toolkit table gained the same six, the package groups now mirror the
  umbrella CLI registry, and docs/RELEASING.md describes the publish set by
  rule instead of a stale package count. (#575)

v1.10.0

Added

• gate-manifest / rails-guard: the manifest forest is now fully
  operational end to end — the CI gate validates segments, cutovers, and
  anchors (spec §9.1–9.3); adlc gate-manifest migrate performs the
  history-preserving cutover for repositories with a live root, sealing
  every standing approve; and migrate-branch salvages an in-flight
  branch's root-tail evidence after a cutover, preserving the
  carry-forward path. A repository can now enter forest mode from any
  starting state, with CI guarding every byte (#470, #472, #475)
• build-gate: the hard band migrates to isHardDegraded (T156) (#469)
• claude-code: context-handoff denies are enforced on PreToolUse (T157)
  (#476)

Fixed

• tests: the spaced-path CLI fixture lives in a private temp root — an
  in-tree fixture raced every repo-copying test and failed unrelated CI
  runs with ENOENT (#471)

This is the recommended minimum toolkit version for repositories cutting
over to the segmented manifest: earlier releases lack the migrate
ceremony and the migrate-branch salvage that in-flight branches need.

v1.9.0

Added

• context-handoff: the slice-2 CLI — write, resume, bypass, repair,
  and unlock verbs on @adlc/context-handoff (T155) (#460)

Fixed

• gate-manifest: enable now discloses that rails-guard cannot yet validate
  .adlc/manifest.d/ segment files, on every outcome that describes a repository
  actually in forest mode — activation, already-enabled, the already-active
  gitignore-drift refusal, and the keyless refusal (via a bounded, no-follow
  probe). When a bounded read cannot decide, the warning says so
  (segmentation-undetermined) instead of claiming forest mode it never
  established. The gap itself closes with the forest CI gate
  (T-MANIFEST-FOREST slice 6), which removes the warning. (#465)
• integrations: ADLC no longer creates or trusts ~/.adlc — a home-directory
  workspace silently captured every project below it (#463)
• release: packages now publish in true dependency order — the previous
  core-first/directory order had 17 inversions (including @adlc/core pinning
  @adlc/tickets 29 slots later), so a mid-run publish failure could strand
  already-published packages uninstallable (#468)

v1.8.0

Added

• gate-manifest: the segmented ("forest") evidence store is now reachable and
  supported. adlc gate-manifest enable activates it on a greenfield repo and
  adlc gate-manifest adopt is the supported remediation for an ambiguous lineage;
  the segment writer, generation descriptor, and adoption-record schema complete the
  write side. Single-file storage remains a permanent, fully supported mode — this is
  a documented dual-mode adapter, not a migration with a deadline (#439, #440, #420, #411)
• gemini: the Antigravity and JetSki integrations are unified into a single
  @adlc/gemini integration (#452)
• quartermaster: new @adlc/quartermaster package — an operator-local channel
  registry and routeJob (T151) (#402)
• context-handoff: new @adlc/context-handoff package — the slice-1 deny gate
  and its contract tests (T154) (#448)
• trust-root: the manifest signing key is an explicit, validated, required
  parameter at every library boundary, and the test runner scrubs it from spawned
  segments — a gate can no longer sign with a key it merely inherited (#410, #406)
• fleet: per-phase token spend is now recorded on the P4/P5 write side (#422)
• distill / hygiene: deterministic P7 gate for authority-smuggling source
  comments, plus a declare-and-neutralize guard for ADLC entrypoint spawns (#432, #414)

