v0.1.8

AOP 0.1.8 adds an enforced no-web capability boundary, improves Antigravity integration, and fixes isolated Cursor and Devin execution failures.

Changes

• --no-web now disables model-controlled external retrieval while preserving provider inference traffic. AOP records the effective policy and rejects harnesses that cannot enforce it before dispatch. (c065420)
• Antigravity now uses its structured model inventory and native model and effort defaults, preserves custom Gemini API routing without recording secrets, and requires Agy 1.1.16 or newer. (50d94d6, b3a3ad4, 7612e4a, 458c501)
• Cursor edit sandboxes now expose the wrapper's required sibling runtime files read-only, allowing current Cursor Agent installations to start successfully. (e4c3d2c)
• Fresh Devin runs now accept an AOP-owned trajectory export even when it omits echoed user steps. Resume validation still correlates the export with the current prompt. (e4ecfb3)
• Provider terminal errors are now distinct from executions that produced no response, including in batch summaries. (48b31c1)
• Harness documentation now includes a compatibility table for no-web enforcement, participant mode, model inventories, provider overrides, and cost evidence. (3838449)

History

v0.1.7...v0.1.8

v0.1.7

AOP now keeps every canonical input snapshot in durable private storage beneath .aop/snapshots, including snapshots created by sealed runs. Isolated profiles continue to expose those inputs read-only to agent harnesses.

Highlights

• Snapshot directories and files now use ordinary private controller permissions (0700 and 0600), so standard cleanup tools can remove test and project state without first undoing read-only modes.
• Sealed runs use a short-lived opaque projection while executing, preventing Linux mount metadata from revealing the controller path. AOP removes the projection after execution and retains the canonical snapshot.
• Exact sealed resumes validate the retained snapshot hashes and fail closed if input content changed.
• Host-profile prompts and documentation now distinguish native host access from the read-only mount enforced by isolated profiles.

Changes

• Release v0.1.7 (7b2c817)

History

v0.1.6...v0.1.7

v0.1.6

This documentation-only patch makes AOP easier to understand and start using without knowing each agent harness's command-line details.

Highlights

• Reworked the README around AOP's main benefit: one CLI for Codex, Claude Code, Cursor Agent, Devin CLI, OpenCode, Antigravity, Grok Build, Hermes, and DeepSeek Harness, with a clearer comparison to ACP and shorter installation and first-run examples. (acceb40, 9462968, 26493f5)
• Simplified the CLI guide around the normal run, resume, profile, artifact, batch, checkpoint, integration, and cleanup workflow. (93bcb80)
• Replaced implementation-heavy harness documentation with a complete support table, clearer authentication and model guidance, corrected Claude and Grok details, and concise limitations. (93bcb80)

History

v0.1.5...v0.1.6

v0.1.5

This documentation-focused patch makes AOP easier to evaluate and use. The README now presents the current CLI, first-run path, execution profiles, and ACP comparison without the obsolete methodology manual that predated the implementation. (f71b818)

Changes

• Reduced the README from more than 1,100 lines to a concise product overview and quick start.
• Added focused guides for CLI commands, execution profiles, provider adapters, token usage and pricing, and task integration.
• Kept detailed operational behavior available without making new users read it before their first run.

History

v0.1.4...v0.1.5

v0.1.4

This release makes token counts mean the same thing no matter which supported agent ran the task.
New result files include a marker that tells other tools which rules the counts follow.

What the token fields mean

New result.json records carry usage_schema: "aop-token-usage-v1" and satisfy these rules:

• input_tokens is total processed input, including cached input and reported cache creation or
  writes. cached_input_tokens is its cache-read subset.
• output_tokens is total processed output, including reasoning. reasoning_output_tokens is its
  reasoning subset.
• Each subset is no greater than its total, and total_tokens is always input_tokens + output_tokens.
• Consumers must never add cached input or reasoning output to either total.

AOP translates usage from Agy, Claude, Codex, Cursor, Devin, DeepSeek Harness, Grok, Hermes, and
OpenCode into this common format. Each resumed run records only the tokens used for that invocation,
including Hermes sessions whose provider counters keep growing across a conversation (212c911).

Pricing and corrected totals

AOP pricing no longer needs the provider-specific additive_cached_input switch. It calculates uncached input as
input_tokens - cached_input_tokens, prices cached input once at its cache rate, and prices total
output once without adding reasoning again. Cached-input and reasoning-heavy test cases produce the
same API price as before. This also fixes DeepSeek Harness pricing when it uses a provider other than
DeepSeek, where cached input could previously be left out of the total. Costs reported directly by a
provider remain separate.

