v0.3.13

Added

• Two production cgroup modes are now checkable on the same paced growth child: treatment (MemorySwapMax infinity) still cooperatively terminates and reaps; control (MemorySwapMax=0) defers to kernel cgroup-OOM of the capped child. Both leave the host up. The uncapped-before-coma case stays inferred.
• metrics.sample() always includes corroborating psi_full_total, io_psi_some_avg10, and io_psi_full_avg10 (None when unread). They are not kill rungs; host_health.memory_pressure stays blind to them.
• host_cgroup_memory_limit carries defer as a bool (True when both caps are finite and plausible, including MemorySwapMax=0).
• round_cgroup_memory may carry those PSI fields as optional flat keys at emit time; omitted when unread.

Docs

• SECURITY.md: isolation is the operator's job (exec_prefix, dedicated user, no passwordless sudo, egress); agent-runner stays lifecycle-safety.

No config migration required. peek --json schema stays 2.6.

v0.3.12

Added

• [goal] config table: a markdown lessons ledger (listed in [prompt] files at index >= 1, and — since it must survive the round's own git stash — required to sit under log_dir or outside work_dir) plus [[goal.checks]] (name, cmd argv, optional timeout_s) — objective, CLI-agnostic checks the round child runs after each round's agent exits, each emitting a goal_check event (satisfied bool, optional value).
• Treadmill assessor (advisory-only): across the last 3 completed rounds, if every round showed activity but at least one goal check stayed unsatisfied with an unchanged signature, serve writes one edge-triggered advisory to the ledger and emits a goal_assessment event (never on convergence). The ledger's [prompt] files membership carries it into the next round's prompt.
• Advisory/kill firewall: the goal loop never CAUSES a kill or give-up — the kill/give-up path reads events by kind and stays blind to goal_check/goal_assessment. A goal check's own wall time does count toward the round's duration, so a long check can DELAY (never trigger) the fast-spin stalled_no_progress/crash_loop breakers; config load warns if the total check budget reaches that window.

Check timeouts fold into the round's own timeout budget. No config migration required (v0.3.11 silently ignores an unrecognized [goal] table). peek --json schema stays 2.6.

v0.3.11

Added

• Host disk/inode-growth WARNING detector: [monitor.host_health.disk] gains disk_growth_pct_per_hr_warning/inode_growth_pct_per_hr_warning (default 5.0%/hr each); a new disk_growth monitor alert kind (observability-only, no action taken).
• agent_runner.events.register_plugin_kind(name) restores a namespaced custom-event-kind affordance for out-of-tree plugins, validated against the builtin-kind namespace.

Verified

• Pre-OOM host-pressure terminate: small-host PSI/swap calibration pinned as always-on tests-of-record, plus a gated real-cgroup property test (AGENT_RUNNER_E2E_PI) run live on a ~0.5 GB host — sustained host PSI-full ≥ 60 (measured 69–77 over 3 samples) terminated and reaped the agent with the host still responsive and no cgroup OOM kill; reproduced across two clean runs.

Docs

• docs/migrations/0.3.md clarifies the 0.3.9 seam-subtraction adaptation contract (fold-in via post_round_hooks, event_kinds replacement) and documents register_plugin_kind.

No config migration required. peek --json schema stays 2.6.

v0.3.10

Added

• Cross-round resume for pi: PluginManifest.resume_flag (pi = --session-id) lets a preset declare an idempotent session flag; serve mints one session id per phase and publishes it via AGENT_RUNNER_RESUME_FLAG/AGENT_RUNNER_RESUME_SESSION_ID, and the round child appends [flag, id] to its command. claude/gemini/codewhale/kimi are untouched (resume_flag stays None) — later release.
• A new session_resumed event records when a round reuses a prior session id.
• Boot guard: a preset whose static command already contains its resume_flag token now fails config load (agent-runner injects it per round; remove the static copy).