Fixed

• fleet: the transport now selects the credential, so a subscription seat cannot
  be silently metered; the dispatch seat is re-derived per attempt so a failed strike
  climbs the ladder; and the ledger signing key is denied to the review subprocess
  (#447, #444, #453)
• gate-manifest: lineage recovery survives fresh clones and branch switches; an
  UNMEASURED call is counted rather than discarded, so the barbell has a shape; and
  fleet's phase gates map correctly, so P4 spend is attributed to P4 (#415, #449, #426)
• core, tickets, gate-manifest: the manifest .gitignore contract now reaches all
  four copies, so scaffolded repos can commit their manifest evidence (#450, #442)
• cli: termination signals are forwarded to the tool child instead of orphaning it
  (#431)
• hollow-test: a mutant stranded by an interrupted run can be recovered (#430)
• install: Antigravity install no longer fails on agy parsing the plugin path as
  plugin@marketplace (#394)
• router: a rename shim expires once the baseline holds the rename (#461)
• docs: Vercel Skew Protection no longer breaks the Twitter card image (#392)

v1.7.0

Added

• gate-manifest / prosecute: cross-model manifest forest — a read layer plus a
  cross-model reader that walks it and closes the prior TRUNCATION gap
  (T-MANIFEST-FOREST slices 1–2) (#384, #389, #355, #387)
• herdr: new adlc-herdr plugin — ADLC lifecycle visibility at the
  terminal-multiplexer layer, built out across board/palette actions, event glue,
  a fleet observer bridge, and marketplace auto-sync (#333, #340, #346, #357, #360)
• copilot: plugins/adlc-copilot, the 7th ADLC harness integration (#242, #290)
• cursor / antigravity: native integration parity build-out, anti-flail
  handling, and marketplace branding fixes (#241, #294, #305, #318)
• install: one-command install, skills.sh distribution, install CTA above
  the fold, and agent-led onboarding (#351)
• tickets: make adlc ticket self-describing, and close what that surfaced (#366)
• marketing: rebuild the marketing site as a controlled-change record; add
  Copilot to the integration set; make @adlc/herdr a publish target (#371, #361)

Fixed

• docs: marketing site design polish — impeccable critique fixes, P0 claims/form, exhibits everywhere (#385)
• gate-manifest: scope legacy-unsigned tolerance to the honest prefix; record-cross-model now
  fails closed without a signing key; node24 action pins in the shipped rails-guard template (#378, #383, #370, #236, #375)
• prosecute: correct trust-root tiering for the sharded ticket store; wire the
  P5→P7 finding bridge into every harness (#319, #322, #323)
• tickets: bound the active-ticket pointer and store readers against a hostile
  store; make the migration write a working .gitignore (#341, #343, #328)
• rails-guard: make the frozen-rail denial state its scope honestly; hermetic
  tests, scoped bypass, in-session observability for rails-bypass (#243, #332, #204, #336)
• flail-detector / fleet: collect file_path from any container, not a fixed
  key set; make the flail gate actually detect a flail; make a fail-open flail
  consultation observable (#114, #335, #334, #284, #304, #309, #316)
• mutation-gate / ci: exclude deleted files from the changed set; classify
  mutation-gate source by include-list, not exclusion; recognize the bot author
  gh reports so the drift tracker updates (#329, #330, #289, #265, #266)
• hollow-test: a kill must mean the tests ran and failed (#293, #306)
• tokenomics: cap unbounded prompt payloads in parallax/fleet (#280, #296)
• herdr: keep the ticket visible in the board header, and measure the board in terminal cells (#368)
• marketing: head the chain column "At this phase", not "Approver" (#373)
• adlc-pi: delete the dead index.js carrying the pre-#290 shell classifier (#307, #331)
• cursor: stop the packaging test mutating the real package.json (#327)

v1.6.0

A lockstep release rewrites the version field in every one of the suite's 34
package.json files at once. Any ticket railing a package path — ordinary
practice here — therefore failed rails-guard on every release, whether or not
the rail had anything to do with that release. Three consecutive releases hit
this and were unblocked by completing stale tickets, which fixed the symptom
(drift) but not the collision. This release fixes the collision.