The locked suite passed 198 tests with 9 opt-in live tests skipped. Tests cover all nine adapters,
token counts for resumed runs, saving and reloading the new format, unchanged pricing, DeepSeek and
non-DeepSeek Harness routes, and saved examples of real provider output.

History

v0.1.3...v0.1.4

v0.1.3

This release replaces the old sandbox write modes with complete execution profiles. It also adds
DeepSeek Harness and Grok Build support and clearly separates estimated costs from costs reported by
a provider.

Execution profiles

• Replaces --sandbox workspace-write, scratch-write, and danger-full-access with four profiles:
  edit gives the agent a writable task worktree, review makes that worktree read-only, sealed
  hides the repository and local instructions, and host uses native host access. Each profile now
  defines what repository data, host paths, instructions, environment values, and reusable state the
  agent can see. Isolated profiles start with an empty filesystem view and add only the paths they
  need (9b2ebd6).
• Replaces live --read mounts with --input snapshots. AOP copies and hashes the declared bytes
  before launch, mounts the copies read-only at stable /inputs paths, and retains them with the run.
  A sealed run can work outside a Git repository without revealing the original input paths or task
  name (9b2ebd6).
• Adds aop profile explain and aop run --dry-run so a profile can be inspected before launch. Every
  dispatched run saves the profile it actually used in request.json for later review (9b2ebd6).
• Keeps Hermes runtime files, tool settings, caches, mounts, and launcher environment private in
  sealed runs while allowing the same authenticated session to continue later (03197d5, e8835d4, 7ba894b, c43586e).

Providers and costs

• Adds DeepSeek Harness support for its DeepSeek route and other configured providers (9b2ebd6).
• Adds Grok Build support without interactive prompts, saves its structured output, continues the
  same conversation on resume, keeps GROK_HOME private to the task, and records model, token, and
  cost details. GROK_STORAGE_MODE is passed through only when users define it (d6ba6ca).
• Adds an estimated API cost for Agy and records estimated costs separately from costs reported by
  providers in both individual and batch results (aef59b0, ac34173).

History

v0.1.2...v0.1.3

v0.1.2

This release lets agents read external files without changing them and lets Hermes runs explicitly
choose an authenticated provider.

Changes

• Adds repeatable --read paths and batch read_paths. AOP mounts declared files or directories
  read-only inside the provider sandbox, records their mappings, sizes, and SHA-256 hashes, and
  inherits or replaces them explicitly on resume (16ea87b).
• Clarifies that declared inputs are hashed before launch but are not copied or snapshotted, so
  another host process can still modify the source during a run (a3bcc8a).
• Adds Hermes --provider overrides when an explicit model is supplied, persists the selected route,
  and reapplies it on exact resume (eae4f91).

History

v0.1.1...v0.1.2

v0.1.1

This maintenance release makes the public installation path and release checks reproducible.

Changes

• Documents direct installation from PyPI with uv tool install agent-orchestration-process (941f95c).
• Adds reproducible test and lint gates to Trusted Publishing (5acbf87).
• Runs the real Bubblewrap sandbox tests on Ubuntu CI before publication (2594c2b).

History

v0.1.0...v0.1.1

v0.1.0

AOP's first public release lets you run several coding-agent command-line tools in separate Git
worktrees. It can run tasks concurrently, continue the same provider conversation later, check
expected output files, and retain the request, result, logs, and other evidence for review.

Highlights

• Introduces the AOP CLI, disposable Git worktrees, bounded parallel batches, safe checkpoints, and
  explicit fast-forward integration (44f4cde, 596321c, cc3b2b3).
• Supports Codex, Claude Code, Cursor Agent, Devin CLI, OpenCode, Antigravity (agy), and Hermes.
  Each run handles one task and can later continue the same provider conversation (24fde3c, 63d43a8, 18aef44, 2878d7a, df70d5a, e139269).
• Uses Bubblewrap, uniform scratch execution, copy-on-write overlays, read-only shared Git metadata,
  and provider-private runtime state to keep workers isolated (90a8ba1, 2e53d38, 2ef4981, 33da900).
• Saves requests, results, logs, machine-readable JSON, timing, token use, expected output files or
  directories, and how the run's billing route was detected (01218f0, e0fdd48, 7674fd9, ccc55e9).
• Packages the implementation for public distribution with portable uv metadata and Trusted PyPI
  Publishing (fe6af2a, 0d38f1b, 7d7307c).

Hermes participant mode is experimental in this release and remains bounded by the outer filesystem
sandbox (3d28e29).

History

Commits through v0.1.0