No config migration — resume_flag is a manifest field, not a TOML key. peek --json schema stays 2.6.

v0.3.9

Changed

• PluginManifest narrows to 3 fields (name, post_round_hooks, cooperative_stop) — dropped 6 zero-producer hook seams, the DirtyHandler seam (dirty-tree resolution is now plain core), the sandbox subsystem, and the owned-paths registry, all with zero real producers.
• sigterm_cooperative: bool is now typed cooperative_stop: Literal["SIGTERM", "SIGINT"] | None: claude now drains on SIGINT (SIGTERM abandoned its turn), gemini/pi stay on SIGTERM; the hard-wall kill path stays SIGTERM-first regardless.
• The claude builtin plugin's manifest/entry-point name changed from claude_rate_limit to claude (agent-runner migrate flags any [plugins] disable entry still naming the old value).
• peek --json schema bumps to 2.6.

Removed

• [plugins] sandbox/pin/spawn_override_allow/raw config keys and [runtime]/[phases.<name>] disable_pre_round_hooks — run agent-runner migrate before upgrading.

v0.3.8

Changed

• try_auto_commit (vcs.dirty_action = "auto_commit") now honors the plugin-owned-paths registry, matching stash_orphan: paths registered via register_plugin_owned_paths are excluded from the auto-commit, so a plugin's deliverables no longer land in the agent's git history.
• round_oom_killed now also carries events_oom_kill_delta — the canonical name, sibling-consistent with round_cgroup_memory's counters; the original bare oom_kill_delta is retained as an alias (a future breaking release drops it).

Added

• The claude preset arms the repetitive-tool-call anomaly detector ([monitor] anomaly_repetitive_window = 30, anomaly_repetitive_threshold = 15) — trips only on an egregious stuck loop (the same tool+target ≥15× within 30 calls). The global default stays opt-in (disabled).

v0.3.7

Added

• Opt-in cgroup v2 memory.high soft-brake ([monitor.host_health.brake] memory_high, default off): under sustained warning-level memory pressure the supervisor reversibly writes memory.high on its OWN cgroup leaf to throttle a growing round before the host swaps, then restores it on recovery or at round end. memory_high_step_pct defaults to 0 = cap-at-current (throttle further growth with no synchronous reclaim burst — safe for SD-backed hosts); step_pct >= 1 is opt-in aggressive reclaim that dumps ~step% of the leaf to swap at engage. Fail-open; arms only when the leaf is delegated.
• Opt-in early cooperative SIGTERM ([monitor.host_health.pressure] in_round_nudge, default off): fires the hard floor's SIGTERM two samples earlier so a cooperative agent gets its wrap-up grace; recorded as round_mem_terminated with a new tier field so the mem-loop give-up still converges.
• New events memory_high_engaged / memory_high_released / memory_high_write_failed; doctor and peek --json (schema 2.5) report the brake as off | armed | inert(<reason>).

v0.3.6

Changed

• agent-runner kill now reaps a stuck round's detached descendants (a child that setsid()'d off its process group) the same way serve stop already does, so a forced stop never leaves an orphan behind.
• A stop (SIGTERM / serve stop) during a sandboxed third-party spawn hook, or during a plugin-requested defer, now takes effect immediately instead of after up to 30 s — and the confined hook's child process is always reaped, never left running. A background process the hook itself forks is not reaped; its abandoned output pipe is dropped after a bounded 2 s drain wait (on a normal hook exit, surfaced as hook_failed) rather than stalling the stop.

v0.3.5

Added

• [agent] sigterm_grace_s (default 10): the SIGTERM→SIGKILL grace a round gives its agent when the agent's preset declares itself cooperative (the built-in gemini preset does), so an agent that catches SIGTERM to flush or commit its work gets time to finish. A non-cooperative agent (e.g. claude) keeps the previous 5 s. Capped at 12 s, inside the supervisor's 15 s wait for the round; peek --json (schema 2.4) and doctor report the resolved grace per agent.

v0.3.4

Changed

• While a round runs, the supervisor now blocks on the round process's exit instead of polling about once a second — it uses no CPU while waiting and notices a round's exit immediately.
• A stop (SIGTERM / agent-runner serve stop) during a schedule, memory, or phase pause, or during the inter-round restart delay, now takes effect near-instantly instead of after the current pause chunk (up to 30 s).
• agent-runner events --tail shows a new matching event within a drain cycle of its being written, instead of on a ~1 s poll.

No change to the rules for when a round is deferred, terminated, or reaped. The mid-round memory check and the round budget now take effect on schedule instead of up to ~1 s late, so within that window the sustained-pressure floor or the budget cutoff can act on a round the old ~1 s poll would have seen finish first.