Changed

• rails-guard: a version-only manifest edit is no longer a rail edit. The
  guard now requires each side of a changed manifest to be its own canonical
  re-serialisation, then compares by structural path rather than raw text or a
  parsed-JSON walk — the first two approaches were each independently rejected
  under adversarial review for classes of bypass the other didn't cover (parsed
  JSON can't see byte-level or encoding tampering; raw text can't see structure,
  e.g. an npm lifecycle field masquerading as a version bump). A lockstep bump
  now passes cleanly; a real behaviour change hidden inside the same edit still
  fails. (#228, #234)

• tickets: a rail that would freeze a manifest is now rejected at authoring
  time, not just exempted at release time. rails: ["packages/x/**"] is
  refused with a pointer to the intended form, packages/x/lib/** — the
  complementary fix to the above: #234 stops a lockstep bump from tripping an
  existing over-broad rail; this stops the next one from being written.
  (#235, #253)

Added

• ci: a diff-scoped mutation-coverage gate. Runs on every PR touching
  packages/** or plugins/**; mutates only the changed lines and fails if
  no test notices. Exists because the same failure mode — a guard added
  without a test that would catch its own removal — recurred five times
  across the two fixes above alone, three of which were caught only by an
  external reviewer rather than the test suite. (#251)

Fixed

• rails-guard: a rail edit could be staged, then reverted in the working
  tree, and evade the freeze gate entirely. The changed-file set was
  computed from a working-tree-only diff, so a violation that made it into the
  index — which is what git commit actually records — was invisible to the
  gate if the working copy was restored to baseline afterward. The changed-file
  set is now the union of the working-tree and staged diffs. (#244, #255)

• core: two files whose names or contents differed only in invalid UTF-8
  bytes could be treated as the same file, because the byte stream was
  decoded before being split on the raw delimiter — every byte a diff cannot
  decode collapses to the same replacement character. Changed-file discovery
  now fails closed on any path or content it cannot represent losslessly,
  rather than silently aliasing two different files together. (#249, #252)

• init: adlc-init now creates a working ticket store on a fresh repository.
  Previously the bootstrap command could leave a repo without a ticket store at
  all, so the very first ticket a new user tried to create had nowhere to go.
  (#258)

• ci: the mutation-coverage gate above was mutating entire touched files
  instead of just the changed lines, so a PR could be blocked by
  pre-existing gaps in code it never touched. Fixed to hunk-scope from the
  diff directly, with a bounded, environment-safe fallback for files outside
  the fast path. (#251, #260)

v1.5.1

Two defects in this release had been shipping silently for weeks. Both were
invisible to the test suite because every gate validated the source tree, never
the artifact a user actually installs.

Fixed

• claude-code: the plugin now tracks releases again. .claude-plugin/marketplace.json
  and the plugin manifest had been frozen at 0.2.0 since 1.2.x, so /plugin
  reported "already at the latest version (0.2.0)" while main carried current
  content. /plugin compares the declared version string to decide whether an
  update exists, so every release since was invisible to the updater. Manifest
  discovery in scripts/release.mjs is now glob-driven by directory shape, and
  the drift gate shares the same discovery — so Codex, Cursor, antigravity and
  any future harness stay in lockstep without a per-host code change. (#214)

• ticket-sync: adlc ticket doctor no longer crashes on install. The
  published tarball omitted scripts/gen-schema.mjs, which lib/doctor.mjs
  imports at module load, so the command died with ERR_MODULE_NOT_FOUND for
  every npm-installed user of 1.5.0. (#214)

• release: the publish path now validates the artifact, not the source tree.
  A new gate asks npm which files a package will actually ship, parses each one
  with a real JS parser, and fails the release closed if any shipped file
  imports something the files allowlist excludes — covering bin, main and
  every exports target. A package npm cannot be consulted about is reported as
  unverified rather than passing as clean. See ADR-0011. (#214)

• codex: read-only searches are no longer denied. The rails-guard split shell
  payloads on | without respecting quoting, so rg '"(a|b|c)"' . was shredded
  into fragments that failed the read-only allowlist — blocking legitimate
  searches, including cross-model review runs. Splitting is now quote-aware and
  fails closed on an unterminated quote. (#219)

• source hygiene: raw control bytes removed and guarded. Literal NUL bytes
  in packages/core/lib/git.mjs and plugins/adlc-pi/lib/reactive-gate.mjs
  made git classify those files as binary, so no diff of them rendered as text
  anywhere — including in pull requests. A new check rejects raw control
  characters and Trojan-Source bidirectional overrides in tracked text files.
  (#218)